diff --git a/DEPS b/DEPS
index e8f5316..721cd10 100644
--- a/DEPS
+++ b/DEPS

@@ -181,11 +181,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '9f22f1ff319060fa62413abb3ea302ca5a710d36',
+  'skia_revision': '447a4e0982e0dd7b8cc49d4cbbd613d2c780c93b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'bf7181f71d00947b7664fb991cb65a6e7e2fca4c',
+  'v8_revision': 'd9e36f4a5808ed584d118ccf0a23d1290e5278f8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -193,7 +193,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '845a09b8241ecac9e268c32ed12bb13f883b39c4',
+  'angle_revision': '8075d3edde6cbce9d1fe48c2e2417de5f5f71915',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -252,7 +252,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': '03acc60fb5fc04594e1a5203550e04c020a36a3e',
+  'devtools_frontend_revision': 'b5315e84d143e54e0238299709f208d36e4b4e57',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -312,7 +312,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '0fee6ccc2e6e4c3860cb3d0e32387469ede2e7ed',
+  'dawn_revision': 'f2ed2482a449f48a74632642e3ae9e67fc08be51',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -343,7 +343,7 @@
   # revisions.
 
   # GN CIPD package version.
-  'gn_version': 'git_revision:0c5557d173ce217cea095086a9c9610068123503',
+  'gn_version': 'git_revision:83dad00afb232d7235dd70dff1ee90292d72a01e',
 
   # Also, if you change these, update buildtools/DEPS too. Also update the
   # libc++ svn_revision in //buildtools/deps_revisions.gni.
@@ -894,7 +894,7 @@
 
   # For Linux and Chromium OS.
   'src/third_party/cros_system_api': {
-      'url': Var('chromium_git') + '/chromiumos/platform2/system_api.git' + '@' + 'e831a312c4ab87704a1139852c276797c47f7e4a',
+      'url': Var('chromium_git') + '/chromiumos/platform2/system_api.git' + '@' + '938e6c4638472c79ed28356d95b65dfc9ec82df5',
       'condition': 'checkout_linux',
   },
 
@@ -904,7 +904,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'b24ca5ac742e6c65e949b2f7f83a2d9b95cff3e9',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '8effa4d0637c83d2e8cd5869c90ced50cdf3c099',
 
   'src/third_party/devtools-frontend/src':
     Var('chromium_git') + '/devtools/devtools-frontend' + '@' + Var('devtools_frontend_revision'),
@@ -1501,7 +1501,7 @@
     Var('chromium_git') + '/external/github.com/gpuweb/cts.git' + '@' + 'ec18cc3262922e7dcdbe70243c6f40606f979144',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '1a68679e65af33ac111c28396fe9fb8414d54f8a',
+    Var('webrtc_git') + '/src.git' + '@' + 'b7dc45f8e8119d367b7513045db7cce68861709f',
 
   'src/third_party/libgifcodec':
      Var('skia_git') + '/libgifcodec' + '@'+  Var('libgifcodec_revision'),
@@ -1571,7 +1571,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@dc9588f19d7089aecf8b542faab6ad8eb4f2501a',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@fa01d48c5cede4b8fe7199796c4c774c867c81db',
     'condition': 'checkout_src_internal',
   },
 

diff --git a/android_webview/nonembedded/BUILD.gn b/android_webview/nonembedded/BUILD.gn
index 377fa18..3b9f820 100644
--- a/android_webview/nonembedded/BUILD.gn
+++ b/android_webview/nonembedded/BUILD.gn

@@ -124,6 +124,12 @@
   android_manifest = "java/DeveloperUiLauncherManifest.xml"
 }
 
+android_resources("monochrome_devui_launcher_icon_resources") {
+  resource_dirs = []
+  android_manifest = "java/MonochromeDeveloperUiLauncherManifest.xml"
+  custom_package = "org.chromium.android_webview.devui.icon"
+}
+
 jinja_template("system_webview_manifest") {
   input = "java/AndroidManifest.xml"
   output = system_webview_android_manifest

diff --git a/android_webview/nonembedded/java/MonochromeDeveloperUiLauncherManifest.xml b/android_webview/nonembedded/java/MonochromeDeveloperUiLauncherManifest.xml
new file mode 100644
index 0000000..6d473ffad
--- /dev/null
+++ b/android_webview/nonembedded/java/MonochromeDeveloperUiLauncherManifest.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2020 The Chromium Authors. All rights reserved.  Use of this
+  source code is governed by a BSD-style license that can be found in the
+  LICENSE file.
+-->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="org.chromium.android_webview.devui">
+
+    <!-- This should only be merged to Monochrome manifest -->
+    <!--suppress HardcodedText -->
+    <application>
+        <activity-alias android:name="org.chromium.android_webview.devui.MonochromeLauncherActivity"
+                  android:targetActivity="org.chromium.android_webview.devui.MainActivity"
+                  android:label="WebView DevTools"
+                  android:exported="true"
+                  android:enabled="false">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN"/>
+                <category android:name="android.intent.category.LAUNCHER"/>
+            </intent-filter>
+        </activity-alias>
+    </application>
+</manifest>

diff --git a/android_webview/variables.gni b/android_webview/variables.gni
index f3142e7b..20d0cfb 100644
--- a/android_webview/variables.gni
+++ b/android_webview/variables.gni

@@ -2,11 +2,15 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//chrome/android/channel.gni")
 import("//weblayer/variables.gni")
 
 declare_args() {
-  # Show a launcher icon to open WebView developer UI, off by default.
-  webview_devui_show_icon = false
+  # Show a launcher icon to open WebView developer UI, enabled by default for dev and canary
+  # channels. The icon for Monochrome is always hidden by default (https://crbug.com/1026062)
+  # TODO(https://crbug.com/1002589): add beta channel when approved
+  webview_devui_show_icon =
+      android_channel == "canary" || android_channel == "dev"
 }
 
 system_webview_android_manifest =

diff --git a/ash/system/machine_learning/user_settings_event.proto b/ash/system/machine_learning/user_settings_event.proto
index 06b6fc8..6d06029e 100644
--- a/ash/system/machine_learning/user_settings_event.proto
+++ b/ash/system/machine_learning/user_settings_event.proto

@@ -93,10 +93,12 @@
     optional DeviceMode device_mode = 13;
     optional DeviceOrientation device_orientation = 14;
 
-    // Whether there are wifi networks available for connection.
-    optional bool has_available_wifi_networks = 15;
-    // Whether there are mobile data networks available for connection.
-    optional bool has_available_cellular_networks = 16;
+    // The signal strength for the connected network. Only populated upon
+    // connection to a wifi or cellular network.
+    optional int32 signal_strength = 15;
+    // Whether or not the current wifi network has security. Only populated upon
+    // connection to a wifi network.
+    optional bool has_wifi_security = 16;
     // Whether the user has connected to a cellular network in the current
     // session.
     optional bool used_cellular_in_session = 17;

diff --git a/ash/system/machine_learning/user_settings_event_logger.cc b/ash/system/machine_learning/user_settings_event_logger.cc
index 777458c..0bb5fa5 100644
--- a/ash/system/machine_learning/user_settings_event_logger.cc
+++ b/ash/system/machine_learning/user_settings_event_logger.cc

@@ -4,11 +4,17 @@
 
 #include "ash/system/machine_learning/user_settings_event_logger.h"
 
+#include "ash/shell.h"
 #include "base/logging.h"
+#include "chromeos/services/network_config/public/mojom/cros_network_config.mojom.h"
 
 namespace ash {
 namespace ml {
 
+using chromeos::network_config::mojom::NetworkStateProperties;
+using chromeos::network_config::mojom::NetworkType;
+using chromeos::network_config::mojom::SecurityType;
+
 // static
 UserSettingsEventLogger* UserSettingsEventLogger::instance_ = nullptr;
 
@@ -29,13 +35,50 @@
   return instance_;
 }
 
-void UserSettingsEventLogger::LogUkmEvent() {
-  // TODO(crbug/1014839): Populate a settings event and log it to UKM.
-}
-
-UserSettingsEventLogger::UserSettingsEventLogger() = default;
+UserSettingsEventLogger::UserSettingsEventLogger()
+    : used_cellular_in_session_(false) {}
 
 UserSettingsEventLogger::~UserSettingsEventLogger() = default;
 
+void UserSettingsEventLogger::LogNetworkUkmEvent(
+    const NetworkStateProperties& network) {
+  UserSettingsEvent settings_event;
+  auto* const event = settings_event.mutable_event();
+  auto* const features = settings_event.mutable_features();
+
+  if (network.type == NetworkType::kWiFi) {
+    event->set_setting_id(UserSettingsEvent::Event::WIFI);
+    const auto& wifi_state = network.type_state->get_wifi();
+    features->set_signal_strength(wifi_state->signal_strength);
+    features->set_has_wifi_security(wifi_state->security !=
+                                    SecurityType::kNone);
+  } else if (network.type == NetworkType::kCellular) {
+    event->set_setting_id(UserSettingsEvent::Event::CELLULAR);
+    features->set_signal_strength(
+        network.type_state->get_cellular()->signal_strength);
+    features->set_used_cellular_in_session(used_cellular_in_session_);
+    used_cellular_in_session_ = true;
+  } else {
+    // We are not interested in other types of networks.
+    return;
+  }
+
+  event->set_setting_type(UserSettingsEvent::Event::QUICK_SETTINGS);
+  // Convert the setting state to an int. Some settings have multiple states, so
+  // all setting states are stored as ints.
+  event->set_current_value(1);
+
+  PopulateSharedFeatures(&settings_event);
+  SendToUkm(settings_event);
+}
+
+void UserSettingsEventLogger::PopulateSharedFeatures(UserSettingsEvent* event) {
+  // TODO(crbug/1014839): Populate the shared contextual features.
+}
+
+void UserSettingsEventLogger::SendToUkm(const UserSettingsEvent& event) {
+  // TODO(crbug/1014839): Implement UKM logging.
+}
+
 }  // namespace ml
 }  // namespace ash

diff --git a/ash/system/machine_learning/user_settings_event_logger.h b/ash/system/machine_learning/user_settings_event_logger.h
index 23c3823..148fbf8 100644
--- a/ash/system/machine_learning/user_settings_event_logger.h
+++ b/ash/system/machine_learning/user_settings_event_logger.h

@@ -6,6 +6,7 @@
 #define ASH_SYSTEM_MACHINE_LEARNING_USER_SETTINGS_EVENT_LOGGER_H_
 
 #include "ash/system/machine_learning/user_settings_event.pb.h"
+#include "chromeos/services/network_config/public/mojom/cros_network_config.mojom-forward.h"
 
 namespace ash {
 namespace ml {
@@ -20,15 +21,25 @@
   // exist in the current process.
   static void CreateInstance();
   static void DeleteInstance();
+  // Gets the current instance of the logger.
   static UserSettingsEventLogger* Get();
 
-  // Logs a settings change event to UKM.
-  void LogUkmEvent();
+  // Logs an event to UKM that the user has connected to the given network.
+  void LogNetworkUkmEvent(
+      const chromeos::network_config::mojom::NetworkStateProperties& network);
 
  private:
   UserSettingsEventLogger();
   ~UserSettingsEventLogger();
 
+  // Populates contextual information shared by all settings events.
+  void PopulateSharedFeatures(UserSettingsEvent* event);
+
+  // Sends the given event to UKM.
+  void SendToUkm(const UserSettingsEvent& event);
+
+  bool used_cellular_in_session_;
+
   static UserSettingsEventLogger* instance_;
 };
 

diff --git a/base/bind.h b/base/bind.h
index 1b33e45..0bbc2ace 100644
--- a/base/bind.h
+++ b/base/bind.h

@@ -276,19 +276,24 @@
 
 // Special cases for binding to a base::Callback without extra bound arguments.
 template <typename Signature>
-OnceCallback<Signature> BindOnce(OnceCallback<Signature> closure) {
-  return closure;
+OnceCallback<Signature> BindOnce(OnceCallback<Signature> callback) {
+  return callback;
+}
+
+template <typename Signature>
+OnceCallback<Signature> BindOnce(RepeatingCallback<Signature> callback) {
+  return callback;
 }
 
 template <typename Signature>
 RepeatingCallback<Signature> BindRepeating(
-    RepeatingCallback<Signature> closure) {
-  return closure;
+    RepeatingCallback<Signature> callback) {
+  return callback;
 }
 
 template <typename Signature>
-Callback<Signature> Bind(Callback<Signature> closure) {
-  return closure;
+Callback<Signature> Bind(Callback<Signature> callback) {
+  return callback;
 }
 
 // Unretained() allows binding a non-refcounted class, and to disable

diff --git a/base/command_line.cc b/base/command_line.cc
index 5df5a529..dc244441 100644
--- a/base/command_line.cc
+++ b/base/command_line.cc

@@ -496,7 +496,6 @@
             ::GetProcAddress(downlevel_shell32_dll, "CommandLineToArgvW"));
     if (command_line_to_argv_w_proc)
       args = command_line_to_argv_w_proc(command_line.data(), &num_args);
-    ::FreeLibrary(downlevel_shell32_dll);
   } else {
     // Since the apiset is not available, allow the delayload of shell32.dll
     // to take place.
@@ -508,6 +507,9 @@
   StringVector argv(args, args + num_args);
   InitFromArgv(argv);
   LocalFree(args);
+
+  if (downlevel_shell32_dll)
+    ::FreeLibrary(downlevel_shell32_dll);
 }
 #endif
 

diff --git a/base/task/post_task.h b/base/task/post_task.h
index 4579cbff..00c0fffa 100644
--- a/base/task/post_task.h
+++ b/base/task/post_task.h

@@ -99,19 +99,10 @@
                                   OnceClosure reply);
 
 // Equivalent to calling PostTaskAndReplyWithResult with default TaskTraits.
-//
-// Though RepeatingCallback is convertible to OnceCallback, we need a
-// CallbackType template since we can not use template deduction and object
-// conversion at once on the overload resolution.
-// TODO(crbug.com/714018): Update all callers of the RepeatingCallback version
-// to use OnceCallback and remove the CallbackType template.
-template <template <typename> class CallbackType,
-          typename TaskReturnType,
-          typename ReplyArgType,
-          typename = EnableIfIsBaseCallback<CallbackType>>
+template <typename TaskReturnType, typename ReplyArgType>
 bool PostTaskAndReplyWithResult(const Location& from_here,
-                                CallbackType<TaskReturnType()> task,
-                                CallbackType<void(ReplyArgType)> reply) {
+                                OnceCallback<TaskReturnType()> task,
+                                OnceCallback<void(ReplyArgType)> reply) {
   return PostTaskAndReplyWithResult(from_here, {ThreadPool()}, std::move(task),
                                     std::move(reply));
 }
@@ -148,20 +139,11 @@
 // or thread and same TaskTraits if applicable) when |task| completes. Returns
 // false if the task definitely won't run because of current shutdown state. Can
 // only be called when SequencedTaskRunnerHandle::IsSet().
-//
-// Though RepeatingCallback is convertible to OnceCallback, we need a
-// CallbackType template since we can not use template deduction and object
-// conversion at once on the overload resolution.
-// TODO(crbug.com/714018): Update all callers of the RepeatingCallback version
-// to use OnceCallback and remove the CallbackType template.
-template <template <typename> class CallbackType,
-          typename TaskReturnType,
-          typename ReplyArgType,
-          typename = EnableIfIsBaseCallback<CallbackType>>
+template <typename TaskReturnType, typename ReplyArgType>
 bool PostTaskAndReplyWithResult(const Location& from_here,
                                 const TaskTraits& traits,
-                                CallbackType<TaskReturnType()> task,
-                                CallbackType<void(ReplyArgType)> reply) {
+                                OnceCallback<TaskReturnType()> task,
+                                OnceCallback<void(ReplyArgType)> reply) {
   auto* result = new std::unique_ptr<TaskReturnType>();
   return PostTaskAndReply(
       from_here, traits,

diff --git a/base/util/memory_pressure/system_memory_pressure_evaluator_chromeos.cc b/base/util/memory_pressure/system_memory_pressure_evaluator_chromeos.cc
index 761eb707b..ddc1632 100644
--- a/base/util/memory_pressure/system_memory_pressure_evaluator_chromeos.cc
+++ b/base/util/memory_pressure/system_memory_pressure_evaluator_chromeos.cc

@@ -297,10 +297,9 @@
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(),
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      kernel_waiting_callback_,
-      base::BindRepeating(
-          &SystemMemoryPressureEvaluator::HandleKernelNotification,
-          weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(kernel_waiting_callback_),
+      base::BindOnce(&SystemMemoryPressureEvaluator::HandleKernelNotification,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 }  // namespace chromeos

diff --git a/buildtools/DEPS b/buildtools/DEPS
index 95a78ec..92d828b2 100644
--- a/buildtools/DEPS
+++ b/buildtools/DEPS

@@ -14,7 +14,7 @@
   #
 
   # GN CIPD package version.
-  'gn_version': 'git_revision:0c5557d173ce217cea095086a9c9610068123503',
+  'gn_version': 'git_revision:83dad00afb232d7235dd70dff1ee90292d72a01e',
 
   # When changing these, also update the svn revisions in deps_revisions.gni
   'clang_format_revision': '96636aa0e9f047f17447f2d45a094d0b59ed7917',

diff --git a/cc/paint/display_item_list.h b/cc/paint/display_item_list.h
index eefd3b69..3b3861bb 100644
--- a/cc/paint/display_item_list.h
+++ b/cc/paint/display_item_list.h

@@ -91,6 +91,8 @@
     return offset;
   }
 
+  UsageHint GetUsageHint() const { return usage_hint_; }
+
   // Called by blink::PaintChunksToCcLayer when an effect ends, to update the
   // bounds of a SaveLayer[Alpha]Op which was emitted when the effect started.
   // This is needed because blink doesn't know the bounds when an effect starts.

diff --git a/chrome/VERSION b/chrome/VERSION
index 062b5660..9c3b653 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=81
 MINOR=0
-BUILD=4034
+BUILD=4035
 PATCH=0

diff --git a/chrome/android/chrome_public_apk_tmpl.gni b/chrome/android/chrome_public_apk_tmpl.gni
index cd1479cf..2a991c2 100644
--- a/chrome/android/chrome_public_apk_tmpl.gni
+++ b/chrome/android/chrome_public_apk_tmpl.gni

@@ -419,8 +419,7 @@
       ]
 
       if (webview_devui_show_icon) {
-        _deps +=
-            [ "//android_webview/nonembedded:devui_launcher_icon_resources" ]
+        _deps += [ "//android_webview/nonembedded:monochrome_devui_launcher_icon_resources" ]
       }
 
       if (_include_primary_support) {

diff --git a/chrome/android/features/autofill_assistant/public/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantFacade.java b/chrome/android/features/autofill_assistant/public/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantFacade.java
index 93c9d5e..ba6ba66 100644
--- a/chrome/android/features/autofill_assistant/public/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantFacade.java
+++ b/chrome/android/features/autofill_assistant/public/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantFacade.java

@@ -221,16 +221,12 @@
     }
 
     public static boolean isAutofillAssistantEnabled(Intent intent) {
-        // Check for configuration first for early return to prevent test failures on checking
-        // feature flags.
-        return AutofillAssistantFacade.isConfigured(intent.getExtras())
-                && ChromeFeatureList.isEnabled(ChromeFeatureList.AUTOFILL_ASSISTANT);
+        return ChromeFeatureList.isEnabled(ChromeFeatureList.AUTOFILL_ASSISTANT)
+                && AutofillAssistantFacade.isConfigured(intent.getExtras());
     }
 
     public static boolean isAutofillAssistantByIntentTriggeringEnabled(Intent intent) {
-        // Check for configuration first for early return to prevent test failures on checking
-        // feature flags.
-        return AutofillAssistantFacade.isAutofillAssistantEnabled(intent)
-                && ChromeFeatureList.isEnabled(ChromeFeatureList.AUTOFILL_ASSISTANT_CHROME_ENTRY);
+        return ChromeFeatureList.isEnabled(ChromeFeatureList.AUTOFILL_ASSISTANT_CHROME_ENTRY)
+                && AutofillAssistantFacade.isAutofillAssistantEnabled(intent);
     }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java
index 6d18ddd9..929f868 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java

@@ -189,15 +189,6 @@
 
         String browserFallbackUrl =
                 IntentUtils.safeGetStringExtra(targetIntent, EXTRA_BROWSER_FALLBACK_URL);
-        // TOOD(b/145195894): This is temporary workaround. The fallback URL should be configured
-        // in the intent directly on the SRP page. This is here for testing purposes and will be
-        // removed as soon as the SRP intents are updated.
-        if (browserFallbackUrl == null
-                && AutofillAssistantFacade.isAutofillAssistantByIntentTriggeringEnabled(
-                        targetIntent)
-                && mDelegate.isSerpReferrer()) {
-            browserFallbackUrl = targetIntent.getDataString();
-        }
         if (browserFallbackUrl != null
                 && !UrlUtilities.isValidForIntentFallbackNavigation(browserFallbackUrl)) {
             browserFallbackUrl = null;

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java
index f9f4301..237d1c9c 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java

@@ -63,6 +63,8 @@
         sdk_is_less_than = Build.VERSION_CODES.LOLLIPOP)
 @Features.EnableFeatures({ChromeFeatureList.CCT_EXTERNAL_LINK_HANDLING,
         ChromeFeatureList.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE})
+@Features.DisableFeatures({ChromeFeatureList.AUTOFILL_ASSISTANT,
+        ChromeFeatureList.AUTOFILL_ASSISTANT_CHROME_ENTRY})
 public class ExternalNavigationHandlerTest {
     // clang-format on
     @Rule

diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index 11790e0f..a687fa6 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp

@@ -3498,6 +3498,9 @@
   <message name="IDS_CROSTINI_INSTALLER_BODY" desc="Description for the Crostini installer, a dialog for installing Linux.">
     Get tools for developing websites, Android apps, and more. Installing Linux will download <ph name="DOWNLOAD_SIZE">$1<ex>300MB</ex></ph> of data.
   </message>
+  <message name="IDS_CROSTINI_INSTALLER_NEXT_BUTTON" desc="Label for the button in the Crostini installer dialog to progress to the next page.">
+    Next
+  </message>
   <message name="IDS_CROSTINI_INSTALLER_INSTALL_BUTTON" desc="Label for the button in the Crostini installer dialog to begin installing Linux.">
     Install
   </message>
@@ -3579,6 +3582,12 @@
   <message name="IDS_CROSTINI_INSTALLER_UNKNOWN_ERROR" desc="Text shown in the Crostini installer dialog when some unknown error happens">
     Something went wrong. Please try again.
   </message>
+  <message name="IDS_CROSTINI_INSTALLER_CONFIGURE_MESSAGE" desc="Text shown in the Crostini installer dialog describing the purpose of the page for entering extra user-specified options">
+    Change how Linux apps will work.
+  </message>
+  <message name="IDS_CROSTINI_INSTALLER_DISK_SIZE_MESSAGE" desc="Text shown in the Crostini installer dialog describing how and why to choose the initial size of the Crostini disk">
+    Disk space to reserve for Crostini (you can change this later).
+  </message>
   <message name="IDS_CROSTINI_UNINSTALLER_TITLE" desc="Title of the Crostini uninstaller, a dialog for uninstalling Linux, the associated VM and Linux files.">
     Delete Linux (Beta)
   </message>

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 7933c70..e58c6b5 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -1592,6 +1592,9 @@
     "sharing/sharing_handler_registry.h",
     "sharing/sharing_handler_registry_impl.cc",
     "sharing/sharing_handler_registry_impl.h",
+    "sharing/sharing_message_bridge.h",
+    "sharing/sharing_message_bridge_impl.cc",
+    "sharing/sharing_message_bridge_impl.h",
     "sharing/sharing_message_handler.h",
     "sharing/sharing_message_sender.cc",
     "sharing/sharing_message_sender.h",

diff --git a/chrome/browser/apps/app_service/app_service_proxy.cc b/chrome/browser/apps/app_service/app_service_proxy.cc
index bc398e6..a472e47f 100644
--- a/chrome/browser/apps/app_service/app_service_proxy.cc
+++ b/chrome/browser/apps/app_service/app_service_proxy.cc

@@ -294,18 +294,18 @@
   }
 }
 
-void AppServiceProxy::GetMenuModel(const std::string& app_id,
-                                   apps::mojom::MenuType menu_type,
-                                   GetMenuModelCallback callback) {
+void AppServiceProxy::GetMenuModel(
+    const std::string& app_id,
+    apps::mojom::MenuType menu_type,
+    int64_t display_id,
+    apps::mojom::Publisher::GetMenuModelCallback callback) {
   if (!app_service_.is_connected()) {
     return;
   }
 
-  // TODO(crbug.com/1038487): change to use below code to call
-  // AppService->GetMenuModel when GetMenuModel is added to mojom.
-  // apps::mojom::AppType app_type = cache_.GetAppType(app_id);
-  // app_service_->GetMenuModel(app_type, app_id, menu_type,
-  //                            std::move(callback));
+  apps::mojom::AppType app_type = cache_.GetAppType(app_id);
+  app_service_->GetMenuModel(app_type, app_id, menu_type, display_id,
+                             std::move(callback));
 }
 
 void AppServiceProxy::OpenNativeSettings(const std::string& app_id) {

diff --git a/chrome/browser/apps/app_service/app_service_proxy.h b/chrome/browser/apps/app_service/app_service_proxy.h
index 7c24a21..783fd9d 100644
--- a/chrome/browser/apps/app_service/app_service_proxy.h
+++ b/chrome/browser/apps/app_service/app_service_proxy.h

@@ -57,8 +57,6 @@
                         public apps::mojom::Subscriber,
                         public apps::AppRegistryCache::Observer {
  public:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
   using OnPauseDialogClosedCallback = base::OnceCallback<void()>;
 
   explicit AppServiceProxy(Profile* profile);
@@ -135,10 +133,12 @@
   // as false directly and removes the paused app icon effect.
   void UnpauseApps(const std::set<std::string>& app_ids);
 
-  // Returns the menu items for the given |app_id|.
+  // Returns the menu items for the given |app_id|. |display_id| is the id of
+  // the display from which the app is launched.
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    apps::mojom::Publisher::GetMenuModelCallback callback);
 
   // Opens native settings for the app with |app_id|.
   void OpenNativeSettings(const std::string& app_id);

diff --git a/chrome/browser/apps/app_service/arc_apps.cc b/chrome/browser/apps/app_service/arc_apps.cc
index ede3368..6b8f830 100644
--- a/chrome/browser/apps/app_service/arc_apps.cc
+++ b/chrome/browser/apps/app_service/arc_apps.cc

@@ -492,6 +492,7 @@
 
 void ArcApps::GetMenuModel(const std::string& app_id,
                            apps::mojom::MenuType menu_type,
+                           int64_t display_id,
                            GetMenuModelCallback callback) {
   ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
   if (!prefs) {
@@ -525,6 +526,11 @@
                    &menu_items);
   }
 
+  if (menu_type == apps::mojom::MenuType::kShelf &&
+      base::Contains(app_id_to_task_ids_, app_id)) {
+    AddCommandItem(ash::MENU_CLOSE, IDS_SHELF_CONTEXT_MENU_CLOSE, &menu_items);
+  }
+
   std::move(callback).Run(std::move(menu_items));
 }
 

diff --git a/chrome/browser/apps/app_service/arc_apps.h b/chrome/browser/apps/app_service/arc_apps.h
index f7557052..7e53acff 100644
--- a/chrome/browser/apps/app_service/arc_apps.h
+++ b/chrome/browser/apps/app_service/arc_apps.h

@@ -52,8 +52,6 @@
 
  private:
   using AppIdToTaskIds = std::map<std::string, std::set<int>>;
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
   using TaskIdToAppId = std::map<int, std::string>;
 
   ArcApps(Profile* profile, apps::AppServiceProxy* proxy);
@@ -88,7 +86,8 @@
   void UnpauseApps(const std::string& app_id) override;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(const std::string& app_id) override;
   void OnPreferredAppSet(const std::string& app_id,
                          apps::mojom::IntentFilterPtr intent_filter,

diff --git a/chrome/browser/apps/app_service/built_in_chromeos_apps.cc b/chrome/browser/apps/app_service/built_in_chromeos_apps.cc
index fe08d79..55fd0c4b 100644
--- a/chrome/browser/apps/app_service/built_in_chromeos_apps.cc
+++ b/chrome/browser/apps/app_service/built_in_chromeos_apps.cc

@@ -192,6 +192,7 @@
 
 void BuiltInChromeOsApps::GetMenuModel(const std::string& app_id,
                                        apps::mojom::MenuType menu_type,
+                                       int64_t display_id,
                                        GetMenuModelCallback callback) {
   apps::mojom::MenuItemsPtr menu_items = apps::mojom::MenuItems::New();
 

diff --git a/chrome/browser/apps/app_service/built_in_chromeos_apps.h b/chrome/browser/apps/app_service/built_in_chromeos_apps.h
index a2916ca..6f41c0ef 100644
--- a/chrome/browser/apps/app_service/built_in_chromeos_apps.h
+++ b/chrome/browser/apps/app_service/built_in_chromeos_apps.h

@@ -31,9 +31,6 @@
   static bool SetHideSettingsAppForTesting(bool hide);
 
  private:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(::apps::mojom::MenuItemsPtr)>;
-
   void Initialize(const mojo::Remote<apps::mojom::AppService>& app_service);
 
   // apps::mojom::Publisher overrides.
@@ -63,7 +60,8 @@
   void UnpauseApps(const std::string& app_id) override;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(const std::string& app_id) override;
   void OnPreferredAppSet(const std::string& app_id,
                          apps::mojom::IntentFilterPtr intent_filter,

diff --git a/chrome/browser/apps/app_service/crostini_apps.cc b/chrome/browser/apps/app_service/crostini_apps.cc
index ec27855..b503a53 100644
--- a/chrome/browser/apps/app_service/crostini_apps.cc
+++ b/chrome/browser/apps/app_service/crostini_apps.cc

@@ -18,12 +18,37 @@
 #include "chrome/grit/chrome_unscaled_resources.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/prefs/pref_change_registrar.h"
+#include "ui/display/display.h"
+#include "ui/display/screen.h"
+#include "ui/strings/grit/ui_strings.h"
 
 // TODO(crbug.com/826982): the equivalent of
 // CrostiniAppModelBuilder::MaybeCreateRootFolder. Does some sort of "root
 // folder" abstraction belong here (on the publisher side of the App Service)
 // or should we hard-code that in one particular subscriber (the App List UI)?
 
+namespace {
+
+bool ShouldShowDisplayDensityMenuItem(const std::string& app_id,
+                                      apps::mojom::MenuType menu_type,
+                                      int64_t display_id) {
+  // The default terminal app is crosh in a Chrome window and it doesn't run in
+  // the Crostini container so it doesn't support display density the same way.
+  if (menu_type != apps::mojom::MenuType::kShelf ||
+      app_id == crostini::GetTerminalId()) {
+    return false;
+  }
+
+  display::Display d;
+  if (!display::Screen::GetScreen()->GetDisplayWithDisplayId(display_id, &d)) {
+    return true;
+  }
+
+  return d.device_scale_factor() != 1.0;
+}
+
+}  // namespace
+
 namespace apps {
 
 CrostiniApps::CrostiniApps(
@@ -177,8 +202,14 @@
 
 void CrostiniApps::GetMenuModel(const std::string& app_id,
                                 apps::mojom::MenuType menu_type,
+                                int64_t display_id,
                                 GetMenuModelCallback callback) {
   apps::mojom::MenuItemsPtr menu_items = apps::mojom::MenuItems::New();
+
+  if (menu_type == apps::mojom::MenuType::kShelf) {
+    AddCommandItem(ash::MENU_NEW_WINDOW, IDS_APP_LIST_NEW_WINDOW, &menu_items);
+  }
+
   if (crostini::IsUninstallable(profile_, app_id)) {
     AddCommandItem(ash::UNINSTALL, IDS_APP_LIST_UNINSTALL_ITEM, &menu_items);
   }
@@ -189,6 +220,31 @@
                    &menu_items);
   }
 
+  if (ShouldAddOpenItem(app_id, menu_type, profile_)) {
+    AddCommandItem(ash::MENU_OPEN_NEW, IDS_APP_CONTEXT_MENU_ACTIVATE_ARC,
+                   &menu_items);
+  }
+
+  if (ShouldAddCloseItem(app_id, menu_type, profile_)) {
+    AddCommandItem(ash::MENU_CLOSE, IDS_SHELF_CONTEXT_MENU_CLOSE, &menu_items);
+  }
+
+  // Offer users the ability to toggle per-application UI scaling.
+  // Some apps have high-density display support and do not require scaling
+  // to match the system display density, but others are density-unaware and
+  // look better when scaled to match the display density.
+  if (ShouldShowDisplayDensityMenuItem(app_id, menu_type, display_id)) {
+    base::Optional<crostini::CrostiniRegistryService::Registration>
+        registration = registry_->GetRegistration(app_id);
+    if (registration->IsScaled()) {
+      AddCommandItem(ash::CROSTINI_USE_HIGH_DENSITY,
+                     IDS_CROSTINI_USE_HIGH_DENSITY, &menu_items);
+    } else {
+      AddCommandItem(ash::CROSTINI_USE_LOW_DENSITY,
+                     IDS_CROSTINI_USE_LOW_DENSITY, &menu_items);
+    }
+  }
+
   std::move(callback).Run(std::move(menu_items));
 }
 

diff --git a/chrome/browser/apps/app_service/crostini_apps.h b/chrome/browser/apps/app_service/crostini_apps.h
index 5c3b89a..4bd97ec 100644
--- a/chrome/browser/apps/app_service/crostini_apps.h
+++ b/chrome/browser/apps/app_service/crostini_apps.h

@@ -43,9 +43,6 @@
       Profile* profile);
 
  private:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
-
   enum class PublishAppIDType {
     kInstall,
     kUninstall,
@@ -81,7 +78,8 @@
   void UnpauseApps(const std::string& app_id) override;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(const std::string& app_id) override;
   void OnPreferredAppSet(const std::string& app_id,
                          apps::mojom::IntentFilterPtr intent_filter,

diff --git a/chrome/browser/apps/app_service/extension_apps.cc b/chrome/browser/apps/app_service/extension_apps.cc
index 6d92722e..b0d1c8d 100644
--- a/chrome/browser/apps/app_service/extension_apps.cc
+++ b/chrome/browser/apps/app_service/extension_apps.cc

@@ -647,6 +647,7 @@
 
 void ExtensionApps::GetMenuModel(const std::string& app_id,
                                  apps::mojom::MenuType menu_type,
+                                 int64_t display_id,
                                  GetMenuModelCallback callback) {
   extensions::ExtensionRegistry* registry =
       extensions::ExtensionRegistry::Get(profile_);
@@ -677,7 +678,7 @@
         &menu_items);
   }
 
-  if (!is_platform_app &&
+  if (!is_platform_app && menu_type == apps::mojom::MenuType::kAppList &&
       extensions::util::IsAppLaunchableWithoutEnabling(app_id, profile_) &&
       extensions::OptionsPageInfo::HasOptionsPage(extension)) {
     AddCommandItem(ash::OPTIONS, IDS_NEW_TAB_APP_OPTIONS, &menu_items);

diff --git a/chrome/browser/apps/app_service/extension_apps.h b/chrome/browser/apps/app_service/extension_apps.h
index 130bf1e..ef385ab 100644
--- a/chrome/browser/apps/app_service/extension_apps.h
+++ b/chrome/browser/apps/app_service/extension_apps.h

@@ -72,9 +72,6 @@
   void ObserveArc();
 
  private:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
-
   void Initialize(const mojo::Remote<apps::mojom::AppService>& app_service);
 
   // Determines whether the given extension should be treated as type app_type_,
@@ -108,7 +105,8 @@
   void UnpauseApps(const std::string& app_id) override;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(const std::string& app_id) override;
   void OnPreferredAppSet(const std::string& app_id,
                          apps::mojom::IntentFilterPtr intent_filter,

diff --git a/chrome/browser/apps/app_service/web_apps.cc b/chrome/browser/apps/app_service/web_apps.cc
index db530523..ae58d50 100644
--- a/chrome/browser/apps/app_service/web_apps.cc
+++ b/chrome/browser/apps/app_service/web_apps.cc

@@ -353,6 +353,7 @@
 
 void WebApps::GetMenuModel(const std::string& app_id,
                            apps::mojom::MenuType menu_type,
+                           int64_t display_id,
                            GetMenuModelCallback callback) {
   const web_app::WebApp* web_app = GetWebApp(app_id);
   if (!web_app) {

diff --git a/chrome/browser/apps/app_service/web_apps.h b/chrome/browser/apps/app_service/web_apps.h
index f127f82..f380bc08 100644
--- a/chrome/browser/apps/app_service/web_apps.h
+++ b/chrome/browser/apps/app_service/web_apps.h

@@ -53,9 +53,6 @@
   void ObserveArc();
 
  private:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
-
   void Initialize(const mojo::Remote<apps::mojom::AppService>& app_service);
 
   const web_app::WebApp* GetWebApp(const web_app::AppId& app_id) const;
@@ -88,7 +85,8 @@
   void UnpauseApps(const std::string& app_id) override;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(const std::string& app_id) override;
   void OnPreferredAppSet(const std::string& app_id,
                          apps::mojom::IntentFilterPtr intent_filter,

diff --git a/chrome/browser/chromeos/BUILD.gn b/chrome/browser/chromeos/BUILD.gn
index c776000..e926e6bd 100644
--- a/chrome/browser/chromeos/BUILD.gn
+++ b/chrome/browser/chromeos/BUILD.gn

@@ -2713,6 +2713,7 @@
     "crostini/crostini_registry_service_unittest.cc",
     "crostini/crostini_reporting_util_unittest.cc",
     "crostini/crostini_unsupported_action_notifier_unittest.cc",
+    "crostini/crostini_util_unittest.cc",
     "crostini/crosvm_metrics_unittest.cc",
     "crostini/crosvm_process_list_unittest.cc",
     "crostini/throttle/crostini_active_window_throttle_observer_unittest.cc",

diff --git a/chrome/browser/chromeos/accessibility/accessibility_manager.cc b/chrome/browser/chromeos/accessibility/accessibility_manager.cc
index eade7b7..9c419a3 100644
--- a/chrome/browser/chromeos/accessibility/accessibility_manager.cc
+++ b/chrome/browser/chromeos/accessibility/accessibility_manager.cc

@@ -965,10 +965,10 @@
     scoped_braille_observer_.Add(braille_controller);
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
-      base::Bind(&BrailleController::GetDisplayState,
-                 base::Unretained(braille_controller)),
-      base::Bind(&AccessibilityManager::ReceiveBrailleDisplayState,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&BrailleController::GetDisplayState,
+                     base::Unretained(braille_controller)),
+      base::BindOnce(&AccessibilityManager::ReceiveBrailleDisplayState,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void AccessibilityManager::ReceiveBrailleDisplayState(

diff --git a/chrome/browser/chromeos/arc/file_system_watcher/arc_file_system_watcher_service.cc b/chrome/browser/chromeos/arc/file_system_watcher/arc_file_system_watcher_service.cc
index cc315a8c..561090b 100644
--- a/chrome/browser/chromeos/arc/file_system_watcher/arc_file_system_watcher_service.cc
+++ b/chrome/browser/chromeos/arc/file_system_watcher/arc_file_system_watcher_service.cc

@@ -267,9 +267,9 @@
   DCHECK(outstanding_task_);
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {base::ThreadPool(), base::MayBlock()},
-      base::Bind(&BuildTimestampMapCallback, cros_dir_, android_dir_),
-      base::Bind(&FileSystemWatcher::OnBuildTimestampMap,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&BuildTimestampMapCallback, cros_dir_, android_dir_),
+      base::BindOnce(&FileSystemWatcher::OnBuildTimestampMap,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void ArcFileSystemWatcherService::FileSystemWatcher::OnBuildTimestampMap(

diff --git a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
index 02eac98..5bb9762 100644
--- a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
+++ b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc

@@ -676,8 +676,8 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&version_loader::GetVersion, version_loader::VERSION_FULL),
-      base::Bind(&ChromeOSVersionCallback));
+      base::BindOnce(&version_loader::GetVersion, version_loader::VERSION_FULL),
+      base::BindOnce(&ChromeOSVersionCallback));
 
   arc_kiosk_app_manager_.reset(new ArcKioskAppManager());
   web_kiosk_app_manager_.reset(new WebKioskAppManager());

diff --git a/chrome/browser/chromeos/crostini/crostini_installer_types.mojom b/chrome/browser/chromeos/crostini/crostini_installer_types.mojom
index b0ead15..65efb5c 100644
--- a/chrome/browser/chromeos/crostini/crostini_installer_types.mojom
+++ b/chrome/browser/chromeos/crostini/crostini_installer_types.mojom

@@ -34,3 +34,9 @@
   kErrorCreateContainer,
   kErrorUnknown,
 };
+
+struct DiskSliderTick {
+  int64 value;        // Size in bytes.
+  string label;       // Localised human-readable value e.g. 4.6GB.
+  string aria_value;  // Value for e.g. screen readers.
+};

diff --git a/chrome/browser/chromeos/crostini/crostini_manager.cc b/chrome/browser/chromeos/crostini/crostini_manager.cc
index e5d7afc..dc1bf23 100644
--- a/chrome/browser/chromeos/crostini/crostini_manager.cc
+++ b/chrome/browser/chromeos/crostini/crostini_manager.cc

@@ -127,7 +127,8 @@
     RestartOptions&&) = default;
 
 class CrostiniManager::CrostiniRestarter
-    : public crostini::VmShutdownObserver,
+    : public base::RefCountedThreadSafe<CrostiniRestarter>,
+      public crostini::VmShutdownObserver,
       public chromeos::disks::DiskMountManager::Observer,
       public chromeos::SchedulerConfigurationManagerBase::Observer {
  public:
@@ -166,15 +167,13 @@
       base::PostTask(
           FROM_HERE, {content::BrowserThread::UI},
           base::BindOnce(&CrostiniRestarter::StartLxdContainerFinished,
-                         weak_ptr_factory_.GetWeakPtr(),
-                         CrostiniResult::SUCCESS));
+                         base::WrapRefCounted(this), CrostiniResult::SUCCESS));
       return;
     }
 
     StartStage(mojom::InstallerState::kInstallImageLoader);
-    crostini_manager_->InstallTerminaComponent(
-        base::BindOnce(&CrostiniRestarter::LoadComponentFinished,
-                       weak_ptr_factory_.GetWeakPtr()));
+    crostini_manager_->InstallTerminaComponent(base::BindOnce(
+        &CrostiniRestarter::LoadComponentFinished, base::WrapRefCounted(this)));
   }
 
   void AddObserver(CrostiniManager::RestartObserver* observer) {
@@ -228,6 +227,9 @@
   bool is_aborted() const { return is_aborted_; }
   CrostiniResult result_ = CrostiniResult::NEVER_FINISHED;
 
+ private:
+  friend class base::RefCountedThreadSafe<CrostiniRestarter>;
+
   ~CrostiniRestarter() override {
     // Do not record results if this restart was triggered by the installer.
     // The crostini installer has its own histograms that should be kept
@@ -244,7 +246,6 @@
       mount_manager->RemoveObserver(this);
   }
 
- private:
   void StartStage(mojom::InstallerState stage) {
     for (auto& observer : observer_list_) {
       observer.OnStageStarted(stage);
@@ -273,8 +274,8 @@
     // Set the pref here, after we first successfully install something
     profile_->GetPrefs()->SetBoolean(crostini::prefs::kCrostiniEnabled, true);
     StartStage(mojom::InstallerState::kStartConcierge);
-    crostini_manager_->StartConcierge(base::BindOnce(
-        &CrostiniRestarter::ConciergeStarted, weak_ptr_factory_.GetWeakPtr()));
+    crostini_manager_->StartConcierge(
+        base::BindOnce(&CrostiniRestarter::ConciergeStarted, this));
   }
 
   void ConciergeStarted(bool is_started) {
@@ -291,7 +292,7 @@
     }
 
     // Allow concierge to choose an appropriate disk image size.
-    int64_t disk_size_available = 0;
+    int64_t disk_size_available = options_.disk_size.value_or(0);
     // If we have an already existing disk, CreateDiskImage will just return its
     // path so we can pass it to StartTerminaVm.
     StartStage(mojom::InstallerState::kCreateDiskImage);
@@ -299,8 +300,8 @@
         base::FilePath(vm_name_),
         vm_tools::concierge::StorageLocation::STORAGE_CRYPTOHOME_ROOT,
         disk_size_available,
-        base::BindOnce(&CrostiniRestarter::CreateDiskImageFinished,
-                       weak_ptr_factory_.GetWeakPtr(), disk_size_available));
+        base::BindOnce(&CrostiniRestarter::CreateDiskImageFinished, this,
+                       disk_size_available));
   }
 
   void CreateDiskImageFinished(int64_t disk_size_available,
@@ -346,8 +347,7 @@
     StartStage(mojom::InstallerState::kStartTerminaVm);
     crostini_manager_->StartTerminaVm(
         vm_name_, disk_path_, num_cores_disabled,
-        base::BindOnce(&CrostiniRestarter::StartTerminaVmFinished,
-                       weak_ptr_factory_.GetWeakPtr()));
+        base::BindOnce(&CrostiniRestarter::StartTerminaVmFinished, this));
   }
 
   void StartTerminaVmFinished(bool success) {
@@ -368,15 +368,13 @@
             crostini::prefs::kReportCrostiniUsageEnabled) &&
         vm_name_ == kCrostiniDefaultVmName &&
         container_name_ == kCrostiniDefaultContainerName) {
-      crostini_manager_->GetTerminaVmKernelVersion(
-          base::BindOnce(&CrostiniRestarter::GetTerminaVmKernelVersionFinished,
-                         weak_ptr_factory_.GetWeakPtr()));
+      crostini_manager_->GetTerminaVmKernelVersion(base::BindOnce(
+          &CrostiniRestarter::GetTerminaVmKernelVersionFinished, this));
     }
     StartStage(mojom::InstallerState::kCreateContainer);
     crostini_manager_->CreateLxdContainer(
         vm_name_, container_name_,
-        base::BindOnce(&CrostiniRestarter::CreateLxdContainerFinished,
-                       weak_ptr_factory_.GetWeakPtr()));
+        base::BindOnce(&CrostiniRestarter::CreateLxdContainerFinished, this));
   }
 
   void GetTerminaVmKernelVersionFinished(
@@ -412,7 +410,7 @@
         options_.container_username.value_or(
             DefaultContainerUserNameForProfile(profile_)),
         base::BindOnce(&CrostiniRestarter::SetUpLxdContainerUserFinished,
-                       weak_ptr_factory_.GetWeakPtr()));
+                       this));
   }
 
   void SetUpLxdContainerUserFinished(bool success) {
@@ -432,8 +430,7 @@
     StartStage(mojom::InstallerState::kStartContainer);
     crostini_manager_->StartLxdContainer(
         vm_name_, container_name_,
-        base::BindOnce(&CrostiniRestarter::StartLxdContainerFinished,
-                       weak_ptr_factory_.GetWeakPtr()));
+        base::BindOnce(&CrostiniRestarter::StartLxdContainerFinished, this));
   }
 
   void StartLxdContainerFinished(CrostiniResult result) {
@@ -471,8 +468,8 @@
       StartStage(mojom::InstallerState::kFetchSshKeys);
       crostini_manager_->GetContainerSshKeys(
           vm_name_, container_name_,
-          base::BindOnce(&CrostiniRestarter::GetContainerSshKeysFinished,
-                         weak_ptr_factory_.GetWeakPtr(), info->username));
+          base::BindOnce(&CrostiniRestarter::GetContainerSshKeysFinished, this,
+                         info->username));
     } else {
       FinishRestart(result);
     }
@@ -586,8 +583,6 @@
   bool is_running_ = false;
 
   static CrostiniManager::RestartId next_restart_id_;
-
-  base::WeakPtrFactory<CrostiniRestarter> weak_ptr_factory_{this};
 };
 
 CrostiniManager::RestartId
@@ -1853,25 +1848,20 @@
     return kUninitializedRestartId;
   }
 
-  auto restarter = std::make_unique<CrostiniRestarter>(
+  auto restarter = base::MakeRefCounted<CrostiniRestarter>(
       profile_, this, std::move(vm_name), std::move(container_name),
       std::move(options), std::move(callback));
-  auto restart_id = restarter->restart_id();
   if (observer)
     restarter->AddObserver(observer);
   auto key = ContainerId(restarter->vm_name(), restarter->container_name());
-  restarters_by_container_.emplace(key, restart_id);
-  restarters_by_id_[restart_id] = std::move(restarter);
+  restarters_by_container_.emplace(key, restarter->restart_id());
+  restarters_by_id_[restarter->restart_id()] = restarter;
   if (restarters_by_container_.count(key) > 1) {
     VLOG(1) << "Already restarting " << key;
   } else {
-    // ::Restart needs to be called after the restarter is inserted into
-    // restarters_by_id_ because some tests will make the restart process
-    // complete before ::Restart returns.
-    restarters_by_id_[restart_id]->Restart();
+    restarter->Restart();
   }
-
-  return restart_id;
+  return restarter->restart_id();
 }
 
 void CrostiniManager::AbortRestartCrostini(
@@ -1911,7 +1901,8 @@
   // Kick off the "next" (in no order) pending Restart() if any.
   auto pending_it = restarters_by_container_.find(key);
   if (pending_it != restarters_by_container_.end()) {
-    restarters_by_id_[pending_it->second]->Restart();
+    auto restarter = restarters_by_id_[pending_it->second];
+    restarter->Restart();
   }
 
   std::move(callback).Run();
@@ -2823,7 +2814,7 @@
           },
           crostini_remover));
 
-  for (const auto& restarter_it : restarters_by_id_) {
+  for (auto restarter_it : restarters_by_id_) {
     AbortRestartCrostini(restarter_it.first, abort_callback);
   }
 }
@@ -2839,11 +2830,11 @@
                                     CrostiniResult result) {
   auto key = ContainerId(restarter->vm_name(), restarter->container_name());
   auto range = restarters_by_container_.equal_range(key);
-  std::vector<std::unique_ptr<CrostiniRestarter>> pending_restarters;
+  std::vector<scoped_refptr<CrostiniRestarter>> pending_restarters;
   // Erase first, because restarter->RunCallback() may modify our maps.
   for (auto it = range.first; it != range.second; ++it) {
     CrostiniManager::RestartId restart_id = it->second;
-    pending_restarters.emplace_back(std::move(restarters_by_id_[restart_id]));
+    pending_restarters.emplace_back(restarters_by_id_[restart_id]);
     restarters_by_id_.erase(restart_id);
   }
   restarters_by_container_.erase(range.first, range.second);

diff --git a/chrome/browser/chromeos/crostini/crostini_manager.h b/chrome/browser/chromeos/crostini/crostini_manager.h
index 78315b1..67a29a4 100644
--- a/chrome/browser/chromeos/crostini/crostini_manager.h
+++ b/chrome/browser/chromeos/crostini/crostini_manager.h

@@ -160,6 +160,7 @@
   struct RestartOptions {
     // This normally will not have effect on existing container.
     base::Optional<std::string> container_username;
+    base::Optional<int64_t> disk_size;
 
     RestartOptions();
     ~RestartOptions();
@@ -848,7 +849,7 @@
   std::multimap<ContainerId, CrostiniManager::RestartId>
       restarters_by_container_;
 
-  std::map<CrostiniManager::RestartId, std::unique_ptr<CrostiniRestarter>>
+  std::map<CrostiniManager::RestartId, scoped_refptr<CrostiniRestarter>>
       restarters_by_id_;
 
   // True when the installer dialog is showing. At that point, it is invalid

diff --git a/chrome/browser/chromeos/crostini/crostini_util.cc b/chrome/browser/chromeos/crostini/crostini_util.cc
index 5d8a594..5730b6d 100644
--- a/chrome/browser/chromeos/crostini/crostini_util.cc
+++ b/chrome/browser/chromeos/crostini/crostini_util.cc

@@ -564,4 +564,19 @@
   return *app_id;
 }
 
+std::vector<int64_t> GetTicksForDiskSize(int64_t min_size,
+                                         int64_t available_space) {
+  if (min_size < 0 || available_space < 0 || min_size > available_space) {
+    return {};
+  }
+  std::vector<int64_t> ticks;
+  int64_t range = available_space - min_size;
+  for (int n = 0; n <= 100; n++) {
+    // These are disk sizes so we're not worried about overflow, 2^60 == 1024
+    // PiB.
+    ticks.emplace_back(min_size + n * range / 100);
+  }
+  return ticks;
+}
+
 }  // namespace crostini

diff --git a/chrome/browser/chromeos/crostini/crostini_util.h b/chrome/browser/chromeos/crostini/crostini_util.h
index fe6045b..6eab876 100644
--- a/chrome/browser/chromeos/crostini/crostini_util.h
+++ b/chrome/browser/chromeos/crostini/crostini_util.h

@@ -207,6 +207,12 @@
 // at |percent| way through.
 base::string16 GetTimeRemainingMessage(base::TimeTicks start, int percent);
 
+// Splits the range between |min_size| and |available_space| into enough
+// evenly-spaced intervals you can use them as ticks on a slider. Will return an
+// empty set if the range is invalid (e.g. any numbers are negative).
+std::vector<int64_t> GetTicksForDiskSize(int64_t min_size,
+                                         int64_t available_space);
+
 }  // namespace crostini
 
 #endif  // CHROME_BROWSER_CHROMEOS_CROSTINI_CROSTINI_UTIL_H_

diff --git a/chrome/browser/chromeos/crostini/crostini_util_unittest.cc b/chrome/browser/chromeos/crostini/crostini_util_unittest.cc
new file mode 100644
index 0000000..0aa43a2
--- /dev/null
+++ b/chrome/browser/chromeos/crostini/crostini_util_unittest.cc

@@ -0,0 +1,72 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/crostini/crostini_util.h"
+#include <limits>
+#include <numeric>
+#include <vector>
+
+#include "testing/gmock/include/gmock/gmock-matchers.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+// end is inclusive
+std::vector<int64_t> range(int64_t start, int64_t end, int64_t step) {
+  std::vector<int64_t> ticks;
+  for (int64_t n = start; n <= end; n += step) {
+    ticks.emplace_back(n);
+  }
+  return ticks;
+}
+}  // namespace
+
+namespace crostini {
+
+class CrostiniUtilTest : public testing::Test {
+ public:
+  CrostiniUtilTest() = default;
+  CrostiniUtilTest(const CrostiniUtilTest&) = delete;
+  CrostiniUtilTest& operator=(const CrostiniUtilTest&) = delete;
+};
+
+TEST_F(CrostiniUtilTest, GetTicksForDiskSizeSizeZeroRange) {
+  // When min_size == available_space the only possible option is
+  // available_space.
+  std::vector<int64_t> expected(101);
+  std::fill(expected.begin(), expected.end(), 10);
+  EXPECT_THAT(crostini::GetTicksForDiskSize(10, 10),
+              testing::ContainerEq(expected));
+}
+
+TEST_F(CrostiniUtilTest, GetTicksForDiskSizeInvalidInputsNoTicks) {
+  const std::vector<int64_t> empty = {};
+  // If min_size > available_space there's no solution, so we expect an empty
+  // range.
+  EXPECT_THAT(crostini::GetTicksForDiskSize(100, 10),
+              testing::ContainerEq(empty));
+
+  // If any of the inputs are negative we return an empty range.
+  EXPECT_THAT(crostini::GetTicksForDiskSize(100, -100),
+              testing::ContainerEq(empty));
+  EXPECT_THAT(crostini::GetTicksForDiskSize(-100, 100),
+              testing::ContainerEq(empty));
+  EXPECT_THAT(crostini::GetTicksForDiskSize(-100, -10),
+              testing::ContainerEq(empty));
+}
+
+TEST_F(CrostiniUtilTest, GetTicksForDiskSizeHappyPath) {
+  auto expected = range(100, 1100, 10);
+  EXPECT_THAT(crostini::GetTicksForDiskSize(100, 1100),
+              testing::ContainerEq(expected));
+}
+
+TEST_F(CrostiniUtilTest, GetTicksForDiskSizeNotDivisible) {
+  // Ticks are rounded down to integer values.
+  auto expected = std::vector<int64_t>{313, 316, 319, 323, 326, 329, 333};
+  EXPECT_THAT(crostini::GetTicksForDiskSize(0, 333),
+              testing::IsSupersetOf(expected));
+}
+
+}  // namespace crostini

diff --git a/chrome/browser/chromeos/fileapi/recent_disk_source.cc b/chrome/browser/chromeos/fileapi/recent_disk_source.cc
index b22b771..8c2d817 100644
--- a/chrome/browser/chromeos/fileapi/recent_disk_source.cc
+++ b/chrome/browser/chromeos/fileapi/recent_disk_source.cc

@@ -14,6 +14,7 @@
 #include "base/time/time.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "net/base/mime_util.h"
 #include "storage/browser/file_system/external_mount_points.h"
 #include "storage/browser/file_system/file_system_context.h"
 #include "storage/browser/file_system/file_system_operation.h"
@@ -26,6 +27,10 @@
 
 namespace {
 
+constexpr char kAudioMimeType[] = "audio/*";
+constexpr char kImageMimeType[] = "image/*";
+constexpr char kVideoMimeType[] = "video/*";
+
 void OnReadDirectoryOnIOThread(
     const storage::FileSystemOperation::ReadDirectoryCallback& callback,
     base::File::Error result,
@@ -70,6 +75,33 @@
       base::BindOnce(&OnGetMetadataOnIOThread, std::move(callback)));
 }
 
+// Returns true if the files at |path| matches the given |file_type|.
+bool MatchesFileType(const base::FilePath& path,
+                     RecentSource::FileType file_type) {
+  if (file_type == RecentSource::FileType::kAll)
+    return true;
+
+  // File type for |path| is guessed using net::GetMimeTypeFromFile.
+  // It guesses mime types based on file extensions, but it has a limited set
+  // of file extensions.
+  // TODO(fukino): It is better to have better coverage of file extensions to be
+  // consistent with file-type detection on Android system. crbug.com/1034874.
+  std::string mime_type;
+  if (!net::GetMimeTypeFromFile(path, &mime_type))
+    return false;
+
+  switch (file_type) {
+    case RecentSource::FileType::kAudio:
+      return net::MatchesMimeType(kAudioMimeType, mime_type);
+    case RecentSource::FileType::kImage:
+      return net::MatchesMimeType(kImageMimeType, mime_type);
+    case RecentSource::FileType::kVideo:
+      return net::MatchesMimeType(kVideoMimeType, mime_type);
+    default:
+      return false;
+  }
+}
+
 }  // namespace
 
 RecentDiskSource::RecentDiskSource(std::string mount_point_name,
@@ -153,6 +185,9 @@
       }
       ScanDirectory(subpath, depth + 1);
     } else {
+      if (!MatchesFileType(entry.name, params_.value().file_type())) {
+        continue;
+      }
       storage::FileSystemURL url = BuildDiskURL(subpath);
       ++inflight_stats_;
       base::PostTask(

diff --git a/chrome/browser/chromeos/fileapi/recent_disk_source_unittest.cc b/chrome/browser/chromeos/fileapi/recent_disk_source_unittest.cc
index f4de11a..cb6995f 100644
--- a/chrome/browser/chromeos/fileapi/recent_disk_source_unittest.cc
+++ b/chrome/browser/chromeos/fileapi/recent_disk_source_unittest.cc

@@ -69,15 +69,16 @@
     return file.SetTimes(time, time);
   }
 
-  std::vector<RecentFile> GetRecentFiles(size_t max_files,
-                                         const base::Time& cutoff_time) {
+  std::vector<RecentFile> GetRecentFiles(
+      size_t max_files,
+      const base::Time& cutoff_time,
+      RecentSource::FileType file_type = RecentSource::FileType::kAll) {
     std::vector<RecentFile> files;
 
     base::RunLoop run_loop;
 
     source_->GetRecentFiles(RecentSource::Params(
-        file_system_context_.get(), origin_, max_files, cutoff_time,
-        RecentSource::FileType::kAll,
+        file_system_context_.get(), origin_, max_files, cutoff_time, file_type,
         base::BindOnce(
             [](base::RunLoop* run_loop, std::vector<RecentFile>* out_files,
                std::vector<RecentFile> files) {
@@ -213,6 +214,72 @@
   EXPECT_EQ(base::Time::FromJavaTime(1000), files[1].last_modified());
 }
 
+TEST_F(RecentDiskSourceTest, GetAudioFiles) {
+  // Oldest
+  ASSERT_TRUE(CreateEmptyFile("1.jpg", base::Time::FromJavaTime(1000)));
+  ASSERT_TRUE(CreateEmptyFile("2.mp4", base::Time::FromJavaTime(2000)));
+  ASSERT_TRUE(CreateEmptyFile("3.png", base::Time::FromJavaTime(3000)));
+  ASSERT_TRUE(CreateEmptyFile("4.mp3", base::Time::FromJavaTime(4000)));
+  ASSERT_TRUE(CreateEmptyFile("5.gif", base::Time::FromJavaTime(5000)));
+  ASSERT_TRUE(CreateEmptyFile("6.webm", base::Time::FromJavaTime(6000)));
+  // Newest
+
+  std::vector<RecentFile> files =
+      GetRecentFiles(6, base::Time(), RecentSource::FileType::kAudio);
+
+  std::sort(files.begin(), files.end(), RecentFileComparator());
+
+  ASSERT_EQ(1u, files.size());
+  EXPECT_EQ("4.mp3", files[0].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(4000), files[0].last_modified());
+}
+
+TEST_F(RecentDiskSourceTest, GetImageFiles) {
+  // Oldest
+  ASSERT_TRUE(CreateEmptyFile("1.jpg", base::Time::FromJavaTime(1000)));
+  ASSERT_TRUE(CreateEmptyFile("2.mp4", base::Time::FromJavaTime(2000)));
+  ASSERT_TRUE(CreateEmptyFile("3.png", base::Time::FromJavaTime(3000)));
+  ASSERT_TRUE(CreateEmptyFile("4.mp3", base::Time::FromJavaTime(4000)));
+  ASSERT_TRUE(CreateEmptyFile("5.gif", base::Time::FromJavaTime(5000)));
+  ASSERT_TRUE(CreateEmptyFile("6.webm", base::Time::FromJavaTime(6000)));
+  // Newest
+
+  std::vector<RecentFile> files =
+      GetRecentFiles(6, base::Time(), RecentSource::FileType::kImage);
+
+  std::sort(files.begin(), files.end(), RecentFileComparator());
+
+  ASSERT_EQ(3u, files.size());
+  EXPECT_EQ("5.gif", files[0].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(5000), files[0].last_modified());
+  EXPECT_EQ("3.png", files[1].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(3000), files[1].last_modified());
+  EXPECT_EQ("1.jpg", files[2].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(1000), files[2].last_modified());
+}
+
+TEST_F(RecentDiskSourceTest, GetVideoFiles) {
+  // Oldest
+  ASSERT_TRUE(CreateEmptyFile("1.jpg", base::Time::FromJavaTime(1000)));
+  ASSERT_TRUE(CreateEmptyFile("2.mp4", base::Time::FromJavaTime(2000)));
+  ASSERT_TRUE(CreateEmptyFile("3.png", base::Time::FromJavaTime(3000)));
+  ASSERT_TRUE(CreateEmptyFile("4.mp3", base::Time::FromJavaTime(4000)));
+  ASSERT_TRUE(CreateEmptyFile("5.gif", base::Time::FromJavaTime(5000)));
+  ASSERT_TRUE(CreateEmptyFile("6.webm", base::Time::FromJavaTime(6000)));
+  // Newest
+
+  std::vector<RecentFile> files =
+      GetRecentFiles(6, base::Time(), RecentSource::FileType::kVideo);
+
+  std::sort(files.begin(), files.end(), RecentFileComparator());
+
+  ASSERT_EQ(2u, files.size());
+  EXPECT_EQ("6.webm", files[0].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(6000), files[0].last_modified());
+  EXPECT_EQ("2.mp4", files[1].url().path().BaseName().value());
+  EXPECT_EQ(base::Time::FromJavaTime(2000), files[1].last_modified());
+}
+
 TEST_F(RecentDiskSourceTest, GetRecentFiles_UmaStats) {
   base::HistogramTester histogram_tester;
 

diff --git a/chrome/browser/chromeos/fileapi/recent_drive_source.cc b/chrome/browser/chromeos/fileapi/recent_drive_source.cc
index eb95643..59164fd2 100644
--- a/chrome/browser/chromeos/fileapi/recent_drive_source.cc
+++ b/chrome/browser/chromeos/fileapi/recent_drive_source.cc

@@ -30,6 +30,10 @@
 const char RecentDriveSource::kLoadHistogramName[] =
     "FileBrowser.Recent.LoadDrive";
 
+const char kAudioMimeType[] = "audio";
+const char kImageMimeType[] = "image";
+const char kVideoMimeType[] = "video";
+
 RecentDriveSource::RecentDriveSource(Profile* profile) : profile_(profile) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
@@ -64,6 +68,20 @@
       drivefs::mojom::QueryParameters::SortField::kLastModified;
   query_params->sort_direction =
       drivefs::mojom::QueryParameters::SortDirection::kDescending;
+  switch (params_->file_type()) {
+    case FileType::kAudio:
+      query_params->mime_type = kAudioMimeType;
+      break;
+    case FileType::kImage:
+      query_params->mime_type = kImageMimeType;
+      break;
+    case FileType::kVideo:
+      query_params->mime_type = kVideoMimeType;
+      break;
+    default:
+      // Leave the mime_type null to query all files.
+      break;
+  }
   integration_service->GetDriveFsInterface()->StartSearchQuery(
       search_query_.BindNewPipeAndPassReceiver(), std::move(query_params));
   search_query_->GetNextPage(base::BindOnce(

diff --git a/chrome/browser/chromeos/first_run/goodies_displayer.cc b/chrome/browser/chromeos/first_run/goodies_displayer.cc
index 39287eb..cde40e0 100644
--- a/chrome/browser/chromeos/first_run/goodies_displayer.cc
+++ b/chrome/browser/chromeos/first_run/goodies_displayer.cc

@@ -88,8 +88,8 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        base::Bind(&CheckGoodiesPrefAgainstOobeTimestamp),
-        base::Bind(&UpdateGoodiesPrefCantShow));
+        base::BindOnce(&CheckGoodiesPrefAgainstOobeTimestamp),
+        base::BindOnce(&UpdateGoodiesPrefCantShow));
   }
   return can_show;
 }

diff --git a/chrome/browser/chromeos/input_method/component_extension_ime_manager_impl.cc b/chrome/browser/chromeos/input_method/component_extension_ime_manager_impl.cc
index 533deded..cd80a3ed 100644
--- a/chrome/browser/chromeos/input_method/component_extension_ime_manager_impl.cc
+++ b/chrome/browser/chromeos/input_method/component_extension_ime_manager_impl.cc

@@ -182,11 +182,11 @@
       // virtual keyboard. See https://crbug.com/976542
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_BLOCKING},
-      base::Bind(&CheckFilePath, base::Unretained(copied_file_path)),
-      base::Bind(&OnFilePathChecked, base::Unretained(profile),
-                 base::Owned(new std::string(extension_id)),
-                 base::Owned(new std::string(manifest)),
-                 base::Owned(copied_file_path)));
+      base::BindOnce(&CheckFilePath, base::Unretained(copied_file_path)),
+      base::BindOnce(&OnFilePathChecked, base::Unretained(profile),
+                     base::Owned(new std::string(extension_id)),
+                     base::Owned(new std::string(manifest)),
+                     base::Owned(copied_file_path)));
 }
 
 void ComponentExtensionIMEManagerImpl::Unload(Profile* profile,

diff --git a/chrome/browser/chromeos/input_method/input_method_syncer.cc b/chrome/browser/chromeos/input_method/input_method_syncer.cc
index ae820dc..dead728 100644
--- a/chrome/browser/chromeos/input_method/input_method_syncer.cc
+++ b/chrome/browser/chromeos/input_method/input_method_syncer.cc

@@ -230,8 +230,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&CheckAndResolveLocales, languages),
-      base::Bind(&InputMethodSyncer::FinishMerge, weak_factory_.GetWeakPtr()));
+      base::BindOnce(&CheckAndResolveLocales, languages),
+      base::BindOnce(&InputMethodSyncer::FinishMerge,
+                     weak_factory_.GetWeakPtr()));
 }
 
 std::string InputMethodSyncer::AddSupportedInputMethodValues(

diff --git a/chrome/browser/chromeos/login/session/user_session_manager.cc b/chrome/browser/chromeos/login/session/user_session_manager.cc
index b99a22d..645e4ce 100644
--- a/chrome/browser/chromeos/login/session/user_session_manager.cc
+++ b/chrome/browser/chromeos/login/session/user_session_manager.cc

@@ -711,8 +711,8 @@
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::Bind(&CollectRlzParams),
-      base::Bind(&UserSessionManager::InitRlzImpl, AsWeakPtr(), profile));
+      base::BindOnce(&CollectRlzParams),
+      base::BindOnce(&UserSessionManager::InitRlzImpl, AsWeakPtr(), profile));
 #endif
 }
 

diff --git a/chrome/browser/chromeos/login/version_info_updater.cc b/chrome/browser/chromeos/login/version_info_updater.cc
index 3b51d9cf..8ebdd8e 100644
--- a/chrome/browser/chromeos/login/version_info_updater.cc
+++ b/chrome/browser/chromeos/login/version_info_updater.cc

@@ -68,11 +68,12 @@
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(),
          base::TaskPriority::USER_VISIBLE},
-        base::Bind(&version_loader::GetVersion,
-                   is_official_build ? version_loader::VERSION_SHORT_WITH_DATE
-                                     : version_loader::VERSION_FULL),
-        base::Bind(&VersionInfoUpdater::OnVersion,
-                   weak_pointer_factory_.GetWeakPtr()));
+        base::BindOnce(&version_loader::GetVersion,
+                       is_official_build
+                           ? version_loader::VERSION_SHORT_WITH_DATE
+                           : version_loader::VERSION_FULL),
+        base::BindOnce(&VersionInfoUpdater::OnVersion,
+                       weak_pointer_factory_.GetWeakPtr()));
   } else {
     OnVersion("linux-chromeos");
   }

diff --git a/chrome/browser/chromeos/policy/dm_token_storage.cc b/chrome/browser/chromeos/policy/dm_token_storage.cc
index d959e38..2ec5b64 100644
--- a/chrome/browser/chromeos/policy/dm_token_storage.cc
+++ b/chrome/browser/chromeos/policy/dm_token_storage.cc

@@ -130,9 +130,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&EncryptToken, system_salt_, dm_token_),
-      base::Bind(&DMTokenStorage::OnTokenEncrypted,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&EncryptToken, system_salt_, dm_token_),
+      base::BindOnce(&DMTokenStorage::OnTokenEncrypted,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void DMTokenStorage::OnTokenEncrypted(const std::string& encrypted_dm_token) {
@@ -154,9 +154,9 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        base::Bind(&DecryptToken, system_salt_, encrypted_dm_token),
-        base::Bind(&DMTokenStorage::FlushRetrieveTokenCallback,
-                   weak_ptr_factory_.GetWeakPtr()));
+        base::BindOnce(&DecryptToken, system_salt_, encrypted_dm_token),
+        base::BindOnce(&DMTokenStorage::FlushRetrieveTokenCallback,
+                       weak_ptr_factory_.GetWeakPtr()));
   } else {
     DLOG(ERROR) << "No DM token in the local state.";
     FlushRetrieveTokenCallback(std::string());

diff --git a/chrome/browser/chromeos/policy/status_collector/child_status_collector.cc b/chrome/browser/chromeos/policy/status_collector/child_status_collector.cc
index ea799f3a..6d9abbc 100644
--- a/chrome/browser/chromeos/policy/status_collector/child_status_collector.cc
+++ b/chrome/browser/chromeos/policy/status_collector/child_status_collector.cc

@@ -161,10 +161,10 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::BindRepeating(&chromeos::version_loader::GetVersion,
-                          chromeos::version_loader::VERSION_FULL),
-      base::BindRepeating(&ChildStatusCollector::OnOSVersion,
-                          weak_factory_.GetWeakPtr()));
+      base::BindOnce(&chromeos::version_loader::GetVersion,
+                     chromeos::version_loader::VERSION_FULL),
+      base::BindOnce(&ChildStatusCollector::OnOSVersion,
+                     weak_factory_.GetWeakPtr()));
 
   DCHECK(pref_service_->GetInitializationStatus() !=
          PrefService::INITIALIZATION_STATUS_WAITING);

diff --git a/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc b/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc
index 2940b1e..bb63e94 100644
--- a/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc
+++ b/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc

@@ -607,8 +607,9 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        base::Bind(volume_info_fetcher, mount_points),
-        base::Bind(&DeviceStatusCollectorState::OnVolumeInfoReceived, this));
+        base::BindOnce(volume_info_fetcher, mount_points),
+        base::BindOnce(&DeviceStatusCollectorState::OnVolumeInfoReceived,
+                       this));
   }
 
   // Queues an async callback to query CPU temperature information.
@@ -618,8 +619,9 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        cpu_temp_fetcher,
-        base::Bind(&DeviceStatusCollectorState::OnCPUTempInfoReceived, this));
+        base::BindOnce(cpu_temp_fetcher),
+        base::BindOnce(&DeviceStatusCollectorState::OnCPUTempInfoReceived,
+                       this));
   }
 
   bool FetchAndroidStatus(
@@ -988,16 +990,16 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&chromeos::version_loader::GetVersion,
-                 chromeos::version_loader::VERSION_FULL),
-      base::Bind(&DeviceStatusCollector::OnOSVersion,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&chromeos::version_loader::GetVersion,
+                     chromeos::version_loader::VERSION_FULL),
+      base::BindOnce(&DeviceStatusCollector::OnOSVersion,
+                     weak_factory_.GetWeakPtr()));
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&ReadFirmwareVersion),
-      base::Bind(&DeviceStatusCollector::OnOSFirmware,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&ReadFirmwareVersion),
+      base::BindOnce(&DeviceStatusCollector::OnOSFirmware,
+                     weak_factory_.GetWeakPtr()));
   chromeos::tpm_util::GetTpmVersion(base::BindOnce(
       &DeviceStatusCollector::OnTpmVersion, weak_factory_.GetWeakPtr()));
 
@@ -1178,9 +1180,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      cpu_statistics_fetcher_,
-      base::Bind(&DeviceStatusCollector::ReceiveCPUStatistics,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(cpu_statistics_fetcher_),
+      base::BindOnce(&DeviceStatusCollector::ReceiveCPUStatistics,
+                     weak_factory_.GetWeakPtr()));
 }
 
 void DeviceStatusCollector::ReceiveCPUStatistics(const std::string& stats) {

diff --git a/chrome/browser/download/chrome_download_manager_delegate.cc b/chrome/browser/download/chrome_download_manager_delegate.cc
index 7756209..94a21e7a 100644
--- a/chrome/browser/download/chrome_download_manager_delegate.cc
+++ b/chrome/browser/download/chrome_download_manager_delegate.cc

@@ -1090,9 +1090,9 @@
     const base::FilePath& path,
     const GetFileMimeTypeCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskAndReplyWithResult(FROM_HERE,
-                                   {base::ThreadPool(), base::MayBlock()},
-                                   base::Bind(&GetMimeType, path), callback);
+  base::PostTaskAndReplyWithResult(
+      FROM_HERE, {base::ThreadPool(), base::MayBlock()},
+      base::BindOnce(&GetMimeType, path), base::BindOnce(callback));
 }
 
 #if BUILDFLAG(FULL_SAFE_BROWSING)

diff --git a/chrome/browser/download/notification/download_item_notification.cc b/chrome/browser/download/notification/download_item_notification.cc
index dfcda10..8b2644a 100644
--- a/chrome/browser/download/notification/download_item_notification.cc
+++ b/chrome/browser/download/notification/download_item_notification.cc

@@ -492,9 +492,9 @@
           FROM_HERE,
           {base::ThreadPool(), base::MayBlock(),
            base::TaskPriority::BEST_EFFORT},
-          base::Bind(&ReadNotificationImage, file_path),
-          base::Bind(&DownloadItemNotification::OnImageLoaded,
-                     weak_factory_.GetWeakPtr()));
+          base::BindOnce(&ReadNotificationImage, file_path),
+          base::BindOnce(&DownloadItemNotification::OnImageLoaded,
+                         weak_factory_.GetWeakPtr()));
     }
   }
 }
@@ -544,9 +544,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&CropImage, decoded_bitmap),
-      base::Bind(&DownloadItemNotification::OnImageCropped,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&CropImage, decoded_bitmap),
+      base::BindOnce(&DownloadItemNotification::OnImageCropped,
+                     weak_factory_.GetWeakPtr()));
 }
 
 void DownloadItemNotification::OnImageCropped(const SkBitmap& bitmap) {

diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.cc b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
index df433097..9d9d31c 100644
--- a/chrome/browser/extensions/api/developer_private/developer_private_api.cc
+++ b/chrome/browser/extensions/api/developer_private/developer_private_api.cc

@@ -1705,8 +1705,8 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&ReadFileToString, extension->path().Append(path_suffix)),
-      base::Bind(&DeveloperPrivateRequestFileSourceFunction::Finish, this));
+      base::BindOnce(&ReadFileToString, extension->path().Append(path_suffix)),
+      base::BindOnce(&DeveloperPrivateRequestFileSourceFunction::Finish, this));
 
   return RespondLater();
 }

diff --git a/chrome/browser/extensions/api/networking_cast_private/chrome_networking_cast_private_delegate.cc b/chrome/browser/extensions/api/networking_cast_private/chrome_networking_cast_private_delegate.cc
index db66f4b2..51b379a 100644
--- a/chrome/browser/extensions/api/networking_cast_private/chrome_networking_cast_private_delegate.cc
+++ b/chrome/browser/extensions/api/networking_cast_private/chrome_networking_cast_private_delegate.cc

@@ -136,9 +136,10 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&RunDecodeAndVerifyCredentials, base::Passed(&credentials)),
-      base::Bind(&VerifyDestinationCompleted, success_callback,
-                 failure_callback));
+      base::BindOnce(&RunDecodeAndVerifyCredentials,
+                     base::Passed(&credentials)),
+      base::BindOnce(&VerifyDestinationCompleted, success_callback,
+                     failure_callback));
 }
 
 void ChromeNetworkingCastPrivateDelegate::VerifyAndEncryptData(
@@ -149,9 +150,10 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&RunVerifyAndEncryptData, data, base::Passed(&credentials)),
-      base::Bind(&VerifyAndEncryptDataCompleted, success_callback,
-                 failure_callback));
+      base::BindOnce(&RunVerifyAndEncryptData, data,
+                     base::Passed(&credentials)),
+      base::BindOnce(&VerifyAndEncryptDataCompleted, success_callback,
+                     failure_callback));
 }
 
 }  // namespace extensions

diff --git a/chrome/browser/extensions/api/processes/processes_api.cc b/chrome/browser/extensions/api/processes/processes_api.cc
index a56649c..ff44f82 100644
--- a/chrome/browser/extensions/api/processes/processes_api.cc
+++ b/chrome/browser/extensions/api/processes/processes_api.cc

@@ -511,9 +511,9 @@
   // IO thread.
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {content::BrowserThread::IO},
-      base::Bind(&ProcessesTerminateFunction::GetProcessHandleOnIO, this,
-                 child_process_host_id_),
-      base::Bind(&ProcessesTerminateFunction::OnProcessHandleOnUI, this));
+      base::BindOnce(&ProcessesTerminateFunction::GetProcessHandleOnIO, this,
+                     child_process_host_id_),
+      base::BindOnce(&ProcessesTerminateFunction::OnProcessHandleOnUI, this));
 
   // Promise to respond later.
   return RespondLater();

diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index d6e414a..bed0e26 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json

@@ -859,7 +859,7 @@
   {
     "name": "download-auto-resumption-native",
     "owners": [ "shaktisahu", "qinmin" ],
-    "expiry_milestone": 80
+    "expiry_milestone": 86
   },
   {
     "name": "draw-vertically-edge-to-edge",
@@ -1603,7 +1603,7 @@
   {
     "name": "enable-new-download-backend",
     "owners": [ "shaktisahu", "dtrainor" ],
-    "expiry_milestone": 80
+    "expiry_milestone": 86
   },
   {
     "name": "enable-noscript-previews",

diff --git a/chrome/browser/google/google_brand_chromeos.cc b/chrome/browser/google/google_brand_chromeos.cc
index 8d1cf6f..eecbcf8 100644
--- a/chrome/browser/google/google_brand_chromeos.cc
+++ b/chrome/browser/google/google_brand_chromeos.cc

@@ -100,7 +100,7 @@
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::Bind(&ReadBrandFromFile), base::Bind(&SetBrand, callback));
+      base::BindOnce(&ReadBrandFromFile), base::BindOnce(&SetBrand, callback));
 }
 
 }  // namespace chromeos

diff --git a/chrome/browser/importer/importer_list.cc b/chrome/browser/importer/importer_list.cc
index 7065785..c5ad71a4 100644
--- a/chrome/browser/importer/importer_list.cc
+++ b/chrome/browser/importer/importer_list.cc

@@ -195,10 +195,10 @@
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE,
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::Bind(&DetectSourceProfilesWorker, locale,
-                 include_interactive_profiles),
-      base::Bind(&ImporterList::SourceProfilesLoaded,
-                 weak_ptr_factory_.GetWeakPtr(), profiles_loaded_callback));
+      base::BindOnce(&DetectSourceProfilesWorker, locale,
+                     include_interactive_profiles),
+      base::BindOnce(&ImporterList::SourceProfilesLoaded,
+                     weak_ptr_factory_.GetWeakPtr(), profiles_loaded_callback));
 }
 
 const importer::SourceProfile& ImporterList::GetSourceProfileAt(

diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc
index 7f7bdb4..61adcf8a 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc

@@ -683,8 +683,8 @@
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      create_temporary_file_callback,
-      base::Bind(
+      base::BindOnce(create_temporary_file_callback),
+      base::BindOnce(
           &MTPDeviceDelegateImplLinux::OnDidCreateTemporaryFileToCopyFileLocal,
           weak_ptr_factory_.GetWeakPtr(), source_file_path, device_file_path,
           progress_callback, success_callback, error_callback));
@@ -1512,10 +1512,11 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&OpenFileDescriptor, source_file_path, O_RDONLY),
-      base::Bind(&MTPDeviceDelegateImplLinux::OnDidOpenFDToCopyFileFromLocal,
-                 weak_ptr_factory_.GetWeakPtr(), device_file_path,
-                 success_callback, error_callback));
+      base::BindOnce(&OpenFileDescriptor, source_file_path, O_RDONLY),
+      base::BindOnce(
+          &MTPDeviceDelegateImplLinux::OnDidOpenFDToCopyFileFromLocal,
+          weak_ptr_factory_.GetWeakPtr(), device_file_path, success_callback,
+          error_callback));
 }
 
 void MTPDeviceDelegateImplLinux::OnDidCreateSingleDirectory(

diff --git a/chrome/browser/media_galleries/chromeos/mtp_read_file_worker.cc b/chrome/browser/media_galleries/chromeos/mtp_read_file_worker.cc
index 1f0d05c6..9356533 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_read_file_worker.cc
+++ b/chrome/browser/media_galleries/chromeos/mtp_read_file_worker.cc

@@ -93,11 +93,11 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&WriteDataChunkIntoSnapshotFileOnFileThread,
-                 snapshot_file_details_ptr->snapshot_file_path(), data),
-      base::Bind(&MTPReadFileWorker::OnDidWriteDataChunkIntoSnapshotFile,
-                 weak_ptr_factory_.GetWeakPtr(),
-                 base::Passed(&snapshot_file_details)));
+      base::BindOnce(&WriteDataChunkIntoSnapshotFileOnFileThread,
+                     snapshot_file_details_ptr->snapshot_file_path(), data),
+      base::BindOnce(&MTPReadFileWorker::OnDidWriteDataChunkIntoSnapshotFile,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     base::Passed(&snapshot_file_details)));
 }
 
 void MTPReadFileWorker::OnDidWriteDataChunkIntoSnapshotFile(

diff --git a/chrome/browser/media_galleries/fileapi/supported_image_type_validator.cc b/chrome/browser/media_galleries/fileapi/supported_image_type_validator.cc
index a0945bf..574a45c 100644
--- a/chrome/browser/media_galleries/fileapi/supported_image_type_validator.cc
+++ b/chrome/browser/media_galleries/fileapi/supported_image_type_validator.cc

@@ -110,9 +110,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&ReadOnFileThread, path_),
-      base::Bind(&SupportedImageTypeValidator::OnFileOpen,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&ReadOnFileThread, path_),
+      base::BindOnce(&SupportedImageTypeValidator::OnFileOpen,
+                     weak_factory_.GetWeakPtr()));
 }
 
 SupportedImageTypeValidator::SupportedImageTypeValidator(

diff --git a/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc b/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc
index a0e9fa8f..6778620 100644
--- a/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc
+++ b/chrome/browser/media_galleries/win/mtp_device_delegate_impl_win.cc

@@ -322,11 +322,12 @@
   base::string16* storage_object_id = new base::string16;
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {content::BrowserThread::UI},
-      base::Bind(&GetStorageInfoOnUIThread, device_location,
-                 base::Unretained(pnp_device_id),
-                 base::Unretained(storage_object_id)),
-      base::Bind(&OnGetStorageInfoCreateDelegate, device_location, callback,
-                 base::Owned(pnp_device_id), base::Owned(storage_object_id)));
+      base::BindOnce(&GetStorageInfoOnUIThread, device_location,
+                     base::Unretained(pnp_device_id),
+                     base::Unretained(storage_object_id)),
+      base::BindOnce(&OnGetStorageInfoCreateDelegate, device_location, callback,
+                     base::Owned(pnp_device_id),
+                     base::Owned(storage_object_id)));
 }
 
 // MTPDeviceDelegateImplWin ---------------------------------------------------

diff --git a/chrome/browser/metrics/subprocess_metrics_provider.cc b/chrome/browser/metrics/subprocess_metrics_provider.cc
index 8d5cc384..56a52b9 100644
--- a/chrome/browser/metrics/subprocess_metrics_provider.cc
+++ b/chrome/browser/metrics/subprocess_metrics_provider.cc

@@ -122,11 +122,11 @@
   // thread so do the necessary dance.
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {content::BrowserThread::IO},
-      base::Bind(
+      base::BindOnce(
           &SubprocessMetricsProvider::GetSubprocessHistogramAllocatorOnIOThread,
           data.id),
-      base::Bind(&SubprocessMetricsProvider::RegisterSubprocessAllocator,
-                 weak_ptr_factory_.GetWeakPtr(), data.id));
+      base::BindOnce(&SubprocessMetricsProvider::RegisterSubprocessAllocator,
+                     weak_ptr_factory_.GetWeakPtr(), data.id));
 }
 
 void SubprocessMetricsProvider::BrowserChildProcessHostDisconnected(

diff --git a/chrome/browser/net/network_context_configuration_browsertest.cc b/chrome/browser/net/network_context_configuration_browsertest.cc
index e523393..e01da50 100644
--- a/chrome/browser/net/network_context_configuration_browsertest.cc
+++ b/chrome/browser/net/network_context_configuration_browsertest.cc

@@ -14,7 +14,6 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/guid.h"
 #include "base/location.h"
-#include "base/optional.h"
 #include "base/path_service.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_util.h"
@@ -60,7 +59,6 @@
 #include "content/public/test/simple_url_loader_test_helper.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
-#include "net/base/address_list.h"
 #include "net/base/filename_util.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/load_flags.h"
@@ -69,7 +67,6 @@
 #include "net/cookies/cookie_options.h"
 #include "net/cookies/cookie_util.h"
 #include "net/dns/mock_host_resolver.h"
-#include "net/dns/public/resolve_error_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/reporting/reporting_policy.h"
 #include "net/ssl/ssl_config.h"
@@ -88,11 +85,9 @@
 #include "services/network/public/cpp/network_connection_tracker.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
-#include "services/network/public/mojom/host_resolver.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
-#include "services/network/test/test_dns_util.h"
 #include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -109,9 +104,6 @@
 
 namespace {
 
-constexpr char kHostname[] = "foo.test";
-constexpr char kAddress[] = "5.8.13.21";
-
 const char kCacheRandomPath[] = "/cacherandom";
 
 // Path using a ControllableHttpResponse that's part of the test fixture.
@@ -244,8 +236,6 @@
     // Used in a bunch of proxy tests. Should not resolve.
     host_resolver()->AddSimulatedFailure("does.not.resolve.test");
 
-    host_resolver()->AddRule(kHostname, kAddress);
-
     controllable_http_response_ =
         std::make_unique<net::test_server::ControllableHttpResponse>(
             embedded_test_server(), kControllablePath);
@@ -1119,57 +1109,6 @@
   }
 }
 
-// Make sure that NetworkContexts have separate DNS caches.
-IN_PROC_BROWSER_TEST_P(NetworkContextConfigurationBrowserTest,
-                       DnsCacheIsolation) {
-  net::NetworkIsolationKey network_isolation_key =
-      net::NetworkIsolationKey::CreateTransient();
-  net::HostPortPair host_port_pair(kHostname, 0);
-
-  // Resolve |host_port_pair|, which should succeed and put it in the
-  // NetworkContext's cache.
-  network::DnsLookupResult result =
-      network::BlockingDnsLookup(network_context(), host_port_pair,
-                                 nullptr /* params */, network_isolation_key);
-  EXPECT_EQ(net::OK, result.error);
-  ASSERT_TRUE(result.resolved_addresses.has_value());
-  ASSERT_EQ(1u, result.resolved_addresses->size());
-  EXPECT_EQ(kAddress,
-            result.resolved_addresses.value()[0].ToStringWithoutPort());
-
-  // Do a cache-only lookup using the original network context, which should
-  // return the same result it initially did. This is done immediately after the
-  // lookup, as a race mitigation to minimize the chance of the cache entry
-  // expiring before this check.
-  network::mojom::ResolveHostParametersPtr params =
-      network::mojom::ResolveHostParameters::New();
-  // Cache only lookup.
-  params->source = net::HostResolverSource::LOCAL_ONLY;
-  result = network::BlockingDnsLookup(network_context(), host_port_pair,
-                                      std::move(params), network_isolation_key);
-  EXPECT_EQ(net::OK, result.error);
-  ASSERT_TRUE(result.resolved_addresses.has_value());
-  ASSERT_EQ(1u, result.resolved_addresses->size());
-  EXPECT_EQ(kAddress,
-            result.resolved_addresses.value()[0].ToStringWithoutPort());
-
-  // Make a cache-only request for the same hostname, for each other network
-  // context, and make sure no result is returned. It's possible for the entry
-  // to expire during this test run, so on regression, this step may flakily
-  // pass.
-  ForEachOtherContext(
-      base::BindLambdaForTesting([&](NetworkContextType network_context_type) {
-        network::mojom::ResolveHostParametersPtr params =
-            network::mojom::ResolveHostParameters::New();
-        // Cache only lookup.
-        params->source = net::HostResolverSource::LOCAL_ONLY;
-        network::DnsLookupResult result = network::BlockingDnsLookup(
-            GetNetworkContextForContextType(network_context_type),
-            host_port_pair, std::move(params), network_isolation_key);
-        EXPECT_EQ(net::ERR_DNS_CACHE_MISS, result.error);
-      }));
-}
-
 // Visits a URL with an HSTS header, and makes sure it is respected.
 IN_PROC_BROWSER_TEST_P(NetworkContextConfigurationBrowserTest, PRE_Hsts) {
   if (IsRestartStateWithInProcessNetworkService())

diff --git a/chrome/browser/offline_pages/android/offline_page_bridge.cc b/chrome/browser/offline_pages/android/offline_page_bridge.cc
index c871699..c3d0dcb7 100644
--- a/chrome/browser/offline_pages/android/offline_page_bridge.cc
+++ b/chrome/browser/offline_pages/android/offline_page_bridge.cc

@@ -779,9 +779,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&ArchiveValidator::GetSizeAndComputeDigest, file_path),
-      base::Bind(&OfflinePageBridge::GetSizeAndComputeDigestDone,
-                 weak_ptr_factory_.GetWeakPtr(), j_callback_ref, url));
+      base::BindOnce(&ArchiveValidator::GetSizeAndComputeDigest, file_path),
+      base::BindOnce(&OfflinePageBridge::GetSizeAndComputeDigestDone,
+                     weak_ptr_factory_.GetWeakPtr(), j_callback_ref, url));
 }
 
 jboolean OfflinePageBridge::IsShowingTrustedOfflinePage(
@@ -815,11 +815,11 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&ArchiveValidator::ValidateFile, offline_page->file_path,
-                 offline_page->file_size, offline_page->digest),
-      base::Bind(&ValidateFileCallback, launch_location, j_callback_obj,
-                 offline_page->offline_id, offline_page->url,
-                 offline_page->file_path));
+      base::BindOnce(&ArchiveValidator::ValidateFile, offline_page->file_path,
+                     offline_page->file_size, offline_page->digest),
+      base::BindOnce(&ValidateFileCallback, launch_location, j_callback_obj,
+                     offline_page->offline_id, offline_page->url,
+                     offline_page->file_path));
 }
 
 void OfflinePageBridge::GetSizeAndComputeDigestDone(

diff --git a/chrome/browser/permissions/permission_request_manager.cc b/chrome/browser/permissions/permission_request_manager.cc
index c94eb07..40806ba 100644
--- a/chrome/browser/permissions/permission_request_manager.cc
+++ b/chrome/browser/permissions/permission_request_manager.cc

@@ -426,8 +426,12 @@
 }
 
 void PermissionRequestManager::ShowBubble() {
+  // There is a race condition where the request might have been removed already
+  // so double-checking that there is a request in progress (crbug.com/1041222).
+  if (!IsRequestInProgress())
+    return;
+
   DCHECK(!view_);
-  DCHECK(IsRequestInProgress());
   DCHECK(web_contents()->IsDocumentOnLoadCompletedInMainFrame());
   DCHECK(current_request_ui_to_use_);
 

diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index fc5dc976..985c6f6 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -518,6 +518,9 @@
   { key::kVariationsRestrictParameter,
     variations::prefs::kVariationsRestrictParameter,
     base::Value::Type::STRING },
+  { key::kChromeVariations,
+    variations::prefs::kVariationsRestrictionsByPolicy,
+    base::Value::Type::INTEGER },
   { key::kForceEphemeralProfiles,
     prefs::kForceEphemeralProfiles,
     base::Value::Type::BOOLEAN },

diff --git a/chrome/browser/profiles/off_the_record_profile_impl.cc b/chrome/browser/profiles/off_the_record_profile_impl.cc
index acd5fb9..ac123ac 100644
--- a/chrome/browser/profiles/off_the_record_profile_impl.cc
+++ b/chrome/browser/profiles/off_the_record_profile_impl.cc

@@ -71,6 +71,7 @@
 #include "media/mojo/services/video_decode_perf_history.h"
 #include "net/http/transport_security_state.h"
 #include "ppapi/buildflags/buildflags.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "storage/browser/database/database_tracker.h"
 
 #if defined(OS_ANDROID)
@@ -189,6 +190,12 @@
   ChromePluginServiceFilter::GetInstance()->UnregisterProfile(this);
 #endif
 
+  // Clears any data the network stack contains that may be related to the
+  // OTR session. Must be done before DestroyBrowserContextServices, since
+  // the NetworkContext is managed by one such service.
+  GetDefaultStoragePartition(this)->GetNetworkContext()->ClearHostCache(
+      nullptr, network::mojom::NetworkContext::ClearHostCacheCallback());
+
   FullBrowserTransitionManager::Get()->OnProfileDestroyed(this);
 
   // The SimpleDependencyManager should always be passed after the

diff --git a/chrome/browser/renderer_host/pepper/pepper_flash_browser_host.cc b/chrome/browser/renderer_host/pepper/pepper_flash_browser_host.cc
index 6d40a6b..c1fdd9d 100644
--- a/chrome/browser/renderer_host/pepper/pepper_flash_browser_host.cc
+++ b/chrome/browser/renderer_host/pepper/pepper_flash_browser_host.cc

@@ -134,11 +134,11 @@
   } else {
     base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::UI},
-        base::Bind(&GetCookieSettings, render_process_id_),
-        base::Bind(&PepperFlashBrowserHost::GetLocalDataRestrictions,
-                   weak_factory_.GetWeakPtr(),
-                   context->MakeReplyMessageContext(), document_url,
-                   plugin_url));
+        base::BindOnce(&GetCookieSettings, render_process_id_),
+        base::BindOnce(&PepperFlashBrowserHost::GetLocalDataRestrictions,
+                       weak_factory_.GetWeakPtr(),
+                       context->MakeReplyMessageContext(), document_url,
+                       plugin_url));
   }
   return PP_OK_COMPLETIONPENDING;
 }

diff --git a/chrome/browser/resources/chromeos/crostini_installer/app.html b/chrome/browser/resources/chromeos/crostini_installer/app.html
index d55eddf..0b69f25 100644
--- a/chrome/browser/resources/chromeos/crostini_installer/app.html
+++ b/chrome/browser/resources/chromeos/crostini_installer/app.html

@@ -55,6 +55,17 @@
     justify-content: flex-end;
     margin: 32px 0;
   }
+
+  #labels {
+      display: flex;
+      flex-direction: row;
+      justify-content: space-between;
+  }
+  div.outer {
+      align-items: stretch;
+      display: flex;
+      flex-direction: column;
+  }
 </style>
 
 <div id="main">
@@ -70,6 +81,21 @@
       <span>$i18n{promptMessage} </span>
       <a href="$i18n{learnMoreUrl}" target="_blank">$i18n{learnMore}</a>
     </div>
+    <div id="configure-message" hidden="[[!isState_(state_, State.CONFIGURE)]]">
+      <div>$i18n{configureMessage}</div>
+      <div>$i18n{diskSizeMessage}</div>
+      <div class="outer">
+        <cr-slider id="diskSlider" pin="true"
+                   value="[[defaultDiskSizeTick_]]"
+                   area-describedby="configure-message"
+                   ticks="[[diskSizeTicks_]]">
+        </cr-slider>
+        <div id="labels">
+          <div id="label-begin">[[minDisk_]]</div>
+          <div id="label-end">[[maxDisk_]]</div>
+        </div>
+      </div>
+    </div>
     <div id="installing-message"
         hidden="[[!isState_(state_, State.INSTALLING)]]">
       <div>[[getProgressMessage_(installerState_)]]</div>
@@ -83,7 +109,6 @@
       <div>$i18n{cancelingMessage}</div>
       <paper-progress class="progress-bar" indeterminate></paper-progress>
     </div>
-
   </div>
   <img id="img-linux-illustration" src="images/linux_illustration.png" alt="">
   <div id="button-container">
@@ -91,9 +116,14 @@
         disabled="[[isState_(state_, State.CANCELING)]]">
       $i18n{cancel}
     </cr-button>
-    <cr-button class="action-button" on-click="onInstallButtonClick_"
+    <cr-button id="next" class="action-button" on-click="onNextButtonClick_"
         aria-describedby="title" aria-details="prompt-message"
-        hidden="[[!canInstall_(state_)]]">
+        hidden="[[!showNextButton_(state_)]]">
+      [[getNextButtonLabel_()]]
+    </cr-button>
+    <cr-button id="install" class="action-button"
+      on-click="onInstallButtonClick_" aria-describedby="title"
+      aria-details="prompt-message" hidden="[[!canInstall_(state_)]]">
       [[getInstallButtonLabel_(state_)]]
     </cr-button>
   </div>

diff --git a/chrome/browser/resources/chromeos/crostini_installer/app.js b/chrome/browser/resources/chromeos/crostini_installer/app.js
index 5725d041..fa9cd765 100644
--- a/chrome/browser/resources/chromeos/crostini_installer/app.js
+++ b/chrome/browser/resources/chromeos/crostini_installer/app.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 import 'chrome://resources/cr_elements/cr_button/cr_button.m.js';
+import 'chrome://resources/cr_elements/cr_slider/cr_slider.m.js';
 import 'chrome://resources/cr_elements/shared_vars_css.m.js';
 import 'chrome://resources/polymer/v3_0/paper-progress/paper-progress.js';
 import './strings.m.js';
@@ -20,6 +21,7 @@
  */
 const State = {
   PROMPT: 'prompt',
+  CONFIGURE: 'configure',
   INSTALLING: 'installing',
   ERROR: 'error',
   CANCELING: 'canceling',
@@ -34,7 +36,7 @@
   _template: html`{__html_template__}`,
 
   properties: {
-    /** @private */
+    /** @private {!State} */
     state_: {
       type: String,
       value: State.PROMPT,
@@ -63,6 +65,35 @@
       type: Object,
       value: State,
     },
+
+    /**
+     * @private
+     */
+    minDisk_: {
+      type: String,
+    },
+
+    /**
+     * @private
+     */
+    maxDisk_: {
+      type: String,
+    },
+
+    /**
+     * @private
+     */
+    defaultDiskSizeTick_: {
+      type: Number,
+    },
+
+    diskSizeTicks_: {
+      type: Array,
+    },
+
+    chosenDiskSize_: {
+      type: Number,
+    },
   },
 
   /** @override */
@@ -86,6 +117,21 @@
         }
       }),
       callbackRouter.onCanceled.addListener(() => this.closeDialog_()),
+      callbackRouter.onAmountOfFreeDiskSpace.addListener(
+          (ticks, defaultIndex, min, max) => {
+            if (ticks.length === 0) {
+              // Error getting the data we need for the slider e.g. unable to
+              // get the amount of free space.
+              // TODO(crbug/1043838): Handle this e.g. show an error to the
+              // user.
+            } else {
+              this.defaultDiskSizeTick_ = defaultIndex;
+              this.diskSizeTicks_ = ticks;
+
+              this.minDisk_ = ticks[0].label;
+              this.maxDisk_ = ticks[ticks.length - 1].label;
+            }
+          }),
     ];
 
     document.addEventListener('keyup', event => {
@@ -95,6 +141,7 @@
       }
     });
 
+    BrowserProxy.getInstance().handler.requestAmountOfFreeDiskSpace();
     this.$$('.action-button').focus();
   },
 
@@ -105,18 +152,29 @@
   },
 
   /** @private */
+  onNextButtonClick_() {
+    assert(this.state_ === State.PROMPT);
+    this.state_ = State.CONFIGURE;
+  },
+
+  /** @private */
   onInstallButtonClick_() {
-    assert(this.state_ === State.PROMPT || this.state_ === State.ERROR);
+    assert(this.canInstall_(this.state_));
+    var diskSize = 0;
+    if (loadTimeData.getBoolean('diskResizingEnabled')) {
+      diskSize = this.diskSizeTicks_[this.$.diskSlider.value].value;
+    }
     this.installerState_ = InstallerState.kStart;
     this.installerProgress_ = 0;
     this.state_ = State.INSTALLING;
-    BrowserProxy.getInstance().handler.install();
+    BrowserProxy.getInstance().handler.install(diskSize);
   },
 
   /** @private */
   onCancelButtonClick_() {
     switch (this.state_) {
       case State.PROMPT:
+      case State.CONFIGURE:
         BrowserProxy.getInstance().handler.cancelBeforeStart();
         this.closeDialog_();
         break;
@@ -150,6 +208,7 @@
     let titleId;
     switch (state) {
       case State.PROMPT:
+      case State.CONFIGURE:
         titleId = 'promptTitle';
         break;
       case State.INSTALLING:
@@ -183,7 +242,29 @@
    * @private
    */
   canInstall_(state) {
-    return state === State.PROMPT || state === State.ERROR;
+    if (loadTimeData.getBoolean('diskResizingEnabled')) {
+      return state === State.CONFIGURE || state === State.ERROR;
+    } else {
+      return state === State.PROMPT || state === State.ERROR;
+    }
+  },
+
+  /**
+   * @param {State} state
+   * @returns {boolean}
+   * @private
+   */
+  showNextButton_(state) {
+    return loadTimeData.getBoolean('diskResizingEnabled') &&
+        state === State.PROMPT;
+  },
+
+  /**
+   * @returns {string}
+   * @private
+   */
+  getNextButtonLabel_() {
+    return loadTimeData.getString('next');
   },
 
   /**
@@ -192,13 +273,20 @@
    * @private
    */
   getInstallButtonLabel_(state) {
+    if (!loadTimeData.getBoolean('diskResizingEnabled') &&
+        state === State.PROMPT) {
+      // TODO(dmunro): Remove all the flag checks once we're rolled out and no
+      // longer need them.
+      return loadTimeData.getString('install');
+    }
     switch (state) {
-      case State.PROMPT:
+      case State.CONFIGURE:
         return loadTimeData.getString('install');
       case State.ERROR:
         return loadTimeData.getString('retry');
+      default:
+        return '';
     }
-    return '';
   },
 
   /**

diff --git a/chrome/browser/sharing/sharing_message_bridge.h b/chrome/browser/sharing/sharing_message_bridge.h
new file mode 100644
index 0000000..c8f6b6030
--- /dev/null
+++ b/chrome/browser/sharing/sharing_message_bridge.h

@@ -0,0 +1,23 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_H_
+#define CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_H_
+
+#include <memory>
+
+#include "components/sync/protocol/sharing_message_specifics.pb.h"
+
+// Class to provide an interface to send sharing messages using Sync.
+class SharingMessageBridge {
+ public:
+  // TODO(crbug.com/1034930): take callbacks once commit error propagation back
+  // to the bridge is implemented.
+  virtual void SendSharingMessage(
+      std::unique_ptr<sync_pb::SharingMessageSpecifics> specifics) = 0;
+
+  virtual ~SharingMessageBridge() = default;
+};
+
+#endif  // CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_H_

diff --git a/chrome/browser/sharing/sharing_message_bridge_impl.cc b/chrome/browser/sharing/sharing_message_bridge_impl.cc
new file mode 100644
index 0000000..b9cb0371
--- /dev/null
+++ b/chrome/browser/sharing/sharing_message_bridge_impl.cc

@@ -0,0 +1,101 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/sharing/sharing_message_bridge_impl.h"
+
+#include "components/sync/model/metadata_batch.h"
+#include "components/sync/model/mutable_data_batch.h"
+#include "components/sync/model_impl/in_memory_metadata_change_list.h"
+
+namespace {
+
+std::unique_ptr<syncer::EntityData> MoveToEntityData(
+    std::unique_ptr<sync_pb::SharingMessageSpecifics> specifics) {
+  auto entity_data = std::make_unique<syncer::EntityData>();
+  entity_data->specifics.set_allocated_sharing_message(specifics.release());
+  return entity_data;
+}
+
+}  // namespace
+
+SharingMessageBridgeImpl::SharingMessageBridgeImpl(
+    std::unique_ptr<syncer::ModelTypeChangeProcessor> change_processor)
+    : ModelTypeSyncBridge(std::move(change_processor)) {
+  // Current data type doesn't have persistent storage so it's ready to sync
+  // immediately.
+  this->change_processor()->ModelReadyToSync(
+      std::make_unique<syncer::MetadataBatch>());
+}
+
+SharingMessageBridgeImpl::~SharingMessageBridgeImpl() = default;
+
+void SharingMessageBridgeImpl::SendSharingMessage(
+    std::unique_ptr<sync_pb::SharingMessageSpecifics> specifics) {
+  std::unique_ptr<syncer::MetadataChangeList> metadata_change_list =
+      CreateMetadataChangeList();
+  std::unique_ptr<syncer::EntityData> entity_data =
+      MoveToEntityData(std::move(specifics));
+  const std::string empty_storage_key;
+  change_processor()->Put(empty_storage_key, std::move(entity_data),
+                          metadata_change_list.get());
+}
+
+std::unique_ptr<syncer::MetadataChangeList>
+SharingMessageBridgeImpl::CreateMetadataChangeList() {
+  // The data type intentionally doesn't persist the data on disk, so metadata
+  // is just ignored.
+  // TODO(crbug.com/1034930): this metadata changelist stores data in memory, it
+  // would be better to create DummyMetadataChangeList to ignore any changes at
+  // all.
+  return std::make_unique<syncer::InMemoryMetadataChangeList>();
+}
+
+base::Optional<syncer::ModelError> SharingMessageBridgeImpl::MergeSyncData(
+    std::unique_ptr<syncer::MetadataChangeList> metadata_change_list,
+    syncer::EntityChangeList entity_data) {
+  DCHECK(entity_data.empty());
+  DCHECK(change_processor()->IsTrackingMetadata());
+  return ApplySyncChanges(std::move(metadata_change_list),
+                          std::move(entity_data));
+}
+
+base::Optional<syncer::ModelError> SharingMessageBridgeImpl::ApplySyncChanges(
+    std::unique_ptr<syncer::MetadataChangeList> metadata_change_list,
+    syncer::EntityChangeList entity_data) {
+  // This data type is commit only and does not store any data in persistent
+  // storage. We can ignore any data coming from the server.
+  return {};
+}
+
+void SharingMessageBridgeImpl::GetData(StorageKeyList storage_keys,
+                                       DataCallback callback) {
+  return GetAllDataForDebugging(std::move(callback));
+}
+
+void SharingMessageBridgeImpl::GetAllDataForDebugging(DataCallback callback) {
+  // This data type does not store any data, we can always run the callback
+  // with empty data.
+  std::move(callback).Run(std::make_unique<syncer::MutableDataBatch>());
+}
+
+std::string SharingMessageBridgeImpl::GetClientTag(
+    const syncer::EntityData& entity_data) {
+  return GetStorageKey(entity_data);
+}
+
+std::string SharingMessageBridgeImpl::GetStorageKey(
+    const syncer::EntityData& entity_data) {
+  NOTREACHED();
+  return "";
+}
+
+// This is commit-only data type without storing any data on persistent storage.
+// We do not need keys here.
+bool SharingMessageBridgeImpl::SupportsGetClientTag() const {
+  return false;
+}
+
+bool SharingMessageBridgeImpl::SupportsGetStorageKey() const {
+  return false;
+}

diff --git a/chrome/browser/sharing/sharing_message_bridge_impl.h b/chrome/browser/sharing/sharing_message_bridge_impl.h
new file mode 100644
index 0000000..2ee91a9
--- /dev/null
+++ b/chrome/browser/sharing/sharing_message_bridge_impl.h

@@ -0,0 +1,47 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_IMPL_H_
+#define CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_IMPL_H_
+
+#include <memory>
+
+#include "chrome/browser/sharing/sharing_message_bridge.h"
+#include "components/sync/model/model_type_change_processor.h"
+#include "components/sync/model/model_type_sync_bridge.h"
+
+// Class that implements sending sharing messages using Sync. This class
+// implements interaction with sync service. Sharing message data type is not
+// stored in any persistent storage.
+class SharingMessageBridgeImpl : public SharingMessageBridge,
+                                 public syncer::ModelTypeSyncBridge {
+ public:
+  explicit SharingMessageBridgeImpl(
+      std::unique_ptr<syncer::ModelTypeChangeProcessor> change_processor);
+  ~SharingMessageBridgeImpl() override;
+  SharingMessageBridgeImpl(const SharingMessageBridgeImpl&) = delete;
+  SharingMessageBridgeImpl& operator=(const SharingMessageBridgeImpl&) = delete;
+
+  // SharingMessageBridge implementation.
+  void SendSharingMessage(
+      std::unique_ptr<sync_pb::SharingMessageSpecifics> specifics) override;
+
+  // ModelTypeSyncBridge implementation.
+  std::unique_ptr<syncer::MetadataChangeList> CreateMetadataChangeList()
+      override;
+  base::Optional<syncer::ModelError> MergeSyncData(
+      std::unique_ptr<syncer::MetadataChangeList> metadata_change_list,
+      syncer::EntityChangeList entity_data) override;
+  base::Optional<syncer::ModelError> ApplySyncChanges(
+      std::unique_ptr<syncer::MetadataChangeList> metadata_change_list,
+      syncer::EntityChangeList entity_changes) override;
+  void GetData(StorageKeyList storage_keys, DataCallback callback) override;
+  void GetAllDataForDebugging(DataCallback callback) override;
+  std::string GetClientTag(const syncer::EntityData& entity_data) override;
+  std::string GetStorageKey(const syncer::EntityData& entity_data) override;
+  bool SupportsGetClientTag() const override;
+  bool SupportsGetStorageKey() const override;
+};
+
+#endif  // CHROME_BROWSER_SHARING_SHARING_MESSAGE_BRIDGE_IMPL_H_

diff --git a/chrome/browser/sharing/sharing_message_bridge_impl_unittest.cc b/chrome/browser/sharing/sharing_message_bridge_impl_unittest.cc
new file mode 100644
index 0000000..d1bacc2
--- /dev/null
+++ b/chrome/browser/sharing/sharing_message_bridge_impl_unittest.cc

@@ -0,0 +1,81 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/sharing/sharing_message_bridge_impl.h"
+
+#include "base/run_loop.h"
+#include "base/test/task_environment.h"
+#include "components/sync/model/metadata_batch.h"
+#include "components/sync/model/mock_model_type_change_processor.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+using testing::_;
+using testing::InvokeWithoutArgs;
+using testing::NotNull;
+using testing::Return;
+using testing::SaveArg;
+
+// Action SaveArgPointeeMove<k>(pointer) saves the value pointed to by the k-th
+// (0-based) argument of the mock function by moving it to *pointer.
+ACTION_TEMPLATE(SaveArgPointeeMove,
+                HAS_1_TEMPLATE_PARAMS(int, k),
+                AND_1_VALUE_PARAMS(pointer)) {
+  *pointer = std::move(*testing::get<k>(args));
+}
+
+class SharingMessageBridgeTest : public testing::Test {
+ protected:
+  SharingMessageBridgeTest() {
+    EXPECT_CALL(*processor(), ModelReadyToSync(NotNull()));
+    bridge_ = std::make_unique<SharingMessageBridgeImpl>(
+        mock_processor_.CreateForwardingProcessor());
+    ON_CALL(*processor(), IsTrackingMetadata()).WillByDefault(Return(true));
+  }
+
+  SharingMessageBridgeImpl* bridge() { return bridge_.get(); }
+  syncer::MockModelTypeChangeProcessor* processor() { return &mock_processor_; }
+
+  std::unique_ptr<sync_pb::SharingMessageSpecifics> CreateSpecifics(
+      const std::string& payload) const {
+    auto specifics = std::make_unique<sync_pb::SharingMessageSpecifics>();
+    specifics->set_payload(payload);
+    return specifics;
+  }
+
+ private:
+  base::test::TaskEnvironment task_environment_;
+  testing::NiceMock<syncer::MockModelTypeChangeProcessor> mock_processor_;
+  std::unique_ptr<SharingMessageBridgeImpl> bridge_;
+};
+
+TEST_F(SharingMessageBridgeTest, ShouldWriteMessagesToProcessor) {
+  syncer::EntityData entity_data;
+  EXPECT_CALL(*processor(), Put(_, _, _))
+      .WillRepeatedly(SaveArgPointeeMove<1>(&entity_data));
+  bridge()->SendSharingMessage(CreateSpecifics("test_payload"));
+
+  EXPECT_TRUE(entity_data.specifics.has_sharing_message());
+  EXPECT_EQ(entity_data.specifics.sharing_message().payload(), "test_payload");
+
+  entity_data.specifics.Clear();
+  bridge()->SendSharingMessage(CreateSpecifics("another_payload"));
+
+  EXPECT_TRUE(entity_data.specifics.has_sharing_message());
+  EXPECT_EQ(entity_data.specifics.sharing_message().payload(),
+            "another_payload");
+}
+
+TEST_F(SharingMessageBridgeTest, ShouldNotGenerateStorageKey) {
+  std::string storage_key;
+  EXPECT_CALL(*processor(), Put(_, _, _)).WillOnce(SaveArg<0>(&storage_key));
+  bridge()->SendSharingMessage(
+      std::make_unique<sync_pb::SharingMessageSpecifics>());
+
+  EXPECT_TRUE(storage_key.empty());
+}
+
+}  // namespace

diff --git a/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc b/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc
index c5b7946..55070ed8 100644
--- a/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc
+++ b/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc

@@ -628,14 +628,7 @@
 
 // If the server sends the same cards and addresses again, they should not
 // change on the client. We should also not overwrite existing metadata.
-// Flaky on ASan/TSan only. http://crbug.com/997912
-#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
-#define MAYBE_SameUpdatesAreIgnored DISABLED_SameUpdatesAreIgnored
-#else
-#define MAYBE_SameUpdatesAreIgnored SameUpdatesAreIgnored
-#endif
-IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       MAYBE_SameUpdatesAreIgnored) {
+IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest, SameUpdatesAreIgnored) {
   GetFakeServer()->SetWalletData(
       {CreateSyncWalletCard(/*name=*/"card-1", /*last_four=*/"0001",
                             kDefaultBillingAddressID),
@@ -692,14 +685,7 @@
 
 // If the server sends the same cards and addresses with changed data, they
 // should change on the client.
-// Flaky on Mac/Linux/ChromeOS only. http://crbug.com/997825
-#if defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
-#define MAYBE_ChangedEntityGetsUpdated DISABLED_ChangedEntityGetsUpdated
-#else
-#define MAYBE_ChangedEntityGetsUpdated ChangedEntityGetsUpdated
-#endif
-IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       MAYBE_ChangedEntityGetsUpdated) {
+IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest, ChangedEntityGetsUpdated) {
   GetFakeServer()->SetWalletData(
       {CreateSyncWalletCard(/*name=*/"card-1", /*last_four=*/"0002",
                             kDefaultBillingAddressID),
@@ -802,9 +788,7 @@
 
 // Wallet data should get cleared from the database when the wallet sync type
 // flag is disabled.
-// Test is flaky: https://crbug.com/997786
-IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       DISABLED_ClearOnDisableWalletSync) {
+IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest, ClearOnDisableWalletSync) {
   GetFakeServer()->SetWalletData({CreateDefaultSyncWalletAddress(),
                                   CreateDefaultSyncWalletCard(),
                                   CreateDefaultSyncPaymentsCustomerData(),
@@ -876,16 +860,8 @@
 
 // Wallet data present on the client should be cleared in favor of the new data
 // synced down form the server.
-// Flaky (mostly) on ASan/TSan. http://crbug.com/998130
-#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
-#define MAYBE_NewWalletCardRemovesExistingCardAndProfile \
-  DISABLED_NewWalletCardRemovesExistingCardAndProfile
-#else
-#define MAYBE_NewWalletCardRemovesExistingCardAndProfile \
-  NewWalletCardRemovesExistingCardAndProfile
-#endif
 IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       MAYBE_NewWalletCardRemovesExistingCardAndProfile) {
+                       NewWalletCardRemovesExistingCardAndProfile) {
   ASSERT_TRUE(SetupSync());
   autofill::PersonalDataManager* pdm = GetPersonalDataManager(0);
   ASSERT_NE(nullptr, pdm);
@@ -961,15 +937,8 @@
 
 // Wallet data present on the client should be cleared in favor of the new data
 // synced down form the server.
-// Flaky (mostly) on ASan/TSan. http://crbug.com/998130
-#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
-#define MAYBE_NewWalletDataRemovesExistingData \
-  DISABLED_NewWalletDataRemovesExistingData
-#else
-#define MAYBE_NewWalletDataRemovesExistingData NewWalletDataRemovesExistingData
-#endif
 IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       MAYBE_NewWalletDataRemovesExistingData) {
+                       NewWalletDataRemovesExistingData) {
   ASSERT_TRUE(SetupSync());
   autofill::PersonalDataManager* pdm = GetPersonalDataManager(0);
   ASSERT_NE(nullptr, pdm);
@@ -1085,16 +1054,8 @@
 
 // Tests that a server billing address id set on a card on the client is
 // overwritten when that same card is synced again.
-// Flaky (mostly) on ASan/TSan. http://crbug.com/998130
-#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
-#define MAYBE_SameWalletCard_DiscardsOldServerBillingAddressId \
-  DISABLED_SameWalletCard_DiscardsOldServerBillingAddressId
-#else
-#define MAYBE_SameWalletCard_DiscardsOldServerBillingAddressId \
-  SameWalletCard_DiscardsOldServerBillingAddressId
-#endif
 IN_PROC_BROWSER_TEST_F(SingleClientWalletSyncTest,
-                       MAYBE_SameWalletCard_DiscardsOldServerBillingAddressId) {
+                       SameWalletCard_DiscardsOldServerBillingAddressId) {
   ASSERT_TRUE(SetupSync());
   autofill::PersonalDataManager* pdm = GetPersonalDataManager(0);
   ASSERT_NE(nullptr, pdm);

diff --git a/chrome/browser/task_manager/providers/child_process_task_provider.cc b/chrome/browser/task_manager/providers/child_process_task_provider.cc
index 3759d45b..5b61df0e 100644
--- a/chrome/browser/task_manager/providers/child_process_task_provider.cc
+++ b/chrome/browser/task_manager/providers/child_process_task_provider.cc

@@ -82,9 +82,9 @@
 
   // First, get the pre-existing child processes data.
   base::PostTaskAndReplyWithResult(
-      FROM_HERE, {BrowserThread::IO}, base::Bind(&CollectChildProcessData),
-      base::Bind(&ChildProcessTaskProvider::ChildProcessDataCollected,
-                 weak_ptr_factory_.GetWeakPtr()));
+      FROM_HERE, {BrowserThread::IO}, base::BindOnce(&CollectChildProcessData),
+      base::BindOnce(&ChildProcessTaskProvider::ChildProcessDataCollected,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void ChildProcessTaskProvider::StopUpdating() {

diff --git a/chrome/browser/task_manager/sampling/task_group.cc b/chrome/browser/task_manager/sampling/task_group.cc
index d7ccb60d..3d2a4b5 100644
--- a/chrome/browser/task_manager/sampling/task_group.cc
+++ b/chrome/browser/task_manager/sampling/task_group.cc

@@ -287,9 +287,9 @@
 void TaskGroup::RefreshNaClDebugStubPort(int child_process_unique_id) {
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {content::BrowserThread::IO},
-      base::Bind(&GetNaClDebugStubPortOnIoThread, child_process_unique_id),
-      base::Bind(&TaskGroup::OnRefreshNaClDebugStubPortDone,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&GetNaClDebugStubPortOnIoThread, child_process_unique_id),
+      base::BindOnce(&TaskGroup::OnRefreshNaClDebugStubPortDone,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void TaskGroup::OnRefreshNaClDebugStubPortDone(int nacl_debug_stub_port) {

diff --git a/chrome/browser/ui/views/location_bar/custom_tab_bar_view.cc b/chrome/browser/ui/views/location_bar/custom_tab_bar_view.cc
index 9585f43..b8a3467 100644
--- a/chrome/browser/ui/views/location_bar/custom_tab_bar_view.cc
+++ b/chrome/browser/ui/views/location_bar/custom_tab_bar_view.cc

@@ -83,10 +83,9 @@
  public:
   CustomTabBarTitleOriginView() {
     auto title_label = std::make_unique<views::Label>(
-        base::string16(), CONTEXT_BODY_TEXT_LARGE,
-        views::style::TextStyle::STYLE_PRIMARY);
+        base::string16(), views::style::CONTEXT_LABEL);
     auto location_label = std::make_unique<views::Label>(
-        base::string16(), CONTEXT_BODY_TEXT_SMALL,
+        base::string16(), views::style::CONTEXT_LABEL,
         views::style::STYLE_SECONDARY,
         gfx::DirectionalityMode::DIRECTIONALITY_AS_URL);
 

diff --git a/chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.cc b/chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.cc
index 673550d..c6e886f3 100644
--- a/chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.cc
+++ b/chrome/browser/ui/views/tabs/tab_drag_controller_interactive_uitest.cc

@@ -2312,6 +2312,7 @@
   EXPECT_FALSE(browser2->window()->IsMaximized());
 }
 
+#if !defined(OS_MACOSX)
 namespace {
 
 // Invoked from the nested run loop.
@@ -2361,6 +2362,7 @@
     EXPECT_FALSE(browser->window()->IsMaximized());
   }
 }
+#endif
 
 namespace {
 

diff --git a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer.mojom b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer.mojom
index d67ac5ac..84c173a 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer.mojom
+++ b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer.mojom

@@ -17,8 +17,8 @@
 // Lives in the browser process. A renderer use this to control Crostini
 // installation.
 interface PageHandler {
-  // Start installation
-  Install();
+  // Start installation, |disk_size| is in bytes.
+  Install(int64 disk_size);
   // Cancel an on-going installation
   Cancel();
   // If a user cancels the installation without starting it at all, this should
@@ -28,6 +28,9 @@
   // chrome.send('dialogClose') should not be used, which could kill the page
   // handler before previous mojom calls have been run.
   Close();
+  // Fetches the amount of free disk space, the result is sent via
+  // OnAmountOfFreeDiskSpace.
+  RequestAmountOfFreeDiskSpace();
 };
 
 // Lives in the renderer process. The browser uses this to sends installation
@@ -43,4 +46,7 @@
   // After user cancels the installation, this is called when the cancellation
   // finishes.
   OnCanceled();
+  // Used to tell the UI how much disk space is available.
+  OnAmountOfFreeDiskSpace(array<crostini.mojom.DiskSliderTick> ticks,
+                          int8 default_index);
 };

diff --git a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.cc b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.cc
index 6e78fc6..7ff2d89 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.cc

@@ -4,11 +4,27 @@
 
 #include "chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.h"
 
+#include <algorithm>
 #include <utility>
+#include <vector>
 
 #include "base/bind.h"
 #include "base/optional.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/system/sys_info.h"
+#include "base/task/post_task.h"
+#include "base/task/task_traits.h"
+#include "chrome/browser/chromeos/crostini/crostini_installer_types.mojom.h"
 #include "chrome/browser/chromeos/crostini/crostini_installer_ui_delegate.h"
+#include "chrome/browser/chromeos/crostini/crostini_util.h"
+#include "chromeos/constants/chromeos_features.h"
+#include "ui/base/text/bytes_formatting.h"
+
+namespace {
+std::string FormatBytes(const int64_t value) {
+  return base::UTF16ToUTF8(ui::FormatBytes(value));
+}
+}  // namespace
 
 namespace chromeos {
 
@@ -25,11 +41,15 @@
 
 CrostiniInstallerPageHandler::~CrostiniInstallerPageHandler() = default;
 
-void CrostiniInstallerPageHandler::Install() {
+void CrostiniInstallerPageHandler::Install(int64_t disk_size) {
   // TODO(crbug.com/1016195): Web page should allow input container username,
   // and here we will pass that to Install().
+  crostini::CrostiniManager::RestartOptions options{};
+  if (base::FeatureList::IsEnabled(chromeos::features::kCrostiniDiskResizing)) {
+    options.disk_size = disk_size;
+  }
   installer_ui_delegate_->Install(
-      crostini::CrostiniManager::RestartOptions{},
+      std::move(options),
       base::BindRepeating(&CrostiniInstallerPageHandler::OnProgressUpdate,
                           weak_ptr_factory_.GetWeakPtr()),
       base::BindOnce(&CrostiniInstallerPageHandler::OnInstallFinished,
@@ -65,4 +85,27 @@
   page_->OnCanceled();
 }
 
+void CrostiniInstallerPageHandler::RequestAmountOfFreeDiskSpace() {
+  base::PostTaskAndReplyWithResult(
+      FROM_HERE, {base::ThreadPool(), base::MayBlock()},
+      base::BindOnce(&base::SysInfo::AmountOfFreeDiskSpace,
+                     base::FilePath(crostini::kHomeDirectory)),
+      base::BindOnce(&CrostiniInstallerPageHandler::OnAmountOfFreeDiskSpace,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
+
+void CrostiniInstallerPageHandler::OnAmountOfFreeDiskSpace(int64_t free_bytes) {
+  std::vector<int64_t> values = crostini::GetTicksForDiskSize(
+      crostini::CrostiniInstallerUIDelegate::kMinimumFreeDiskSpace, free_bytes);
+
+  std::vector<crostini::mojom::DiskSliderTickPtr> ticks;
+  for (const auto& val : values) {
+    std::string formatted_val = FormatBytes(val);
+    ticks.emplace_back(crostini::mojom::DiskSliderTick::New(val, formatted_val,
+                                                            formatted_val));
+  }
+  // TODO(crbug/1043837): Pick a better default than always the minimum.
+  page_->OnAmountOfFreeDiskSpace(std::move(ticks), 0);
+}
+
 }  // namespace chromeos

diff --git a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.h b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.h
index 9060a950..e66adce0 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.h
+++ b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_page_handler.h

@@ -34,16 +34,18 @@
   ~CrostiniInstallerPageHandler() override;
 
   // chromeos::crostini_installer::mojom::PageHandler:
-  void Install() override;
+  void Install(int64_t disk_size) override;
   void Cancel() override;
   void CancelBeforeStart() override;
   void Close() override;
+  void RequestAmountOfFreeDiskSpace() override;
 
  private:
   void OnProgressUpdate(crostini::mojom::InstallerState installer_state,
                         double progress_fraction);
   void OnInstallFinished(crostini::mojom::InstallerError error);
   void OnCanceled();
+  void OnAmountOfFreeDiskSpace(int64_t free_bytes);
 
   crostini::CrostiniInstallerUIDelegate* installer_ui_delegate_;
   mojo::Receiver<chromeos::crostini_installer::mojom::PageHandler> receiver_;

diff --git a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_ui.cc b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_ui.cc
index 80c5729c..42bed82 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_ui.cc
+++ b/chrome/browser/ui/webui/chromeos/crostini_installer/crostini_installer_ui.cc

@@ -33,6 +33,7 @@
 namespace {
 void AddStringResources(content::WebUIDataSource* source) {
   static constexpr webui::LocalizedString kStrings[] = {
+      {"next", IDS_CROSTINI_INSTALLER_NEXT_BUTTON},
       {"install", IDS_CROSTINI_INSTALLER_INSTALL_BUTTON},
       {"retry", IDS_CROSTINI_INSTALLER_RETRY_BUTTON},
       {"close", IDS_APP_CLOSE},
@@ -68,6 +69,9 @@
       {"fetchSshKeysMessage", IDS_CROSTINI_INSTALLER_FETCH_SSH_KEYS_MESSAGE},
       {"mountContainerMessage", IDS_CROSTINI_INSTALLER_MOUNT_CONTAINER_MESSAGE},
       {"cancelingMessage", IDS_CROSTINI_INSTALLER_CANCELING},
+
+      {"configureMessage", IDS_CROSTINI_INSTALLER_CONFIGURE_MESSAGE},
+      {"diskSizeMessage", IDS_CROSTINI_INSTALLER_DISK_SIZE_MESSAGE},
   };
   AddLocalizedStringsBulk(source, kStrings);
 
@@ -110,6 +114,9 @@
   source->OverrideContentSecurityPolicyScriptSrc(
       "script-src chrome://resources chrome://test 'self';");
   AddStringResources(source);
+  source->AddBoolean(
+      "diskResizingEnabled",
+      base::FeatureList::IsEnabled(chromeos::features::kCrostiniDiskResizing));
 
   source->AddResourcePath("app.js", IDR_CROSTINI_INSTALLER_APP_JS);
   source->AddResourcePath("browser_proxy.js",

diff --git a/chrome/browser/ui/webui/chromeos/cryptohome_web_ui_handler.cc b/chrome/browser/ui/webui/chromeos/cryptohome_web_ui_handler.cc
index 52894b68..0611cef 100644
--- a/chrome/browser/ui/webui/chromeos/cryptohome_web_ui_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/cryptohome_web_ui_handler.cc

@@ -42,9 +42,9 @@
 
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
-      base::Bind(&crypto::IsTPMTokenReady, base::Closure()),
-      base::Bind(&CryptohomeWebUIHandler::DidGetNSSUtilInfoOnUIThread,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&crypto::IsTPMTokenReady, base::Closure()),
+      base::BindOnce(&CryptohomeWebUIHandler::DidGetNSSUtilInfoOnUIThread,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void CryptohomeWebUIHandler::DidGetNSSUtilInfoOnUIThread(

diff --git a/chrome/browser/ui/webui/chromeos/login/encryption_migration_screen_handler.cc b/chrome/browser/ui/webui/chromeos/login/encryption_migration_screen_handler.cc
index b375ec4..4e4ef11 100644
--- a/chrome/browser/ui/webui/chromeos/login/encryption_migration_screen_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/encryption_migration_screen_handler.cc

@@ -521,9 +521,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      free_disk_space_fetcher_,
-      base::Bind(&EncryptionMigrationScreenHandler::OnGetAvailableStorage,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(free_disk_space_fetcher_),
+      base::BindOnce(&EncryptionMigrationScreenHandler::OnGetAvailableStorage,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void EncryptionMigrationScreenHandler::OnGetAvailableStorage(int64_t size) {

diff --git a/chrome/browser/ui/webui/help/version_updater_win.cc b/chrome/browser/ui/webui/help/version_updater_win.cc
index 6467d6e1..a89a258 100644
--- a/chrome/browser/ui/webui/help/version_updater_win.cc
+++ b/chrome/browser/ui/webui/help/version_updater_win.cc

@@ -44,9 +44,9 @@
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(),
          base::TaskPriority::USER_VISIBLE},
-        base::Bind(&upgrade_util::IsUpdatePendingRestart),
-        base::Bind(&VersionUpdaterWin::OnPendingRestartCheck,
-                   weak_factory_.GetWeakPtr()));
+        base::BindOnce(&upgrade_util::IsUpdatePendingRestart),
+        base::BindOnce(&VersionUpdaterWin::OnPendingRestartCheck,
+                       weak_factory_.GetWeakPtr()));
     // Early exit since callback_ will be Run in OnPendingRestartCheck.
     return;
   }

diff --git a/chrome/browser/ui/webui/nacl_ui.cc b/chrome/browser/ui/webui/nacl_ui.cc
index dc610e2..3c1cbb8 100644
--- a/chrome/browser/ui/webui/nacl_ui.cc
+++ b/chrome/browser/ui/webui/nacl_ui.cc

@@ -374,10 +374,10 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        base::Bind(&CheckPathAndVersion, version_string),
-        base::Bind(&NaClDomHandler::DidCheckPathAndVersion,
-                   weak_ptr_factory_.GetWeakPtr(),
-                   base::Owned(version_string)));
+        base::BindOnce(&CheckPathAndVersion, version_string),
+        base::BindOnce(&NaClDomHandler::DidCheckPathAndVersion,
+                       weak_ptr_factory_.GetWeakPtr(),
+                       base::Owned(version_string)));
     return;
   }
 

diff --git a/chrome/browser/ui/webui/sandbox/sandbox_handler.cc b/chrome/browser/ui/webui/sandbox/sandbox_handler.cc
index e8190bec..02072a0 100644
--- a/chrome/browser/ui/webui/sandbox/sandbox_handler.cc
+++ b/chrome/browser/ui/webui/sandbox/sandbox_handler.cc

@@ -132,9 +132,9 @@
 
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {content::BrowserThread::IO},
-      base::Bind(&FetchBrowserChildProcesses),
-      base::Bind(&SandboxHandler::FetchBrowserChildProcessesCompleted,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&FetchBrowserChildProcesses),
+      base::BindOnce(&SandboxHandler::FetchBrowserChildProcessesCompleted,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void SandboxHandler::FetchBrowserChildProcessesCompleted(

diff --git a/chrome/browser/ui/webui/settings/about_handler.cc b/chrome/browser/ui/webui/settings/about_handler.cc
index 3fe0e47..ebe6fb28 100644
--- a/chrome/browser/ui/webui/settings/about_handler.cc
+++ b/chrome/browser/ui/webui/settings/about_handler.cc

@@ -603,9 +603,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&GetVersionInfo),
-      base::Bind(&AboutHandler::OnGetVersionInfoReady,
-                 weak_factory_.GetWeakPtr(), callback_id));
+      base::BindOnce(&GetVersionInfo),
+      base::BindOnce(&AboutHandler::OnGetVersionInfoReady,
+                     weak_factory_.GetWeakPtr(), callback_id));
 }
 
 void AboutHandler::OnGetVersionInfoReady(
@@ -622,9 +622,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&FindRegulatoryLabelDir),
-      base::Bind(&AboutHandler::OnRegulatoryLabelDirFound,
-                 weak_factory_.GetWeakPtr(), callback_id));
+      base::BindOnce(&FindRegulatoryLabelDir),
+      base::BindOnce(&AboutHandler::OnRegulatoryLabelDirFound,
+                     weak_factory_.GetWeakPtr(), callback_id));
 }
 
 void AboutHandler::HandleGetChannelInfo(const base::ListValue* args) {
@@ -811,9 +811,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-      base::Bind(&ReadRegulatoryLabelText, label_dir_path),
-      base::Bind(&AboutHandler::OnRegulatoryLabelTextRead,
-                 weak_factory_.GetWeakPtr(), callback_id, label_dir_path));
+      base::BindOnce(&ReadRegulatoryLabelText, label_dir_path),
+      base::BindOnce(&AboutHandler::OnRegulatoryLabelTextRead,
+                     weak_factory_.GetWeakPtr(), callback_id, label_dir_path));
 }
 
 void AboutHandler::OnRegulatoryLabelTextRead(

diff --git a/chrome/browser/ui/webui/settings/chromeos/device_storage_handler.cc b/chrome/browser/ui/webui/settings/chromeos/device_storage_handler.cc
index 343a70b..cd460a3 100644
--- a/chrome/browser/ui/webui/settings/chromeos/device_storage_handler.cc
+++ b/chrome/browser/ui/webui/settings/chromeos/device_storage_handler.cc

@@ -250,10 +250,10 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&StorageHandler::ComputeLocalFilesSize, base::Unretained(this),
-                 my_files_path),
-      base::Bind(&StorageHandler::OnGetMyFilesSize,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&StorageHandler::ComputeLocalFilesSize,
+                     base::Unretained(this), my_files_path),
+      base::BindOnce(&StorageHandler::OnGetMyFilesSize,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 int64_t StorageHandler::ComputeLocalFilesSize(

diff --git a/chrome/browser/ui/webui/version_handler_chromeos.cc b/chrome/browser/ui/webui/version_handler_chromeos.cc
index a2ed0a7..32b0c8af 100644
--- a/chrome/browser/ui/webui/version_handler_chromeos.cc
+++ b/chrome/browser/ui/webui/version_handler_chromeos.cc

@@ -22,22 +22,22 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&chromeos::version_loader::GetVersion,
-                 chromeos::version_loader::VERSION_FULL),
-      base::Bind(&VersionHandlerChromeOS::OnVersion,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&chromeos::version_loader::GetVersion,
+                     chromeos::version_loader::VERSION_FULL),
+      base::BindOnce(&VersionHandlerChromeOS::OnVersion,
+                     weak_factory_.GetWeakPtr()));
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&chromeos::version_loader::GetFirmware),
-      base::Bind(&VersionHandlerChromeOS::OnOSFirmware,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&chromeos::version_loader::GetFirmware),
+      base::BindOnce(&VersionHandlerChromeOS::OnOSFirmware,
+                     weak_factory_.GetWeakPtr()));
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&chromeos::version_loader::GetARCVersion),
-      base::Bind(&VersionHandlerChromeOS::OnARCVersion,
-                 weak_factory_.GetWeakPtr()));
+      base::BindOnce(&chromeos::version_loader::GetARCVersion),
+      base::BindOnce(&VersionHandlerChromeOS::OnARCVersion,
+                     weak_factory_.GetWeakPtr()));
 }
 
 void VersionHandlerChromeOS::OnVersion(const std::string& version) {

diff --git a/chrome/installer/setup/install_service_work_item_impl.cc b/chrome/installer/setup/install_service_work_item_impl.cc
index 0dc142d..b156cfc 100644
--- a/chrome/installer/setup/install_service_work_item_impl.cc
+++ b/chrome/installer/setup/install_service_work_item_impl.cc

@@ -134,17 +134,19 @@
   scm_.Set(::OpenSCManager(nullptr, nullptr,
                            SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE));
   if (!scm_.IsValid()) {
-    DPLOG(ERROR) << "::OpenSCManager Failed";
+    PLOG(ERROR) << "::OpenSCManager Failed";
     RecordServiceInstallResult(ServiceInstallResult::kFailedOpenSCManager);
     RecordWin32ApiErrorCode(kOpenSCManager);
     return false;
   }
 
   if (!OpenService()) {
+    VPLOG(1) << "Attempting to install new service following failure to open";
     const bool succeeded = InstallNewService();
     if (succeeded) {
       RecordServiceInstallResult(ServiceInstallResult::kSucceededFreshInstall);
     } else {
+      PLOG(ERROR) << "Failed to install service";
       RecordServiceInstallResult(ServiceInstallResult::kFailedFreshInstall);
       RecordWin32ApiErrorCode(kCreateService);
     }
@@ -180,6 +182,7 @@
     return true;
   }
 
+  PLOG(ERROR) << "Failed to install service with new name";
   RecordServiceInstallResult(
       ServiceInstallResult::kFailedInstallNewAfterFailedUpgrade);
   RecordWin32ApiErrorCode(kCreateService);

diff --git a/chrome/renderer/sandbox_status_extension_android.cc b/chrome/renderer/sandbox_status_extension_android.cc
index 8076cd91..08cab18 100644
--- a/chrome/renderer/sandbox_status_extension_android.cc
+++ b/chrome/renderer/sandbox_status_extension_android.cc

@@ -116,9 +116,9 @@
 
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {base::ThreadPool(), base::MayBlock()},
-      base::Bind(&SandboxStatusExtension::ReadSandboxStatus, this),
-      base::Bind(&SandboxStatusExtension::RunCallback, this,
-                 base::Passed(&global_callback)));
+      base::BindOnce(&SandboxStatusExtension::ReadSandboxStatus, this),
+      base::BindOnce(&SandboxStatusExtension::RunCallback, this,
+                     base::Passed(&global_callback)));
 }
 
 std::unique_ptr<base::Value> SandboxStatusExtension::ReadSandboxStatus() {

diff --git a/chrome/services/app_service/app_service_impl.cc b/chrome/services/app_service/app_service_impl.cc
index 2aa4e157..f5e91a88 100644
--- a/chrome/services/app_service/app_service_impl.cc
+++ b/chrome/services/app_service/app_service_impl.cc

@@ -187,6 +187,7 @@
 void AppServiceImpl::GetMenuModel(apps::mojom::AppType app_type,
                                   const std::string& app_id,
                                   apps::mojom::MenuType menu_type,
+                                  int64_t display_id,
                                   GetMenuModelCallback callback) {
   auto iter = publishers_.find(app_type);
   if (iter == publishers_.end()) {
@@ -194,9 +195,8 @@
     return;
   }
 
-  // TODO(crbug.com/1038487): change to use below code to call
-  // AppServiceProxy->GetMenuModel when GetMenuModel is added to mojom.
-  // iter->second->GetMenuModel(app_id, menu_type, std::move(callback));
+  iter->second->GetMenuModel(app_id, menu_type, display_id,
+                             std::move(callback));
 }
 
 void AppServiceImpl::OpenNativeSettings(apps::mojom::AppType app_type,

diff --git a/chrome/services/app_service/app_service_impl.h b/chrome/services/app_service/app_service_impl.h
index 03afef9..af94523f 100644
--- a/chrome/services/app_service/app_service_impl.h
+++ b/chrome/services/app_service/app_service_impl.h

@@ -27,9 +27,6 @@
 // See chrome/services/app_service/README.md.
 class AppServiceImpl : public apps::mojom::AppService {
  public:
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
-
   explicit AppServiceImpl(PrefService* profile_prefs);
   ~AppServiceImpl() override;
 
@@ -79,7 +76,8 @@
   void GetMenuModel(apps::mojom::AppType app_type,
                     const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback);
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override;
   void OpenNativeSettings(apps::mojom::AppType app_type,
                           const std::string& app_id) override;
   void AddPreferredApp(apps::mojom::AppType app_type,

diff --git a/chrome/services/app_service/app_service_impl_unittest.cc b/chrome/services/app_service/app_service_impl_unittest.cc
index ab179399..252d533 100644
--- a/chrome/services/app_service/app_service_impl_unittest.cc
+++ b/chrome/services/app_service/app_service_impl_unittest.cc

@@ -96,11 +96,10 @@
                  bool clear_site_data,
                  bool report_abuse) override {}
 
-  using GetMenuModelCallback =
-      base::OnceCallback<void(apps::mojom::MenuItemsPtr)>;
   void GetMenuModel(const std::string& app_id,
                     apps::mojom::MenuType menu_type,
-                    GetMenuModelCallback callback) {}
+                    int64_t display_id,
+                    GetMenuModelCallback callback) override {}
 
   void PauseApp(const std::string& app_id) override {}
   void UnpauseApps(const std::string& app_id) override {}

diff --git a/chrome/services/app_service/public/mojom/app_service.mojom b/chrome/services/app_service/public/mojom/app_service.mojom
index 1346ebd..ec92a37 100644
--- a/chrome/services/app_service/public/mojom/app_service.mojom
+++ b/chrome/services/app_service/public/mojom/app_service.mojom

@@ -81,11 +81,19 @@
       AppType app_type,
       string app_id);
 
+  // Returns the menu items for an app with |app_id|.
+  GetMenuModel(
+      AppType app_type,
+      string app_id,
+      MenuType menu_type,
+      int64 display_id) => (MenuItems menu_items);
+
+  // Opens native settings for the app with |app_id|.
   OpenNativeSettings(
       AppType app_type,
       string app_id);
 
-  // Set app identified by |app_id| as preferred app for |intent_filter|.
+  // Sets app identified by |app_id| as preferred app for |intent_filter|.
   // |intent| is needed to set the preferred app in ARC.
   // If the request is |from_publisher|, we would not sync the preferred
   // app back to the publisher.
@@ -96,10 +104,10 @@
       Intent? intent,
       bool from_publisher);
 
-  // Remove all preferred app setting for an |app_id|.
+  // Removes all preferred app setting for an |app_id|.
   RemovePreferredApp(AppType app_type, string app_id);
 
-  // Reset app identified by |app_id| as preferred app for |intent_filter|.
+  // Resets app identified by |app_id| as preferred app for |intent_filter|.
   RemovePreferredAppForFilter(
       AppType app_type,
       string app_id,
@@ -160,6 +168,13 @@
   UnpauseApps(
       string app_id);
 
+  // Returns the menu items for an app with |app_id|.
+  GetMenuModel(
+      string app_id,
+      MenuType menu_type,
+      int64 display_id) => (MenuItems menu_items);
+
+  // Opens native settings for the app with |app_id|.
   OpenNativeSettings(
       string app_id);
 

diff --git a/chrome/services/util_win/av_products.cc b/chrome/services/util_win/av_products.cc
index 93ee4333..d1ba4b0 100644
--- a/chrome/services/util_win/av_products.cc
+++ b/chrome/services/util_win/av_products.cc

@@ -145,7 +145,7 @@
     return internal::ResultCode::kFailedToGetProductCount;
 
   for (LONG i = 0; i < product_count; i++) {
-    IWscProduct* product = nullptr;
+    Microsoft::WRL::ComPtr<IWscProduct> product;
     result = product_list->get_Item(i, &product);
     if (FAILED(result))
       return internal::ResultCode::kFailedToGetItem;

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index abe6c1b..e4224da 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -3343,6 +3343,7 @@
     "../browser/sharing/sharing_fcm_handler_unittest.cc",
     "../browser/sharing/sharing_fcm_sender_unittest.cc",
     "../browser/sharing/sharing_handler_registry_impl_unittest.cc",
+    "../browser/sharing/sharing_message_bridge_impl_unittest.cc",
     "../browser/sharing/sharing_message_sender_unittest.cc",
     "../browser/sharing/sharing_service_unittest.cc",
     "../browser/sharing/sharing_sync_preference_unittest.cc",

diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index 4af56100..a577035 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json

@@ -2850,6 +2850,18 @@
     ]
   },
 
+  "ChromeVariations": {
+    "os": ["win", "linux", "mac", "chromeos"],
+    "policy_pref_mapping_test": [
+      {
+        "policies": {
+          "ChromeVariations": 1
+        },
+        "prefs": { "variations_restrictions_by_policy": { "local_state": true } }
+      }
+    ]
+  },
+
   "DataCompressionProxyEnabled": {
     "os": [
       "android"

diff --git a/chrome/test/data/webui/chromeos/crostini_installer_app_test.js b/chrome/test/data/webui/chromeos/crostini_installer_app_test.js
index 131d14a6..66fc4402 100644
--- a/chrome/test/data/webui/chromeos/crostini_installer_app_test.js
+++ b/chrome/test/data/webui/chromeos/crostini_installer_app_test.js

@@ -13,11 +13,14 @@
 
 class FakePageHandler extends TestBrowserProxy {
   constructor() {
-    super(['install', 'cancel', 'cancelBeforeStart', 'close']);
+    super([
+      'install', 'cancel', 'cancelBeforeStart', 'close',
+      'requestAmountOfFreeDiskSpace'
+    ]);
   }
 
   /** @override */
-  install() {
+  install(diskSize, username) {
     this.methodCalled('install');
   }
 
@@ -35,6 +38,11 @@
   close() {
     this.methodCalled('close');
   }
+
+  /** @override */
+  requestAmountOfFreeDiskSpace() {
+    this.methodCalled('requestAmountOfFreeDiskSpace');
+  }
 }
 
 class FakeBrowserProxy {
@@ -74,7 +82,7 @@
   };
 
   const getInstallButton = () => {
-    return app.$$('.action-button');
+    return app.$$('#install');
   };
 
   const getCancelButton = () => {

diff --git a/chromecast/common/BUILD.gn b/chromecast/common/BUILD.gn
index ab65991c..14be649 100644
--- a/chromecast/common/BUILD.gn
+++ b/chromecast/common/BUILD.gn

@@ -11,9 +11,7 @@
     "queryable_data.h",
   ]
 
-  deps = [
-    "//base",
-  ]
+  deps = [ "//base" ]
 }
 
 cast_source_set("resource_delegate") {

diff --git a/chromecast/common/extensions_api/BUILD.gn b/chromecast/common/extensions_api/BUILD.gn
index 7469d44..50993ea9 100644
--- a/chromecast/common/extensions_api/BUILD.gn
+++ b/chromecast/common/extensions_api/BUILD.gn

@@ -36,9 +36,7 @@
   bundle_name = "Cast"
   schema_include_rules = extensions_api_schema_include_rules
 
-  deps = [
-    "//extensions/common/api",
-  ]
+  deps = [ "//extensions/common/api" ]
   visibility = [ ":api" ]
 }
 
@@ -58,34 +56,26 @@
   sources = schema_sources
   schema_include_rules = extensions_api_schema_include_rules
 
-  deps = [
-    "//extensions/common/api",
-  ]
+  deps = [ "//extensions/common/api" ]
   visibility = [ ":api" ]
 }
 
 json_features("cast_api_features") {
   feature_type = "APIFeature"
   method_name = "AddCastAPIFeatures"
-  sources = [
-    "_api_features.json",
-  ]
+  sources = [ "_api_features.json" ]
 }
 
 json_features("cast_permission_features") {
   feature_type = "PermissionFeature"
   method_name = "AddCastPermissionFeatures"
-  sources = [
-    "_permission_features.json",
-  ]
+  sources = [ "_permission_features.json" ]
 }
 
 json_features("cast_manifest_features") {
   feature_type = "ManifestFeature"
   method_name = "AddCastManifestFeatures"
-  sources = [
-    "_manifest_features.json",
-  ]
+  sources = [ "_manifest_features.json" ]
 }
 
 # Public Targets

diff --git a/chromecast/common/mojom/BUILD.gn b/chromecast/common/mojom/BUILD.gn
index 39c9da91..3ce5950 100644
--- a/chromecast/common/mojom/BUILD.gn
+++ b/chromecast/common/mojom/BUILD.gn

@@ -19,7 +19,5 @@
     "service_connector.mojom",
   ]
 
-  public_deps = [
-    "//mojo/public/mojom/base",
-  ]
+  public_deps = [ "//mojo/public/mojom/base" ]
 }

diff --git a/chromecast/media/BUILD.gn b/chromecast/media/BUILD.gn
index 29e12c0..d52bc9a5 100644
--- a/chromecast/media/BUILD.gn
+++ b/chromecast/media/BUILD.gn

@@ -36,25 +36,15 @@
 # Handles the various differences between (ATV, Things, desktop, device builds).
 group("libcast_media") {
   if (is_android) {
-    deps = [
-      "//chromecast/media/cma/backend/android:cast_media_android",
-    ]
+    deps = [ "//chromecast/media/cma/backend/android:cast_media_android" ]
   } else if (is_fuchsia) {
-    deps = [
-      "//chromecast/media/cma/backend/fuchsia:media_backend",
-    ]
+    deps = [ "//chromecast/media/cma/backend/fuchsia:media_backend" ]
   } else if (cast_static_media_lib_target != "") {
-    deps = [
-      "$cast_static_media_lib_target",
-    ]
+    deps = [ "$cast_static_media_lib_target" ]
   } else if (is_cast_desktop_build) {
-    deps = [
-      "//chromecast/media/cma/backend/desktop",
-    ]
+    deps = [ "//chromecast/media/cma/backend/desktop" ]
   } else {
-    deps = [
-      "//chromecast/media/cma/backend:libcast_media_1.0",
-    ]
+    deps = [ "//chromecast/media/cma/backend:libcast_media_1.0" ]
   }
 
   if (cast_volume_control_in_avsettings) {

diff --git a/chromecast/media/audio/BUILD.gn b/chromecast/media/audio/BUILD.gn
index 17dc915..5de5f4ee 100644
--- a/chromecast/media/audio/BUILD.gn
+++ b/chromecast/media/audio/BUILD.gn

@@ -19,9 +19,7 @@
     "audio_io_thread.h",
   ]
 
-  deps = [
-    "//base",
-  ]
+  deps = [ "//base" ]
 }
 
 cast_source_set("processing") {
@@ -109,19 +107,13 @@
 }
 
 source_set("dummy_external_audio_pipeline") {
-  sources = [
-    "external_audio_pipeline_dummy.cc",
-  ]
+  sources = [ "external_audio_pipeline_dummy.cc" ]
 
-  public_deps = [
-    "//chromecast/public/media",
-  ]
+  public_deps = [ "//chromecast/public/media" ]
 }
 
 cast_shared_library("libcast_external_audio_pipeline_1.0") {
-  public_deps = [
-    ":dummy_external_audio_pipeline",
-  ]
+  public_deps = [ ":dummy_external_audio_pipeline" ]
 }
 
 source_set("fake_external_audio_pipeline") {
@@ -157,17 +149,11 @@
 cast_source_set("test_support") {
   testonly = true
 
-  sources = [
-    "mock_audio_input_callback.h",
-  ]
+  sources = [ "mock_audio_input_callback.h" ]
 
-  public_deps = [
-    "//testing/gmock",
-  ]
+  public_deps = [ "//testing/gmock" ]
 
-  deps = [
-    "//media",
-  ]
+  deps = [ "//media" ]
 }
 
 cast_source_set("unittests") {

diff --git a/chromecast/media/audio/capture_service/BUILD.gn b/chromecast/media/audio/capture_service/BUILD.gn
index 18f0e2b..7caa541 100644
--- a/chromecast/media/audio/capture_service/BUILD.gn
+++ b/chromecast/media/audio/capture_service/BUILD.gn

@@ -7,9 +7,7 @@
 import("//testing/test.gni")
 
 cast_source_set("common") {
-  sources = [
-    "constants.h",
-  ]
+  sources = [ "constants.h" ]
 }
 
 cast_source_set("utils") {
@@ -18,9 +16,7 @@
     "message_parsing_utils.h",
   ]
 
-  public_deps = [
-    ":common",
-  ]
+  public_deps = [ ":common" ]
 
   deps = [
     "//base",
@@ -35,9 +31,7 @@
     "capture_service_receiver.h",
   ]
 
-  public_deps = [
-    ":common",
-  ]
+  public_deps = [ ":common" ]
 
   deps = [
     ":utils",
@@ -70,9 +64,7 @@
 }
 
 fuzzer_test("message_parsing_fuzzer") {
-  sources = [
-    "message_parsing_fuzzer.cc",
-  ]
+  sources = [ "message_parsing_fuzzer.cc" ]
   deps = [
     ":utils",
     "//base",

diff --git a/chromecast/media/audio/mixer_service/BUILD.gn b/chromecast/media/audio/mixer_service/BUILD.gn
index 53b9415..68dc389 100644
--- a/chromecast/media/audio/mixer_service/BUILD.gn
+++ b/chromecast/media/audio/mixer_service/BUILD.gn

@@ -14,9 +14,7 @@
 
 proto_library("proto") {
   proto_out_dir = "chromecast/media/audio/mixer_service"
-  sources = [
-    "mixer_service.proto",
-  ]
+  sources = [ "mixer_service.proto" ]
 }
 
 cast_source_set("common") {
@@ -112,9 +110,7 @@
     "loopback_connection.h",
   ]
 
-  public_deps = [
-    ":common",
-  ]
+  public_deps = [ ":common" ]
 
   deps = [
     ":connection",

diff --git a/chromecast/media/audio/mixer_service/receiver/BUILD.gn b/chromecast/media/audio/mixer_service/receiver/BUILD.gn
index 221180d..c2a96fa 100644
--- a/chromecast/media/audio/mixer_service/receiver/BUILD.gn
+++ b/chromecast/media/audio/mixer_service/receiver/BUILD.gn

@@ -18,9 +18,7 @@
     "//net",
   ]
 
-  public_deps = [
-    "//chromecast/media/audio/mixer_service:proto",
-  ]
+  public_deps = [ "//chromecast/media/audio/mixer_service:proto" ]
 }
 
 cast_source_set("receiver_cma") {

diff --git a/chromecast/media/avsettings/BUILD.gn b/chromecast/media/avsettings/BUILD.gn
index dc01162..478a3225 100644
--- a/chromecast/media/avsettings/BUILD.gn
+++ b/chromecast/media/avsettings/BUILD.gn

@@ -19,17 +19,13 @@
     "avsettings_dummy.h",
   ]
 
-  deps = [
-    "//chromecast/public",
-  ]
+  deps = [ "//chromecast/public" ]
 }
 
 # Target for OEM partners to override avsettings shared library, i.e.
 # libcast_avsettings_1.0.so.
 cast_shared_library("libcast_avsettings_1.0") {
-  sources = [
-    "avsettings_shlib.cc",
-  ]
+  sources = [ "avsettings_shlib.cc" ]
 
   deps = [
     ":avsettings_buildflags",

diff --git a/chromecast/media/base/BUILD.gn b/chromecast/media/base/BUILD.gn
index da44bb4c..bb31e7b3 100644
--- a/chromecast/media/base/BUILD.gn
+++ b/chromecast/media/base/BUILD.gn

@@ -89,9 +89,7 @@
     "media_codec_support.h",
   ]
 
-  public_deps = [
-    "//chromecast/public/media",
-  ]
+  public_deps = [ "//chromecast/public/media" ]
 
   deps = [
     "//base",
@@ -105,9 +103,7 @@
     "video_plane_controller.h",
   ]
 
-  public_deps = [
-    "//chromecast/public",
-  ]
+  public_deps = [ "//chromecast/public" ]
 
   deps = [
     "//base",

diff --git a/chromecast/media/cma/BUILD.gn b/chromecast/media/cma/BUILD.gn
index 4020907d..2843e166 100644
--- a/chromecast/media/cma/BUILD.gn
+++ b/chromecast/media/cma/BUILD.gn

@@ -79,9 +79,7 @@
     defines = [ "ENABLE_VIDEO_WITH_MIXED_AUDIO" ]
   }
 
-  data = [
-    "//media/test/data/",
-  ]
+  data = [ "//media/test/data/" ]
 
   # MultizoneBackendTest verifies rendering delay reported by the backend.
   if (supports_multizone) {

diff --git a/chromecast/media/cma/backend/BUILD.gn b/chromecast/media/cma/backend/BUILD.gn
index 51a7c7f..ab63ff8 100644
--- a/chromecast/media/cma/backend/BUILD.gn
+++ b/chromecast/media/cma/backend/BUILD.gn

@@ -57,9 +57,7 @@
 # libcast_media_1.0.so. This target is only used to build executables
 # with correct linkage information.
 cast_shared_library("libcast_media_1.0") {
-  sources = [
-    "cast_media_dummy.cc",
-  ]
+  sources = [ "cast_media_dummy.cc" ]
 
   deps = [
     ":audio_buildflags",
@@ -95,9 +93,7 @@
 }
 
 cast_source_set("public") {
-  sources = [
-    "system_volume_control.h",
-  ]
+  sources = [ "system_volume_control.h" ]
 
   deps = [
     "//base",
@@ -106,9 +102,7 @@
 }
 
 cast_source_set("av_sync_dummy") {
-  sources = [
-    "av_sync_dummy.cc",
-  ]
+  sources = [ "av_sync_dummy.cc" ]
 
   deps = [
     "//base",
@@ -117,9 +111,7 @@
 }
 
 cast_source_set("audio_codec_support") {
-  sources = [
-    "media_codec_support_cast_audio.cc",
-  ]
+  sources = [ "media_codec_support_cast_audio.cc" ]
   deps = [
     "//base",
     "//chromecast/public",
@@ -133,9 +125,7 @@
     "cast_audio_json.h",
   ]
 
-  deps = [
-    "//base",
-  ]
+  deps = [ "//base" ]
 }
 
 cast_source_set("volume_map") {
@@ -188,9 +178,7 @@
 
 test("cast_audio_backend_unittests") {
   testonly = true
-  sources = [
-    "volume_map_unittest.cc",
-  ]
+  sources = [ "volume_map_unittest.cc" ]
 
   deps = [
     ":cast_audio_json",

diff --git a/chromecast/media/cma/backend/alsa/BUILD.gn b/chromecast/media/cma/backend/alsa/BUILD.gn
index a7ae5fb..289891a 100644
--- a/chromecast/media/cma/backend/alsa/BUILD.gn
+++ b/chromecast/media/cma/backend/alsa/BUILD.gn

@@ -11,9 +11,7 @@
 assert(use_alsa)
 
 cast_source_set("libcast_media_1.0_audio") {
-  sources = [
-    "cast_media_shlib.cc",
-  ]
+  sources = [ "cast_media_shlib.cc" ]
 
   deps = [
     ":volume_control",

diff --git a/chromecast/media/cma/backend/mixer/BUILD.gn b/chromecast/media/cma/backend/mixer/BUILD.gn
index 5f343eb..13869f18 100644
--- a/chromecast/media/cma/backend/mixer/BUILD.gn
+++ b/chromecast/media/cma/backend/mixer/BUILD.gn

@@ -15,9 +15,7 @@
     "post_processor_paths.cc",
     "post_processor_paths.h",
   ]
-  deps = [
-    "//base",
-  ]
+  deps = [ "//base" ]
 }
 
 cast_source_set("loopback") {

diff --git a/chromecast/media/cma/backend/mixer/post_processors/BUILD.gn b/chromecast/media/cma/backend/mixer/post_processors/BUILD.gn
index 6adcbe3c..78593486 100644
--- a/chromecast/media/cma/backend/mixer/post_processors/BUILD.gn
+++ b/chromecast/media/cma/backend/mixer/post_processors/BUILD.gn

@@ -17,9 +17,7 @@
 }
 
 cast_shared_library("libcast_governor_2.0") {
-  sources = [
-    "post_processor_name.cc",
-  ]
+  sources = [ "post_processor_name.cc" ]
   defines = [
     "DEFINED_POSTPROCESSOR_NAME=chromecast::media::Governor",
     "DEFINED_POSTPROCESSOR_HEADER=chromecast/media/cma/backend/mixer/post_processors/governor.h",
@@ -49,9 +47,7 @@
 }
 
 cast_shared_library("libcast_saturated_gain_2.0") {
-  sources = [
-    "post_processor_name.cc",
-  ]
+  sources = [ "post_processor_name.cc" ]
   defines = [
     "DEFINED_POSTPROCESSOR_NAME=chromecast::media::SaturatedGain",
     "DEFINED_POSTPROCESSOR_HEADER=chromecast/media/cma/backend/mixer/post_processors/saturated_gain.h",

diff --git a/chromecast/media/cma/backend/video/BUILD.gn b/chromecast/media/cma/backend/video/BUILD.gn
index 5279108..1981bd6 100644
--- a/chromecast/media/cma/backend/video/BUILD.gn
+++ b/chromecast/media/cma/backend/video/BUILD.gn

@@ -21,9 +21,7 @@
 }
 
 cast_source_set("cast_media_shlib_common") {
-  sources = [
-    "cast_media_shlib_common.cc",
-  ]
+  sources = [ "cast_media_shlib_common.cc" ]
   deps = [
     "//base",
     "//chromecast/public/media",
@@ -31,9 +29,7 @@
 }
 
 cast_source_set("cast_media_shlib_default") {
-  sources = [
-    "cast_media_shlib_default.cc",
-  ]
+  sources = [ "cast_media_shlib_default.cc" ]
   deps = [
     ":cast_media_shlib_common",
     "//base",

diff --git a/chromecast/media/cma/base/BUILD.gn b/chromecast/media/cma/base/BUILD.gn
index 0b322cb..f4714b65 100644
--- a/chromecast/media/cma/base/BUILD.gn
+++ b/chromecast/media/cma/base/BUILD.gn

@@ -35,9 +35,7 @@
     "simple_media_task_runner.h",
   ]
 
-  public_deps = [
-    "//chromecast/public/media",
-  ]
+  public_deps = [ "//chromecast/public/media" ]
 
   deps = [
     "//base",

diff --git a/chromecast/media/service/mojom/BUILD.gn b/chromecast/media/service/mojom/BUILD.gn
index e07bcde..939a464 100644
--- a/chromecast/media/service/mojom/BUILD.gn
+++ b/chromecast/media/service/mojom/BUILD.gn

@@ -5,9 +5,7 @@
 import("//mojo/public/tools/bindings/mojom.gni")
 
 mojom("mojom") {
-  sources = [
-    "video_geometry_setter.mojom",
-  ]
+  sources = [ "video_geometry_setter.mojom" ]
 
   public_deps = [
     "//mojo/public/mojom/base",

diff --git a/chromecast/ui/BUILD.gn b/chromecast/ui/BUILD.gn
index 5540fc3..f5059d6c 100644
--- a/chromecast/ui/BUILD.gn
+++ b/chromecast/ui/BUILD.gn

@@ -8,23 +8,15 @@
 import("//components/vector_icons/vector_icons.gni")
 
 cast_source_set("public") {
-  sources = [
-    "media_overlay.h",
-  ]
+  sources = [ "media_overlay.h" ]
 
-  deps = [
-    "//base",
-  ]
+  deps = [ "//base" ]
 }
 
 cast_source_set("aura_components") {
-  sources = [
-    "aura_components.h",
-  ]
+  sources = [ "aura_components.h" ]
 
-  deps = [
-    ":public",
-  ]
+  deps = [ ":public" ]
 
   if (use_aura) {
     sources += [ "aura_components.cc" ]

diff --git a/chromeos/services/machine_learning/public/cpp/BUILD.gn b/chromeos/services/machine_learning/public/cpp/BUILD.gn
index ece19f12..28b24b1 100644
--- a/chromeos/services/machine_learning/public/cpp/BUILD.gn
+++ b/chromeos/services/machine_learning/public/cpp/BUILD.gn

@@ -32,9 +32,7 @@
 
 source_set("unit_tests") {
   testonly = true
-  sources = [
-    "service_connection_unittest.cc",
-  ]
+  sources = [ "service_connection_unittest.cc" ]
   deps = [
     ":cpp",
     ":test_support",

diff --git a/components/autofill_assistant/browser/controller.cc b/components/autofill_assistant/browser/controller.cc
index d316dac..3d3b0ed 100644
--- a/components/autofill_assistant/browser/controller.cc
+++ b/components/autofill_assistant/browser/controller.cc

@@ -927,7 +927,8 @@
       IDS_AUTOFILL_ASSISTANT_LOADING, base::UTF8ToUTF16(deeplink_url_.host())));
   SetProgress(kAutostartInitialProgress);
 
-  if (IsNavigatingToNewDocument()) {
+  if (base::FeatureList::IsEnabled(features::kAutofillAssistantChromeEntry) &&
+      IsNavigatingToNewDocument()) {
     start_after_navigation_ = base::BindOnce(&Controller::EnterStateSilent,
                                              weak_ptr_factory_.GetWeakPtr(),
                                              AutofillAssistantState::STARTING);

diff --git a/components/cronet/ios/BUILD.gn b/components/cronet/ios/BUILD.gn
index 3f50a8d3..33d3ade7 100644
--- a/components/cronet/ios/BUILD.gn
+++ b/components/cronet/ios/BUILD.gn

@@ -25,7 +25,7 @@
 config("cronet_static_config") {
   libs = [
     "Cronet.framework",
-    "UIKit.Framework",
+    "UIKit.framework",
     "CFNetwork.framework",
     "MobileCoreServices.framework",
     "Security.framework",
@@ -108,7 +108,7 @@
     "//net:net",
   ]
 
-  libs = [ "UIKit.Framework" ]
+  libs = [ "UIKit.framework" ]
 
   public_deps = [ "//components/grpc_support:headers" ]
 

diff --git a/components/exo/pointer.cc b/components/exo/pointer.cc
index 20bf4e7a..634d6a4f 100644
--- a/components/exo/pointer.cc
+++ b/components/exo/pointer.cc

@@ -225,6 +225,62 @@
   relative_pointer_delegate_ = nullptr;
 }
 
+bool Pointer::EnablePointerCapture() {
+  if (!base::FeatureList::IsEnabled(kPointerCapture))
+    return false;
+
+  // You are not allowed to have more than one capture active.
+  if (capture_window_)
+    return false;
+
+  aura::Window* active_window = WMHelper::GetInstance()->GetActiveWindow();
+  if (!active_window) {
+    LOG(ERROR) << "Failed to enable pointer capture: "
+                  "active window not found";
+    return false;
+  }
+  auto* top_level_widget =
+      views::Widget::GetTopLevelWidgetForNativeView(active_window);
+
+  if (!top_level_widget) {
+    LOG(ERROR) << "Failed to enable pointer capture: "
+                  "active window does not have associated widget";
+    return false;
+  }
+  Surface* root_surface =
+      GetShellMainSurface(top_level_widget->GetNativeWindow());
+  if (!root_surface ||
+      !delegate_->CanAcceptPointerEventsForSurface(root_surface)) {
+    LOG(ERROR) << "Failed to enable pointer capture: "
+                  "cannot find window for capture";
+    return false;
+  }
+  return EnablePointerCapture(root_surface);
+}
+
+void Pointer::DisablePointerCapture() {
+  // Early out if pointer capture is not enabled.
+  if (!capture_window_)
+    return;
+
+  // Remove the pre-target handler that consumes all mouse events.
+  aura::Env::GetInstance()->RemovePreTargetHandler(this);
+
+  auto* cursor_client = WMHelper::GetInstance()->GetCursorClient();
+  cursor_client->UnlockCursor();
+  cursor_client->ShowCursor();
+
+  aura::Window* root = capture_window_->GetRootWindow();
+  gfx::Point p = location_when_pointer_capture_enabled_
+                     ? *location_when_pointer_capture_enabled_
+                     : root->bounds().CenterPoint();
+  root->MoveCursorTo(p);
+
+  capture_window_ = nullptr;
+  location_when_pointer_capture_enabled_.reset();
+  UpdateCursor();
+}
+
 bool Pointer::ConstrainPointer(PointerConstraintDelegate* delegate) {
   // Pointer lock is a chromeos-only feature (i.e. the chromeos::features
   // namespace only exists in chromeos builds). So we do not compile pointer
@@ -289,29 +345,6 @@
   return true;
 }
 
-void Pointer::DisablePointerCapture() {
-  // Early out if pointer capture is not enabled.
-  if (!capture_window_)
-    return;
-
-  // Remove the pre-target handler that consumes all mouse events.
-  aura::Env::GetInstance()->RemovePreTargetHandler(this);
-
-  auto* cursor_client = WMHelper::GetInstance()->GetCursorClient();
-  cursor_client->UnlockCursor();
-  cursor_client->ShowCursor();
-
-  aura::Window* root = capture_window_->GetRootWindow();
-  gfx::Point p = location_when_pointer_capture_enabled_
-                     ? *location_when_pointer_capture_enabled_
-                     : root->bounds().CenterPoint();
-  root->MoveCursorTo(p);
-
-  capture_window_ = nullptr;
-  location_when_pointer_capture_enabled_.reset();
-  UpdateCursor();
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // SurfaceDelegate overrides:
 

diff --git a/components/exo/pointer.h b/components/exo/pointer.h
index bd757ed..0478501 100644
--- a/components/exo/pointer.h
+++ b/components/exo/pointer.h

@@ -92,6 +92,17 @@
   void RegisterRelativePointerDelegate(RelativePointerDelegate* delegate);
   void UnregisterRelativePointerDelegate(RelativePointerDelegate* delegate);
 
+  // Capture the pointer for the top-most surface. Returns true iff the capture
+  // succeeded.
+  //
+  // TODO(b/124059008): Historically, exo needed to guess what the correct
+  // capture window was, as it did not implement wayland's pointer capture
+  // protocol.
+  bool EnablePointerCapture();
+
+  // Remove the currently active pointer capture (if there is one).
+  void DisablePointerCapture();
+
   // Enable the pointer constraint on the given surface. Returns true if the
   // lock was granted, false otherwise.
   //
@@ -110,9 +121,6 @@
   // succeeded.
   bool EnablePointerCapture(Surface* capture_surface);
 
-  // Remove the currently active pointer capture (if there is one).
-  void DisablePointerCapture();
-
   // Returns the effective target for |event|.
   Surface* GetEffectiveTargetForEvent(ui::LocatedEvent* event) const;
 

diff --git a/components/exo/wayland/zwp_relative_pointer_manager.cc b/components/exo/wayland/zwp_relative_pointer_manager.cc
index 3d14b73..d579b4b 100644
--- a/components/exo/wayland/zwp_relative_pointer_manager.cc
+++ b/components/exo/wayland/zwp_relative_pointer_manager.cc

@@ -27,11 +27,20 @@
   WaylandRelativePointerDelegate(wl_resource* resource, Pointer* pointer)
       : resource_(resource), pointer_(pointer) {
     pointer->RegisterRelativePointerDelegate(this);
+    // TODO(b/124059008): See below, when requesting relative motion we will
+    // also try to gain pointer lock even though the client hasn't asked for it
+    // yet...
+    pointer_->EnablePointerCapture();
   }
 
   ~WaylandRelativePointerDelegate() override {
-    if (pointer_)
+    if (pointer_) {
+      // TODO(b/124059008): For whatever reason, exo conflates pointer capture
+      // and relative motion. Normally in wayland, removing the relative pointer
+      // would not break pointer capture, but in exo that is the case.
+      pointer_->DisablePointerCapture();
       pointer_->UnregisterRelativePointerDelegate(this);
+    }
   }
   void OnPointerDestroying(Pointer* pointer) override { pointer_ = nullptr; }
   void OnPointerRelativeMotion(base::TimeTicks time_stamp,

diff --git a/components/nacl/browser/nacl_process_host.cc b/components/nacl/browser/nacl_process_host.cc
index e72addb..98b7c4e 100644
--- a/components/nacl/browser/nacl_process_host.cc
+++ b/components/nacl/browser/nacl_process_host.cc

@@ -1052,9 +1052,9 @@
       // USER_BLOCKING because it is on the critical path of displaying the
       // official virtual keyboard on Chrome OS. https://crbug.com/976542
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_BLOCKING},
-      base::Bind(OpenNaClReadExecImpl, file_path, true /* is_executable */),
-      base::Bind(&NaClProcessHost::FileResolved, weak_factory_.GetWeakPtr(),
-                 file_token_lo, file_token_hi, file_path));
+      base::BindOnce(OpenNaClReadExecImpl, file_path, true /* is_executable */),
+      base::BindOnce(&NaClProcessHost::FileResolved, weak_factory_.GetWeakPtr(),
+                     file_token_lo, file_token_hi, file_path));
 }
 
 void NaClProcessHost::FileResolved(

diff --git a/components/nacl/browser/pnacl_host.cc b/components/nacl/browser/pnacl_host.cc
index 344709b..74c24c4 100644
--- a/components/nacl/browser/pnacl_host.cc
+++ b/components/nacl/browser/pnacl_host.cc

@@ -379,9 +379,9 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&FileProxy::Write, base::Unretained(proxy),
-                 pt->nexe_read_buffer),
-      base::Bind(&FileProxy::WriteDone, base::Owned(proxy), entry->first));
+      base::BindOnce(&FileProxy::Write, base::Unretained(proxy),
+                     pt->nexe_read_buffer),
+      base::BindOnce(&FileProxy::WriteDone, base::Owned(proxy), entry->first));
 }
 
 //////////////////// GetNexeFd miss path
@@ -454,9 +454,9 @@
     base::PostTaskAndReplyWithResult(
         FROM_HERE,
         {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-        base::Bind(&PnaclHost::CopyFileToBuffer, Passed(&file)),
-        base::Bind(&PnaclHost::StoreTranslatedNexe, base::Unretained(this),
-                   id));
+        base::BindOnce(&PnaclHost::CopyFileToBuffer, Passed(&file)),
+        base::BindOnce(&PnaclHost::StoreTranslatedNexe, base::Unretained(this),
+                       id));
   }
 
   if (!store_nexe) {

diff --git a/components/password_manager/core/browser/mock_password_form_manager_for_ui.h b/components/password_manager/core/browser/mock_password_form_manager_for_ui.h
index 7ed8ea2..7adbb825 100644
--- a/components/password_manager/core/browser/mock_password_form_manager_for_ui.h
+++ b/components/password_manager/core/browser/mock_password_form_manager_for_ui.h

@@ -40,6 +40,7 @@
   MOCK_METHOD1(OnNoInteraction, void(bool));
   MOCK_METHOD0(PermanentlyBlacklist, void());
   MOCK_METHOD0(OnPasswordsRevealed, void());
+  MOCK_METHOD0(MoveCredentialsToAccountStore, void());
 
   DISALLOW_COPY_AND_ASSIGN(MockPasswordFormManagerForUI);
 };

diff --git a/components/password_manager/core/browser/multi_store_password_save_manager.cc b/components/password_manager/core/browser/multi_store_password_save_manager.cc
index 8eb14f9..a864d20 100644
--- a/components/password_manager/core/browser/multi_store_password_save_manager.cc
+++ b/components/password_manager/core/browser/multi_store_password_save_manager.cc

@@ -135,4 +135,32 @@
          password_manager::ACCOUNT_PASSWORDS_ACTIVE_NORMAL_ENCRYPTION;
 }
 
+void MultiStorePasswordSaveManager::MoveCredentialsToAccountStore() {
+  // TODO(crbug.com/1032992): There are other rare corner cases that should
+  // still be handled: 0. Moving PSL matched credentials doesn't work now
+  // because of
+  // https://cs.chromium.org/chromium/src/components/password_manager/core/browser/login_database.cc?l=1318&rcl=e32055d4843e9fc1fa920c5f1f83c1313607e28a
+  // 1. Credential exists only in the profile store but with an outdated
+  // password.
+  // 2. Credentials exist in both stores.
+  // 3. Credentials exist in both stores while one of them of outdated. (profile
+  // or remote).
+  // 4. Credential exists only in the profile store but a PSL matched one exists
+  // in both profile and account store.
+
+  const std::vector<const PasswordForm*> account_store_matches =
+      AccountStoreMatches(form_fetcher_->GetBestMatches());
+  for (const PasswordForm* match :
+       ProfileStoreMatches(form_fetcher_->GetBestMatches())) {
+    DCHECK(!match->IsUsingAccountStore());
+    // Ignore credentials matches for other usernames.
+    if (match->username_value != pending_credentials_.username_value)
+      continue;
+
+    account_store_form_saver_->Save(*match, account_store_matches,
+                                    /*old_password=*/base::string16());
+    form_saver_->Remove(*match);
+  }
+}
+
 }  // namespace password_manager

diff --git a/components/password_manager/core/browser/multi_store_password_save_manager.h b/components/password_manager/core/browser/multi_store_password_save_manager.h
index b2a34bcf..1dfac4c3 100644
--- a/components/password_manager/core/browser/multi_store_password_save_manager.h
+++ b/components/password_manager/core/browser/multi_store_password_save_manager.h

@@ -39,6 +39,8 @@
 
   std::unique_ptr<PasswordSaveManager> Clone() override;
 
+  void MoveCredentialsToAccountStore() override;
+
  protected:
   FormSaver* GetFormSaverForGeneration() override;
 

diff --git a/components/password_manager/core/browser/multi_store_password_save_manager_unittest.cc b/components/password_manager/core/browser/multi_store_password_save_manager_unittest.cc
index c3eb8729..603823b0 100644
--- a/components/password_manager/core/browser/multi_store_password_save_manager_unittest.cc
+++ b/components/password_manager/core/browser/multi_store_password_save_manager_unittest.cc

@@ -501,4 +501,45 @@
   password_save_manager()->PermanentlyBlacklist(form_digest);
 }
 
+TEST_F(MultiStorePasswordSaveManagerTest,
+       MoveCredentialsFromProfileToAccountStoreWhenExistsOnlyInProfileStore) {
+  PasswordForm saved_match_in_profile_store(saved_match_);
+  saved_match_in_profile_store.in_store = PasswordForm::Store::kProfileStore;
+  SetNonFederatedAndNotifyFetchCompleted({&saved_match_in_profile_store});
+
+  password_save_manager()->CreatePendingCredentials(
+      saved_match_in_profile_store, observed_form_, submitted_form_,
+      /*is_http_auth=*/false,
+      /*is_credential_api_save=*/false);
+
+  EXPECT_CALL(*mock_profile_form_saver(), Remove(saved_match_in_profile_store));
+  EXPECT_CALL(*mock_account_form_saver(),
+              Save(saved_match_in_profile_store, _, _));
+
+  password_save_manager()->MoveCredentialsToAccountStore();
+}
+
+TEST_F(
+    MultiStorePasswordSaveManagerTest,
+    DoNotMoveCredentialsFromProfileToAccountStoreWhenExistsOnlyInProfileStoreWithDifferentUserName) {
+  PasswordForm saved_match_in_profile_store(saved_match_);
+  saved_match_in_profile_store.in_store = PasswordForm::Store::kProfileStore;
+  SetNonFederatedAndNotifyFetchCompleted({&saved_match_in_profile_store});
+  PasswordForm credentials_with_diffrent_username(saved_match_in_profile_store);
+  credentials_with_diffrent_username.username_value =
+      ASCIIToUTF16("different_username");
+  password_save_manager()->CreatePendingCredentials(
+      credentials_with_diffrent_username, observed_form_, submitted_form_,
+      /*is_http_auth=*/false,
+      /*is_credential_api_save=*/false);
+
+  EXPECT_CALL(*mock_profile_form_saver(), Remove(saved_match_in_profile_store))
+      .Times(0);
+  EXPECT_CALL(*mock_account_form_saver(),
+              Save(saved_match_in_profile_store, _, _))
+      .Times(0);
+
+  password_save_manager()->MoveCredentialsToAccountStore();
+}
+
 }  // namespace password_manager

diff --git a/components/password_manager/core/browser/password_form_manager.cc b/components/password_manager/core/browser/password_form_manager.cc
index a6dde80..d19e9a64 100644
--- a/components/password_manager/core/browser/password_form_manager.cc
+++ b/components/password_manager/core/browser/password_form_manager.cc

@@ -388,6 +388,10 @@
   votes_uploader_.set_has_passwords_revealed_vote(true);
 }
 
+void PasswordFormManager::MoveCredentialsToAccountStore() {
+  password_save_manager_->MoveCredentialsToAccountStore();
+}
+
 bool PasswordFormManager::IsNewLogin() const {
   return password_save_manager_->IsNewLogin();
 }
@@ -460,16 +464,13 @@
   votes_uploader_.set_generation_element(generation_element);
 }
 
-bool PasswordFormManager::UpdateGeneratedPasswordOnUserInput(
+bool PasswordFormManager::UpdateStateOnUserInput(
     const base::string16& form_identifier,
     const base::string16& field_identifier,
     const base::string16& field_value) {
-  if (observed_form_.name != form_identifier || !HasGeneratedPassword()) {
-    // *this might not have generated password, because
-    // 1.This function is called before PresaveGeneratedPassword, or
-    // 2.There are multiple forms with the same |form_identifier|
+  if (observed_form_.name != form_identifier)
     return false;
-  }
+
   bool form_data_changed = false;
   for (FormFieldData& field : observed_form_.fields) {
     if (field.unique_id == field_identifier) {
@@ -478,6 +479,10 @@
       break;
     }
   }
+
+  if (!HasGeneratedPassword())
+    return true;
+
   base::string16 generated_password =
       password_save_manager_->GetGeneratedPassword();
   if (votes_uploader_.get_generation_element() == field_identifier) {

diff --git a/components/password_manager/core/browser/password_form_manager.h b/components/password_manager/core/browser/password_form_manager.h
index eba5453..b0aea1e 100644
--- a/components/password_manager/core/browser/password_form_manager.h
+++ b/components/password_manager/core/browser/password_form_manager.h

@@ -154,6 +154,7 @@
   void OnNoInteraction(bool is_update) override;
   void PermanentlyBlacklist() override;
   void OnPasswordsRevealed() override;
+  void MoveCredentialsToAccountStore() override;
 
   bool IsNewLogin() const;
   FormFetcher* GetFormFetcher();
@@ -180,14 +181,13 @@
                                 const base::string16& generated_password,
                                 const base::string16& generation_element);
 
-  // Updates the presaved credential with the generated password when the user
-  // types in field with |field_identifier|, which is in form with
-  // |form_identifier| and the field value is |field_value|. Return true if
-  // |*this| manages a form with name |form_identifier|.
-  bool UpdateGeneratedPasswordOnUserInput(
-      const base::string16& form_identifier,
-      const base::string16& field_identifier,
-      const base::string16& field_value);
+  // Return false and do nothing if |form_identifier| does not correspond to
+  // |observed_form_|. Otherwise set a value of the field with
+  // |field_identifier| of |observed_form_| to |field_value|. In case if there
+  // is a presaved credential this function updates the presaved credential.
+  bool UpdateStateOnUserInput(const base::string16& form_identifier,
+                              const base::string16& field_identifier,
+                              const base::string16& field_value);
 #endif  // defined(OS_IOS)
 
   // Create a copy of |*this| which can be passed to the code handling
@@ -211,6 +211,9 @@
   FormSaver* form_saver() const {
     return password_save_manager_->GetFormSaver();
   }
+
+  const autofill::FormData& observed_form() { return observed_form_; }
+
 #endif
 
  protected:

diff --git a/components/password_manager/core/browser/password_form_manager_for_ui.h b/components/password_manager/core/browser/password_form_manager_for_ui.h
index ddfecaa..558c3ed9 100644
--- a/components/password_manager/core/browser/password_form_manager_for_ui.h
+++ b/components/password_manager/core/browser/password_form_manager_for_ui.h

@@ -95,6 +95,10 @@
 
   // Called when the passwords were shown on on the bubble without obfuscation.
   virtual void OnPasswordsRevealed() = 0;
+
+  // A user opted to move the credentials used for a successful login from the
+  // profile store to the account store.
+  virtual void MoveCredentialsToAccountStore() = 0;
 };
 
 }  // namespace  password_manager

diff --git a/components/password_manager/core/browser/password_form_manager_unittest.cc b/components/password_manager/core/browser/password_form_manager_unittest.cc
index 68c6bf1..de1cde4f 100644
--- a/components/password_manager/core/browser/password_form_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_form_manager_unittest.cc

@@ -2052,27 +2052,29 @@
   EXPECT_CALL(form_saver, UpdateReplace(_, _, base::string16(), _))
       .WillOnce(SaveArg<0>(&saved_form));
 
-  form_manager_->UpdateGeneratedPasswordOnUserInput(
-      form_to_presave.name, generation_element, changed_password);
+  form_manager_->UpdateStateOnUserInput(form_to_presave.name,
+                                        generation_element, changed_password);
   EXPECT_EQ(username_field.value, saved_form.username_value);
   EXPECT_EQ(changed_password, saved_form.password_value);
 }
 
-TEST_P(PasswordFormManagerTest, UpdateGeneratedPasswordBeforePresaving) {
+TEST_P(PasswordFormManagerTest, iOSUpdateStateWithoutPresaving) {
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   fetcher_->NotifyFetchCompleted();
   MockFormSaver& form_saver = MockFormSaver::Get(form_manager_.get());
 
-  FormData form_to_presave = observed_form_;
-  const base::string16 generation_element =
-      form_to_presave.fields[kPasswordFieldIndex].unique_id;
-  const base::string16 generation_field_value = ASCIIToUTF16("some_password");
+  const base::string16 password_field =
+      observed_form_.fields[kPasswordFieldIndex].unique_id;
+  const base::string16 new_field_value = ASCIIToUTF16("some_password");
 
   // Check that nothing is saved on changing password, in case when there was no
   // pre-saving.
   EXPECT_CALL(form_saver, Save(_, _, _)).Times(0);
-  form_manager_->UpdateGeneratedPasswordOnUserInput(
-      form_to_presave.name, generation_element, generation_field_value);
+  EXPECT_TRUE(form_manager_->UpdateStateOnUserInput(
+      observed_form_.name, password_field, new_field_value));
+
+  EXPECT_EQ(new_field_value,
+            form_manager_->observed_form().fields[kPasswordFieldIndex].value);
 }
 
 #endif  // defined(OS_IOS)
@@ -2330,6 +2332,7 @@
   std::unique_ptr<PasswordSaveManager> Clone() override {
     return std::make_unique<MockPasswordSaveManager>();
   }
+  MOCK_METHOD0(MoveCredentialsToAccountStore, void());
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockPasswordSaveManager);
@@ -2521,6 +2524,12 @@
   EXPECT_TRUE(form_manager_->IsBlacklisted());
 }
 
+TEST_F(PasswordFormManagerTestWithMockedSaver, MoveCredentialsToAccountStore) {
+  TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
+  EXPECT_CALL(*mock_password_save_manager(), MoveCredentialsToAccountStore());
+  form_manager_->MoveCredentialsToAccountStore();
+}
+
 TEST_F(PasswordFormManagerTestWithMockedSaver, IsNewLogin) {
   EXPECT_CALL(*mock_password_save_manager(), IsNewLogin());
   form_manager_->IsNewLogin();

diff --git a/components/password_manager/core/browser/password_generation_manager.cc b/components/password_manager/core/browser/password_generation_manager.cc
index c0ebd7c..2dff14c 100644
--- a/components/password_manager/core/browser/password_generation_manager.cc
+++ b/components/password_manager/core/browser/password_generation_manager.cc

@@ -63,6 +63,7 @@
   void OnNoInteraction(bool is_update) override;
   void PermanentlyBlacklist() override;
   void OnPasswordsRevealed() override;
+  void MoveCredentialsToAccountStore() override;
 
  private:
   PasswordForm pending_form_;
@@ -170,6 +171,8 @@
 
 void PasswordDataForUI::OnPasswordsRevealed() {}
 
+void PasswordDataForUI::MoveCredentialsToAccountStore() {}
+
 // Returns a form from |matches| that causes a name conflict with |generated|.
 const PasswordForm* FindUsernameConflict(
     const PasswordForm& generated,

diff --git a/components/password_manager/core/browser/password_manager.cc b/components/password_manager/core/browser/password_manager.cc
index ccee3b1..b7e423f6 100644
--- a/components/password_manager/core/browser/password_manager.cc
+++ b/components/password_manager/core/browser/password_manager.cc

@@ -680,13 +680,13 @@
   }
 }
 
-void PasswordManager::UpdateGeneratedPasswordOnUserInput(
+void PasswordManager::UpdateStateOnUserInput(
     const base::string16& form_identifier,
     const base::string16& field_identifier,
     const base::string16& field_value) {
   for (std::unique_ptr<PasswordFormManager>& manager : form_managers_) {
-    if (manager->UpdateGeneratedPasswordOnUserInput(
-            form_identifier, field_identifier, field_value)) {
+    if (manager->UpdateStateOnUserInput(form_identifier, field_identifier,
+                                        field_value)) {
       break;
     }
   }

diff --git a/components/password_manager/core/browser/password_manager.h b/components/password_manager/core/browser/password_manager.h
index 4457754..5c6aa80a 100644
--- a/components/password_manager/core/browser/password_manager.h
+++ b/components/password_manager/core/browser/password_manager.h

@@ -193,14 +193,12 @@
                                 const base::string16& generated_password,
                                 const base::string16& generation_element);
 
-  // Updates the presaved credential with the generated password when the user
-  // types in field with |field_identifier|, which is in form with
-  // |form_identifier| and the field value is |field_value|. |driver|
-  // corresponds to the form parent frame.
-  void UpdateGeneratedPasswordOnUserInput(
-      const base::string16& form_identifier,
-      const base::string16& field_identifier,
-      const base::string16& field_value);
+  // Updates the state if the PasswordFormManager which corresponds to the form
+  // with |form_identifier|. In case if there is a presaved credential it
+  // updates the presaved credential.
+  void UpdateStateOnUserInput(const base::string16& form_identifier,
+                              const base::string16& field_identifier,
+                              const base::string16& field_value);
 
   // Stops treating a password as generated. |driver| corresponds to the
   // form parent frame.

diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index afe7f57..a376c26 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc

@@ -659,8 +659,8 @@
                            FormHasUniqueKey(presaved_form)))
       .WillOnce(SaveArg<0>(&presaved_form));
 
-  manager()->UpdateGeneratedPasswordOnUserInput(
-      form_data.name, generation_element, generated_password);
+  manager()->UpdateStateOnUserInput(form_data.name, generation_element,
+                                    generated_password);
   Mock::VerifyAndClearExpectations(store_.get());
 
   // Test when the user is changing the username, presaved credential is
@@ -671,8 +671,7 @@
                   FormUsernamePasswordAre(username, generated_password),
                   FormHasUniqueKey(presaved_form)));
 
-  manager()->UpdateGeneratedPasswordOnUserInput(form_data.name,
-                                                username_element, username);
+  manager()->UpdateStateOnUserInput(form_data.name, username_element, username);
 }
 
 TEST_F(PasswordManagerTest, SavingGeneratedPasswordOnIOS) {
@@ -698,8 +697,8 @@
 
   EXPECT_CALL(*store_, UpdateLoginWithPrimaryKey(_, _));
   // Test when the user is changing the generated password.
-  manager()->UpdateGeneratedPasswordOnUserInput(
-      form_data.name, generation_element, generated_password);
+  manager()->UpdateStateOnUserInput(form_data.name, generation_element,
+                                    generated_password);
 
   // The user is submitting the form.
   form_data.fields[0].value = username;

diff --git a/components/password_manager/core/browser/password_save_manager.h b/components/password_manager/core/browser/password_save_manager.h
index abeca5a..02a3297c 100644
--- a/components/password_manager/core/browser/password_save_manager.h
+++ b/components/password_manager/core/browser/password_save_manager.h

@@ -76,6 +76,10 @@
   // Signals that the user cancels password generation.
   virtual void PasswordNoLongerGenerated() = 0;
 
+  // Moves the pending credentials together with any other PSL matched ones from
+  // the profile store to the account store.
+  virtual void MoveCredentialsToAccountStore() = 0;
+
   virtual bool IsNewLogin() const = 0;
   virtual bool IsPasswordUpdate() const = 0;
   virtual bool HasGeneratedPassword() const = 0;

diff --git a/components/password_manager/core/browser/password_save_manager_impl.cc b/components/password_manager/core/browser/password_save_manager_impl.cc
index 4e545a5..7683b10 100644
--- a/components/password_manager/core/browser/password_save_manager_impl.cc
+++ b/components/password_manager/core/browser/password_save_manager_impl.cc

@@ -331,6 +331,11 @@
       PasswordFormMetricsRecorder::GeneratedPasswordStatus::kPasswordDeleted);
 }
 
+void PasswordSaveManagerImpl::MoveCredentialsToAccountStore() {
+  // Moving credentials is only supported in MultiStorePasswordSaveManager.
+  NOTREACHED();
+}
+
 bool PasswordSaveManagerImpl::IsNewLogin() const {
   return pending_credentials_state_ == PendingCredentialsState::NEW_LOGIN ||
          pending_credentials_state_ == PendingCredentialsState::AUTOMATIC_SAVE;

diff --git a/components/password_manager/core/browser/password_save_manager_impl.h b/components/password_manager/core/browser/password_save_manager_impl.h
index 00a5415..731817b4 100644
--- a/components/password_manager/core/browser/password_save_manager_impl.h
+++ b/components/password_manager/core/browser/password_save_manager_impl.h

@@ -63,6 +63,8 @@
   // Signals that the user cancels password generation.
   void PasswordNoLongerGenerated() override;
 
+  void MoveCredentialsToAccountStore() override;
+
   bool IsNewLogin() const override;
   bool IsPasswordUpdate() const override;
   bool HasGeneratedPassword() const override;
@@ -105,6 +107,9 @@
   PendingCredentialsState pending_credentials_state_ =
       PendingCredentialsState::NONE;
 
+  // FormFetcher instance which owns the login data from PasswordStore.
+  const FormFetcher* form_fetcher_;
+
  private:
   // Create pending credentials from provisionally saved form when this form
   // represents credentials that were not previously saved.
@@ -128,9 +133,6 @@
   // Handles the user flows related to the generation.
   std::unique_ptr<PasswordGenerationManager> generation_manager_;
 
-  // FormFetcher instance which owns the login data from PasswordStore.
-  const FormFetcher* form_fetcher_;
-
   // Takes care of recording metrics and events for |*this|.
   scoped_refptr<PasswordFormMetricsRecorder> metrics_recorder_;
 

diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index f3b0b90..9d49147 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json

@@ -11389,6 +11389,51 @@
       If not specified, will not modify the Variations seed URL.''',
     },
     {
+      'name': 'ChromeVariations',
+      'owners': ['pastarmovj@chromium.org', 'asvitkine@chromium.org'],
+      'type': 'int-enum',
+      'schema': {
+        'type': 'integer',
+        'enum': [0,1,2],
+      },
+      'items': [
+        {
+          'name': 'VariationsEnabled',
+          'value': 0,
+          'caption': '''Enable all variations''',
+        },
+        {
+          'name': 'CriticalFixesOnly',
+          'value': 1,
+          'caption': '''Enable variations concerning criticial fixes only''',
+        },
+        {
+          'name': 'VariationsDisabled',
+          'value': 2,
+          'caption': '''Disable all variations''',
+        },
+      ],
+      'supported_on': ['chrome.*:81-', 'chrome_os:81-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'future': True,
+      'example_value': 1,
+      'id': 663,
+      'caption': '''Determine the availability of variations''',
+      'tags': [],
+      'desc': '''Configuring this policy allows to specify which variations are allowed to be applied in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
+
+      Variations provide a mean for offering modifications to <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> without shipping a new version of the browser by selectively enabling or disabling already existing features.
+
+      Setting the <ph name="VARIATIONS_ENABLED_OPTION_NAME">VariationsEnabled</ph> (value 0), or leaving the policy not set allows all variations to be applied to the browser.
+
+      Setting the <ph name="CRITICAL_VARIATIONS_ONLY_OPTION_NAME">CriticalFixesOnly</ph> (value 1), allows only variations considered critical security or stability fixes to be applied to <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
+
+      Setting the <ph name="VARIATIONS_DISABLED_OPTION_NAME">VariationsDisabled</ph> (value 2), prevent all variations from being applied to the browser. Please note that this mode can potentially prevent the <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> developers from providing criticial security fixes in a timely manner and is thus not recommended.'''
+    },
+    {
       'name': 'AttestationEnabledForDevice',
       'owners': ['file://components/policy/resources/OWNERS'],
       'type': 'main',
@@ -20338,6 +20383,6 @@
   ],
   'placeholders': [],
   'deleted_policy_ids': [412, 546, 562, 569, 578],
-  'highest_id_currently_used': 662,
+  'highest_id_currently_used': 663,
   'highest_atomic_group_id_currently_used': 38
 }

diff --git a/components/sync/driver/profile_sync_service.cc b/components/sync/driver/profile_sync_service.cc
index cd986e4..ccc4dd65 100644
--- a/components/sync/driver/profile_sync_service.cc
+++ b/components/sync/driver/profile_sync_service.cc

@@ -694,7 +694,6 @@
   // If Sync is disabled via command line flag, then ProfileSyncService
   // shouldn't even be instantiated.
   DCHECK(switches::IsSyncAllowedByFlag());
-
   DisableReasonSet result;
   if (!user_settings_->IsSyncAllowedByPlatform()) {
     result.Put(DISABLE_REASON_PLATFORM_OVERRIDE);
@@ -715,7 +714,11 @@
     result.Put(DISABLE_REASON_UNRECOVERABLE_ERROR);
   }
   if (base::FeatureList::IsEnabled(switches::kStopSyncInPausedState)) {
-    if (auth_manager_->IsSyncPaused()) {
+    // Some crashes on Chrome OS (crbug.com/1043642) suggest that
+    // ProfileSyncService gets called after its shutdown. It's not clear why
+    // this actually happens. To avoid crashes check that |auth_manager_| isn't
+    // null.
+    if (auth_manager_ && auth_manager_->IsSyncPaused()) {
       result.Put(DISABLE_REASON_PAUSED);
     }
   }

diff --git a/components/sync/driver/profile_sync_service_unittest.cc b/components/sync/driver/profile_sync_service_unittest.cc
index 2ed8429..c0ea431 100644
--- a/components/sync/driver/profile_sync_service_unittest.cc
+++ b/components/sync/driver/profile_sync_service_unittest.cc

@@ -323,6 +323,19 @@
   std::unique_ptr<ProfileSyncService> service_;
 };
 
+class ProfileSyncServiceTestWithStopSyncInPausedState
+    : public ProfileSyncServiceTest {
+ public:
+  ProfileSyncServiceTestWithStopSyncInPausedState() {
+    override_features_.InitAndEnableFeature(switches::kStopSyncInPausedState);
+  }
+
+  ~ProfileSyncServiceTestWithStopSyncInPausedState() override = default;
+
+ private:
+  base::test::ScopedFeatureList override_features_;
+};
+
 // Gets the now time used for testing user demographics.
 base::Time GetNowTime() {
   base::Time now;
@@ -1525,5 +1538,16 @@
   EXPECT_FALSE(service()->GetExperimentalAuthenticationKey());
 }
 
+// Regression test for crbug.com/1043642, can be removed once
+// ProfileSyncService usages after shutdown are addressed.
+TEST_F(ProfileSyncServiceTestWithStopSyncInPausedState,
+       ShouldProvideDisableReasonsAfterShutdown) {
+  CreateService(ProfileSyncService::AUTO_START);
+  InitializeForFirstSync();
+  SignIn();
+  service()->Shutdown();
+  EXPECT_FALSE(service()->GetDisableReasons().Empty());
+}
+
 }  // namespace
 }  // namespace syncer

diff --git a/components/sync/model/model_type_sync_bridge.cc b/components/sync/model/model_type_sync_bridge.cc
index 6edcdc8..e9b801a 100644
--- a/components/sync/model/model_type_sync_bridge.cc
+++ b/components/sync/model/model_type_sync_bridge.cc

@@ -54,6 +54,11 @@
   }
 }
 
+void ModelTypeSyncBridge::OnCommitAttemptErrors(
+    const syncer::FailedCommitResponseDataList& error_response_list) {
+  // By default the bridge just ignores failed commit items.
+}
+
 size_t ModelTypeSyncBridge::EstimateSyncOverheadMemoryUsage() const {
   return 0U;
 }

diff --git a/components/sync/model/model_type_sync_bridge.h b/components/sync/model/model_type_sync_bridge.h
index fbe02684..ba9c449e 100644
--- a/components/sync/model/model_type_sync_bridge.h
+++ b/components/sync/model/model_type_sync_bridge.h

@@ -11,6 +11,7 @@
 
 #include "base/callback.h"
 #include "base/optional.h"
+#include "components/sync/engine/non_blocking_sync_common.h"
 #include "components/sync/model/entity_change.h"
 #include "components/sync/model/model_type_change_processor.h"
 
@@ -162,6 +163,11 @@
   virtual void ApplyStopSyncChanges(
       std::unique_ptr<MetadataChangeList> delete_metadata_change_list);
 
+  // Called only when some items in a commit haven't been committed due to an
+  // error.
+  virtual void OnCommitAttemptErrors(
+      const syncer::FailedCommitResponseDataList& error_response_list);
+
   // Returns an estimate of memory usage attributed to sync (that is, excludes
   // the actual model). Because the resulting UMA metrics are often used to
   // compare with the non-USS equivalent implementations (SyncableService), it's

diff --git a/components/sync/model_impl/client_tag_based_model_type_processor.cc b/components/sync/model_impl/client_tag_based_model_type_processor.cc
index 4290dd5..966fe474 100644
--- a/components/sync/model_impl/client_tag_based_model_type_processor.cc
+++ b/components/sync/model_impl/client_tag_based_model_type_processor.cc

@@ -635,9 +635,13 @@
     entity_kv.second->ClearTransientSyncState();
   }
 
-  // TODO(crbug.com/1034923): Propagate failed items to bridge.
   base::Optional<ModelError> error = bridge_->ApplySyncChanges(
       std::move(metadata_change_list), std::move(entity_change_list));
+
+  if (!error_response_list.empty()) {
+    bridge_->OnCommitAttemptErrors(error_response_list);
+  }
+
   if (error) {
     ReportError(*error);
   }

diff --git a/components/sync/model_impl/client_tag_based_model_type_processor_unittest.cc b/components/sync/model_impl/client_tag_based_model_type_processor_unittest.cc
index 5c276c7..cb41a95 100644
--- a/components/sync/model_impl/client_tag_based_model_type_processor_unittest.cc
+++ b/components/sync/model_impl/client_tag_based_model_type_processor_unittest.cc

@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/run_loop.h"
 #include "base/test/metrics/histogram_tester.h"
@@ -21,6 +22,7 @@
 #include "components/sync/base/sync_mode.h"
 #include "components/sync/base/time.h"
 #include "components/sync/engine/data_type_activation_response.h"
+#include "components/sync/engine/non_blocking_sync_common.h"
 #include "components/sync/model/conflict_resolution.h"
 #include "components/sync/model/data_type_activation_request.h"
 #include "components/sync/model/fake_model_type_sync_bridge.h"
@@ -165,6 +167,18 @@
     }
   }
 
+  void OnCommitAttemptErrors(
+      const FailedCommitResponseDataList& error_response_list) override {
+    if (!on_commit_attempt_errors_callback_.is_null()) {
+      std::move(on_commit_attempt_errors_callback_).Run(error_response_list);
+    }
+  }
+
+  void SetOnCommitAttemptErrorsCallback(
+      base::OnceCallback<void(const FailedCommitResponseDataList&)> callback) {
+    on_commit_attempt_errors_callback_ = std::move(callback);
+  }
+
  private:
   void CaptureDataCallback(DataCallback callback,
                            std::unique_ptr<DataBatch> data) {
@@ -186,6 +200,9 @@
   // Whether to return GetData results synchronously. Overrides the default
   // callback capture behavior if set to true.
   bool synchronous_data_callback_ = false;
+
+  base::OnceCallback<void(const FailedCommitResponseDataList&)>
+      on_commit_attempt_errors_callback_;
 };
 
 }  // namespace
@@ -2429,6 +2446,57 @@
   EXPECT_TRUE(type_processor()->IsTrackingEntityForTest(kStorageKey2));
 }
 
+TEST_F(ClientTagBasedModelTypeProcessorTest,
+       ShouldPropagateFailedCommitItemsToBridgeWhenCommitCompleted) {
+  FailedCommitResponseData response_data;
+  response_data.client_tag_hash = GetHash("dummy tag");
+  response_data.response_type = sync_pb::CommitResponse::TRANSIENT_ERROR;
+
+  FailedCommitResponseDataList failed_list;
+  failed_list.push_back(response_data);
+
+  FailedCommitResponseDataList actual_error_response_list;
+
+  auto on_commit_attempt_errors_callback = base::BindOnce(
+      [](FailedCommitResponseDataList* actual_error_response_list,
+         const FailedCommitResponseDataList& error_response_list) {
+        // We put expectations outside of the callback, so that they fail if
+        // callback is not ran.
+        *actual_error_response_list = error_response_list;
+      },
+      &actual_error_response_list);
+
+  bridge()->SetOnCommitAttemptErrorsCallback(
+      std::move(on_commit_attempt_errors_callback));
+
+  type_processor()->OnCommitCompleted(
+      model_type_state(),
+      /*committed_response_list=*/CommitResponseDataList(), failed_list);
+
+  ASSERT_EQ(1u, actual_error_response_list.size());
+  EXPECT_EQ(response_data.client_tag_hash,
+            actual_error_response_list[0].client_tag_hash);
+  EXPECT_EQ(response_data.response_type,
+            actual_error_response_list[0].response_type);
+}
+
+TEST_F(ClientTagBasedModelTypeProcessorTest,
+       ShouldNotPropagateFailedCommitAttemptToBridgeWhenNoFailedItems) {
+  auto on_commit_attempt_errors_callback = base::BindOnce(
+      [](const FailedCommitResponseDataList& error_response_list) {
+        ADD_FAILURE()
+            << "OnCommitAttemptErrors is called when no failed items.";
+      });
+
+  bridge()->SetOnCommitAttemptErrorsCallback(
+      std::move(on_commit_attempt_errors_callback));
+
+  type_processor()->OnCommitCompleted(
+      model_type_state(),
+      /*committed_response_list=*/CommitResponseDataList(),
+      /*rror_response_list=*/FailedCommitResponseDataList());
+}
+
 class CommitOnlyClientTagBasedModelTypeProcessorTest
     : public ClientTagBasedModelTypeProcessorTest {
  protected:

diff --git a/components/variations/pref_names.cc b/components/variations/pref_names.cc
index b75b75a..f1cd8d1 100644
--- a/components/variations/pref_names.cc
+++ b/components/variations/pref_names.cc

@@ -94,5 +94,11 @@
 // Digital signature of the binary variations seed data, base64-encoded.
 const char kVariationsSeedSignature[] = "variations_seed_signature";
 
+// Reflects the state of the "ChromeVariations" policy which determines
+// if and which variations should be enabled for the client. The possible
+// values are defined in the VariationsService::RestrictionPolicyValues enum.
+const char kVariationsRestrictionsByPolicy[] =
+    "variations_restrictions_by_policy";
+
 }  // namespace prefs
 }  // namespace variations

diff --git a/components/variations/pref_names.h b/components/variations/pref_names.h
index a1f2e1d..9781532 100644
--- a/components/variations/pref_names.h
+++ b/components/variations/pref_names.h

@@ -28,6 +28,7 @@
 extern const char kVariationsSafeSeedSignature[];
 extern const char kVariationsSeedDate[];
 extern const char kVariationsSeedSignature[];
+extern const char kVariationsRestrictionsByPolicy[];
 
 }  // namespace prefs
 }  // namespace variations

diff --git a/components/variations/service/variations_service.cc b/components/variations/service/variations_service.cc
index e17e607..e94b7d5 100644
--- a/components/variations/service/variations_service.cc
+++ b/components/variations/service/variations_service.cc

@@ -462,6 +462,11 @@
   // This preference keeps track of the country code used to filter
   // permanent-consistency studies.
   registry->RegisterListPref(prefs::kVariationsPermanentConsistencyCountry);
+  // This preference keeps track of ChromeVariations enum policy which
+  // allows the admin to restrict the set of variations applied.
+  registry->RegisterIntegerPref(
+      prefs::kVariationsRestrictionsByPolicy,
+      static_cast<int>(RestrictionPolicyValues::NO_RESTRICTIONS));
 }
 
 // static

diff --git a/components/variations/service/variations_service.h b/components/variations/service/variations_service.h
index 43f89ad9..183d0664 100644
--- a/components/variations/service/variations_service.h
+++ b/components/variations/service/variations_service.h

@@ -85,6 +85,17 @@
     virtual ~Observer() {}
   };
 
+  // The values of the ChromeVariations policy. Those should be kept in sync
+  // with the values defined in policy_templates.json!
+  enum class RestrictionPolicyValues {
+    // No restrictions applied by policy. Default value when policy not set.
+    NO_RESTRICTIONS = 0,
+    // Only critical security variations should be applied.
+    CRITICAL_ONLY = 1,
+    // All variations disabled. Disables the variations framework altogether.
+    ALL = 2
+  };
+
   ~VariationsService() override;
 
   // Enum used to choose whether GetVariationsServerURL will return an HTTPS

diff --git a/content/browser/frame_host/ancestor_throttle.cc b/content/browser/frame_host/ancestor_throttle.cc
index add93340..14a643c5 100644
--- a/content/browser/frame_host/ancestor_throttle.cc
+++ b/content/browser/frame_host/ancestor_throttle.cc

@@ -187,10 +187,11 @@
     return NavigationThrottle::PROCEED;
   }
 
-  // Downloads should be exempt from checking for X-Frame-Options, so
-  // proceed if this is a download.
-  if (request->IsDownload())
+  // 204/205 responses and downloads are not sent to the renderer and don't need
+  // to be checked.
+  if (is_response_check && !request->response_should_be_rendered()) {
     return NavigationThrottle::PROCEED;
+  }
 
   // Evaluate whether the navigation should be allowed or blocked based on
   // existing content-security-policy on the response.
@@ -238,8 +239,8 @@
   }
 
   std::string header_value;
-  HeaderDisposition disposition =
-      ParseHeader(request->GetResponseHeaders(), &header_value);
+  HeaderDisposition disposition = ParseHeader(request->GetResponseHeaders(),
+                                              &header_value, is_response_check);
 
   switch (disposition) {
     case HeaderDisposition::CONFLICT:
@@ -362,7 +363,8 @@
 
 AncestorThrottle::HeaderDisposition AncestorThrottle::ParseHeader(
     const net::HttpResponseHeaders* headers,
-    std::string* header_value) {
+    std::string* header_value,
+    bool is_response_check) {
   DCHECK(header_value);
   if (!headers)
     return HeaderDisposition::NONE;
@@ -405,8 +407,9 @@
   if (result != HeaderDisposition::NONE &&
       result != HeaderDisposition::ALLOWALL &&
       HeadersContainFrameAncestorsCSP(headers)) {
-    DCHECK(!base::FeatureList::IsEnabled(
-        network::features::kOutOfBlinkFrameAncestors));
+    DCHECK(!is_response_check ||
+           !base::FeatureList::IsEnabled(
+               network::features::kOutOfBlinkFrameAncestors));
     // TODO(mkwst): 'frame-ancestors' is currently handled in Blink. We should
     // handle it here instead. Until then, don't block the request, and let
     // Blink handle it. https://crbug.com/555418

diff --git a/content/browser/frame_host/ancestor_throttle.h b/content/browser/frame_host/ancestor_throttle.h
index 2e1cbda..3bdeeb10 100644
--- a/content/browser/frame_host/ancestor_throttle.h
+++ b/content/browser/frame_host/ancestor_throttle.h

@@ -61,7 +61,8 @@
   // or INVALID, |header_value| will be populated with the value which caused
   // the parse error.
   HeaderDisposition ParseHeader(const net::HttpResponseHeaders* headers,
-                                std::string* header_value);
+                                std::string* header_value,
+                                bool is_response_check);
 
   DISALLOW_COPY_AND_ASSIGN(AncestorThrottle);
 };

diff --git a/content/browser/frame_host/ancestor_throttle_browsertest.cc b/content/browser/frame_host/ancestor_throttle_browsertest.cc
index 1729803..3b101e9 100644
--- a/content/browser/frame_host/ancestor_throttle_browsertest.cc
+++ b/content/browser/frame_host/ancestor_throttle_browsertest.cc

@@ -118,6 +118,21 @@
                   .opaque());
 }
 
+// Check that we don't process CSP for 204 responses.
+IN_PROC_BROWSER_TEST_P(AncestorThrottleTest, Response204CSP) {
+  GURL parent_url(
+      embedded_test_server()->GetURL("foo.com", "/page_with_iframe.html"));
+  GURL iframe_url(embedded_test_server()->GetURL(
+      "foo.com", "/response204-csp-frame-ancestors-none"));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_TRUE(NavigateToURL(web_contents, parent_url));
+  EXPECT_TRUE(NavigateIframeToURL(web_contents, "test_iframe", iframe_url));
+
+  // Not crashing means that the test succeeded.
+}
+
 INSTANTIATE_TEST_SUITE_P(All, AncestorThrottleTest, ::testing::Bool());
 
 }  // namespace

diff --git a/content/browser/frame_host/ancestor_throttle_unittest.cc b/content/browser/frame_host/ancestor_throttle_unittest.cc
index 605d8a4..b414014 100644
--- a/content/browser/frame_host/ancestor_throttle_unittest.cc
+++ b/content/browser/frame_host/ancestor_throttle_unittest.cc

@@ -89,7 +89,7 @@
         GetAncestorHeaders(test.header, nullptr);
     std::string header_value;
     EXPECT_EQ(test.expected,
-              throttle.ParseHeader(headers.get(), &header_value));
+              throttle.ParseHeader(headers.get(), &header_value, true));
     EXPECT_EQ(test.value, header_value);
   }
 }
@@ -124,7 +124,7 @@
         GetAncestorHeaders(test.header, nullptr);
     std::string header_value;
     EXPECT_EQ(test.expected,
-              throttle.ParseHeader(headers.get(), &header_value));
+              throttle.ParseHeader(headers.get(), &header_value, true));
     EXPECT_EQ(test.failure, header_value);
   }
 }
@@ -184,7 +184,7 @@
         GetAncestorHeaders("DENY", test.csp);
     std::string header_value;
     EXPECT_EQ(test.expected,
-              throttle.ParseHeader(headers.get(), &header_value));
+              throttle.ParseHeader(headers.get(), &header_value, true));
     EXPECT_EQ("DENY", header_value);
   }
 }

diff --git a/content/browser/frame_host/navigation_request.h b/content/browser/frame_host/navigation_request.h
index 5a332b0c..676a005e 100644
--- a/content/browser/frame_host/navigation_request.h
+++ b/content/browser/frame_host/navigation_request.h

@@ -516,6 +516,17 @@
 
   std::unique_ptr<PeakGpuMemoryTracker> TakePeakGpuMemoryTracker();
 
+  // Returns true for navigation responses to be rendered in a renderer process.
+  // This excludes:
+  //  - 204/205 navigation responses.
+  //  - downloads.
+  //
+  // Must not be called before having received the response.
+  bool response_should_be_rendered() const {
+    DCHECK_GE(state_, WILL_PROCESS_RESPONSE);
+    return response_should_be_rendered_;
+  }
+
  private:
   friend class NavigationRequestTest;
 

diff --git a/content/browser/service_worker/embedded_worker_instance_unittest.cc b/content/browser/service_worker/embedded_worker_instance_unittest.cc
index ad5da71b..e77cfa3 100644
--- a/content/browser/service_worker/embedded_worker_instance_unittest.cc
+++ b/content/browser/service_worker/embedded_worker_instance_unittest.cc

@@ -118,9 +118,7 @@
     RegistrationAndVersionPair pair;
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = scope;
-    pair.first = base::MakeRefCounted<ServiceWorkerRegistration>(
-        options, context()->storage()->NewRegistrationId(),
-        context()->AsWeakPtr());
+    pair.first = context()->registry()->CreateNewRegistration(options);
     pair.second = base::MakeRefCounted<ServiceWorkerVersion>(
         pair.first.get(), script_url, blink::mojom::ScriptType::kClassic,
         context()->storage()->NewVersionId(), context()->AsWeakPtr());

diff --git a/content/browser/service_worker/service_worker_navigation_loader_unittest.cc b/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
index c39ded4..dc09ea2 100644
--- a/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
+++ b/content/browser/service_worker/service_worker_navigation_loader_unittest.cc

@@ -342,8 +342,7 @@
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = GURL("https://example.com/");
     registration_ =
-        new ServiceWorkerRegistration(options, storage()->NewRegistrationId(),
-                                      helper_->context()->AsWeakPtr());
+        helper_->context()->registry()->CreateNewRegistration(options);
     version_ = new ServiceWorkerVersion(
         registration_.get(), GURL("https://example.com/service_worker.js"),
         blink::mojom::ScriptType::kClassic, storage()->NewVersionId(),

diff --git a/content/browser/service_worker/service_worker_new_script_loader_unittest.cc b/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
index fa308e3e..e3d66ae 100644
--- a/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
+++ b/content/browser/service_worker/service_worker_new_script_loader_unittest.cc

@@ -180,9 +180,7 @@
   void SetUpRegistrationWithOptions(
       const GURL& script_url,
       blink::mojom::ServiceWorkerRegistrationOptions options) {
-    registration_ = base::MakeRefCounted<ServiceWorkerRegistration>(
-        options, context()->storage()->NewRegistrationId(),
-        context()->AsWeakPtr());
+    registration_ = context()->registry()->CreateNewRegistration(options);
     SetUpVersion(script_url);
   }
 

diff --git a/content/browser/service_worker/service_worker_object_host_unittest.cc b/content/browser/service_worker/service_worker_object_host_unittest.cc
index 9913030..174e554 100644
--- a/content/browser/service_worker/service_worker_object_host_unittest.cc
+++ b/content/browser/service_worker/service_worker_object_host_unittest.cc

@@ -116,9 +116,8 @@
 
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = scope;
-    registration_ = new ServiceWorkerRegistration(
-        options, helper_->context()->storage()->NewRegistrationId(),
-        helper_->context()->AsWeakPtr());
+    registration_ =
+        helper_->context()->registry()->CreateNewRegistration(options);
     version_ = new ServiceWorkerVersion(
         registration_.get(), script_url, blink::mojom::ScriptType::kClassic,
         helper_->context()->storage()->NewVersionId(),

diff --git a/content/browser/service_worker/service_worker_register_job.cc b/content/browser/service_worker/service_worker_register_job.cc
index 4a08d52e..e923c75 100644
--- a/content/browser/service_worker/service_worker_register_job.cc
+++ b/content/browser/service_worker/service_worker_register_job.cc

@@ -422,16 +422,16 @@
 void ServiceWorkerRegisterJob::RegisterAndContinue() {
   SetPhase(REGISTER);
 
-  int64_t registration_id = context_->storage()->NewRegistrationId();
-  if (registration_id == blink::mojom::kInvalidServiceWorkerRegistrationId) {
+  blink::mojom::ServiceWorkerRegistrationOptions options(
+      scope_, worker_script_type_, update_via_cache_);
+  scoped_refptr<ServiceWorkerRegistration> new_registration =
+      context_->registry()->CreateNewRegistration(options);
+  if (!new_registration) {
     Complete(blink::ServiceWorkerStatusCode::kErrorAbort);
     return;
   }
 
-  blink::mojom::ServiceWorkerRegistrationOptions options(
-      scope_, worker_script_type_, update_via_cache_);
-  set_registration(new ServiceWorkerRegistration(options, registration_id,
-                                                 context_->AsWeakPtr()));
+  set_registration(std::move(new_registration));
   AddRegistrationToMatchingProviderHosts(registration());
   UpdateAndContinue();
 }

diff --git a/content/browser/service_worker/service_worker_registration.h b/content/browser/service_worker/service_worker_registration.h
index 6f6c54e..aeafeea 100644
--- a/content/browser/service_worker/service_worker_registration.h
+++ b/content/browser/service_worker/service_worker_registration.h

@@ -71,6 +71,8 @@
     kUninstalled,
   };
 
+  // The constructor should be called only from ServiceWorkerRegistry other than
+  // tests.
   ServiceWorkerRegistration(
       const blink::mojom::ServiceWorkerRegistrationOptions& options,
       int64_t registration_id,

diff --git a/content/browser/service_worker/service_worker_registration_unittest.cc b/content/browser/service_worker/service_worker_registration_unittest.cc
index 5871b96..e37df62b 100644
--- a/content/browser/service_worker/service_worker_registration_unittest.cc
+++ b/content/browser/service_worker/service_worker_registration_unittest.cc

@@ -345,8 +345,7 @@
   blink::mojom::ServiceWorkerRegistrationOptions options;
   options.scope = kScope;
   scoped_refptr<ServiceWorkerRegistration> registration =
-      base::MakeRefCounted<ServiceWorkerRegistration>(
-          options, storage()->NewRegistrationId(), context()->AsWeakPtr());
+      context()->registry()->CreateNewRegistration(options);
   scoped_refptr<ServiceWorkerVersion> version_1 =
       base::MakeRefCounted<ServiceWorkerVersion>(
           registration.get(), kScript, blink::mojom::ScriptType::kClassic,
@@ -394,8 +393,7 @@
 
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = kScope;
-    registration_ = base::MakeRefCounted<ServiceWorkerRegistration>(
-        options, storage()->NewRegistrationId(), context()->AsWeakPtr());
+    registration_ = context()->registry()->CreateNewRegistration(options);
 
     // Create an active version.
     scoped_refptr<ServiceWorkerVersion> version_1 =
@@ -881,12 +879,11 @@
     return status.value();
   }
 
-  scoped_refptr<ServiceWorkerRegistration> CreateRegistration(
+  scoped_refptr<ServiceWorkerRegistration> CreateNewRegistration(
       const GURL& scope) {
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = scope;
-    return base::MakeRefCounted<ServiceWorkerRegistration>(
-        options, storage()->NewRegistrationId(), context()->AsWeakPtr());
+    return context()->registry()->CreateNewRegistration(options);
   }
 
   scoped_refptr<ServiceWorkerVersion> CreateVersion(
@@ -914,7 +911,7 @@
 
     // Prepare ServiceWorkerRegistration and ServiceWorkerVersion.
     scoped_refptr<ServiceWorkerRegistration> registration =
-        CreateRegistration(scope);
+        CreateNewRegistration(scope);
     scoped_refptr<ServiceWorkerVersion> version =
         CreateVersion(registration.get(), script_url);
 
@@ -1113,7 +1110,7 @@
   const GURL kScope("https://www.example.com/");
   const GURL kScriptUrl("https://www.example.com/sw.js");
   scoped_refptr<ServiceWorkerRegistration> registration =
-      CreateRegistration(kScope);
+      CreateNewRegistration(kScope);
   scoped_refptr<ServiceWorkerVersion> version =
       CreateVersion(registration.get(), kScriptUrl);
 
@@ -1144,7 +1141,7 @@
   const GURL kScope("https://www.example.com/");
   const GURL kScriptUrl("https://www.example.com/sw.js");
   scoped_refptr<ServiceWorkerRegistration> registration =
-      CreateRegistration(kScope);
+      CreateNewRegistration(kScope);
 
   scoped_refptr<ServiceWorkerVersion> version =
       CreateVersion(registration.get(), kScriptUrl);

diff --git a/content/browser/service_worker/service_worker_registry.cc b/content/browser/service_worker/service_worker_registry.cc
index 55485a2..36d902a 100644
--- a/content/browser/service_worker/service_worker_registry.cc
+++ b/content/browser/service_worker/service_worker_registry.cc

@@ -64,6 +64,16 @@
 
 ServiceWorkerRegistry::~ServiceWorkerRegistry() = default;
 
+scoped_refptr<ServiceWorkerRegistration>
+ServiceWorkerRegistry::CreateNewRegistration(
+    blink::mojom::ServiceWorkerRegistrationOptions options) {
+  int64_t registration_id = storage()->NewRegistrationId();
+  if (registration_id == blink::mojom::kInvalidServiceWorkerRegistrationId)
+    return nullptr;
+  return base::MakeRefCounted<ServiceWorkerRegistration>(
+      std::move(options), registration_id, context_->AsWeakPtr());
+}
+
 void ServiceWorkerRegistry::FindRegistrationForClientUrl(
     const GURL& client_url,
     FindRegistrationCallback callback) {

diff --git a/content/browser/service_worker/service_worker_registry.h b/content/browser/service_worker/service_worker_registry.h
index 2e06d6ec8..179b8b8 100644
--- a/content/browser/service_worker/service_worker_registry.h
+++ b/content/browser/service_worker/service_worker_registry.h

@@ -68,6 +68,12 @@
 
   ServiceWorkerStorage* storage() const { return storage_.get(); }
 
+  // Creates a new in-memory representation of registration. Can be null when
+  // storage is disabled. This method must be called after storage is
+  // initialized.
+  scoped_refptr<ServiceWorkerRegistration> CreateNewRegistration(
+      blink::mojom::ServiceWorkerRegistrationOptions options);
+
   // TODO(crbug.com/1039200): Move corresponding comments from
   // ServiceWorkerStorage.
   void FindRegistrationForClientUrl(const GURL& client_url,

diff --git a/content/browser/service_worker/service_worker_test_utils.cc b/content/browser/service_worker/service_worker_test_utils.cc
index 52ef915..f3b4b58 100644
--- a/content/browser/service_worker/service_worker_test_utils.cc
+++ b/content/browser/service_worker/service_worker_test_utils.cc

@@ -355,8 +355,7 @@
 
   blink::mojom::ServiceWorkerRegistrationOptions options;
   options.scope = scope;
-  auto registration = base::MakeRefCounted<ServiceWorkerRegistration>(
-      options, storage->NewRegistrationId(), context->AsWeakPtr());
+  auto registration = context->registry()->CreateNewRegistration(options);
   auto version = base::MakeRefCounted<ServiceWorkerVersion>(
       registration.get(), script, blink::mojom::ScriptType::kClassic,
       storage->NewVersionId(), context->AsWeakPtr());

diff --git a/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc b/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc
index ebd09c25..0c975777 100644
--- a/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc
+++ b/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc

@@ -98,9 +98,7 @@
   void SetUpRegistrationWithOptions(
       const GURL& script_url,
       blink::mojom::ServiceWorkerRegistrationOptions options) {
-    registration_ = base::MakeRefCounted<ServiceWorkerRegistration>(
-        options, context()->storage()->NewRegistrationId(),
-        context()->AsWeakPtr());
+    registration_ = context()->registry()->CreateNewRegistration(options);
     SetUpVersion(script_url);
   }
 

diff --git a/content/browser/service_worker/service_worker_version_browsertest.cc b/content/browser/service_worker/service_worker_version_browsertest.cc
index a0a3183..e5dbb16 100644
--- a/content/browser/service_worker/service_worker_version_browsertest.cc
+++ b/content/browser/service_worker/service_worker_version_browsertest.cc

@@ -433,9 +433,8 @@
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = scope;
     options.type = script_type;
-    registration_ = new ServiceWorkerRegistration(
-        options, wrapper()->context()->storage()->NewRegistrationId(),
-        wrapper()->context()->AsWeakPtr());
+    registration_ =
+        wrapper()->context()->registry()->CreateNewRegistration(options);
     // Set the update check time to avoid triggering updates in the middle of
     // tests.
     registration_->set_last_update_check(base::Time::Now());

diff --git a/content/browser/service_worker/service_worker_version_unittest.cc b/content/browser/service_worker/service_worker_version_unittest.cc
index 12a761a3..c1ccf47 100644
--- a/content/browser/service_worker/service_worker_version_unittest.cc
+++ b/content/browser/service_worker/service_worker_version_unittest.cc

@@ -90,9 +90,8 @@
     scope_ = GURL("https://www.example.com/test/");
     blink::mojom::ServiceWorkerRegistrationOptions options;
     options.scope = scope_;
-    registration_ = new ServiceWorkerRegistration(
-        options, helper_->context()->storage()->NewRegistrationId(),
-        helper_->context()->AsWeakPtr());
+    registration_ =
+        helper_->context()->registry()->CreateNewRegistration(options);
     version_ = new ServiceWorkerVersion(
         registration_.get(),
         GURL("https://www.example.com/test/service_worker.js"),
@@ -1115,9 +1114,8 @@
   const GURL scope("bad-origin://www.example.com/test/");
   blink::mojom::ServiceWorkerRegistrationOptions options;
   options.scope = scope;
-  auto registration = base::MakeRefCounted<ServiceWorkerRegistration>(
-      options, helper_->context()->storage()->NewRegistrationId(),
-      helper_->context()->AsWeakPtr());
+  auto registration =
+      helper_->context()->registry()->CreateNewRegistration(options);
   auto version = base::MakeRefCounted<ServiceWorkerVersion>(
       registration_.get(),
       GURL("bad-origin://www.example.com/test/service_worker.js"),

diff --git a/content/test/data/response204-csp-frame-ancestors-none b/content/test/data/response204-csp-frame-ancestors-none
new file mode 100644
index 0000000..72f219e2
--- /dev/null
+++ b/content/test/data/response204-csp-frame-ancestors-none

@@ -0,0 +1 @@
+response204-csp-frame-ancestors-none

diff --git a/content/test/data/response204-csp-frame-ancestors-none.mock-http-headers b/content/test/data/response204-csp-frame-ancestors-none.mock-http-headers
new file mode 100644
index 0000000..ac4659ce
--- /dev/null
+++ b/content/test/data/response204-csp-frame-ancestors-none.mock-http-headers

@@ -0,0 +1,2 @@
+HTTP/1.1 204 No Content
+Content-Security-Policy: frame-ancestors 'none'

diff --git a/extensions/browser/api/file_system/file_system_api.cc b/extensions/browser/api/file_system/file_system_api.cc
index de4be627..d690d4a 100644
--- a/extensions/browser/api/file_system/file_system_api.cc
+++ b/extensions/browser/api/file_system/file_system_api.cc

@@ -752,7 +752,7 @@
     return RespondLater();
   }
 
-  base::Callback<void(bool)> set_initial_path_callback = base::Bind(
+  base::OnceCallback<void(bool)> set_initial_path_callback = base::BindOnce(
       &FileSystemChooseEntryFunction::SetInitialPathAndShowPicker, this,
       previous_path, suggested_name, file_type_info, picker_type);
 
@@ -762,16 +762,16 @@
       ExtensionsAPIClient::Get()->GetNonNativeFileSystemDelegate();
   if (delegate &&
       delegate->IsUnderNonNativeLocalPath(browser_context(), previous_path)) {
-    delegate->IsNonNativeLocalPathDirectory(browser_context(), previous_path,
-                                            set_initial_path_callback);
+    delegate->IsNonNativeLocalPathDirectory(
+        browser_context(), previous_path, std::move(set_initial_path_callback));
     return RespondLater();
   }
 #endif
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-      base::Bind(&base::DirectoryExists, previous_path),
-      set_initial_path_callback);
+      base::BindOnce(&base::DirectoryExists, previous_path),
+      std::move(set_initial_path_callback));
 
   return RespondLater();
 }

diff --git a/ios/chrome/browser/language/language_model_manager_factory.h b/ios/chrome/browser/language/language_model_manager_factory.h
index 58ee713..9c14746 100644
--- a/ios/chrome/browser/language/language_model_manager_factory.h
+++ b/ios/chrome/browser/language/language_model_manager_factory.h

@@ -11,10 +11,7 @@
 #include "base/no_destructor.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
-
-namespace ios {
-class ChromeBrowserState;
-}
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace language {
 class LanguageModelManager;

diff --git a/ios/chrome/browser/language/url_language_histogram_factory.h b/ios/chrome/browser/language/url_language_histogram_factory.h
index ad94ab2..dce18d36 100644
--- a/ios/chrome/browser/language/url_language_histogram_factory.h
+++ b/ios/chrome/browser/language/url_language_histogram_factory.h

@@ -11,10 +11,7 @@
 #include "base/no_destructor.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
-
-namespace ios {
-class ChromeBrowserState;
-}
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace language {
 class UrlLanguageHistogram;

diff --git a/ios/chrome/browser/passwords/password_controller.mm b/ios/chrome/browser/passwords/password_controller.mm
index bce81b8..2ae70adb 100644
--- a/ios/chrome/browser/passwords/password_controller.mm
+++ b/ios/chrome/browser/passwords/password_controller.mm

@@ -370,12 +370,9 @@
     }
   }
 
-  if (self.isPasswordGenerated) {
-    // Always update, in case, for example, that username has been edited.
-    self.passwordManager->UpdateGeneratedPasswordOnUserInput(
-        SysNSStringToUTF16(formName), SysNSStringToUTF16(fieldIdentifier),
-        SysNSStringToUTF16(typedValue));
-  }
+  self.passwordManager->UpdateStateOnUserInput(
+      SysNSStringToUTF16(formName), SysNSStringToUTF16(fieldIdentifier),
+      SysNSStringToUTF16(typedValue));
 }
 
 - (void)retrieveSuggestionsForForm:(NSString*)formName

diff --git a/ios/chrome/browser/sync/device_info_sync_service_factory.h b/ios/chrome/browser/sync/device_info_sync_service_factory.h
index d77370b..efe2c13 100644
--- a/ios/chrome/browser/sync/device_info_sync_service_factory.h
+++ b/ios/chrome/browser/sync/device_info_sync_service_factory.h

@@ -10,6 +10,7 @@
 
 #include "base/macros.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace base {
 template <typename T>
@@ -21,10 +22,6 @@
 class DeviceInfoTracker;
 }  // namespace syncer
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Singleton that owns all DeviceInfoSyncService and associates them with
 // ios::ChromeBrowserState.
 class DeviceInfoSyncServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/sync/ios_chrome_sync_client.h b/ios/chrome/browser/sync/ios_chrome_sync_client.h
index 0696897..6200b6b0 100644
--- a/ios/chrome/browser/sync/ios_chrome_sync_client.h
+++ b/ios/chrome/browser/sync/ios_chrome_sync_client.h

@@ -12,15 +12,12 @@
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "components/browser_sync/browser_sync_client.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace autofill {
 class AutofillWebDataService;
 }
 
-namespace ios {
-class ChromeBrowserState;
-}
-
 namespace password_manager {
 class PasswordStore;
 }

diff --git a/ios/chrome/browser/sync/ios_user_event_service_factory.h b/ios/chrome/browser/sync/ios_user_event_service_factory.h
index 1b9c6f0..7f86b08 100644
--- a/ios/chrome/browser/sync/ios_user_event_service_factory.h
+++ b/ios/chrome/browser/sync/ios_user_event_service_factory.h

@@ -10,10 +10,7 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
-
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace syncer {
 class UserEventService;

diff --git a/ios/chrome/browser/sync/model_type_store_service_factory.h b/ios/chrome/browser/sync/model_type_store_service_factory.h
index 693610a5..4e96307 100644
--- a/ios/chrome/browser/sync/model_type_store_service_factory.h
+++ b/ios/chrome/browser/sync/model_type_store_service_factory.h

@@ -10,15 +10,12 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace syncer {
 class ModelTypeStoreService;
 }  // namespace syncer
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Singleton that owns all ModelTypeStoreService and associates them with
 // ios::ChromeBrowserState.
 class ModelTypeStoreServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/sync/profile_sync_service_factory.h b/ios/chrome/browser/sync/profile_sync_service_factory.h
index 7f563888..f67b5c9 100644
--- a/ios/chrome/browser/sync/profile_sync_service_factory.h
+++ b/ios/chrome/browser/sync/profile_sync_service_factory.h

@@ -10,16 +10,13 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace syncer {
 class ProfileSyncService;
 class SyncService;
 }  // namespace syncer
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Singleton that owns all SyncServices and associates them with
 // ios::ChromeBrowserState.
 class ProfileSyncServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/sync/send_tab_to_self_sync_service_factory.h b/ios/chrome/browser/sync/send_tab_to_self_sync_service_factory.h
index 931140a..05802b613 100644
--- a/ios/chrome/browser/sync/send_tab_to_self_sync_service_factory.h
+++ b/ios/chrome/browser/sync/send_tab_to_self_sync_service_factory.h

@@ -10,15 +10,12 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace send_tab_to_self {
 class SendTabToSelfSyncService;
 }  // namespace send_tab_to_self
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Singleton that owns all SendTabToSelfSyncService and associates them with
 // ios::ChromeBrowserState.
 class SendTabToSelfSyncServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/sync/session_sync_service_factory.h b/ios/chrome/browser/sync/session_sync_service_factory.h
index c049e2222..481f376 100644
--- a/ios/chrome/browser/sync/session_sync_service_factory.h
+++ b/ios/chrome/browser/sync/session_sync_service_factory.h

@@ -10,6 +10,7 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 class GURL;
 
@@ -17,10 +18,6 @@
 class SessionSyncService;
 }  // namespace sync_sessions
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Singleton that owns all SessionSyncService and associates them with
 // ios::ChromeBrowserState.
 class SessionSyncServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/sync/sessions/ios_chrome_local_session_event_router.h b/ios/chrome/browser/sync/sessions/ios_chrome_local_session_event_router.h
index 173b39a..b060fe15 100644
--- a/ios/chrome/browser/sync/sessions/ios_chrome_local_session_event_router.h
+++ b/ios/chrome/browser/sync/sessions/ios_chrome_local_session_event_router.h

@@ -14,16 +14,13 @@
 #include "base/macros.h"
 #include "components/sync/model/syncable_service.h"
 #include "components/sync_sessions/local_session_event_router.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #import "ios/chrome/browser/tabs/tab_model_list_observer.h"
 #include "ios/chrome/browser/web_state_list/web_state_list_observer.h"
 #include "ios/web/public/web_state_observer.h"
 
 class GURL;
 
-namespace ios {
-class ChromeBrowserState;
-}
-
 namespace sync_sessions {
 class SyncSessionsClient;
 }

diff --git a/ios/chrome/browser/sync/sync_setup_service_factory.h b/ios/chrome/browser/sync/sync_setup_service_factory.h
index e97e1bf..c15389b3 100644
--- a/ios/chrome/browser/sync/sync_setup_service_factory.h
+++ b/ios/chrome/browser/sync/sync_setup_service_factory.h

@@ -10,13 +10,10 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 class SyncSetupService;
 
-namespace ios {
-class ChromeBrowserState;
-}
-
 // Singleton that owns all SyncSetupServices and associates them with
 // BrowserStates.
 class SyncSetupServiceFactory : public BrowserStateKeyedServiceFactory {

diff --git a/ios/chrome/browser/ui/activity_services/activity_service_legacy_coordinator.h b/ios/chrome/browser/ui/activity_services/activity_service_legacy_coordinator.h
index 1a409cb..c2acd05 100644
--- a/ios/chrome/browser/ui/activity_services/activity_service_legacy_coordinator.h
+++ b/ios/chrome/browser/ui/activity_services/activity_service_legacy_coordinator.h

@@ -5,6 +5,7 @@
 #ifndef IOS_CHROME_BROWSER_UI_ACTIVITY_SERVICES_ACTIVITY_SERVICE_LEGACY_COORDINATOR_H_
 #define IOS_CHROME_BROWSER_UI_ACTIVITY_SERVICES_ACTIVITY_SERVICE_LEGACY_COORDINATOR_H_
 
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #import "ios/chrome/browser/ui/coordinators/chrome_coordinator.h"
 
 @protocol ActivityServicePositioner;
@@ -12,10 +13,6 @@
 @class CommandDispatcher;
 @class TabModel;
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace
-
 // ActivityServiceLegacyCoordinator provides a public interface for the share
 // menu feature.
 @interface ActivityServiceLegacyCoordinator : ChromeCoordinator

diff --git a/ios/chrome/browser/ui/activity_services/share_protocol.h b/ios/chrome/browser/ui/activity_services/share_protocol.h
index 6073daf..f8bccc4 100644
--- a/ios/chrome/browser/ui/activity_services/share_protocol.h
+++ b/ios/chrome/browser/ui/activity_services/share_protocol.h

@@ -8,6 +8,8 @@
 #import <Foundation/Foundation.h>
 #import <UIKit/UIKit.h>
 
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
+
 @protocol ActivityServicePassword;
 @protocol ActivityServicePositioner;
 @protocol ActivityServicePresentation;
@@ -15,10 +17,6 @@
 @class ShareToData;
 @protocol SnackbarCommands;
 
-namespace ios {
-class ChromeBrowserState;
-}
-
 namespace ShareTo {
 
 // Provides the result of a sharing event.

diff --git a/ios/chrome/browser/ui/authentication/authentication_flow_performer.h b/ios/chrome/browser/ui/authentication/authentication_flow_performer.h
index bdd85e4..9239194 100644
--- a/ios/chrome/browser/ui/authentication/authentication_flow_performer.h
+++ b/ios/chrome/browser/ui/authentication/authentication_flow_performer.h

@@ -10,16 +10,13 @@
 #import <UIKit/UIKit.h>
 
 #import "base/ios/block_types.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #import "ios/chrome/browser/ui/authentication/authentication_flow_performer_delegate.h"
 
 class Browser;
 @protocol BrowsingDataCommands;
 @class ChromeIdentity;
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 // Performs the sign-in steps and user interactions as part of the sign-in flow.
 @interface AuthenticationFlowPerformer : NSObject
 

diff --git a/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.h b/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.h
index 713fa35..9c56ac55 100644
--- a/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.h
+++ b/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.h

@@ -11,6 +11,7 @@
 
 #include "base/auto_reset.h"
 #include "base/timer/timer.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #import "ios/chrome/browser/signin/constants.h"
 
 @protocol ApplicationCommands;
@@ -19,10 +20,6 @@
 @class ChromeIdentity;
 @class ChromeSigninViewController;
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 namespace signin_metrics {
 enum class AccessPoint;
 enum class PromoAction;

diff --git a/ios/chrome/browser/ui/authentication/re_signin_infobar_delegate.h b/ios/chrome/browser/ui/authentication/re_signin_infobar_delegate.h
index 1a4dc0d2..57b6ded 100644
--- a/ios/chrome/browser/ui/authentication/re_signin_infobar_delegate.h
+++ b/ios/chrome/browser/ui/authentication/re_signin_infobar_delegate.h

@@ -10,6 +10,7 @@
 #include "base/strings/string16.h"
 #include "components/infobars/core/confirm_infobar_delegate.h"
 #include "components/infobars/core/infobar.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #include "ui/gfx/image/image.h"
 
 @protocol SigninPresenter;
@@ -18,10 +19,6 @@
 class InfoBarManager;
 }  // namespace infobars
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
-
 namespace web {
 class WebState;
 }  // namespace web

diff --git a/ios/chrome/browser/ui/authentication/signed_in_accounts_view_controller.h b/ios/chrome/browser/ui/authentication/signed_in_accounts_view_controller.h
index 0bb7482..1b55fba 100644
--- a/ios/chrome/browser/ui/authentication/signed_in_accounts_view_controller.h
+++ b/ios/chrome/browser/ui/authentication/signed_in_accounts_view_controller.h

@@ -7,10 +7,9 @@
 
 #import <UIKit/UIKit.h>
 
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
+
 @protocol ApplicationSettingsCommands;
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
 
 // View controller that presents the signed in accounts when they have changed
 // while the application was in background.

diff --git a/ios/chrome/browser/ui/authentication/signin_promo_view_mediator.h b/ios/chrome/browser/ui/authentication/signin_promo_view_mediator.h
index 47e9ea2..f4a1443f 100644
--- a/ios/chrome/browser/ui/authentication/signin_promo_view_mediator.h
+++ b/ios/chrome/browser/ui/authentication/signin_promo_view_mediator.h

@@ -7,6 +7,7 @@
 
 #import <Foundation/Foundation.h>
 
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 #import "ios/chrome/browser/ui/authentication/cells/signin_promo_view.h"
 #import "ios/chrome/browser/ui/authentication/cells/signin_promo_view_delegate.h"
 
@@ -20,8 +21,6 @@
 }
 
 namespace ios {
-class ChromeBrowserState;
-
 // Enums for the sign-in promo view state. Those states are sequential, with no
 // way to go backwards. All states can be skipped except |NeverVisible| and
 // |Invalid|.

diff --git a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
index f0dc0e16..aa9ed484 100644
--- a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm

@@ -4120,8 +4120,7 @@
   // TODO(crbug.com/972114) Move or reroute to browserCoordinator.
   self.sendTabToSelfCoordinator = [[SendTabToSelfCoordinator alloc]
       initWithBaseViewController:self
-                    browserState:self.browserState];
-  self.sendTabToSelfCoordinator.dispatcher = self.dispatcher;
+                         browser:self.browser];
   [self.sendTabToSelfCoordinator start];
 }
 

diff --git a/ios/chrome/browser/ui/first_run/first_run_util.h b/ios/chrome/browser/ui/first_run/first_run_util.h
index 1688ee7..2f8ba6599 100644
--- a/ios/chrome/browser/ui/first_run/first_run_util.h
+++ b/ios/chrome/browser/ui/first_run/first_run_util.h

@@ -7,6 +7,8 @@
 
 #import <UIKit/UIKit.h>
 
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
+
 @class FirstRunConfiguration;
 @protocol SyncPresenter;
 
@@ -14,9 +16,6 @@
 class TimeTicks;
 }
 
-namespace ios {
-class ChromeBrowserState;
-}
 namespace web {
 class WebState;
 }

diff --git a/ios/chrome/browser/ui/first_run/static_file_view_controller.h b/ios/chrome/browser/ui/first_run/static_file_view_controller.h
index 49a29ce8..a8be026 100644
--- a/ios/chrome/browser/ui/first_run/static_file_view_controller.h
+++ b/ios/chrome/browser/ui/first_run/static_file_view_controller.h

@@ -7,9 +7,7 @@
 
 #import <UIKit/UIKit.h>
 
-namespace ios {
-class ChromeBrowserState;
-}
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 // Status for tapped links.  This enum is used in UMA and entries should not be
 // re-ordered or deleted.

diff --git a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.h b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.h
index 911dbc22..280a94f9 100644
--- a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.h
+++ b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.h

@@ -7,15 +7,19 @@
 
 #import "ios/chrome/browser/ui/coordinators/chrome_coordinator.h"
 
-@protocol BrowserCommands;
-
 // Displays the send tab to self UI for all device form factors. Will show a
 // modal dialog popup on both platforms. Once this coordinator is stopped, the
 // underlying dialog is dismissed.
 @interface SendTabToSelfCoordinator : ChromeCoordinator
 
-// Dispatcher
-@property(nonatomic, weak) id<BrowserCommands> dispatcher;
+// Unavailable, use -initWithBaseViewController:browser:.
+- (instancetype)initWithBaseViewController:(UIViewController*)viewController
+    NS_UNAVAILABLE;
+// Unavailable, use -initWithBaseViewController:browser:.
+- (instancetype)initWithBaseViewController:(UIViewController*)viewController
+                              browserState:
+                                  (ios::ChromeBrowserState*)browserState
+    NS_UNAVAILABLE;
 
 @end
 

diff --git a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.mm b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.mm
index f3b1f24..89dd9328 100644
--- a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.mm
+++ b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_coordinator.mm

@@ -7,8 +7,10 @@
 #include "base/logging.h"
 #include "components/send_tab_to_self/send_tab_to_self_sync_service.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
+#import "ios/chrome/browser/main/browser.h"
 #include "ios/chrome/browser/sync/send_tab_to_self_sync_service_factory.h"
 #import "ios/chrome/browser/ui/commands/browser_commands.h"
+#import "ios/chrome/browser/ui/commands/command_dispatcher.h"
 #import "ios/chrome/browser/ui/commands/send_tab_to_self_command.h"
 #import "ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_modal_delegate.h"
 #import "ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_modal_positioner.h"
@@ -35,7 +37,8 @@
 
 - (void)start {
   send_tab_to_self::SendTabToSelfSyncService* syncService =
-      SendTabToSelfSyncServiceFactory::GetForBrowserState(self.browserState);
+      SendTabToSelfSyncServiceFactory::GetForBrowserState(
+          self.browser->GetBrowserState());
   // This modal should not be launched in incognito mode where syncService is
   // undefined.
   DCHECK(syncService);
@@ -111,8 +114,9 @@
   SendTabToSelfCommand* command =
       [[SendTabToSelfCommand alloc] initWithTargetDeviceID:cacheGUID
                                           targetDeviceName:deviceName];
-
-  [self.dispatcher sendTabToSelf:command];
+  id<BrowserCommands> handler =
+      HandlerForProtocol(self.browser->GetCommandDispatcher(), BrowserCommands);
+  [handler sendTabToSelf:command];
   [self stop];
 }
 

diff --git a/ios/chrome/browser/unified_consent/unified_consent_service_factory.h b/ios/chrome/browser/unified_consent/unified_consent_service_factory.h
index 73c8163..6fc2e9b 100644
--- a/ios/chrome/browser/unified_consent/unified_consent_service_factory.h
+++ b/ios/chrome/browser/unified_consent/unified_consent_service_factory.h

@@ -8,13 +8,11 @@
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 namespace unified_consent {
 class UnifiedConsentService;
 }
-namespace ios {
-class ChromeBrowserState;
-}
 
 class UnifiedConsentServiceFactory : public BrowserStateKeyedServiceFactory {
  public:

diff --git a/ios/chrome/browser/web/font_size_js_unittest.mm b/ios/chrome/browser/web/font_size_js_unittest.mm
index 0a44acf6..70dd22c 100644
--- a/ios/chrome/browser/web/font_size_js_unittest.mm
+++ b/ios/chrome/browser/web/font_size_js_unittest.mm

@@ -41,7 +41,7 @@
   void LoadHtml(NSString* html) {
     LoadHtmlAndInject(
         [NSString stringWithFormat:@"<html><style>"
-                                   @"html { -webkit-text-size-adjust=none }"
+                                   @"html { -webkit-text-size-adjust: none }"
                                    @"</style><meta name='viewport' "
                                    @"content='initial-scale=1.0'>%@</html>",
                                    html]);
@@ -255,13 +255,6 @@
 
 // Tests that __gCrWeb.accessibility.adjustFontSize works for nested elements.
 TEST_F(FontSizeJsTest, TestAdjustFontSizeForNestedElements) {
-// TODO(crbug.com/1041873): Re-enable this test on device.
-#if !TARGET_IPHONE_SIMULATOR
-  if (ui::GetDeviceFormFactor() != ui::DEVICE_FORM_FACTOR_TABLET) {
-    return;
-  }
-#endif  // TARGET_IPHONE_SIMULATOR
-
   // TODO(crbug.com/983776): This test fails on ipad since beta5 due to a
   // simulator bug. Re-enable this once the bug is fixed.
   if (base::ios::IsRunningOnIOS13OrLater() &&

diff --git a/ios/public/provider/chrome/browser/BUILD.gn b/ios/public/provider/chrome/browser/BUILD.gn
index d135c432..f9637005 100644
--- a/ios/public/provider/chrome/browser/BUILD.gn
+++ b/ios/public/provider/chrome/browser/BUILD.gn

@@ -20,6 +20,7 @@
     "//base",
     "//components/metrics",
     "//ios//web/public",
+    "//ios/chrome/browser/browser_state:forward",
     "//ios/public/provider/chrome/browser/mailto",
   ]
   libs = [ "CoreLocation.framework" ]

diff --git a/ios/public/provider/chrome/browser/DEPS b/ios/public/provider/chrome/browser/DEPS
index 9d4bc261..8f95b9d 100644
--- a/ios/public/provider/chrome/browser/DEPS
+++ b/ios/public/provider/chrome/browser/DEPS

@@ -10,4 +10,8 @@
   # Do not allow inclusion of forwarding header in the provider code as the
   # provider is not allowed to depends on //ios/chrome.
   "-ios/public/provider/chrome/browser/browser_state/chrome_browser_state.h",
+
+  # To allow moving ChromeBrowserState to the global namespace, permit the
+  # use of chrome_browser_state_forward.h.
+  "+ios/chrome/browser/browser_state/chrome_browser_state_forward.h",
 ]

diff --git a/ios/public/provider/chrome/browser/chrome_browser_provider.h b/ios/public/provider/chrome/browser/chrome_browser_provider.h
index 0f4853819..038bd85 100644
--- a/ios/public/provider/chrome/browser/chrome_browser_provider.h
+++ b/ios/public/provider/chrome/browser/chrome_browser_provider.h

@@ -15,6 +15,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/observer_list.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 class AppDistributionProvider;
 class BrandedImageProvider;
@@ -45,7 +46,6 @@
 namespace ios {
 
 class ChromeBrowserProvider;
-class ChromeBrowserState;
 class ChromeIdentityService;
 class GeolocationUpdaterProvider;
 class SigninErrorProvider;

diff --git a/ios/public/provider/chrome/browser/mailto/BUILD.gn b/ios/public/provider/chrome/browser/mailto/BUILD.gn
index 12b2870..7b46892 100644
--- a/ios/public/provider/chrome/browser/mailto/BUILD.gn
+++ b/ios/public/provider/chrome/browser/mailto/BUILD.gn

@@ -8,7 +8,10 @@
     "mailto_handler_provider.h",
     "mailto_handler_provider.mm",
   ]
-  deps = [ "//base" ]
+  deps = [
+    "//base",
+    "//ios/chrome/browser/browser_state:forward",
+  ]
 }
 
 source_set("test_support") {

diff --git a/ios/public/provider/chrome/browser/mailto/mailto_handler_provider.h b/ios/public/provider/chrome/browser/mailto/mailto_handler_provider.h
index 4b4faba..262c14c 100644
--- a/ios/public/provider/chrome/browser/mailto/mailto_handler_provider.h
+++ b/ios/public/provider/chrome/browser/mailto/mailto_handler_provider.h

@@ -6,11 +6,9 @@
 #define IOS_PUBLIC_PROVIDER_CHROME_BROWSER_MAILTO_MAILTO_HANDLER_PROVIDER_H_
 
 #import <UIKit/UIKit.h>
-#include "base/macros.h"
 
-namespace ios {
-class ChromeBrowserState;
-}  // namespace ios
+#include "base/macros.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 @class ChromeIdentity;
 

diff --git a/ios/public/provider/chrome/browser/voice/BUILD.gn b/ios/public/provider/chrome/browser/voice/BUILD.gn
index cb3a8d3..ce1447be 100644
--- a/ios/public/provider/chrome/browser/voice/BUILD.gn
+++ b/ios/public/provider/chrome/browser/voice/BUILD.gn

@@ -16,7 +16,10 @@
     "voice_search_provider.h",
     "voice_search_provider.mm",
   ]
-  deps = [ "//base" ]
+  deps = [
+    "//base",
+    "//ios/chrome/browser/browser_state:forward",
+  ]
 }
 
 source_set("test_support") {

diff --git a/ios/public/provider/chrome/browser/voice/voice_search_provider.h b/ios/public/provider/chrome/browser/voice/voice_search_provider.h
index 92b4550..72ad7fe 100644
--- a/ios/public/provider/chrome/browser/voice/voice_search_provider.h
+++ b/ios/public/provider/chrome/browser/voice/voice_search_provider.h

@@ -10,15 +10,12 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state_forward.h"
 
 @protocol ApplicationCommands;
 class AudioSessionController;
 class VoiceSearchController;
 
-namespace ios {
-class ChromeBrowserState;
-}
-
 // VoiceSearchProvider allows embedders to provide functionality related to
 // voice search.
 class VoiceSearchProvider {

diff --git a/ios/web/navigation/crw_wk_navigation_handler.mm b/ios/web/navigation/crw_wk_navigation_handler.mm
index 0ab29e4..0e5fa30 100644
--- a/ios/web/navigation/crw_wk_navigation_handler.mm
+++ b/ios/web/navigation/crw_wk_navigation_handler.mm

@@ -757,7 +757,7 @@
 
   web::NavigationContextImpl* context =
       [self.navigationStates contextForNavigation:navigation];
-  if (!web::IsWKWebViewSSLCertError(context->GetError())) {
+  if (context && !web::IsWKWebViewSSLCertError(context->GetError())) {
     _certVerificationErrors->Clear();
   }
 
@@ -945,8 +945,7 @@
   // Sometimes |webView:didFinishNavigation| arrives before
   // |webView:didCommitNavigation|. Explicitly trigger post-commit processing.
   bool navigationCommitted =
-      [self.navigationStates stateForNavigation:navigation] ==
-      web::WKNavigationState::COMMITTED;
+      [self.navigationStates isCommittedNavigation:navigation];
   UMA_HISTOGRAM_BOOLEAN("IOS.WKWebViewFinishBeforeCommit",
                         !navigationCommitted);
   if (!navigationCommitted) {

diff --git a/media/gpu/v4l2/generic_v4l2_device.cc b/media/gpu/v4l2/generic_v4l2_device.cc
index 33f55bf..1fe4b4b 100644
--- a/media/gpu/v4l2/generic_v4l2_device.cc
+++ b/media/gpu/v4l2/generic_v4l2_device.cc

@@ -272,14 +272,6 @@
   size_t num_planes = handle.planes.size();
   DCHECK_LE(num_planes, 3u);
 
-  gfx::NativePixmapHandle native_pixmap_handle;
-
-  for (size_t p = 0; p < num_planes; ++p) {
-    native_pixmap_handle.planes.emplace_back(
-        handle.planes[p].stride, handle.planes[p].offset, handle.planes[p].size,
-        std::move(handle.planes[p].fd));
-  }
-
   gfx::BufferFormat buffer_format = gfx::BufferFormat::BGRA_8888;
   switch (fourcc.ToV4L2PixFmt()) {
     case DRM_FORMAT_ARGB8888:
@@ -299,7 +291,7 @@
       ui::OzonePlatform::GetInstance()
           ->GetSurfaceFactoryOzone()
           ->CreateNativePixmapFromHandle(0, size, buffer_format,
-                                         std::move(native_pixmap_handle));
+                                         std::move(handle));
 
   DCHECK(pixmap);
 

diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
index 21c01c5..c075f337 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc

@@ -1381,7 +1381,6 @@
     gfx::NativePixmapHandle handle,
     GLuint client_texture_id,
     GLuint texture_id,
-    const gfx::Size& size,
     const Fourcc fourcc) {
   DVLOGF(3) << "index=" << buffer_index;
   DCHECK(child_task_runner_->BelongsToCurrentThread());
@@ -1402,8 +1401,8 @@
 
   V4L2Device* gl_device =
       image_processor_device_ ? image_processor_device_.get() : device_.get();
-  scoped_refptr<gl::GLImage> gl_image =
-      gl_device->CreateGLImage(size, fourcc, std::move(handle));
+  scoped_refptr<gl::GLImage> gl_image = gl_device->CreateGLImage(
+      decoder_->GetVisibleRect().size(), fourcc, std::move(handle));
   if (!gl_image) {
     VLOGF(1) << "Could not create GLImage,"
              << " index=" << buffer_index << " texture_id=" << texture_id;
@@ -1570,7 +1569,7 @@
         base::BindOnce(&V4L2SliceVideoDecodeAccelerator::CreateGLImageFor,
                        weak_this_, index, picture_buffer_id, std::move(handle),
                        iter->client_texture_id, iter->texture_id,
-                       gl_image_size_, *gl_image_format_fourcc_));
+                       *gl_image_format_fourcc_));
   }
 
   // Buffer is now ready to be used.
@@ -2231,7 +2230,7 @@
             ip_buffer_index, ip_output_record.picture_id,
             CreateGpuMemoryBufferHandle(frame.get()).native_pixmap_handle,
             ip_output_record.client_texture_id, ip_output_record.texture_id,
-            gl_image_size_, *gl_image_format_fourcc_));
+            *gl_image_format_fourcc_));
   }
 
   DCHECK(!surfaces_at_ip_.empty());

diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
index 7cac63c66..37355132 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h

@@ -279,7 +279,6 @@
                         gfx::NativePixmapHandle handle,
                         GLuint client_texture_id,
                         GLuint texture_id,
-                        const gfx::Size& size,
                         const Fourcc fourcc);
 
   // Performed on decoder_thread_ as a consequence of poll() on decoder_thread_

diff --git a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
index f3dbbf0..66c9e66 100644
--- a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc

@@ -470,7 +470,6 @@
     int32_t picture_buffer_id,
     gfx::NativePixmapHandle handle,
     GLuint texture_id,
-    const gfx::Size& size,
     const Fourcc fourcc) {
   DVLOGF(3) << "index=" << buffer_index;
   DCHECK(child_task_runner_->BelongsToCurrentThread());
@@ -494,8 +493,8 @@
   V4L2Device* egl_device =
       image_processor_device_ ? image_processor_device_.get() : device_.get();
   EGLImageKHR egl_image = egl_device->CreateEGLImage(
-      egl_display_, gl_context->GetHandle(), texture_id, size, buffer_index,
-      fourcc, std::move(handle));
+      egl_display_, gl_context->GetHandle(), texture_id, visible_size_,
+      buffer_index, fourcc, std::move(handle));
   if (egl_image == EGL_NO_IMAGE_KHR) {
     VLOGF(1) << "could not create EGLImageKHR,"
              << " index=" << buffer_index << " texture_id=" << texture_id;
@@ -725,7 +724,7 @@
           FROM_HERE,
           base::BindOnce(&V4L2VideoDecodeAccelerator::CreateEGLImageFor,
                          weak_this_, index, picture_buffer_id,
-                         std::move(handle), iter->texture_id, egl_image_size_,
+                         std::move(handle), iter->texture_id,
                          *egl_image_format_fourcc_));
 
       // Early return, AssignEGLImage will make the buffer available for
@@ -2696,8 +2695,7 @@
             &V4L2VideoDecodeAccelerator::CreateEGLImageFor, weak_this_,
             ip_buffer_index, ip_output_record.picture_id,
             CreateGpuMemoryBufferHandle(frame.get()).native_pixmap_handle,
-            ip_output_record.texture_id, egl_image_size_,
-            *egl_image_format_fourcc_));
+            ip_output_record.texture_id, *egl_image_format_fourcc_));
   }
 
   // Remove our job from the IP jobs queue

diff --git a/media/gpu/v4l2/v4l2_video_decode_accelerator.h b/media/gpu/v4l2/v4l2_video_decode_accelerator.h
index 0a5c54b..86f433f 100644
--- a/media/gpu/v4l2/v4l2_video_decode_accelerator.h
+++ b/media/gpu/v4l2/v4l2_video_decode_accelerator.h

@@ -252,13 +252,12 @@
 
   // Create an EGLImage for the buffer associated with V4L2 |buffer_index| and
   // for |picture_buffer_id|, and backed by |handle|.
-  // The buffer should be bound to |texture_id| and is of |size| and format
-  // described by |fourcc|.
+  // The buffer should be bound to |texture_id| and is of format described by
+  // |fourcc|.
   void CreateEGLImageFor(size_t buffer_index,
                          int32_t picture_buffer_id,
                          gfx::NativePixmapHandle handle,
                          GLuint texture_id,
-                         const gfx::Size& size,
                          const Fourcc fourcc);
 
   // Take the EGLImage |egl_image|, created for |picture_buffer_id|, and use it

diff --git a/net/test/url_request/url_request_mock_http_job.cc b/net/test/url_request/url_request_mock_http_job.cc
index 1473b31..52a8581 100644
--- a/net/test/url_request/url_request_mock_http_job.cc
+++ b/net/test/url_request/url_request_mock_http_job.cc

@@ -160,9 +160,9 @@
 void URLRequestMockHTTPJob::Start() {
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {base::ThreadPool(), base::MayBlock()},
-      base::Bind(&DoFileIO, file_path_),
-      base::Bind(&URLRequestMockHTTPJob::SetHeadersAndStart,
-                 weak_ptr_factory_.GetWeakPtr()));
+      base::BindOnce(&DoFileIO, file_path_),
+      base::BindOnce(&URLRequestMockHTTPJob::SetHeadersAndStart,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 void URLRequestMockHTTPJob::SetHeadersAndStart(const std::string& raw_headers) {

diff --git a/remoting/protocol/webrtc_video_renderer_adapter.cc b/remoting/protocol/webrtc_video_renderer_adapter.cc
index dabdd3a..6be73dc 100644
--- a/remoting/protocol/webrtc_video_renderer_adapter.cc
+++ b/remoting/protocol/webrtc_video_renderer_adapter.cc

@@ -178,11 +178,12 @@
   base::PostTaskAndReplyWithResult(
       FROM_HERE,
       {base::ThreadPool(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-      base::Bind(&ConvertYuvToRgb, base::Passed(&frame),
-                 base::Passed(&rgb_frame),
-                 video_renderer_->GetFrameConsumer()->GetPixelFormat()),
-      base::Bind(&WebrtcVideoRendererAdapter::DrawFrame,
-                 weak_factory_.GetWeakPtr(), frame_id, base::Passed(&stats)));
+      base::BindOnce(&ConvertYuvToRgb, base::Passed(&frame),
+                     base::Passed(&rgb_frame),
+                     video_renderer_->GetFrameConsumer()->GetPixelFormat()),
+      base::BindOnce(&WebrtcVideoRendererAdapter::DrawFrame,
+                     weak_factory_.GetWeakPtr(), frame_id,
+                     base::Passed(&stats)));
 }
 
 void WebrtcVideoRendererAdapter::DrawFrame(

diff --git a/services/tracing/public/cpp/BUILD.gn b/services/tracing/public/cpp/BUILD.gn
index 37aa9b7..b412100 100644
--- a/services/tracing/public/cpp/BUILD.gn
+++ b/services/tracing/public/cpp/BUILD.gn

@@ -17,14 +17,42 @@
 
   public_deps = [ "//services/tracing/public/mojom" ]
 
-  if (!is_nacl && !is_ios) {
-    deps = [ ":cpp" ]
-  }
+  deps = [ ":cpp" ]
 }
 
+# On IOS and NACL we don't support tracing so we only include the minimum needed
+# to support a fake typed TRACE_EVENT macro. However this means we don't have
+# any .cc files and thus on iOS and NaCl it needs to be a source_set and not a
+# component. |tracing_lib_type| decides which version to build.
 if (!is_nacl && !is_ios) {
-  component("cpp") {
-    sources = [
+  tracing_lib_type = "component"
+} else {
+  tracing_lib_type = "source_set"
+}
+
+target(tracing_lib_type, "cpp") {
+  sources = [
+    "perfetto/event_context.h",
+    "perfetto/macros.h",
+    "perfetto/macros_internal.h",
+  ]
+
+  defines = [ "IS_TRACING_CPP_IMPL" ]
+  output_name = "tracing_cpp"
+
+  configs += [ "//build/config/compiler:wexit_time_destructors" ]
+
+  public_deps = [
+    "//base",
+    "//third_party/perfetto:libperfetto",
+  ]
+
+  deps = [ "//third_party/perfetto/include/perfetto/protozero" ]
+
+  all_dependent_configs = [ "//third_party/perfetto/gn:public_config" ]
+
+  if (!is_nacl && !is_ios) {
+    sources += [
       "base_agent.cc",
       "base_agent.h",
       "perfetto/dummy_producer.cc",
@@ -40,9 +68,7 @@
       "perfetto/java_heap_profiler/hprof_parser_android.h",
       "perfetto/java_heap_profiler/java_heap_profiler_android.cc",
       "perfetto/java_heap_profiler/java_heap_profiler_android.h",
-      "perfetto/macros.h",
       "perfetto/macros_internal.cc",
-      "perfetto/macros_internal.h",
       "perfetto/perfetto_config.cc",
       "perfetto/perfetto_config.h",
       "perfetto/perfetto_producer.cc",
@@ -79,24 +105,14 @@
       "tracing_features.h",
     ]
 
-    defines = [ "IS_TRACING_CPP_IMPL" ]
-    output_name = "tracing_cpp"
-
-    configs += [ "//build/config/compiler:wexit_time_destructors" ]
-
-    public_deps = [
-      "//base",
+    public_deps += [
       "//components/tracing:startup_tracing",
       "//mojo/public/cpp/bindings",
       "//services/tracing/public/mojom",
-      "//third_party/perfetto:libperfetto",
     ]
 
-    all_dependent_configs = [ "//third_party/perfetto/gn:public_config" ]
-
-    deps = [
+    deps += [
       "//build:chromecast_buildflags",
-      "//third_party/perfetto/include/perfetto/protozero",
       "//third_party/perfetto/protos/perfetto/trace/chrome:minimal_complete_lite",
     ]
 
@@ -122,5 +138,5 @@
       # stack_unwinder_android.cc overrides the dl_unwind_find_exidx function.
       all_dependent_configs += [ ":wrap_find_exidx" ]
     }
-  }
-}  # !is_nacl && !is_ios
+  }  # !is_ios && !is_nacl
+}

diff --git a/services/tracing/public/cpp/perfetto/macros.h b/services/tracing/public/cpp/perfetto/macros.h
index 28a72abd..0ee1edac 100644
--- a/services/tracing/public/cpp/perfetto/macros.h
+++ b/services/tracing/public/cpp/perfetto/macros.h

@@ -8,6 +8,11 @@
 #include "base/trace_event/trace_event.h"
 #include "services/tracing/public/cpp/perfetto/macros_internal.h"
 
+// Needed not for this file but for every user of the TRACE_EVENT macros for the
+// lambda definition. So included here for convenience.
+#include "services/tracing/public/cpp/perfetto/event_context.h"
+#include "third_party/perfetto/protos/perfetto/trace/track_event/track_event.pbzero.h"
+
 #if defined(TRACE_EVENT_BEGIN)
 #error "Another copy of perfetto tracing macros have been included"
 #endif

diff --git a/services/tracing/public/cpp/perfetto/macros_internal.h b/services/tracing/public/cpp/perfetto/macros_internal.h
index d30d7d7..cbe0240 100644
--- a/services/tracing/public/cpp/perfetto/macros_internal.h
+++ b/services/tracing/public/cpp/perfetto/macros_internal.h

@@ -5,14 +5,18 @@
 #ifndef SERVICES_TRACING_PUBLIC_CPP_PERFETTO_MACROS_INTERNAL_H_
 #define SERVICES_TRACING_PUBLIC_CPP_PERFETTO_MACROS_INTERNAL_H_
 
+#include "build/build_config.h"
+
+namespace perfetto {
+class EventContext;
+}
+
+#if !defined(OS_IOS) && !defined(OS_NACL)
+
 #include "base/component_export.h"
 #include "base/trace_event/trace_event.h"
 #include "services/tracing/public/cpp/perfetto/trace_event_data_source.h"
 
-namespace perfetto {
-class TrackEventContext;
-}
-
 namespace tracing {
 namespace internal {
 base::Optional<base::trace_event::TraceEvent> COMPONENT_EXPORT(TRACING_CPP)
@@ -24,7 +28,7 @@
 // A simple function that will add the TraceEvent requested and will call the
 // |argument_func| after the track_event has been filled in.
 template <
-    typename TrackEventArgumentFunction = void (*)(perfetto::TrackEventContext)>
+    typename TrackEventArgumentFunction = void (*)(perfetto::EventContext)>
 static inline base::trace_event::TraceEventHandle AddTraceEvent(
     char phase,
     const unsigned char* category_group_enabled,
@@ -87,4 +91,33 @@
     return 0;                                                                 \
   }()};
 
+#else  // !defined(OS_IOS) && !defined(OS_NACL)
+
+// Tracing isn't supported on IOS or NACL so we just black hole all the
+// parameters into a function that doesn't do anything. This ensures that no
+// warnings about unused parameters are generated.
+
+namespace tracing {
+namespace internal {
+template <
+    typename TrackEventArgumentFunction = void (*)(perfetto::EventContext)>
+static inline base::trace_event::TraceEventHandle AddTraceEvent(
+    char,
+    const unsigned char*,
+    const char*,
+    unsigned int,
+    TrackEventArgumentFunction) {
+  return {0, 0, 0};
+}
+}  // namespace internal
+}  // namespace tracing
+
+#define TRACING_INTERNAL_ADD_TRACE_EVENT(phase, category, name, flags, ...) \
+  tracing::internal::AddTraceEvent(phase, nullptr, name, flags, ##__VA_ARGS__);
+
+#define TRACING_INTERNAL_SCOPED_ADD_TRACE_EVENT(category, name, ...)           \
+  TRACING_INTERNAL_ADD_TRACE_EVENT('B', category, name, TRACE_EVENT_FLAG_NONE, \
+                                   ##__VA_ARGS__);
+#endif  // else of !defined(OS_IOS) && !defined(OS_NACL)
+
 #endif  // SERVICES_TRACING_PUBLIC_CPP_PERFETTO_MACROS_INTERNAL_H_

diff --git a/testing/buildbot/manage.py b/testing/buildbot/manage.py
index 5682f3d..1d9e929 100755
--- a/testing/buildbot/manage.py
+++ b/testing/buildbot/manage.py

@@ -149,7 +149,8 @@
 
   # These tests are only run on WebRTC CI.
   'AppRTCMobileTest',
-  'android_junit_tests',
+  'android_examples_junit_tests',
+  'android_sdk_junit_tests',
   'audio_decoder_unittests',
   'common_audio_unittests',
   'common_video_unittests',

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index b9a135c..a2dd426 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -7361,6 +7361,8 @@
         {
             "platforms": [
                 "android",
+                "android_webview",
+                "ios",
                 "chromeos",
                 "linux",
                 "mac",
@@ -7368,14 +7370,14 @@
             ],
             "experiments": [
                 {
-                    "name": "Disabled",
-                    "disable_features": [
+                    "name": "Enabled",
+                    "enable_features": [
                         "V8ConcurrentInlining"
                     ]
                 },
                 {
-                    "name": "Enabled",
-                    "enable_features": [
+                    "name": "Disabled",
+                    "disable_features": [
                         "V8ConcurrentInlining"
                     ]
                 }

diff --git a/third_party/blink/renderer/controller/BUILD.gn b/third_party/blink/renderer/controller/BUILD.gn
index 73040f41..4342631 100644
--- a/third_party/blink/renderer/controller/BUILD.gn
+++ b/third_party/blink/renderer/controller/BUILD.gn

@@ -73,6 +73,10 @@
     ]
   }
   if (is_mac) {
+    sources += [
+      "memory_usage_monitor_mac.cc",
+      "memory_usage_monitor_mac.h",
+    ]
     libs = [
       "AppKit.framework",
       "Foundation.framework",
@@ -177,6 +181,12 @@
     ]
   }
 
+  if (is_mac) {
+    sources += [
+      "memory_usage_monitor_test.cc",
+    ]
+  }
+
   deps = [
     ":controller",
     "//base",

diff --git a/third_party/blink/renderer/controller/memory_usage_monitor_mac.cc b/third_party/blink/renderer/controller/memory_usage_monitor_mac.cc
new file mode 100644
index 0000000..4cfe463
--- /dev/null
+++ b/third_party/blink/renderer/controller/memory_usage_monitor_mac.cc

@@ -0,0 +1,127 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/controller/memory_usage_monitor_mac.h"
+
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+
+#include "base/mac/mac_util.h"
+#include "third_party/blink/public/platform/platform.h"
+
+namespace blink {
+
+// The following code is copied from
+// //services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc
+// to use task_info API.
+namespace {
+#if !defined(MAC_OS_X_VERSION_10_11) || \
+    MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_11
+// The |phys_footprint| field was introduced in 10.11.
+struct ChromeTaskVMInfo {
+  mach_vm_size_t virtual_size;
+  integer_t region_count;
+  integer_t page_size;
+  mach_vm_size_t resident_size;
+  mach_vm_size_t resident_size_peak;
+  mach_vm_size_t device;
+  mach_vm_size_t device_peak;
+  mach_vm_size_t internal;
+  mach_vm_size_t internal_peak;
+  mach_vm_size_t external;
+  mach_vm_size_t external_peak;
+  mach_vm_size_t reusable;
+  mach_vm_size_t reusable_peak;
+  mach_vm_size_t purgeable_volatile_pmap;
+  mach_vm_size_t purgeable_volatile_resident;
+  mach_vm_size_t purgeable_volatile_virtual;
+  mach_vm_size_t compressed;
+  mach_vm_size_t compressed_peak;
+  mach_vm_size_t compressed_lifetime;
+  mach_vm_size_t phys_footprint;
+};
+#else
+using ChromeTaskVMInfo = task_vm_info;
+#endif  // MAC_OS_X_VERSION_10_11
+
+// Don't simply use sizeof(task_vm_info) / sizeof(natural_t):
+// In the 10.15 SDK, this structure is 87 32-bit words long, and in
+// mach_types.defs:
+//
+//   type task_info_t    = array[*:87] of integer_t;
+//
+// However in the 10.14 SDK, this structure is 42 32-bit words, and in
+// mach_types.defs:
+//
+//   type task_info_t    = array[*:52] of integer_t;
+//
+// As a result, the 10.15 SDK's task_vm_info won't fit inside the 10.14 SDK's
+// task_info_t, so the *rest of the system* (on 10.14 and earlier) can't handle
+// calls that request the full 10.15 structure. We have to request a prefix of
+// it that 10.14 and earlier can handle by limiting the length we request. The
+// rest of the fields just get ignored, but we don't use them anyway.
+
+constexpr mach_msg_type_number_t ChromeTaskVMInfoCount =
+    TASK_VM_INFO_REV2_COUNT;
+
+// The count field is in units of natural_t, which is the machine's word size
+// (64 bits on all modern machines), but the task_info_t array is in units of
+// integer_t, which is 32 bits.
+constexpr mach_msg_type_number_t MAX_MIG_SIZE_FOR_1014 =
+    52 / (sizeof(natural_t) / sizeof(integer_t));
+static_assert(ChromeTaskVMInfoCount <= MAX_MIG_SIZE_FOR_1014,
+              "task_vm_info must be small enough for 10.14 MIG interfaces");
+
+static MemoryUsageMonitor* g_instance_for_testing = nullptr;
+
+}  // namespace
+
+// static
+MemoryUsageMonitor& MemoryUsageMonitor::Instance() {
+  DEFINE_STATIC_LOCAL(MemoryUsageMonitorMac, monitor, ());
+  return g_instance_for_testing ? *g_instance_for_testing : monitor;
+}
+
+// static
+void MemoryUsageMonitor::SetInstanceForTesting(MemoryUsageMonitor* instance) {
+  g_instance_for_testing = instance;
+}
+
+bool MemoryUsageMonitorMac::CalculateProcessMemoryFootprint(
+    uint64_t* private_footprint) {
+  // The following code is copied from OSMetrics::FillOSMemoryDump defined in
+  // //services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc
+  ChromeTaskVMInfo task_vm_info;
+  mach_msg_type_number_t count = ChromeTaskVMInfoCount;
+  kern_return_t result =
+      task_info(mach_task_self(), TASK_VM_INFO,
+                reinterpret_cast<task_info_t>(&task_vm_info), &count);
+  if (result != KERN_SUCCESS)
+    return false;
+
+  uint64_t internal_bytes = task_vm_info.internal;
+  uint64_t compressed_bytes = task_vm_info.compressed;
+  uint64_t phys_footprint_bytes = 0;
+
+  if (count == ChromeTaskVMInfoCount) {
+    phys_footprint_bytes = task_vm_info.phys_footprint;
+  }
+
+  // The following code is copied from CalculatePrivateFootprintKB defined in
+  // //services/resource_coordinator/memory_instrumentation/queued_request_dispatcher.cc
+  if (base::mac::IsAtLeastOS10_12()) {
+    *private_footprint = phys_footprint_bytes;
+  } else {
+    *private_footprint = internal_bytes + compressed_bytes;
+  }
+  return true;
+}
+
+void MemoryUsageMonitorMac::GetProcessMemoryUsage(MemoryUsage& usage) {
+  uint64_t private_footprint;
+  if (CalculateProcessMemoryFootprint(&private_footprint))
+    usage.private_footprint_bytes = static_cast<double>(private_footprint);
+}
+
+}  // namespace blink

diff --git a/third_party/blink/renderer/controller/memory_usage_monitor_mac.h b/third_party/blink/renderer/controller/memory_usage_monitor_mac.h
new file mode 100644
index 0000000..79b2a2e
--- /dev/null
+++ b/third_party/blink/renderer/controller/memory_usage_monitor_mac.h

@@ -0,0 +1,25 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CONTROLLER_MEMORY_USAGE_MONITOR_MAC_H_
+#define THIRD_PARTY_BLINK_RENDERER_CONTROLLER_MEMORY_USAGE_MONITOR_MAC_H_
+
+#include "third_party/blink/renderer/controller/controller_export.h"
+#include "third_party/blink/renderer/controller/memory_usage_monitor.h"
+
+namespace blink {
+
+// MemoryUsageMonitor implementation for Mac platform.
+class CONTROLLER_EXPORT MemoryUsageMonitorMac : public MemoryUsageMonitor {
+ public:
+  MemoryUsageMonitorMac() = default;
+
+ private:
+  void GetProcessMemoryUsage(MemoryUsage&) override;
+  static bool CalculateProcessMemoryFootprint(uint64_t* private_footprint);
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CONTROLLER_MEMORY_USAGE_MONITOR_MAC_H_

diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.cc b/third_party/blink/renderer/core/html/forms/file_input_type.cc
index d1b97b0..c207f65ee 100644
--- a/third_party/blink/renderer/core/html/forms/file_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/file_input_type.cc

@@ -33,6 +33,7 @@
 #include "third_party/blink/renderer/core/html/forms/form_controller.h"
 #include "third_party/blink/renderer/core/html/forms/form_data.h"
 #include "third_party/blink/renderer/core/html/forms/html_input_element.h"
+#include "third_party/blink/renderer/core/html/shadow/shadow_element_names.h"
 #include "third_party/blink/renderer/core/html_names.h"
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
@@ -248,9 +249,8 @@
     return;
 
   file_list_->clear();
-  if (auto* layout_object = GetElement().GetLayoutObject())
-    layout_object->SetShouldDoFullPaintInvalidation();
   GetElement().SetNeedsValidityCheck();
+  UpdateView();
 }
 
 FileList* FileInputType::CreateFileList(const FileChooserFileInfoList& files,
@@ -324,14 +324,17 @@
           GetElement().Multiple() ? IDS_FORM_MULTIPLE_FILES_BUTTON_LABEL
                                   : IDS_FORM_FILE_BUTTON_LABEL)));
   button->SetShadowPseudoId(AtomicString("-webkit-file-upload-button"));
+  button->setAttribute(html_names::kIdAttr,
+                       shadow_element_names::FileUploadButton());
   button->SetActive(GetElement().CanReceiveDroppedFiles());
   GetElement().UserAgentShadowRoot()->AppendChild(button);
 }
 
 HTMLInputElement* FileInputType::UploadButton() const {
-  Node* node = GetElement().UserAgentShadowRoot()->firstChild();
-  CHECK(!node || IsA<HTMLInputElement>(node));
-  return To<HTMLInputElement>(node);
+  Element* element = GetElement().UserAgentShadowRoot()->getElementById(
+      shadow_element_names::FileUploadButton());
+  CHECK(!element || IsA<HTMLInputElement>(element));
+  return To<HTMLInputElement>(element);
 }
 
 void FileInputType::DisabledAttributeChanged() {
@@ -373,10 +376,7 @@
 
   GetElement().NotifyFormStateChanged();
   GetElement().SetNeedsValidityCheck();
-
-  if (GetElement().GetLayoutObject())
-    GetElement().GetLayoutObject()->SetShouldDoFullPaintInvalidation();
-
+  UpdateView();
   return files_changed;
 }
 
@@ -520,4 +520,9 @@
   }
 }
 
+void FileInputType::UpdateView() {
+  if (auto* layout_object = GetElement().GetLayoutObject())
+    layout_object->SetShouldDoFullPaintInvalidation();
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.h b/third_party/blink/renderer/core/html/forms/file_input_type.h
index b2e94cad..3abb82a 100644
--- a/third_party/blink/renderer/core/html/forms/file_input_type.h
+++ b/third_party/blink/renderer/core/html/forms/file_input_type.h

@@ -93,6 +93,7 @@
   void MultipleAttributeChanged() override;
   String DefaultToolTip(const InputTypeView&) const override;
   void CopyNonAttributeProperties(const HTMLInputElement&) override;
+  void UpdateView() override;
 
   // KeyboardClickableInputTypeView overrides.
   void HandleKeypressEvent(KeyboardEvent&) override;

diff --git a/third_party/blink/renderer/core/html/shadow/shadow_element_names.cc b/third_party/blink/renderer/core/html/shadow/shadow_element_names.cc
index d1f4ee4..ae955ff 100644
--- a/third_party/blink/renderer/core/html/shadow/shadow_element_names.cc
+++ b/third_party/blink/renderer/core/html/shadow/shadow_element_names.cc

@@ -104,6 +104,11 @@
   return name;
 }
 
+const AtomicString& FileUploadButton() {
+  DEFINE_STATIC_LOCAL(AtomicString, name, ("file-upload-button"));
+  return name;
+}
+
 const AtomicString& OptGroupLabel() {
   DEFINE_STATIC_LOCAL(AtomicString, name, ("optgroup-label"));
   return name;

diff --git a/third_party/blink/renderer/core/html/shadow/shadow_element_names.h b/third_party/blink/renderer/core/html/shadow/shadow_element_names.h
index 3d0dd77..128f3eb 100644
--- a/third_party/blink/renderer/core/html/shadow/shadow_element_names.h
+++ b/third_party/blink/renderer/core/html/shadow/shadow_element_names.h

@@ -52,6 +52,7 @@
 CORE_EXPORT const AtomicString& SliderThumb();
 const AtomicString& SliderTrack();
 const AtomicString& TextFieldContainer();
+const AtomicString& FileUploadButton();
 const AtomicString& OptGroupLabel();
 
 }  // namespace shadow_element_names

diff --git a/third_party/blink/renderer/core/script/worker_modulator_impl.cc b/third_party/blink/renderer/core/script/worker_modulator_impl.cc
index 10b82a7..1292fd9 100644
--- a/third_party/blink/renderer/core/script/worker_modulator_impl.cc
+++ b/third_party/blink/renderer/core/script/worker_modulator_impl.cc

@@ -43,8 +43,14 @@
     return false;
   }
 
-  // TODO(nhiroki): Support module loading for SharedWorker and Service Worker.
-  // (https://crbug.com/680046)
+  // TODO(https://crbug.com/824646): Remove this flag check once module loading
+  // for SharedWorker is enabled by default.
+  if (GetExecutionContext()->IsSharedWorkerGlobalScope() &&
+      RuntimeEnabledFeatures::ModuleSharedWorkerEnabled()) {
+    return false;
+  }
+
+  // TODO(https://crbug.com/824647): Support module loading for Service Worker.
   *reason =
       "Module scripts are not supported on WorkerGlobalScope yet (see "
       "https://crbug.com/680046).";

diff --git a/third_party/blink/renderer/modules/encoding/text_encoder.cc b/third_party/blink/renderer/modules/encoding/text_encoder.cc
index 0e2da7a..8907b5026 100644
--- a/third_party/blink/renderer/modules/encoding/text_encoder.cc
+++ b/third_party/blink/renderer/modules/encoding/text_encoder.cc

@@ -92,11 +92,11 @@
   if (source.Is8Bit()) {
     encode_into_result_data = codec_->EncodeInto(
         source.Characters8(), source.length(), destination_buffer,
-        destination.View()->deprecatedLengthAsUnsigned());
+        destination.View()->lengthAsSizeT());
   } else {
     encode_into_result_data = codec_->EncodeInto(
         source.Characters16(), source.length(), destination_buffer,
-        destination.View()->deprecatedLengthAsUnsigned());
+        destination.View()->lengthAsSizeT());
   }
 
   encode_into_result->setRead(encode_into_result_data.code_units_read);

diff --git a/third_party/blink/renderer/modules/webaudio/periodic_wave.cc b/third_party/blink/renderer/modules/webaudio/periodic_wave.cc
index b8a64742..fa765ce 100644
--- a/third_party/blink/renderer/modules/webaudio/periodic_wave.cc
+++ b/third_party/blink/renderer/modules/webaudio/periodic_wave.cc

@@ -241,17 +241,19 @@
   for (unsigned range_index = 0; range_index < NumberOfRanges();
        ++range_index) {
     // This FFTFrame is used to cull partials (represented by frequency bins).
-    float* real_p = frame.RealData();
-    float* imag_p = frame.ImagData();
+    AudioFloatArray& real = frame.RealData();
+    DCHECK_GE(real.size(), number_of_components);
+    AudioFloatArray& imag = frame.ImagData();
+    DCHECK_GE(imag.size(), number_of_components);
 
     // Copy from loaded frequency data and generate the complex conjugate
     // because of the way the inverse FFT is defined versus the values in the
     // arrays.  Need to scale the data by fftSize to remove the scaling that the
     // inverse IFFT would do.
     float scale = fft_size;
-    vector_math::Vsmul(real_data, 1, &scale, real_p, 1, number_of_components);
+    vector_math::Vsmul(real_data, 1, &scale, real.Data(), 1, number_of_components);
     scale = -scale;
-    vector_math::Vsmul(imag_data, 1, &scale, imag_p, 1, number_of_components);
+    vector_math::Vsmul(imag_data, 1, &scale, imag.Data(), 1, number_of_components);
 
     // Find the starting bin where we should start culling.  We need to clear
     // out the highest frequencies to band-limit the waveform.
@@ -262,13 +264,13 @@
     // pitch range.
     for (i = std::min(number_of_components, number_of_partials + 1);
          i < half_size; ++i) {
-      real_p[i] = 0;
-      imag_p[i] = 0;
+      real[i] = 0;
+      imag[i] = 0;
     }
 
     // Clear packed-nyquist and any DC-offset.
-    real_p[0] = 0;
-    imag_p[0] = 0;
+    real[0] = 0;
+    imag[0] = 0;
 
     // Create the band-limited table.
     unsigned wave_size = PeriodicWaveSize();

diff --git a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
index 6b3a70e..325f61e 100644
--- a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
+++ b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc

@@ -154,11 +154,11 @@
   // Do the analysis.
   analysis_frame_->DoFFT(temp_p);
 
-  const float* real_p = analysis_frame_->RealData();
-  float* imag_p = analysis_frame_->ImagData();
+  const AudioFloatArray& real = analysis_frame_->RealData();
+  AudioFloatArray& imag = analysis_frame_->ImagData();
 
   // Blow away the packed nyquist component.
-  imag_p[0] = 0;
+  imag[0] = 0;
 
   // Normalize so than an input sine wave at 0dBfs registers as 0dBfs (undo FFT
   // scaling factor).
@@ -174,8 +174,12 @@
   // previous result.
   float* destination = MagnitudeBuffer().Data();
   size_t n = MagnitudeBuffer().size();
+  DCHECK_GE(real.size(), n);
+  const float* real_p_data = real.Data();
+  DCHECK_GE(imag.size(), n);
+  const float* imag_p_data = imag.Data();
   for (size_t i = 0; i < n; ++i) {
-    std::complex<double> c(real_p[i], imag_p[i]);
+    std::complex<double> c(real_p_data[i], imag_p_data[i]);
     double scalar_magnitude = abs(c) * magnitude_scale;
     destination[i] = float(k * destination[i] + (1 - k) * scalar_magnitude);
   }

diff --git a/third_party/blink/renderer/platform/audio/ffmpeg/fft_frame_ffmpeg.cc b/third_party/blink/renderer/platform/audio/ffmpeg/fft_frame_ffmpeg.cc
index c2b692b..69b31df 100644
--- a/third_party/blink/renderer/platform/audio/ffmpeg/fft_frame_ffmpeg.cc
+++ b/third_party/blink/renderer/platform/audio/ffmpeg/fft_frame_ffmpeg.cc

@@ -84,8 +84,8 @@
 
   // Copy/setup frame data.
   unsigned nbytes = sizeof(float) * (fft_size_ / 2);
-  memcpy(RealData(), frame.RealData(), nbytes);
-  memcpy(ImagData(), frame.ImagData(), nbytes);
+  memcpy(RealData().Data(), frame.RealData().Data(), nbytes);
+  memcpy(ImagData().Data(), frame.ImagData().Data(), nbytes);
 }
 
 int FFTFrame::MinFFTSize() {

diff --git a/third_party/blink/renderer/platform/audio/fft_frame.cc b/third_party/blink/renderer/platform/audio/fft_frame.cc
index b5b02af..b10f84b 100644
--- a/third_party/blink/renderer/platform/audio/fft_frame.cc
+++ b/third_party/blink/renderer/platform/audio/fft_frame.cc

@@ -82,13 +82,13 @@
                                               double interp) {
   // FIXME : with some work, this method could be optimized
 
-  float* real_p = RealData();
-  float* imag_p = ImagData();
+  AudioFloatArray& real = RealData();
+  AudioFloatArray& imag = ImagData();
 
-  const float* real_p1 = frame1.RealData();
-  const float* imag_p1 = frame1.ImagData();
-  const float* real_p2 = frame2.RealData();
-  const float* imag_p2 = frame2.ImagData();
+  const AudioFloatArray& real1 = frame1.RealData();
+  const AudioFloatArray& imag1 = frame1.ImagData();
+  const AudioFloatArray& real2 = frame2.RealData();
+  const AudioFloatArray& imag2 = frame2.ImagData();
 
   fft_size_ = frame1.FftSize();
   log2fft_size_ = frame1.Log2FFTSize();
@@ -100,14 +100,26 @@
   double last_phase1 = 0.0;
   double last_phase2 = 0.0;
 
-  real_p[0] = static_cast<float>(s1base * real_p1[0] + s2base * real_p2[0]);
-  imag_p[0] = static_cast<float>(s1base * imag_p1[0] + s2base * imag_p2[0]);
+  const float* real_p1_data = real1.Data();
+  const float* real_p2_data = real2.Data();
+  const float* imag_p1_data = imag1.Data();
+  const float* imag_p2_data = imag2.Data();
+
+  real[0] = static_cast<float>(s1base * real_p1_data[0] +
+                                         s2base * real_p2_data[0]);
+  imag[0] = static_cast<float>(s1base * imag_p1_data[0] +
+                                         s2base * imag_p2_data[0]);
 
   int n = fft_size_ / 2;
 
+  DCHECK_GE(real1.size(), static_cast<uint32_t>(n));
+  DCHECK_GE(imag1.size(), static_cast<uint32_t>(n));
+  DCHECK_GE(real2.size(), static_cast<uint32_t>(n));
+  DCHECK_GE(imag2.size(), static_cast<uint32_t>(n));
+
   for (int i = 1; i < n; ++i) {
-    std::complex<double> c1(real_p1[i], imag_p1[i]);
-    std::complex<double> c2(real_p2[i], imag_p2[i]);
+    std::complex<double> c1(real_p1_data[i], imag_p1_data[i]);
+    std::complex<double> c2(real_p2_data[i], imag_p2_data[i]);
 
     double mag1 = abs(c1);
     double mag2 = abs(c2);
@@ -178,14 +190,14 @@
 
     std::complex<double> c = std::polar(mag, phase_accum);
 
-    real_p[i] = static_cast<float>(c.real());
-    imag_p[i] = static_cast<float>(c.imag());
+    real[i] = static_cast<float>(c.real());
+    imag[i] = static_cast<float>(c.imag());
   }
 }
 
 double FFTFrame::ExtractAverageGroupDelay() {
-  float* real_p = RealData();
-  float* imag_p = ImagData();
+  AudioFloatArray& real = RealData();
+  AudioFloatArray& imag = ImagData();
 
   double ave_sum = 0.0;
   double weight_sum = 0.0;
@@ -198,7 +210,7 @@
 
   // Calculate weighted average group delay
   for (int i = 0; i < half_size; i++) {
-    std::complex<double> c(real_p[i], imag_p[i]);
+    std::complex<double> c(real[i], imag[i]);
     double mag = abs(c);
     double phase = arg(c);
 
@@ -228,7 +240,7 @@
   AddConstantGroupDelay(-ave_sample_delay);
 
   // Remove DC offset
-  real_p[0] = 0.0f;
+  real[0] = 0.0f;
 
   return ave_sample_delay;
 }
@@ -236,8 +248,8 @@
 void FFTFrame::AddConstantGroupDelay(double sample_frame_delay) {
   int half_size = FftSize() / 2;
 
-  float* real_p = RealData();
-  float* imag_p = ImagData();
+  AudioFloatArray& real = RealData();
+  AudioFloatArray& imag = ImagData();
 
   const double sample_phase_delay =
       kTwoPiDouble / static_cast<double>(FftSize());
@@ -246,7 +258,7 @@
 
   // Add constant group delay
   for (int i = 1; i < half_size; i++) {
-    std::complex<double> c(real_p[i], imag_p[i]);
+    std::complex<double> c(real[i], imag[i]);
     double mag = abs(c);
     double phase = arg(c);
 
@@ -254,8 +266,8 @@
 
     std::complex<double> c2 = std::polar(mag, phase);
 
-    real_p[i] = static_cast<float>(c2.real());
-    imag_p[i] = static_cast<float>(c2.imag());
+    real[i] = static_cast<float>(c2.real());
+    imag[i] = static_cast<float>(c2.imag());
   }
 }
 
@@ -263,21 +275,27 @@
   FFTFrame& frame1 = *this;
   const FFTFrame& frame2 = frame;
 
-  float* real_p1 = frame1.RealData();
-  float* imag_p1 = frame1.ImagData();
-  const float* real_p2 = frame2.RealData();
-  const float* imag_p2 = frame2.ImagData();
+  AudioFloatArray& real1 = frame1.RealData();
+  AudioFloatArray& imag1 = frame1.ImagData();
+  const AudioFloatArray& real2 = frame2.RealData();
+  const AudioFloatArray& imag2 = frame2.ImagData();
 
   unsigned half_size = FftSize() / 2;
-  float real0 = real_p1[0];
-  float imag0 = imag_p1[0];
+  float real0 = real1[0];
+  float imag0 = imag1[0];
 
-  vector_math::Zvmul(real_p1, imag_p1, real_p2, imag_p2, real_p1, imag_p1,
+  DCHECK_GE(real1.size(), half_size);
+  DCHECK_GE(imag1.size(), half_size);
+  DCHECK_GE(real2.size(), half_size);
+  DCHECK_GE(imag2.size(), half_size);
+
+  vector_math::Zvmul(real1.Data(), imag1.Data(), real2.Data(),
+                     imag2.Data(), real1.Data(), imag1.Data(),
                      half_size);
 
   // Multiply the packed DC/nyquist component
-  real_p1[0] = real0 * real_p2[0];
-  imag_p1[0] = imag0 * imag_p2[0];
+  real1[0] = real0 * real2.Data()[0];
+  imag1[0] = imag0 * imag2.Data()[0];
 }
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/platform/audio/fft_frame.h b/third_party/blink/renderer/platform/audio/fft_frame.h
index a6022b9..ea19c80fd0 100644
--- a/third_party/blink/renderer/platform/audio/fft_frame.h
+++ b/third_party/blink/renderer/platform/audio/fft_frame.h

@@ -83,10 +83,10 @@
   // least |fft_size_| elements.
   void DoInverseFFT(float* data);
 
-  float* RealData() { return real_data_.Data(); }
-  const float* RealData() const { return real_data_.Data(); }
-  float* ImagData() { return imag_data_.Data(); }
-  const float* ImagData() const { return imag_data_.Data(); }
+  AudioFloatArray& RealData() { return real_data_; }
+  const AudioFloatArray& RealData() const { return real_data_; }
+  AudioFloatArray& ImagData() { return imag_data_; }
+  const AudioFloatArray& ImagData() const { return imag_data_; }
 
   unsigned FftSize() const { return fft_size_; }
   unsigned Log2FFTSize() const { return log2fft_size_; }

diff --git a/third_party/blink/renderer/platform/audio/mac/fft_frame_mac.cc b/third_party/blink/renderer/platform/audio/mac/fft_frame_mac.cc
index 8b77f6d..f189a78 100644
--- a/third_party/blink/renderer/platform/audio/mac/fft_frame_mac.cc
+++ b/third_party/blink/renderer/platform/audio/mac/fft_frame_mac.cc

@@ -131,8 +131,8 @@
 
   // Copy/setup frame data
   unsigned nbytes = sizeof(float) * fft_size_;
-  memcpy(RealData(), frame.frame_.realp, nbytes);
-  memcpy(ImagData(), frame.frame_.imagp, nbytes);
+  memcpy(RealData().Data(), frame.frame_.realp, nbytes);
+  memcpy(ImagData().Data(), frame.frame_.imagp, nbytes);
 }
 
 FFTFrame::~FFTFrame() {}

diff --git a/third_party/blink/renderer/platform/audio/pffft/fft_frame_pffft.cc b/third_party/blink/renderer/platform/audio/pffft/fft_frame_pffft.cc
index 7432ad5..620188f 100644
--- a/third_party/blink/renderer/platform/audio/pffft/fft_frame_pffft.cc
+++ b/third_party/blink/renderer/platform/audio/pffft/fft_frame_pffft.cc

@@ -111,8 +111,8 @@
 
   // Copy/setup frame data.
   unsigned nbytes = sizeof(float) * (fft_size_ / 2);
-  memcpy(RealData(), frame.RealData(), nbytes);
-  memcpy(ImagData(), frame.ImagData(), nbytes);
+  memcpy(RealData().Data(), frame.RealData().Data(), nbytes);
+  memcpy(ImagData().Data(), frame.ImagData().Data(), nbytes);
 }
 
 int FFTFrame::MinFFTSize() {

diff --git a/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer.cc b/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer.cc
index 407f7b2..176249a 100644
--- a/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer.cc
+++ b/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer.cc

@@ -172,7 +172,8 @@
   // Ends the effect on the top of the state stack if the stack is not empty,
   // and update the bounds of the SaveLayer[Alpha]Op of the effect.
   void EndEffect();
-  void UpdateEffectBounds(const FloatRect&, const TransformPaintPropertyNode&);
+  void UpdateEffectBounds(const base::Optional<FloatRect>&,
+                          const TransformPaintPropertyNode&);
 
   // Starts a clip state by adjusting the transform state, applying
   // |combined_clip_rect| which is combined from one or more consecutive clips,
@@ -243,7 +244,7 @@
     // Records the bounds of the effect which initiated the entry. Note that
     // the effect is not |this->effect| (which is the previous effect), but the
     // |current_effect_| when this entry is the top of the stack.
-    FloatRect bounds;
+    base::Optional<FloatRect> bounds;
   };
   Vector<EffectBoundsInfo> effect_bounds_stack_;
 
@@ -588,22 +589,25 @@
   const ClipPaintPropertyNode* input_clip = current_clip_;
   PushState(StateEntry::kEffect, saved_count);
   effect_bounds_stack_.emplace_back(
-      EffectBoundsInfo{save_layer_id, current_transform_});
+      EffectBoundsInfo{save_layer_id, current_transform_, base::nullopt});
   current_clip_ = input_clip;
   current_effect_ = &effect;
 }
 
 void ConversionContext::UpdateEffectBounds(
-    const FloatRect& bounds,
+    const base::Optional<FloatRect>& bounds,
     const TransformPaintPropertyNode& transform) {
-  if (effect_bounds_stack_.IsEmpty() || bounds.IsEmpty())
+  if (effect_bounds_stack_.IsEmpty() || !bounds)
     return;
 
   auto& effect_bounds_info = effect_bounds_stack_.back();
-  FloatRect mapped_bounds = bounds;
+  FloatRect mapped_bounds = *bounds;
   GeometryMapper::SourceToDestinationRect(
       transform, *effect_bounds_info.transform, mapped_bounds);
-  effect_bounds_info.bounds.Unite(mapped_bounds);
+  if (effect_bounds_info.bounds)
+    effect_bounds_info.bounds->Unite(mapped_bounds);
+  else
+    effect_bounds_info.bounds = mapped_bounds;
 }
 
 void ConversionContext::EndEffect() {
@@ -617,20 +621,20 @@
 
   DCHECK(effect_bounds_stack_.size());
   const auto& bounds_info = effect_bounds_stack_.back();
-  FloatRect bounds = bounds_info.bounds;
-  if (!bounds.IsEmpty()) {
+  base::Optional<FloatRect> bounds = bounds_info.bounds;
+  if (bounds) {
     if (current_effect_->Filter().IsEmpty()) {
-      cc_list_.UpdateSaveLayerBounds(bounds_info.save_layer_id, bounds);
+      cc_list_.UpdateSaveLayerBounds(bounds_info.save_layer_id, *bounds);
     } else {
       // The bounds for the SaveLayer[Alpha]Op should be the source bounds
       // before the filter is applied, in the space of the TranslateOp which was
       // emitted before the SaveLayer[Alpha]Op.
-      auto save_layer_bounds = bounds;
+      auto save_layer_bounds = *bounds;
       save_layer_bounds.MoveBy(-current_effect_->FiltersOrigin());
       cc_list_.UpdateSaveLayerBounds(bounds_info.save_layer_id,
                                      save_layer_bounds);
       // We need to propagate the filtered bounds to the parent.
-      bounds = current_effect_->MapRect(bounds);
+      bounds = current_effect_->MapRect(*bounds);
     }
   }
 
@@ -749,7 +753,17 @@
       cc_list_.EndPaintOfUnpaired(
           chunk_to_layer_mapper_.MapVisualRect(item.VisualRect()));
     }
-    UpdateEffectBounds(FloatRect(chunk.bounds), chunk_state.Transform());
+
+    // Chunk bounds are only important when we are actually drawing. There may
+    // also be cases when we only generate a paint record and do not draw,
+    // for example, to implement an SVG clip. In such cases, we can safely
+    // ignore effect bounds.
+    base::Optional<FloatRect> chunk_bounds;
+    if (cc_list_.GetUsageHint() ==
+        cc::DisplayItemList::kTopLevelDisplayItemList) {
+      chunk_bounds = FloatRect(chunk.bounds);
+    }
+    UpdateEffectBounds(chunk_bounds, chunk_state.Transform());
   }
 }
 

diff --git a/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer_test.cc b/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer_test.cc
index e7aaa29..7953f48 100644
--- a/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer_test.cc
+++ b/third_party/blink/renderer/platform/graphics/compositing/paint_chunks_to_cc_layer_test.cc

@@ -101,7 +101,7 @@
   Vector<cc::PaintOpType> expected_ops_;
 };
 
-#define EXPECT_EFFECT_BOUNDS(x, y, width, height, op_buffer, index)         \
+#define EXPECT_EFFECT_BOUNDS(rect, op_buffer, index)                        \
   do {                                                                      \
     FloatRect bounds;                                                       \
     if (const auto* save_layer_alpha =                                      \
@@ -113,7 +113,7 @@
     } else {                                                                \
       FAIL() << "No SaveLayer[Alpha]Op at " << index;                       \
     }                                                                       \
-    EXPECT_EQ(FloatRect(x, y, width, height), bounds);                      \
+    EXPECT_EQ(rect, bounds);                                                \
   } while (false)
 
 #define EXPECT_TRANSFORM_MATRIX(transform, op_buffer, index)                 \
@@ -183,6 +183,10 @@
   }
 };
 
+const cc::DisplayItemList::UsageHint kUsageHints[] = {
+    cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer,
+    cc::DisplayItemList::kTopLevelDisplayItemList};
+
 TEST_P(PaintChunksToCcLayerTest, EffectGroupingSimple) {
   // This test verifies effects are applied as a group.
   auto e1 = CreateOpacityEffect(e0(), 0.5f);
@@ -190,18 +194,23 @@
   chunks.AddChunk(t0(), c0(), *e1, IntRect(0, 0, 50, 50));
   chunks.AddChunk(t0(), c0(), *e1, IntRect(20, 20, 70, 70));
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                                cc::PaintOpType::DrawRecord,      // <p0/>
-                                cc::PaintOpType::DrawRecord,      // <p1/>
-                                cc::PaintOpType::Restore}));      // </e1>
-  EXPECT_EFFECT_BOUNDS(0, 0, 90, 90, *output, 0);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 90, 90)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                                  cc::PaintOpType::DrawRecord,      // <p0/>
+                                  cc::PaintOpType::DrawRecord,      // <p1/>
+                                  cc::PaintOpType::Restore}));      // </e1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, EffectGroupingNested) {
@@ -213,24 +222,33 @@
   chunks.AddChunk(t0(), c0(), *e2);
   chunks.AddChunk(t0(), c0(), *e3, IntRect(111, 222, 333, 444));
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                                cc::PaintOpType::SaveLayerAlpha,  // <e2>
-                                cc::PaintOpType::DrawRecord,      // <p0/>
-                                cc::PaintOpType::Restore,         // </e2>
-                                cc::PaintOpType::SaveLayerAlpha,  // <e3>
-                                cc::PaintOpType::DrawRecord,      // <p1/>
-                                cc::PaintOpType::Restore,         // </e3>
-                                cc::PaintOpType::Restore}));      // </e1>
-  EXPECT_EFFECT_BOUNDS(0, 0, 444, 666, *output, 0);
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 1);
-  EXPECT_EFFECT_BOUNDS(111, 222, 333, 444, *output, 4);
+  const FloatRect kExpectedBounds1[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 444, 666)};
+  const FloatRect kExpectedBounds2[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 100, 100)};
+  const FloatRect kExpectedBounds3[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(111, 222, 333, 444)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                                  cc::PaintOpType::SaveLayerAlpha,  // <e2>
+                                  cc::PaintOpType::DrawRecord,      // <p0/>
+                                  cc::PaintOpType::Restore,         // </e2>
+                                  cc::PaintOpType::SaveLayerAlpha,  // <e3>
+                                  cc::PaintOpType::DrawRecord,      // <p1/>
+                                  cc::PaintOpType::Restore,         // </e3>
+                                  cc::PaintOpType::Restore}));      // </e1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds1[hint], *output, 0);
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds2[hint], *output, 1);
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds3[hint], *output, 4);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, EffectFilterGroupingNestedWithTransforms) {
@@ -246,40 +264,47 @@
   chunks.AddChunk(*t2, c0(), *e1, IntRect(0, 0, 50, 50));
   chunks.AddChunk(*t1, c0(), *e2, IntRect(20, 20, 70, 70));
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make(
-          {cc::PaintOpType::Save, cc::PaintOpType::Concat,     // <t1*t2>
-           cc::PaintOpType::SaveLayerAlpha,                    // <e1>
-           cc::PaintOpType::DrawRecord,                        // <p1/>
-           cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <e2_offset>
-           cc::PaintOpType::SaveLayer,                         // <e2>
-           cc::PaintOpType::Translate,  // <e2_offset^-1/>
-           cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <t2^-1>
-           cc::PaintOpType::DrawRecord,                        // <p2/>
-           cc::PaintOpType::Restore,                           // </t2^-1>
-           cc::PaintOpType::Restore,                           // </e2>
-           cc::PaintOpType::Restore,                           // </e2_offset>
-           cc::PaintOpType::Restore,                           // </e1>
-           cc::PaintOpType::Restore}));                        // </t1*t2>
-  EXPECT_TRANSFORM_MATRIX(t1->Matrix() * t2->SlowMatrix(), *output, 1);
-  // chunk1.bounds + e2(t2^-1(chunk2.bounds))
-  EXPECT_EFFECT_BOUNDS(0, 0, 155, 155, *output, 2);
-  // e2_offset
-  EXPECT_TRANSLATE(60, 60, *output, 5);
-  // t2^-1(chunk2.bounds) - e2_offset
-  EXPECT_EFFECT_BOUNDS(10, 10, 70, 70, *output, 6);
-  // -e2_offset
-  EXPECT_TRANSLATE(-e2->FiltersOrigin().X(), -e2->FiltersOrigin().Y(), *output,
-                   7);
-  // t2^1
-  EXPECT_TRANSLATE(-t2->Translation2D().Width(), -t2->Translation2D().Height(),
-                   *output, 9);
+  const FloatRect kExpectedBounds1[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 155, 155)};
+  const FloatRect kExpectedBounds2[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(10, 10, 70, 70)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make(
+            {cc::PaintOpType::Save, cc::PaintOpType::Concat,     // <t1*t2>
+             cc::PaintOpType::SaveLayerAlpha,                    // <e1>
+             cc::PaintOpType::DrawRecord,                        // <p1/>
+             cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <e2_offset>
+             cc::PaintOpType::SaveLayer,                         // <e2>
+             cc::PaintOpType::Translate,  // <e2_offset^-1/>
+             cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <t2^-1>
+             cc::PaintOpType::DrawRecord,                        // <p2/>
+             cc::PaintOpType::Restore,                           // </t2^-1>
+             cc::PaintOpType::Restore,                           // </e2>
+             cc::PaintOpType::Restore,                           // </e2_offset>
+             cc::PaintOpType::Restore,                           // </e1>
+             cc::PaintOpType::Restore}));                        // </t1*t2>
+    EXPECT_TRANSFORM_MATRIX(t1->Matrix() * t2->SlowMatrix(), *output, 1);
+    // chunk1.bounds + e2(t2^-1(chunk2.bounds))
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds1[hint], *output, 2);
+    // e2_offset
+    EXPECT_TRANSLATE(60, 60, *output, 5);
+    // t2^-1(chunk2.bounds) - e2_offset
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds2[hint], *output, 6);
+    // -e2_offset
+    EXPECT_TRANSLATE(-e2->FiltersOrigin().X(), -e2->FiltersOrigin().Y(),
+                     *output, 7);
+    // t2^1
+    EXPECT_TRANSLATE(-t2->Translation2D().Width(),
+                     -t2->Translation2D().Height(), *output, 9);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, InterleavedClipEffect) {
@@ -301,38 +326,45 @@
   chunks.AddChunk(t0(), *c3, *e1, IntRect(20, 20, 70, 70));
   chunks.AddChunk(t0(), *c4, e0());
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(*output, PaintRecordMatcher::Make(
-                           {cc::PaintOpType::Save,
-                            cc::PaintOpType::ClipRect,    // <c1+c2>
-                            cc::PaintOpType::DrawRecord,  // <p0/>
-                            cc::PaintOpType::Save,
-                            cc::PaintOpType::ClipRect,        // <c3>
-                            cc::PaintOpType::DrawRecord,      // <p1/>
-                            cc::PaintOpType::Restore,         // </c3>
-                            cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                            cc::PaintOpType::Save,
-                            cc::PaintOpType::ClipRect,        // <c3+c4>
-                            cc::PaintOpType::SaveLayerAlpha,  // <e2>
-                            cc::PaintOpType::DrawRecord,      // <p2/>
-                            cc::PaintOpType::Restore,         // </e2>
-                            cc::PaintOpType::Restore,         // </c3+c4>
-                            cc::PaintOpType::Save,
-                            cc::PaintOpType::ClipRect,    // <c3>
-                            cc::PaintOpType::DrawRecord,  // <p3/>
-                            cc::PaintOpType::Restore,     // </c3>
-                            cc::PaintOpType::Restore,     // </e1>
-                            cc::PaintOpType::Save,
-                            cc::PaintOpType::ClipRect,    // <c3+c4>
-                            cc::PaintOpType::DrawRecord,  // <p4/>
-                            cc::PaintOpType::Restore,     // </c3+c4>
-                            cc::PaintOpType::Restore}));  // </c1+c2>
-  EXPECT_EFFECT_BOUNDS(0, 0, 90, 90, *output, 7);
-  EXPECT_EFFECT_BOUNDS(0, 0, 50, 50, *output, 10);
+  const FloatRect kExpectedBounds1[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 90, 90)};
+  const FloatRect kExpectedBounds2[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 50, 50)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(*output, PaintRecordMatcher::Make(
+                             {cc::PaintOpType::Save,
+                              cc::PaintOpType::ClipRect,    // <c1+c2>
+                              cc::PaintOpType::DrawRecord,  // <p0/>
+                              cc::PaintOpType::Save,
+                              cc::PaintOpType::ClipRect,        // <c3>
+                              cc::PaintOpType::DrawRecord,      // <p1/>
+                              cc::PaintOpType::Restore,         // </c3>
+                              cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                              cc::PaintOpType::Save,
+                              cc::PaintOpType::ClipRect,        // <c3+c4>
+                              cc::PaintOpType::SaveLayerAlpha,  // <e2>
+                              cc::PaintOpType::DrawRecord,      // <p2/>
+                              cc::PaintOpType::Restore,         // </e2>
+                              cc::PaintOpType::Restore,         // </c3+c4>
+                              cc::PaintOpType::Save,
+                              cc::PaintOpType::ClipRect,    // <c3>
+                              cc::PaintOpType::DrawRecord,  // <p3/>
+                              cc::PaintOpType::Restore,     // </c3>
+                              cc::PaintOpType::Restore,     // </e1>
+                              cc::PaintOpType::Save,
+                              cc::PaintOpType::ClipRect,    // <c3+c4>
+                              cc::PaintOpType::DrawRecord,  // <p4/>
+                              cc::PaintOpType::Restore,     // </c3+c4>
+                              cc::PaintOpType::Restore}));  // </c1+c2>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds1[hint], *output, 7);
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds2[hint], *output, 10);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, ClipSpaceInversion) {
@@ -375,24 +407,29 @@
   chunks.AddChunk(t0(), c0(), *e1);
   chunks.AddChunk(*t1, c0(), *e1);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(*output,
-              PaintRecordMatcher::Make(
-                  {cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1>
-                   cc::PaintOpType::SaveLayerAlpha,                 // <e1>
-                   cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1^-1>
-                   cc::PaintOpType::DrawRecord,                     // <p0/>
-                   cc::PaintOpType::Restore,                        // </t1^-1>
-                   cc::PaintOpType::DrawRecord,                     // <p1/>
-                   cc::PaintOpType::Restore,                        // </e1>
-                   cc::PaintOpType::Restore}));                     // </t1>
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 2);
-  EXPECT_TRANSFORM_MATRIX(t1->Matrix(), *output, 1);
-  EXPECT_TRANSFORM_MATRIX(t1->Matrix().Inverse(), *output, 4);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 100, 100)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(*output,
+                PaintRecordMatcher::Make(
+                    {cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1>
+                     cc::PaintOpType::SaveLayerAlpha,                 // <e1>
+                     cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1^-1>
+                     cc::PaintOpType::DrawRecord,                     // <p0/>
+                     cc::PaintOpType::Restore,     // </t1^-1>
+                     cc::PaintOpType::DrawRecord,  // <p1/>
+                     cc::PaintOpType::Restore,     // </e1>
+                     cc::PaintOpType::Restore}));  // </t1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 2);
+    EXPECT_TRANSFORM_MATRIX(t1->Matrix(), *output, 1);
+    EXPECT_TRANSFORM_MATRIX(t1->Matrix().Inverse(), *output, 4);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, FilterEffectSpaceInversion) {
@@ -410,29 +447,33 @@
   TestChunks chunks;
   chunks.AddChunk(t0(), c0(), *e1);
 
-  auto output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make(
-          {cc::PaintOpType::Save, cc::PaintOpType::Concat,     // <t1>
-           cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <e1_offset>
-           cc::PaintOpType::SaveLayer,                         // <e1>
-           cc::PaintOpType::Translate,                      // <e1_offset^-1/>
-           cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1^-1>
-           cc::PaintOpType::DrawRecord,                     // <p0/>
-           cc::PaintOpType::Restore,                        // </t1^-1>
-           cc::PaintOpType::Restore,                        // </e1>
-           cc::PaintOpType::Restore,                        // </e1_offset>
-           cc::PaintOpType::Restore}));                     // </t1>
-  EXPECT_TRANSFORM_MATRIX(t1->Matrix(), *output, 1);
-  EXPECT_TRANSLATE(66, 88, *output, 3);
-  EXPECT_EFFECT_BOUNDS(-66, -88, 50, 50, *output, 4);
-  EXPECT_TRANSLATE(-66, -88, *output, 5);
-  EXPECT_TRANSFORM_MATRIX(t1->Matrix().Inverse(), *output, 7);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(-66, -88, 50, 50)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    auto output = PaintChunksToCcLayer::Convert(
+                      chunks.chunks, PropertyTreeState::Root(),
+                      gfx::Vector2dF(), chunks.items, kUsageHints[hint])
+                      ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make(
+            {cc::PaintOpType::Save, cc::PaintOpType::Concat,     // <t1>
+             cc::PaintOpType::Save, cc::PaintOpType::Translate,  // <e1_offset>
+             cc::PaintOpType::SaveLayer,                         // <e1>
+             cc::PaintOpType::Translate,                      // <e1_offset^-1/>
+             cc::PaintOpType::Save, cc::PaintOpType::Concat,  // <t1^-1>
+             cc::PaintOpType::DrawRecord,                     // <p0/>
+             cc::PaintOpType::Restore,                        // </t1^-1>
+             cc::PaintOpType::Restore,                        // </e1>
+             cc::PaintOpType::Restore,                        // </e1_offset>
+             cc::PaintOpType::Restore}));                     // </t1>
+    EXPECT_TRANSFORM_MATRIX(t1->Matrix(), *output, 1);
+    EXPECT_TRANSLATE(66, 88, *output, 3);
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 4);
+    EXPECT_TRANSLATE(-66, -88, *output, 5);
+    EXPECT_TRANSFORM_MATRIX(t1->Matrix().Inverse(), *output, 7);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, NonRootLayerSimple) {
@@ -482,20 +523,25 @@
   TestChunks chunks;
   chunks.AddChunk(t0(), *c2, *e1);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState(t0(), *c1, e0()), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                                cc::PaintOpType::Save,
-                                cc::PaintOpType::ClipRect,    // <c2>
-                                cc::PaintOpType::DrawRecord,  // <p0/>
-                                cc::PaintOpType::Restore,     // </c2>
-                                cc::PaintOpType::Restore}));  // </e1>
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 0);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 100, 100)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(
+            chunks.chunks, PropertyTreeState(t0(), *c1, e0()), gfx::Vector2dF(),
+            chunks.items, kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                                  cc::PaintOpType::Save,
+                                  cc::PaintOpType::ClipRect,    // <c2>
+                                  cc::PaintOpType::DrawRecord,  // <p0/>
+                                  cc::PaintOpType::Restore,     // </c2>
+                                  cc::PaintOpType::Restore}));  // </e1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest,
@@ -507,23 +553,30 @@
   TestChunks chunks;
   chunks.AddChunk(t0(), *c1, *e2);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                                cc::PaintOpType::SaveLayerAlpha,  // <e2>
-                                cc::PaintOpType::Save,
-                                cc::PaintOpType::ClipRect,    // <c1>
-                                cc::PaintOpType::DrawRecord,  // <p0/>
-                                cc::PaintOpType::Restore,     // </c1>
-                                cc::PaintOpType::Restore,     // </e2>
-                                cc::PaintOpType::Restore}));  // </e1>
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 0);
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 1);
+  const FloatRect kExpectedBounds1[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 100, 100)};
+  const FloatRect kExpectedBounds2[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                        FloatRect(0, 0, 100, 100)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                                  cc::PaintOpType::SaveLayerAlpha,  // <e2>
+                                  cc::PaintOpType::Save,
+                                  cc::PaintOpType::ClipRect,    // <c1>
+                                  cc::PaintOpType::DrawRecord,  // <p0/>
+                                  cc::PaintOpType::Restore,     // </c1>
+                                  cc::PaintOpType::Restore,     // </e2>
+                                  cc::PaintOpType::Restore}));  // </e1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds1[hint], *output, 0);
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds2[hint], *output, 1);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest,
@@ -535,20 +588,25 @@
   TestChunks chunks;
   chunks.AddChunk(t0(), *c1, *e2);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState(t0(), c0(), *e1), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e2>
-                                cc::PaintOpType::Save,
-                                cc::PaintOpType::ClipRect,    // <c1>
-                                cc::PaintOpType::DrawRecord,  // <p0/>
-                                cc::PaintOpType::Restore,     // </c1>
-                                cc::PaintOpType::Restore}));  // </e2>
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 0);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 100, 100)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(
+            chunks.chunks, PropertyTreeState(t0(), c0(), *e1), gfx::Vector2dF(),
+            chunks.items, kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e2>
+                                  cc::PaintOpType::Save,
+                                  cc::PaintOpType::ClipRect,    // <c1>
+                                  cc::PaintOpType::DrawRecord,  // <p0/>
+                                  cc::PaintOpType::Restore,     // </c1>
+                                  cc::PaintOpType::Restore}));  // </e2>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest,
@@ -560,17 +618,22 @@
   TestChunks chunks;
   chunks.AddChunk(t0(), *c1, *e2);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState(t0(), *c1, *e1), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
-  EXPECT_THAT(
-      *output,
-      PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e2>
-                                cc::PaintOpType::DrawRecord,      // <p0/>
-                                cc::PaintOpType::Restore}));      // </e2>
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 0);
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 100, 100)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(
+            chunks.chunks, PropertyTreeState(t0(), *c1, *e1), gfx::Vector2dF(),
+            chunks.items, kUsageHints[hint])
+            ->ReleaseAsRecord();
+    EXPECT_THAT(
+        *output,
+        PaintRecordMatcher::Make({cc::PaintOpType::SaveLayerAlpha,  // <e2>
+                                  cc::PaintOpType::DrawRecord,      // <p0/>
+                                  cc::PaintOpType::Restore}));      // </e2>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, VisualRect) {
@@ -688,17 +751,22 @@
   chunks.AddChunk(nullptr, t0(), c0(), e0());
   chunks.AddChunk(nullptr, t0(), c0(), *e1);
 
-  sk_sp<PaintRecord> output =
-      PaintChunksToCcLayer::Convert(
-          chunks.chunks, PropertyTreeState::Root(), gfx::Vector2dF(),
-          chunks.items, cc::DisplayItemList::kToBeReleasedAsPaintOpBuffer)
-          ->ReleaseAsRecord();
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 100, 100)};
 
-  EXPECT_THAT(*output, PaintRecordMatcher::Make({
-                           cc::PaintOpType::SaveLayerAlpha,  // <e1>
-                           cc::PaintOpType::Restore,         // </e1>
-                       }));
-  EXPECT_EFFECT_BOUNDS(0, 0, 100, 100, *output, 0);
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    sk_sp<PaintRecord> output =
+        PaintChunksToCcLayer::Convert(chunks.chunks, PropertyTreeState::Root(),
+                                      gfx::Vector2dF(), chunks.items,
+                                      kUsageHints[hint])
+            ->ReleaseAsRecord();
+
+    EXPECT_THAT(*output, PaintRecordMatcher::Make({
+                             cc::PaintOpType::SaveLayerAlpha,  // <e1>
+                             cc::PaintOpType::Restore,         // </e1>
+                         }));
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
 }
 
 TEST_P(PaintChunksToCcLayerTest, CombineClips) {
@@ -1313,5 +1381,28 @@
                        }));
 }
 
+// https://crbug.com/918240
+TEST_P(PaintChunksToCcLayerTest, EmptyChunkRectDoesntTurnToUnsetOne) {
+  CompositorFilterOperations filter;
+  filter.AppendBlurFilter(5);
+  auto e1 = CreateFilterEffect(e0(), t0(), &c0(), filter, FloatPoint(0, 0));
+  TestChunks chunks;
+  chunks.AddChunk(nullptr, t0(), c0(), *e1, {0, 0, 0, 0});
+
+  const FloatRect kExpectedBounds[] = {FloatRect(cc::PaintOp::kUnsetRect),
+                                       FloatRect(0, 0, 0, 0)};
+
+  for (size_t hint = 0; hint < base::size(kUsageHints); ++hint) {
+    auto output = PaintChunksToCcLayer::Convert(
+                      chunks.chunks, PropertyTreeState::Root(),
+                      gfx::Vector2dF(), chunks.items, kUsageHints[hint])
+                      ->ReleaseAsRecord();
+    EXPECT_THAT(*output,
+                PaintRecordMatcher::Make({cc::PaintOpType::SaveLayer,   // <e1>
+                                          cc::PaintOpType::Restore}));  // </e1>
+    EXPECT_EFFECT_BOUNDS(kExpectedBounds[hint], *output, 0);
+  }
+}
+
 }  // namespace
 }  // namespace blink

diff --git a/third_party/blink/renderer/platform/heap/heap.cc b/third_party/blink/renderer/platform/heap/heap.cc
index a821220..fde1aedb 100644
--- a/third_party/blink/renderer/platform/heap/heap.cc
+++ b/third_party/blink/renderer/platform/heap/heap.cc

@@ -370,34 +370,44 @@
   return finished;
 }
 
+bool ThreadHeap::HasWorkForConcurrentMarking() const {
+  return !marking_worklist_->IsGlobalPoolEmpty() ||
+         !write_barrier_worklist_->IsGlobalPoolEmpty();
+}
+
 bool ThreadHeap::AdvanceConcurrentMarking(ConcurrentMarkingVisitor* visitor,
                                           base::TimeTicks deadline) {
-  bool finished = false;
-  // Iteratively mark all objects that are reachable from the objects
-  // currently pushed onto the marking worklist.
-  finished = DrainWorklistWithDeadline(
-      deadline, marking_worklist_.get(),
-      [visitor](const MarkingItem& item) {
-        HeapObjectHeader* header =
-            HeapObjectHeader::FromPayload(item.base_object_payload);
-        DCHECK(!ConcurrentMarkingVisitor::IsInConstruction(header));
-        item.callback(visitor, item.base_object_payload);
-        visitor->AccountMarkedBytesSafe(header);
-      },
-      visitor->task_id());
-  if (!finished)
-    return false;
+  bool finished;
+  do {
+    // Iteratively mark all objects that are reachable from the objects
+    // currently pushed onto the marking worklist.
+    finished = DrainWorklistWithDeadline(
+        deadline, marking_worklist_.get(),
+        [visitor](const MarkingItem& item) {
+          HeapObjectHeader* header =
+              HeapObjectHeader::FromPayload(item.base_object_payload);
+          DCHECK(!ConcurrentMarkingVisitor::IsInConstruction(header));
+          item.callback(visitor, item.base_object_payload);
+          visitor->AccountMarkedBytesSafe(header);
+        },
+        visitor->task_id());
+    if (!finished)
+      break;
 
-  finished = DrainWorklistWithDeadline(
-      deadline, write_barrier_worklist_.get(),
-      [visitor](HeapObjectHeader* header) {
-        DCHECK(!ConcurrentMarkingVisitor::IsInConstruction(header));
-        GCInfoTable::Get()
-            .GCInfoFromIndex(header->GcInfoIndex())
-            ->trace(visitor, header->Payload());
-        visitor->AccountMarkedBytes(header);
-      },
-      visitor->task_id());
+    finished = DrainWorklistWithDeadline(
+        deadline, write_barrier_worklist_.get(),
+        [visitor](HeapObjectHeader* header) {
+          DCHECK(!ConcurrentMarkingVisitor::IsInConstruction(header));
+          GCInfoTable::Get()
+              .GCInfoFromIndex(header->GcInfoIndex())
+              ->trace(visitor, header->Payload());
+          visitor->AccountMarkedBytes(header);
+        },
+        visitor->task_id());
+    if (!finished)
+      break;
+  } while (HasWorkForConcurrentMarking());
+
   return finished;
 }
 

diff --git a/third_party/blink/renderer/platform/heap/heap.h b/third_party/blink/renderer/platform/heap/heap.h
index 4f853630..14913bb 100644
--- a/third_party/blink/renderer/platform/heap/heap.h
+++ b/third_party/blink/renderer/platform/heap/heap.h

@@ -302,6 +302,8 @@
   bool AdvanceMarking(MarkingVisitor*, base::TimeTicks deadline);
   void VerifyMarking();
 
+  // Returns true if concurrent markers will have work to steal
+  bool HasWorkForConcurrentMarking() const;
   // Returns true if marker is done
   bool AdvanceConcurrentMarking(ConcurrentMarkingVisitor*, base::TimeTicks);
 

diff --git a/third_party/blink/renderer/platform/heap/thread_state.cc b/third_party/blink/renderer/platform/heap/thread_state.cc
index 3af6f1c1..2cc8d8d5 100644
--- a/third_party/blink/renderer/platform/heap/thread_state.cc
+++ b/third_party/blink/renderer/platform/heap/thread_state.cc

@@ -1217,7 +1217,7 @@
 
   if (base::FeatureList::IsEnabled(
           blink::features::kBlinkHeapConcurrentMarking)) {
-    complete = complete && ConcurrentMarkingStep();
+    complete = ConcurrentMarkingStep() && complete;
   }
 
   if (complete) {
@@ -1239,7 +1239,7 @@
 
 bool ThreadState::ConcurrentMarkingStep() {
   current_gc_data_.visitor->FlushMarkingWorklists();
-  if (!Heap().GetMarkingWorklist()->IsGlobalPoolEmpty()) {
+  if (Heap().HasWorkForConcurrentMarking()) {
     ScheduleConcurrentMarking();
     return false;
   }

diff --git a/third_party/blink/renderer/platform/heap/unified_heap_controller.cc b/third_party/blink/renderer/platform/heap/unified_heap_controller.cc
index c7f17541d..1a43d92 100644
--- a/third_party/blink/renderer/platform/heap/unified_heap_controller.cc
+++ b/third_party/blink/renderer/platform/heap/unified_heap_controller.cc

@@ -134,6 +134,11 @@
     base::TimeTicks deadline =
         base::TimeTicks() + base::TimeDelta::FromMillisecondsD(deadline_in_ms);
     is_tracing_done_ = thread_state_->MarkPhaseAdvanceMarking(deadline);
+    if (base::FeatureList::IsEnabled(
+            blink::features::kBlinkHeapConcurrentMarking)) {
+      is_tracing_done_ =
+          thread_state_->ConcurrentMarkingStep() && is_tracing_done_;
+    }
     return is_tracing_done_;
   }
   thread_state_->AtomicPauseMarkTransitiveClosure();

diff --git a/third_party/blink/renderer/platform/scheduler/common/thread_cpu_throttler.cc b/third_party/blink/renderer/platform/scheduler/common/thread_cpu_throttler.cc
index c184e22..856a09c 100644
--- a/third_party/blink/renderer/platform/scheduler/common/thread_cpu_throttler.cc
+++ b/third_party/blink/renderer/platform/scheduler/common/thread_cpu_throttler.cc

@@ -106,6 +106,9 @@
   struct sigaction sa;
   sa.sa_handler = &HandleSignal;
   sigemptyset(&sa.sa_mask);
+  // Block SIGPROF while our handler is running so that the V8 CPU profiler
+  // doesn't try to sample the stack while our signal handler is active.
+  sigaddset(&sa.sa_mask, SIGPROF);
   sa.sa_flags = SA_RESTART;
   signal_handler_installed_ =
       (sigaction(SIGUSR2, &sa, &old_signal_handler_) == 0);

diff --git a/third_party/blink/renderer/platform/wtf/text/text_codec.h b/third_party/blink/renderer/platform/wtf/text/text_codec.h
index b692617..3d4f410 100644
--- a/third_party/blink/renderer/platform/wtf/text/text_codec.h
+++ b/third_party/blink/renderer/platform/wtf/text/text_codec.h

@@ -82,7 +82,7 @@
 
   struct EncodeIntoResult {
     wtf_size_t code_units_read;
-    wtf_size_t bytes_written;
+    size_t bytes_written;
   };
 
   String Decode(const char* str,
@@ -108,14 +108,14 @@
   virtual EncodeIntoResult EncodeInto(const LChar*,
                                       wtf_size_t length,
                                       unsigned char* destination,
-                                      wtf_size_t capacity) {
+                                      size_t capacity) {
     NOTREACHED();
     return EncodeIntoResult{0, 0};
   }
   virtual EncodeIntoResult EncodeInto(const UChar*,
                                       wtf_size_t length,
                                       unsigned char* destination,
-                                      wtf_size_t capacity) {
+                                      size_t capacity) {
     NOTREACHED();
     return EncodeIntoResult{0, 0};
   }

diff --git a/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.cc b/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.cc
index 6874eca2..71fc2ac2 100644
--- a/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.cc
+++ b/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.cc

@@ -497,7 +497,7 @@
     const CharType* characters,
     wtf_size_t length,
     unsigned char* destination,
-    wtf_size_t capacity) {
+    size_t capacity) {
   TextCodec::EncodeIntoResult encode_into_result{0, 0};
 
   wtf_size_t i = 0;
@@ -544,7 +544,7 @@
     const UChar* characters,
     wtf_size_t length,
     unsigned char* destination,
-    wtf_size_t capacity) {
+    size_t capacity) {
   return EncodeIntoCommon(characters, length, destination, capacity);
 }
 
@@ -552,7 +552,7 @@
     const LChar* characters,
     wtf_size_t length,
     unsigned char* destination,
-    wtf_size_t capacity) {
+    size_t capacity) {
   return EncodeIntoCommon(characters, length, destination, capacity);
 }
 

diff --git a/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.h b/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.h
index 688a404..65806a9b 100644
--- a/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.h
+++ b/third_party/blink/renderer/platform/wtf/text/text_codec_utf8.h

@@ -62,11 +62,11 @@
   EncodeIntoResult EncodeInto(const UChar*,
                               wtf_size_t length,
                               unsigned char* destination,
-                              wtf_size_t capacity) override;
+                              size_t capacity) override;
   EncodeIntoResult EncodeInto(const LChar*,
                               wtf_size_t length,
                               unsigned char* destination,
-                              wtf_size_t capacity) override;
+                              size_t capacity) override;
 
   template <typename CharType>
   std::string EncodeCommon(const CharType* characters, wtf_size_t length);
@@ -74,7 +74,7 @@
   EncodeIntoResult EncodeIntoCommon(const CharType* characters,
                                     wtf_size_t length,
                                     unsigned char* destination,
-                                    wtf_size_t capacity);
+                                    size_t capacity);
 
   template <typename CharType>
   bool HandlePartialSequence(CharType*& destination,

diff --git a/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py b/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py
index 75ca351..8bbddc29 100644
--- a/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py
+++ b/third_party/blink/tools/blinkpy/web_tests/servers/apache_http.py

@@ -82,6 +82,8 @@
             '-c', 'Alias /resources/chromium "%s/external/wpt/resources/chromium"' % test_dir,
             '-c', 'Alias /resources/testharness.js "%s/resources/testharness.js"' % test_dir,
             '-c', 'Alias /resources/testharnessreport.js "%s/resources/testharnessreport.js"' % test_dir,
+            '-c', 'Alias /resources/testdriver.js "%s/resources/testdriver.js"' % test_dir,
+            '-c', 'Alias /resources/testdriver-vendor.js "%s/resources/testdriver-vendor.js"' % test_dir,
             '-c', 'Alias /w3c/resources "%s/resources"' % test_dir,
             # TODO(509038): To be removed after bluetooth tests are ported to WPT.
             '-c', 'Alias /bluetooth-resources "%s/external/wpt/bluetooth/resources"' % test_dir,

diff --git a/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors b/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors
index 8a75481..98d1b61a 100644
--- a/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors
+++ b/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors

@@ -4,7 +4,7 @@
 # results: [ Timeout Crash Pass Failure Slow Skip ]
 
 # Tests that passes only with OOR-CORS.
-# These tests should not pass at linux-blink-cors-rel fyi bot.
+# Following tests should not pass at linux-blink-cors-rel fyi bot.
 # TODO(cbur.com/1001450): Remove this file after removing the OOR-CORS releted
 # enterprise policies.
 crbug.com/870173 external/wpt/resource-timing/cors-preflight.any.html [ Skip ]
@@ -25,6 +25,21 @@
 crbug.com/870173 virtual/omt-worker-fetch/external/wpt/resource-timing/cors-preflight.any.worker.html [ Skip ]
 crbug.com/870173 virtual/omt-worker-fetch/http/tests/workers/worker-redirect.html [ Skip ]
 
+# Timing-Allow-Origin checks are only completely correct with OOR-CORS.
+crbug.com/1042580 external/wpt/element-timing/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 external/wpt/element-timing/redirects-tao-star.html [ Skip ]
+crbug.com/1042580 external/wpt/largest-contentful-paint/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 external/wpt/largest-contentful-paint/redirects-tao-star.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200/external/wpt/element-timing/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200/external/wpt/element-timing/redirects-tao-star.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200/external/wpt/largest-contentful-paint/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200/external/wpt/largest-contentful-paint/redirects-tao-star.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200withoutzoom/external/wpt/element-timing/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200withoutzoom/external/wpt/element-timing/redirects-tao-star.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200withoutzoom/external/wpt/largest-contentful-paint/multiple-redirects-TAO.html [ Skip ]
+crbug.com/1042580 virtual/scalefactor200withoutzoom/external/wpt/largest-contentful-paint/redirects-tao-star.html [ Skip ]
+
+
 # The fetch-request-xhr.https.html fails on some checks, but has an expectation
 # file to ignore text diffs. It also fails on the same checks even without
 # OOR-CORS, but with different texts. Just mark them as Failure.
@@ -34,9 +49,3 @@
 crbug.com/870173 virtual/cache-storage-sequence/external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Failure ]
 crbug.com/870173 virtual/omt-service-worker-startup/external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Failure ]
 crbug.com/870173 virtual/omt-worker-fetch/external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Failure ]
-
-# Timing-Allow-Origin checks are only completely correct with OOR-CORS.
-crbug.com/1042580 external/wpt/element-timing/multiple-redirects-TAO.html [ Failure ]
-crbug.com/1042580 external/wpt/element-timing/redirects-tao-star.html [ Failure ]
-crbug.com/1042580 external/wpt/largest-contentful-paint/multiple-redirects-TAO.html [ Failure ]
-crbug.com/1042580 external/wpt/largest-contentful-paint/redirects-tao-star.html [ Failure ]

diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index fa744f4..43465f8 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations

@@ -6262,7 +6262,8 @@
 crbug.com/963183 http/tests/devtools/animation/animation-timeline.js [ Pass Failure ]
 
 # Popup and no-opener may crash WPTs: crrev.com/c/1984306
-crbug.com/1040059 external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html [ Pass Crash Timeout ]
+crbug.com/1040059 external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html [ Pass Crash ]
+crbug.com/1040059 external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html [ Pass Crash ]
 
 # Broken in https://chromium-review.googlesource.com/c/chromium/src/+/1636716
 crbug.com/963183 http/tests/devtools/sources/debugger-breakpoints/disable-breakpoints.js [ Pass Failure ]
@@ -6274,7 +6275,6 @@
 crbug.com/1041973 virtual/web-components-v0-disabled/external/wpt/html/semantics/forms/constraints/form-validation-reportValidity.html [ Pass Failure ]
 
 # Sheriff 2020-01-15
-crbug.com/1042199 external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html [ Pass Timeout ]
 crbug.com/1041451 virtual/gpu-rasterization-disable-yuv/images/yuv-decode-eligible/color-profile-filter.html [ Pass Failure ]
 
 # Disabled for landing devtools changes

diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
index d0f7833..caa1cac 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json

@@ -161389,6 +161389,15 @@
    "html/cross-origin-opener-policy/coep-navigate-popup.https.html.headers": [
     []
    ],
+   "html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt": [
+    []
+   ],
+   "html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt": [
+    []
+   ],
+   "html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt": [
+    []
+   ],
    "html/cross-origin-opener-policy/coep-redirect.https-expected.txt": [
     []
    ],
@@ -173851,6 +173860,15 @@
    "referrer-policy/gen/top.http-rp/unsafe-url/xhr/same-https.swap-origin.http.html.headers": [
     []
    ],
+   "referrer-policy/generic/inheritance/iframe-inheritance-javascript-child-expected.txt": [
+    []
+   ],
+   "referrer-policy/generic/inheritance/iframe-inheritance-javascript-expected.txt": [
+    []
+   ],
+   "referrer-policy/generic/inheritance/resources/make-html-script.js": [
+    []
+   ],
    "referrer-policy/generic/multiple-headers-and-values.html.headers": [
     []
    ],
@@ -185896,12 +185914,6 @@
    "workers/modules/resources/static-import-worker.js": [
     []
    ],
-   "workers/modules/shared-worker-import-blob-url.any-expected.txt": [
-    []
-   ],
-   "workers/modules/shared-worker-import.any-expected.txt": [
-    []
-   ],
    "workers/non-automated/application-cache-dedicated.html": [
     []
    ],
@@ -251838,7 +251850,19 @@
    ],
    "html/cross-origin-opener-policy/coep-navigate-popup.https.html": [
     [
-     "html/cross-origin-opener-policy/coep-navigate-popup.https.html",
+     "html/cross-origin-opener-policy/coep-navigate-popup.https.html?0-1",
+     {
+      "timeout": "long"
+     }
+    ],
+    [
+     "html/cross-origin-opener-policy/coep-navigate-popup.https.html?2-3",
+     {
+      "timeout": "long"
+     }
+    ],
+    [
+     "html/cross-origin-opener-policy/coep-navigate-popup.https.html?4-last",
      {
       "timeout": "long"
      }
@@ -298593,6 +298617,24 @@
      {}
     ]
    ],
+   "referrer-policy/generic/inheritance/iframe-inheritance-document-write.html": [
+    [
+     "referrer-policy/generic/inheritance/iframe-inheritance-document-write.html",
+     {}
+    ]
+   ],
+   "referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html": [
+    [
+     "referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html",
+     {}
+    ]
+   ],
+   "referrer-policy/generic/inheritance/iframe-inheritance-javascript.html": [
+    [
+     "referrer-policy/generic/inheritance/iframe-inheritance-javascript.html",
+     {}
+    ]
+   ],
    "referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html": [
     [
      "referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html",
@@ -299395,7 +299437,9 @@
    "resource-timing/resource_timing_buffer_full_eventually.html": [
     [
      "resource-timing/resource_timing_buffer_full_eventually.html",
-     {}
+     {
+      "timeout": "long"
+     }
     ]
    ],
    "resource-timing/resource_timing_buffer_full_when_shrink_buffer_size.html": [
@@ -458188,13 +458232,25 @@
    "support"
   ],
   "html/cross-origin-opener-policy/coep-navigate-popup.https.html": [
-   "42fb35f1d6842ceb5f2aa4ba0c3fc0b64a1fac47",
+   "391929e75cf93c7d9dee24141398c6d6f80135be",
    "testharness"
   ],
   "html/cross-origin-opener-policy/coep-navigate-popup.https.html.headers": [
    "63b60e490f47f4db77d33d7a4ca2f5b9a4181de8",
    "support"
   ],
+  "html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt": [
+   "529eadc5d370bf5b47ea47eef0c0be7bc8c9292e",
+   "support"
+  ],
+  "html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt": [
+   "e6c2fa46d949d79517a8c1973202379c4fb2c555",
+   "support"
+  ],
+  "html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt": [
+   "1e74c90db47ce01fbbe413e8b758d15a021cd3f9",
+   "support"
+  ],
   "html/cross-origin-opener-policy/coep-redirect.https-expected.txt": [
    "fd033fd632fe81a9f8adf6c93468f21bc8e1ea9b",
    "support"
@@ -472024,7 +472080,7 @@
    "support"
   ],
   "html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt": [
-   "36e95c63965d55fa21929e2d5d3a7fe09c46876c",
+   "77c1f1875bc0b7eb15e1f8c59ad6851e9fdf6aa0",
    "support"
   ],
   "html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.worker-expected.txt": [
@@ -506868,17 +506924,41 @@
    "testharness"
   ],
   "referrer-policy/generic/inheritance/iframe-inheritance-data.html": [
-   "368e77e1217d449f558f6e45174227fd64e3b27d",
+   "1d39781e30583201cf057c5269146ea95ca2d510",
+   "testharness"
+  ],
+  "referrer-policy/generic/inheritance/iframe-inheritance-document-write.html": [
+   "cba71bb1d9f541deef790d3adeee159180196dca",
+   "testharness"
+  ],
+  "referrer-policy/generic/inheritance/iframe-inheritance-javascript-child-expected.txt": [
+   "73cb453c7a84e010a05a31ba49749cad220d2438",
+   "support"
+  ],
+  "referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html": [
+   "e20da4f2cccfe4d8981d83ddb6d48ec3d6f4c2d6",
+   "testharness"
+  ],
+  "referrer-policy/generic/inheritance/iframe-inheritance-javascript-expected.txt": [
+   "01ccc62c8af4bd123c402f6164c98988fe6133a9",
+   "support"
+  ],
+  "referrer-policy/generic/inheritance/iframe-inheritance-javascript.html": [
+   "77b6d759f5f4694298da8dc3f72825fbfcffe799",
    "testharness"
   ],
   "referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html": [
-   "ecd5a41cc0beb02a36a7dcaca2803e6c84697158",
+   "cd4b4ae724814625b210b5fc96ecf5ecef321822",
    "testharness"
   ],
   "referrer-policy/generic/inheritance/iframe-inheritance-srcdoc.html": [
-   "6639ebd98731b28cef86e3743e4def21cfa14fa9",
+   "c4dffd3ed70607f0caaddb99d0b0291e719e1e96",
    "testharness"
   ],
+  "referrer-policy/generic/inheritance/resources/make-html-script.js": [
+   "e285c559c04db3884022a94f6df8ca4f1b5e8cf1",
+   "support"
+  ],
   "referrer-policy/generic/link-rel-prefetch.html": [
    "72e831c92129aed2d80a4178fb56f9d7c20dacad",
    "testharness"
@@ -507428,7 +507508,7 @@
    "testharness"
   ],
   "resource-timing/resource_timing_buffer_full_eventually.html": [
-   "ce745237c0657c7045b00d9c7b8e71770ed490fc",
+   "140973156fbd85b7228c7dc6e2b36866bbcd2975",
    "testharness"
   ],
   "resource-timing/resource_timing_buffer_full_when_shrink_buffer_size.html": [
@@ -509816,11 +509896,11 @@
    "testharness"
   ],
   "service-workers/service-worker/clients-matchall-client-types.https-expected.txt": [
-   "02cc3314f319289aa3ebae07632c6995fbc101e2",
+   "a5702d0326367c8a1552bbd99d98bb3d0c12cb7c",
    "support"
   ],
   "service-workers/service-worker/clients-matchall-client-types.https.html": [
-   "a2a56816a650fa54d6075055a64e0f009e5829ac",
+   "7dfd5ed1b87327303b94b531d51cf6cc18a20919",
    "testharness"
   ],
   "service-workers/service-worker/clients-matchall-exact-controller.https.html": [
@@ -513276,7 +513356,7 @@
    "support"
   ],
   "speech-api/META.yml": [
-   "9ce8830e78fc4be5b25e5382248810932abfd829",
+   "88f1837f96f6e140990eb2de9981f7901596a32f",
    "support"
   ],
   "speech-api/OWNERS": [
@@ -538319,10 +538399,6 @@
    "19a347999d386fd4df8dc831c6d164b27630ef7a",
    "support"
   ],
-  "workers/modules/shared-worker-import-blob-url.any-expected.txt": [
-   "c45166005be52bde9ecde3129e595cac691744a8",
-   "support"
-  ],
   "workers/modules/shared-worker-import-blob-url.any.js": [
    "d9e9e34c394bc171cd497c8527b4806dfc32c595",
    "testharness"
@@ -538331,10 +538407,6 @@
    "0e0b9b306314fd96b48e0007918935bc56df2d53",
    "testharness"
   ],
-  "workers/modules/shared-worker-import.any-expected.txt": [
-   "c45166005be52bde9ecde3129e595cac691744a8",
-   "support"
-  ],
   "workers/modules/shared-worker-import.any.js": [
    "450d4ad422b8da33d515da9b41557f488aff8bff",
    "testharness"

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https.html
index 42fb35f..391929e7 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https.html

@@ -1,8 +1,12 @@
 <!doctype html>
 <title>Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy: a navigating popup</title>
 <meta name=timeout content=long>
+<meta name=variant content=?0-1>
+<meta name=variant content=?2-3>
+<meta name=variant content=?4-last>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
+<script src="/common/subset-tests.js"></script>
 <script src="/common/get-host-info.sub.js"></script>
 <script src="resources/common.js"></script>
 <script>
@@ -43,7 +47,12 @@
     "coep": "",
     "opener": false
   }
-].forEach(variant => {
+].forEach((variant, i) => {
+  // Only run specified variants
+  if (!shouldRunSubTest(i)) {
+    return;
+  }
+
   ["same-origin", "same-site"].forEach(site => {
     const title = `Popup navigating to ${site} with ${variant.title}`;
     const channel = title.replace(/ /g,"-");

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt
new file mode 100644
index 0000000..529eadc5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt

@@ -0,0 +1,7 @@
+This is a testharness.js-based test.
+PASS Popup navigating to same-origin with coop/coep
+FAIL Popup navigating to same-site with coop/coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-coop/coep"
+FAIL Popup navigating to same-origin with no coop/coep assert_equals: name expected "" but got "Popup-navigating-to-same-origin-with-no-coop/coep"
+FAIL Popup navigating to same-site with no coop/coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-no-coop/coep"
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt
new file mode 100644
index 0000000..e6c2fa4
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt

@@ -0,0 +1,7 @@
+This is a testharness.js-based test.
+FAIL Popup navigating to same-origin with coop/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-origin-with-coop/no-coep"
+FAIL Popup navigating to same-site with coop/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-coop/no-coep"
+FAIL Popup navigating to same-origin with no coop/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-origin-with-no-coop/no-coep"
+FAIL Popup navigating to same-site with no coop/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-no-coop/no-coep"
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt
new file mode 100644
index 0000000..1e74c90
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt

@@ -0,0 +1,7 @@
+This is a testharness.js-based test.
+PASS Popup navigating to same-origin with coop unsafe-none/coep
+FAIL Popup navigating to same-site with coop unsafe-none/coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-coop-unsafe-none/coep"
+FAIL Popup navigating to same-origin with coop unsafe-none/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-origin-with-coop-unsafe-none/no-coep"
+FAIL Popup navigating to same-site with coop unsafe-none/no coep assert_equals: name expected "" but got "Popup-navigating-to-same-site-with-coop-unsafe-none/no-coep"
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https-expected.txt
new file mode 100644
index 0000000..77c908d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https-expected.txt

@@ -0,0 +1,12 @@
+This is a testharness.js-based test.
+PASS same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https.html
new file mode 100644
index 0000000..b03949e
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset=utf-8>
+<meta name=timeout content=long>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/common.js"></script>
+
+<div id=log></div>
+<script>
+[
+[SAME_ORIGIN, SAME_ORIGIN, "same-origin-allow-popups", true, true],
+[SAME_SITE, SAME_ORIGIN, "same-origin-allow-popups", false, false],
+[CROSS_ORIGIN, SAME_ORIGIN, "same-origin-allow-popups", false, false],
+[SAME_ORIGIN, SAME_SITE, "same-origin-allow-popups", false, false],
+[SAME_SITE, SAME_SITE, "same-origin-allow-popups", false, false],
+[CROSS_ORIGIN, SAME_SITE, "same-origin-allow-popups", false, false],
+[SAME_ORIGIN, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
+[SAME_SITE, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
+[CROSS_ORIGIN, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
+].forEach( value => {
+    run_coop_test_iframe("same-origin-allow-popups", value[0], value[1], value[2], value[3], value[4]);
+});
+
+
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https.html.headers
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https-expected.txt
new file mode 100644
index 0000000..67e7b60e
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https-expected.txt

@@ -0,0 +1,12 @@
+This is a testharness.js-based test.
+FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https.html
similarity index 62%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https.html
index 8781684..66b0a4a 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https.html

@@ -1,5 +1,6 @@
 <!doctype html>
 <meta charset=utf-8>
+<meta name=timeout content=long>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -17,17 +18,9 @@
 [SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
 [SAME_SITE, CROSS_ORIGIN, "same-origin", false, false],
 [CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_SITE, SAME_ORIGIN, "", true, true],
-[CROSS_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_ORIGIN, SAME_SITE, "", true, true],
-[SAME_SITE, SAME_SITE, "", true, true],
-[CROSS_ORIGIN, SAME_SITE, "", true, true],
-[SAME_ORIGIN, CROSS_ORIGIN, "", true, true],
-[SAME_SITE, CROSS_ORIGIN, "", true, true],
-[CROSS_ORIGIN, CROSS_ORIGIN, "", true, true],
 ].forEach( value => {
-    run_coop_test_iframe("unsafe-none", value[0], value[1], value[2], value[3], value[4]);
+    run_coop_test_iframe("same-origin-allow-popups", value[0], value[1], value[2], value[3], value[4]);
 });
 
-</script>
+
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https.html.headers
similarity index 100%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html
new file mode 100644
index 0000000..d2f2783
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset=utf-8>
+<meta name=timeout content=long>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/common.js"></script>
+
+<div id=log></div>
+<script>
+[
+[SAME_ORIGIN, SAME_ORIGIN, "", true, true],
+[SAME_SITE, SAME_ORIGIN, "", true, true],
+[CROSS_ORIGIN, SAME_ORIGIN, "", true, true],
+[SAME_ORIGIN, SAME_SITE, "", true, true],
+[SAME_SITE, SAME_SITE, "", true, true],
+[CROSS_ORIGIN, SAME_SITE, "", true, true],
+[SAME_ORIGIN, CROSS_ORIGIN, "", true, true],
+[SAME_SITE, CROSS_ORIGIN, "", true, true],
+[CROSS_ORIGIN, CROSS_ORIGIN, "", true, true],
+].forEach( value => {
+    run_coop_test_iframe("same-origin-allow-popups", value[0], value[1], value[2], value[3], value[4]);
+});
+
+
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html.headers
similarity index 100%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html.headers
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-unsafe-none.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https-expected.txt
deleted file mode 100644
index 2a5f690..0000000
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https-expected.txt
+++ /dev/null

@@ -1,30 +0,0 @@
-This is a testharness.js-based test.
-FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-PASS same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-FAIL same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin-allow-popups assert_equals: opener expected false but got true
-PASS same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
-PASS same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: 
-PASS same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
-PASS same-origin-allow-popups with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: 
-PASS same-origin-allow-popups with SAME_SITE iframe opening popup a SAME_SITE with COOP: 
-PASS same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: 
-PASS same-origin-allow-popups with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
-PASS same-origin-allow-popups with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: 
-PASS same-origin-allow-popups with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
-Harness: the test ran to completion.
-

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html
deleted file mode 100644
index 51f4b54..0000000
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups.https.html
+++ /dev/null

@@ -1,43 +0,0 @@
-<!doctype html>
-<meta charset=utf-8>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
-<script src="/common/get-host-info.sub.js"></script>
-<script src="resources/common.js"></script>
-
-<div id=log></div>
-<script>
-[
-[SAME_ORIGIN, SAME_ORIGIN, "same-origin", false, false],
-[SAME_SITE, SAME_ORIGIN, "same-origin", false, false],
-[CROSS_ORIGIN, SAME_ORIGIN, "same-origin", false, false],
-[SAME_ORIGIN, SAME_SITE, "same-origin", false, false],
-[SAME_SITE, SAME_SITE, "same-origin", false, false],
-[CROSS_ORIGIN, SAME_SITE, "same-origin", false, false],
-[SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_SITE, CROSS_ORIGIN, "same-origin", false, false],
-[CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_ORIGIN, SAME_ORIGIN, "same-origin-allow-popups", true, true],
-[SAME_SITE, SAME_ORIGIN, "same-origin-allow-popups", false, false],
-[CROSS_ORIGIN, SAME_ORIGIN, "same-origin-allow-popups", false, false],
-[SAME_ORIGIN, SAME_SITE, "same-origin-allow-popups", false, false],
-[SAME_SITE, SAME_SITE, "same-origin-allow-popups", false, false],
-[CROSS_ORIGIN, SAME_SITE, "same-origin-allow-popups", false, false],
-[SAME_ORIGIN, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
-[SAME_SITE, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
-[CROSS_ORIGIN, CROSS_ORIGIN, "same-origin-allow-popups", false, false],
-[SAME_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_SITE, SAME_ORIGIN, "", true, true],
-[CROSS_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_ORIGIN, SAME_SITE, "", true, true],
-[SAME_SITE, SAME_SITE, "", true, true],
-[CROSS_ORIGIN, SAME_SITE, "", true, true],
-[SAME_ORIGIN, CROSS_ORIGIN, "", true, true],
-[SAME_SITE, CROSS_ORIGIN, "", true, true],
-[CROSS_ORIGIN, CROSS_ORIGIN, "", true, true],
-].forEach( value => {
-    run_coop_test_iframe("same-origin-allow-popups", value[0], value[1], value[2], value[3], value[4]);
-});
-
-
-</script>

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https-expected.txt
new file mode 100644
index 0000000..a0c0e0c
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https-expected.txt

@@ -0,0 +1,12 @@
+This is a testharness.js-based test.
+PASS same-origin with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin
+PASS same-origin with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin
+PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin
+FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
+PASS same-origin with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin
+PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin
+FAIL same-origin with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
+PASS same-origin with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin
+PASS same-origin with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html
similarity index 68%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html
index 55fb5920..4c70b110 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html

@@ -1,5 +1,6 @@
 <!doctype html>
 <meta charset=utf-8>
+<meta name=timeout content=long>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -17,17 +18,8 @@
 [SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
 [SAME_SITE, CROSS_ORIGIN, "same-origin", false, true],
 [CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, true],
-[SAME_ORIGIN, SAME_ORIGIN, "", false, false],
-[SAME_SITE, SAME_ORIGIN, "", false, true],
-[CROSS_ORIGIN, SAME_ORIGIN, "", false, true],
-[SAME_ORIGIN, SAME_SITE, "", false, false],
-[SAME_SITE, SAME_SITE, "", false, true],
-[CROSS_ORIGIN, SAME_SITE, "", false, true],
-[SAME_ORIGIN, CROSS_ORIGIN, "", false, false],
-[SAME_SITE, CROSS_ORIGIN, "", false, true],
-[CROSS_ORIGIN, CROSS_ORIGIN, "", false, true],
 ].forEach( value => {
     run_coop_test_iframe("same-origin", value[0], value[1], value[2], value[3], value[4]);
 });
 
-</script>
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html.headers
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html.headers
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https-expected.txt
new file mode 100644
index 0000000..47c49510
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https-expected.txt

@@ -0,0 +1,12 @@
+This is a testharness.js-based test.
+FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP:  assert_equals: opener expected false but got true
+PASS same-origin with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: 
+PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
+FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP:  assert_equals: opener expected false but got true
+PASS same-origin with SAME_SITE iframe opening popup a SAME_SITE with COOP: 
+PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: 
+FAIL same-origin with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP:  assert_equals: opener expected false but got true
+PASS same-origin with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: 
+PASS same-origin with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html
similarity index 61%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html
index 55fb5920..d6521bd 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html

@@ -1,5 +1,6 @@
 <!doctype html>
 <meta charset=utf-8>
+<meta name=timeout content=long>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -8,15 +9,6 @@
 <div id=log></div>
 <script>
 [
-[SAME_ORIGIN, SAME_ORIGIN, "same-origin", true, true],
-[SAME_SITE, SAME_ORIGIN, "same-origin", false, true],
-[CROSS_ORIGIN, SAME_ORIGIN, "same-origin", false, true],
-[SAME_ORIGIN, SAME_SITE, "same-origin", false, false],
-[SAME_SITE, SAME_SITE, "same-origin", false, true],
-[CROSS_ORIGIN, SAME_SITE, "same-origin", false, true],
-[SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_SITE, CROSS_ORIGIN, "same-origin", false, true],
-[CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, true],
 [SAME_ORIGIN, SAME_ORIGIN, "", false, false],
 [SAME_SITE, SAME_ORIGIN, "", false, true],
 [CROSS_ORIGIN, SAME_ORIGIN, "", false, true],
@@ -30,4 +22,4 @@
     run_coop_test_iframe("same-origin", value[0], value[1], value[2], value[3], value[4]);
 });
 
-</script>
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html.headers
similarity index 100%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https.html.headers
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https-expected.txt
deleted file mode 100644
index fadc943d..0000000
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-same-origin.https-expected.txt
+++ /dev/null

@@ -1,21 +0,0 @@
-This is a testharness.js-based test.
-PASS same-origin with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin
-PASS same-origin with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: same-origin
-PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: same-origin
-FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin assert_equals: opener expected false but got true
-PASS same-origin with SAME_SITE iframe opening popup a SAME_SITE with COOP: same-origin
-PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: same-origin
-FAIL same-origin with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-PASS same-origin with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin
-PASS same-origin with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin
-FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP:  assert_equals: opener expected false but got true
-PASS same-origin with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: 
-PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
-FAIL same-origin with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP:  assert_equals: opener expected false but got true
-PASS same-origin with SAME_SITE iframe opening popup a SAME_SITE with COOP: 
-PASS same-origin with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: 
-FAIL same-origin with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP:  assert_equals: opener expected false but got true
-PASS same-origin with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: 
-PASS same-origin with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
-Harness: the test ran to completion.
-

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https-expected.txt b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https-expected.txt
similarity index 65%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https-expected.txt
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https-expected.txt
index 4e74c99..d0eaa17a 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https-expected.txt

@@ -8,14 +8,5 @@
 FAIL unsafe-none with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
 FAIL unsafe-none with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
 FAIL unsafe-none with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: same-origin assert_equals: opener expected false but got true
-PASS unsafe-none with SAME_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
-PASS unsafe-none with SAME_SITE iframe opening popup a SAME_ORIGIN with COOP: 
-PASS unsafe-none with CROSS_ORIGIN iframe opening popup a SAME_ORIGIN with COOP: 
-PASS unsafe-none with SAME_ORIGIN iframe opening popup a SAME_SITE with COOP: 
-PASS unsafe-none with SAME_SITE iframe opening popup a SAME_SITE with COOP: 
-PASS unsafe-none with CROSS_ORIGIN iframe opening popup a SAME_SITE with COOP: 
-PASS unsafe-none with SAME_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
-PASS unsafe-none with SAME_SITE iframe opening popup a CROSS_ORIGIN with COOP: 
-PASS unsafe-none with CROSS_ORIGIN iframe opening popup a CROSS_ORIGIN with COOP: 
 Harness: the test ran to completion.
 

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https.html
similarity index 69%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https.html
index 8781684..ad7c0e26 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https.html

@@ -1,5 +1,6 @@
 <!doctype html>
 <meta charset=utf-8>
+<meta name=timeout content=long>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -17,17 +18,8 @@
 [SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
 [SAME_SITE, CROSS_ORIGIN, "same-origin", false, false],
 [CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_SITE, SAME_ORIGIN, "", true, true],
-[CROSS_ORIGIN, SAME_ORIGIN, "", true, true],
-[SAME_ORIGIN, SAME_SITE, "", true, true],
-[SAME_SITE, SAME_SITE, "", true, true],
-[CROSS_ORIGIN, SAME_SITE, "", true, true],
-[SAME_ORIGIN, CROSS_ORIGIN, "", true, true],
-[SAME_SITE, CROSS_ORIGIN, "", true, true],
-[CROSS_ORIGIN, CROSS_ORIGIN, "", true, true],
 ].forEach( value => {
     run_coop_test_iframe("unsafe-none", value[0], value[1], value[2], value[3], value[4]);
 });
 
-</script>
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https.html.headers
similarity index 100%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html.headers
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-unsafe-none.https.html
similarity index 60%
copy from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
copy to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-unsafe-none.https.html
index 8781684..8113189c 100644
--- a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html
+++ b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-unsafe-none.https.html

@@ -1,5 +1,6 @@
 <!doctype html>
 <meta charset=utf-8>
+<meta name=timeout content=long>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -8,15 +9,6 @@
 <div id=log></div>
 <script>
 [
-[SAME_ORIGIN, SAME_ORIGIN, "same-origin", false, false],
-[SAME_SITE, SAME_ORIGIN, "same-origin", false, false],
-[CROSS_ORIGIN, SAME_ORIGIN, "same-origin", false, false],
-[SAME_ORIGIN, SAME_SITE, "same-origin", false, false],
-[SAME_SITE, SAME_SITE, "same-origin", false, false],
-[CROSS_ORIGIN, SAME_SITE, "same-origin", false, false],
-[SAME_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
-[SAME_SITE, CROSS_ORIGIN, "same-origin", false, false],
-[CROSS_ORIGIN, CROSS_ORIGIN, "same-origin", false, false],
 [SAME_ORIGIN, SAME_ORIGIN, "", true, true],
 [SAME_SITE, SAME_ORIGIN, "", true, true],
 [CROSS_ORIGIN, SAME_ORIGIN, "", true, true],
@@ -30,4 +22,4 @@
     run_coop_test_iframe("unsafe-none", value[0], value[1], value[2], value[3], value[4]);
 });
 
-</script>
+</script>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html.headers b/third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-unsafe-none.https.html.headers
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none.https.html.headers
rename to third_party/blink/web_tests/external/wpt/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-unsafe-none.https.html.headers


diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt
index 36e95c63..77c1f18 100644
--- a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt

@@ -1,8 +1,8 @@
 This is a testharness.js-based test.
-FAIL Non-object: null promise_test: Unhandled rejection with value: object "TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046)."
-FAIL Non-object: true promise_test: Unhandled rejection with value: object "TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046)."
-FAIL Non-object: false promise_test: Unhandled rejection with value: object "TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046)."
-FAIL Non-object: string promise_test: Unhandled rejection with value: object "TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046)."
-FAIL Non-object: array promise_test: Unhandled rejection with value: object "TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046)."
+FAIL Non-object: null promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch dynamically imported module: http://web-platform.test:8001/html/semantics/scripting-1/the-script-element/json-module/null.json"
+FAIL Non-object: true promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch dynamically imported module: http://web-platform.test:8001/html/semantics/scripting-1/the-script-element/json-module/true.json"
+FAIL Non-object: false promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch dynamically imported module: http://web-platform.test:8001/html/semantics/scripting-1/the-script-element/json-module/false.json"
+FAIL Non-object: string promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch dynamically imported module: http://web-platform.test:8001/html/semantics/scripting-1/the-script-element/json-module/string.json"
+FAIL Non-object: array promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch dynamically imported module: http://web-platform.test:8001/html/semantics/scripting-1/the-script-element/json-module/array.json"
 Harness: the test ran to completion.
 

diff --git a/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/set_permission.https-expected.txt b/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/set_permission.https-expected.txt
deleted file mode 100644
index 6906a84..0000000
--- a/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/set_permission.https-expected.txt
+++ /dev/null

@@ -1,5 +0,0 @@
-This is a testharness.js-based test.
-FAIL Grant Permission for one realm promise_test: Unhandled rejection with value: object "Error: unimplemented"
-FAIL Deny Permission, omit one realm promise_test: Unhandled rejection with value: object "Error: unimplemented"
-Harness: the test ran to completion.
-

diff --git a/third_party/blink/web_tests/external/wpt/portals/portals-focus.sub.html b/third_party/blink/web_tests/external/wpt/portals/portals-focus.sub.html
index 17795907..97b7579 100644
--- a/third_party/blink/web_tests/external/wpt/portals/portals-focus.sub.html
+++ b/third_party/blink/web_tests/external/wpt/portals/portals-focus.sub.html

@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<meta name="timeout" content="long">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/testdriver.js"></script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-data.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-data.html
index 368e77e..1d39781e 100644
--- a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-data.html
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-data.html

@@ -4,37 +4,21 @@
     <link rel="help" href="https://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-nested">
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
-    <!-- Common global functions for referrer-policy tests. -->
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="/referrer-policy/generic/referrer-policy-test-case.js"></script>
+    <script src="/common/get-host-info.sub.js"></script>
+    <script src="resources/make-html-script.js"></script>
     <meta name="referrer" content="origin">
   </head>
   <body onload="runTest()">
     <h1>Referrer Policy: iframes with data url uses no referrer</h1>
     <script>
       let test = async_test("iframes with data url uses no referrer");
-      window.addEventListener("message", test.step_func((msg) => {
+      window.addEventListener("message", test.step_func_done(msg => {
         assert_equals(msg.data.referrer, undefined);
-        test.done();
       }));
 
       function runTest() {
-        const BASE = location.protocol + "//www1." + location.hostname + ":" + location.port;
-        const TEST_DATA =
-            `data:text/html,<script src = "${BASE}/common/security-features/resources/common.sub.js"></` + `script>
-            <script src = "${BASE}/referrer-policy/generic/referrer-policy-test-case.js"></` + `script>
-            <script>
-              var urlPath = "/common/security-features/subresource/xhr.py";
-              var url = "${BASE}" + urlPath;
-              requestViaXhr(url).then((msg) => {
-                  parent.postMessage({referrer: msg.referrer}, "*")})
-                .catch((e) => {
-                    parent.postMessage({referrer: "FAILURE"}, "*");
-                  });
-            </` + "script>";
-
         let iframe = document.createElement("iframe");
-        iframe.src = TEST_DATA;
+        iframe.src = `data:text/html,${createScriptString(get_host_info().REMOTE_ORIGIN)}`;
         document.body.appendChild(iframe);
       }
     </script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-document-write.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-document-write.html
new file mode 100644
index 0000000..cba71bb1
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-document-write.html

@@ -0,0 +1,20 @@
+<!doctype html>
+<title>Referrer Policy: iframes with document.write()</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/make-html-script.js"></script>
+<meta name="referrer" content="origin">
+<div id="log"></div>
+<script>
+async_test(t => {
+  window.addEventListener("message", t.step_func_done(msg => {
+    assert_equals(msg.data.referrer, self.origin + "/");
+  }));
+
+  const iframe = document.createElement("iframe");
+  document.body.appendChild(iframe);
+  iframe.contentDocument.write(createScriptString(get_host_info().REMOTE_ORIGIN));
+  iframe.contentDocument.close();
+});
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child-expected.txt b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child-expected.txt
new file mode 100644
index 0000000..73cb453
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child-expected.txt

@@ -0,0 +1,7 @@
+This is a testharness.js-based test.
+FAIL Referrer Policy: iframes with javascript url reuse referrer policy assert_equals: expected (string) "http://web-platform.test:8001/" but got (undefined) undefined
+PASS Referrer Policy: iframes with javascript url reuse referrer policy 1
+PASS Referrer Policy: iframes with javascript url reuse referrer policy 2
+FAIL Referrer Policy: iframes with javascript url reuse referrer policy 3 assert_equals: expected (undefined) undefined but got (string) "http://web-platform.test:8001/"
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html
new file mode 100644
index 0000000..e20da4f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-child.html

@@ -0,0 +1,70 @@
+<!doctype html>
+<title>Referrer Policy: iframes with javascript url reuse referrer policy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/make-html-script.js"></script>
+<meta name="referrer" content="origin">
+<div id="log"></div>
+<script>
+[
+  {
+    srcDocPolicy: ``,
+    expected: self.origin + "/"
+  },
+  {
+    srcDocPolicy: `<meta name="referrer" content="no-referrer">`,
+    expected: undefined
+  }
+].forEach(({ srcDocPolicy, expected }) => {
+  promise_test(t => {
+    return new Promise(resolve => {
+      window.addEventListener("message", t.step_func(msg => {
+        assert_equals(msg.data.referrer, expected);
+        resolve();
+      }), { once:true });
+
+      const iframe = document.createElement("iframe");
+      t.add_cleanup(() => iframe.remove());
+      iframe.srcdoc = `${srcDocPolicy}<body><h1>Outer iframe</h1></body>`;
+      iframe.onload = t.step_func(() => {
+        iframe.onload = null;
+        const iframeChild =  iframe.contentDocument.createElement("iframe");
+        iframeChild.src = `javascript:'${createScriptString(get_host_info().REMOTE_ORIGIN)}'`;
+        iframe.contentDocument.body.appendChild(iframeChild);
+      });
+      document.body.appendChild(iframe);
+    });
+  });
+});
+
+[
+  {
+    srcDocPolicy: ``,
+    expected: self.origin + "/"
+  },
+  {
+    srcDocPolicy: `<meta name="referrer" content="no-referrer">`,
+    expected: undefined
+  }
+].forEach(({ srcDocPolicy, expected }) => {
+  promise_test(t => {
+    return new Promise(resolve => {
+      window.addEventListener("message", t.step_func(msg => {
+        assert_equals(msg.data.referrer, expected);
+        resolve();
+      }), { once:true });
+
+      const iframe = document.createElement("iframe");
+      t.add_cleanup(() => iframe.remove());
+      iframe.srcdoc = `${srcDocPolicy}<body><h1>Outer iframe</h1></body>`;
+      iframe.onload = t.step_func(() => {
+        iframe.onload = null;
+        iframe.contentWindow.location = `javascript:'${createScriptString(get_host_info().REMOTE_ORIGIN)}'`;
+      });
+      document.body.appendChild(iframe);
+    });
+  });
+});
+
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-expected.txt b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-expected.txt
new file mode 100644
index 0000000..01ccc62
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript-expected.txt

@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL Referrer Policy: iframes with javascript url reuse referrer policy assert_equals: expected (string) "http://web-platform.test:8001/" but got (undefined) undefined
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript.html
new file mode 100644
index 0000000..77b6d759
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript.html

@@ -0,0 +1,19 @@
+<!doctype html>
+<title>Referrer Policy: iframes with javascript url reuse referrer policy</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/make-html-script.js"></script>
+<meta name="referrer" content="origin">
+<div id="log"></div>
+<script>
+async_test(t => {
+  window.addEventListener("message", t.step_func_done(msg => {
+    assert_equals(msg.data.referrer, self.origin + "/");
+  }));
+
+  const iframe = document.createElement("iframe");
+  iframe.src = `javascript:'${createScriptString(get_host_info().REMOTE_ORIGIN)}'`;
+  document.body.appendChild(iframe);
+});
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html
index ecd5a41..cd4b4ae 100644
--- a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc-child.html

@@ -5,43 +5,27 @@
     <link rel="help" href="https://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-nested">
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
-    <!-- Common global functions for referrer-policy tests. -->
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="/referrer-policy/generic/referrer-policy-test-case.js"></script>
+    <script src="/common/get-host-info.sub.js"></script>
+    <script src="resources/make-html-script.js"></script>
     <meta name="referrer" content="origin">
   </head>
   <body onload="runTest()">
     <h1>Referrer Policy: iframes srcdoc child correctly inherit the ancestor's referrer policy</h1>
     <script>
       var test = async_test("iframes srcdoc child correctly inherit the ancestor's referrer policy");
-      window.addEventListener("message", test.step_func((msg) => {
-        assert_equals(msg.data.referrer, document.location.origin + "/");
-        test.done();
+      window.addEventListener("message", test.step_func_done(msg => {
+        assert_equals(msg.data.referrer, self.origin + "/");
       }));
 
-      const BASE = location.protocol + "//www1." + location.hostname + ":" + location.port;
-
       function runTest() {
         var iframe = document.createElement("iframe");
         iframe.srcdoc = `<body><h1>Outer iframe</h1></body>`;
-        iframe.onload = function() {
+        iframe.onload = test.step_func(() => {
           iframe.onload = null;
           var iframeChild =  iframe.contentDocument.createElement("iframe");
-          iframeChild.srcdoc =
-            `<script src = "${BASE}/common/security-features/resources/common.sub.js"></sc` + `ript>
-            <script src = "${BASE}/referrer-policy/generic/referrer-policy-test-case.js"></sc` + `ript>
-            <script>
-              var urlPath = "/common/security-features/subresource/xhr.py";
-              var url = "${BASE}" + urlPath;
-              requestViaXhr(url).then((msg) => {
-                  window.top.postMessage({referrer: msg.referrer}, "*")})
-                .catch((e) => {
-                    window.top.postMessage({referrer: "FAILURE"}, "*");
-                  });
-            </sc` + "ript>";
+          iframeChild.srcdoc = createScriptString(get_host_info().REMOTE_ORIGIN);
           iframe.contentDocument.body.appendChild(iframeChild);
-        };
-
+        });
         document.body.appendChild(iframe);
       }
     </script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc.html b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc.html
index 6639ebd9..c4dffd3 100644
--- a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc.html
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-srcdoc.html

@@ -5,33 +5,21 @@
     <link rel="help" href="https://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-nested">
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
-    <!-- Common global functions for referrer-policy tests. -->
-    <script src="/common/security-features/resources/common.sub.js"></script>
+    <script src="/common/get-host-info.sub.js"></script>
+    <script src="resources/make-html-script.js"></script>
     <meta name="referrer" content="origin">
   </head>
   <body onload="runTest()">
     <h1>Referrer Policy: iframes srcdoc correctly inherit the ancestor's referrer policy</h1>
     <script>
       var test = async_test("iframes srcdoc correctly inherit the ancestor's referrer policy");
-      window.addEventListener("message", test.step_func((msg) => {
-        assert_equals(msg.data.referrer, document.location.origin + "/");
-        test.done();
+      window.addEventListener("message", test.step_func_done(msg => {
+        assert_equals(msg.data.referrer, self.origin + "/");
       }));
 
       function runTest() {
         var iframe = document.createElement("iframe");
-        iframe.srcdoc =
-            `<script src = "/common/security-features/resources/common.sub.js"></` + `script>
-            <script>
-              var urlPath = "/common/security-features/subresource/xhr.py";
-              var url = "${location.protocol}//www1.${location.hostname}:${location.port}" + urlPath;
-              requestViaXhr(url).then((msg) => {
-                  parent.postMessage({referrer: msg.referrer}, "*")})
-                .catch((e) => {
-                    parent.postMessage({referrer: "FAILURE"}, "*");
-                  });
-            </` + "script>";
-
+        iframe.srcdoc = createScriptString(get_host_info().REMOTE_ORIGIN);
         document.body.appendChild(iframe);
       }
     </script>

diff --git a/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/resources/make-html-script.js b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/resources/make-html-script.js
new file mode 100644
index 0000000..e285c55
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/resources/make-html-script.js

@@ -0,0 +1,10 @@
+function createScriptString(origin) {
+  return `<script src = "${origin}/common/security-features/resources/common.sub.js"><\/script>
+          <script>
+            requestViaXhr("${origin}/common/security-features/subresource/xhr.py").then(msg => {
+              top.postMessage({referrer: msg.referrer}, "*")
+            }).catch(e => {
+              top.postMessage({referrer: "FAILURE"}, "*");
+            });
+          <\/script>`;
+}

diff --git a/third_party/blink/web_tests/external/wpt/speech-api/META.yml b/third_party/blink/web_tests/external/wpt/speech-api/META.yml
index 9ce8830..88f1837 100644
--- a/third_party/blink/web_tests/external/wpt/speech-api/META.yml
+++ b/third_party/blink/web_tests/external/wpt/speech-api/META.yml

@@ -1,3 +1,5 @@
 spec: https://w3c.github.io/speech-api/
 suggested_reviewers:
+  - andrenatal
   - foolip
+  - marcoscaceres

diff --git a/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import-blob-url.any-expected.txt b/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import-blob-url.any-expected.txt
deleted file mode 100644
index c4516600..0000000
--- a/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import-blob-url.any-expected.txt
+++ /dev/null

@@ -1,10 +0,0 @@
-This is a testharness.js-based test.
-PASS Static import.
-PASS Nested static import.
-FAIL Static import and then dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Nested dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Dynamic import and then static import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL eval(import()). assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-Harness: the test ran to completion.
-

diff --git a/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import.any-expected.txt b/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import.any-expected.txt
deleted file mode 100644
index c4516600..0000000
--- a/third_party/blink/web_tests/external/wpt/workers/modules/shared-worker-import.any-expected.txt
+++ /dev/null

@@ -1,10 +0,0 @@
-This is a testharness.js-based test.
-PASS Static import.
-PASS Nested static import.
-FAIL Static import and then dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Nested dynamic import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL Dynamic import and then static import. assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-FAIL eval(import()). assert_array_equals: value is "Failed to do dynamic import: TypeError: Module scripts are not supported on WorkerGlobalScope yet (see https://crbug.com/680046).", expected array
-Harness: the test ran to completion.
-

diff --git a/third_party/blink/web_tests/fast/forms/file/file-appearance-basic.html b/third_party/blink/web_tests/fast/forms/file/file-appearance-basic.html
new file mode 100644
index 0000000..e8e074bd
--- /dev/null
+++ b/third_party/blink/web_tests/fast/forms/file/file-appearance-basic.html

@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<style>
+input {
+  margin: 4px;
+}
+</style>
+<body>
+<div>Normal: <input type=file>
+Disabled: <input type=file disabled></div>
+<div>
+Various sizes:
+<input type=file style="width:1em">
+<input type=file style="width:2em">
+<input type=file style="width:3em">
+<input type=file style="width:4em">
+<input type=file style="width:5em">
+<input type=file style="width:6em">
+<input type=file style="width:7em">
+<input type=file style="width:8em">
+<input type=file style="width:9em">
+<input type=file style="width:10em">
+<input type=file style="width:11em">
+<input type=file style="width:12em">
+<input type=file style="width:13em">
+<input type=file style="width:14em">
+<input type=file style="width:22em">
+</div>
+<div>
+<input type=file style="height:8px">
+<input type=file style="height:30px; border:1px solid lightgray;">
+</div>
+
+<div>
+<input type=file style="font-size:20px">
+<input type=file style="text-decoration:underline">
+</div>
+
+<div>
+<style>
+.button-display-none::-webkit-file-upload-button {
+  display: none;
+}
+.button-appearance-none::-webkit-file-upload-button {
+  -webkit-appearance: none;
+}
+.button-shadow::-webkit-file-upload-button {
+  box-shadow: 8px 8px 8px gray;
+}
+</style>
+Styling ::-webkit-file-upload-button:
+<input type=file class="button-display-none">
+<input type=file class="button-appearance-none">
+<input type=file class="button-shadow">
+<div>
+
+</body>

diff --git a/third_party/blink/web_tests/fast/forms/file/file-input-disabled.html b/third_party/blink/web_tests/fast/forms/file/file-input-disabled.html
deleted file mode 100644
index 42baaee..0000000
--- a/third_party/blink/web_tests/fast/forms/file/file-input-disabled.html
+++ /dev/null

@@ -1,26 +0,0 @@
-<html>
-<head>
-<title>Testing disabling file input</title>
-
-<script language="JavaScript" type="text/javascript">
-<!--
-function checkboxClicked(element) {
-	if (element.checked) {
-		document.getElementById("file_input").disabled = false;
-	} else {
-		document.getElementById("file_input").disabled = true;
-	}
-}
-//-->
-</script>
-</head>
-<body>
-<form>
-<table>
-<input name="attach_screenshot" type="checkbox" onClick="checkboxClicked(this);">
-<b>Attach File</b><br><br>
-&nbsp;&nbsp;Select File:&nbsp;
-<input id="file_input" name="thumbnail_file" type="file" disabled="true"><br>
-</form>
-</body>
-</html>

diff --git a/third_party/blink/web_tests/fast/forms/file/input-file-label.html b/third_party/blink/web_tests/fast/forms/file/input-file-label.html
index 0e8f9ca..546968a 100644
--- a/third_party/blink/web_tests/fast/forms/file/input-file-label.html
+++ b/third_party/blink/web_tests/fast/forms/file/input-file-label.html

@@ -10,33 +10,37 @@
 <p>This tests the label of a file chooser button.</p>
 <div id="console"></div>
 <script>
+function uploadButton(input) {
+  return internals.shadowRoot(input).getElementById('file-upload-button');
+}
+
 if (window.testRunner) {
     var file = document.getElementById('single_file');
-    var button = internals.shadowRoot(file).firstChild;
+    var button = uploadButton(file);
     var label = button.getAttribute('value');
     var result = 'The label of a single file chooser button is "' + label + '".';
     label == 'Choose File' ? testPassed(result) : testFailed(result);
 
     file = document.getElementById('multiple_files');
-    button = internals.shadowRoot(file).firstChild;
+    button = uploadButton(file);
     label = button.getAttribute('value');
     result = 'The label of a multiple file chooser button is "' + label + '".';
     label == 'Choose Files' ? testPassed(result) : testFailed(result);
 
     file = document.getElementById('single_or_multiple_file');
-    button = internals.shadowRoot(file).firstChild;
+    button = uploadButton(file);
     label = button.getAttribute('value');
     result = 'Initially, the label of a file chooser button is "' + label + '".';
     label == 'Choose File' ? testPassed(result) : testFailed(result);
 
     file.setAttribute("multiple", "multiple");
-    button = internals.shadowRoot(file).firstChild;
+    button = uploadButton(file);
     label = button.getAttribute('value');
     result = 'Set "multiple" attribute, then the label of the file chooser button becomes "' + label + '".';
     label == 'Choose Files' ? testPassed(result) : testFailed(result);
 
     file.removeAttribute("multiple");
-    button = internals.shadowRoot(file).firstChild;
+    button = uploadButton(file);
     label = button.getAttribute('value');
     result = 'Unset "multiple" attribute, then the label of the file chooser button becomes "' + label + '".';
     label == 'Choose File' ? testPassed(result) : testFailed(result);

diff --git a/third_party/blink/web_tests/fast/workers/chromium/shared-worker-dynamic-import.html b/third_party/blink/web_tests/fast/workers/chromium/shared-worker-dynamic-import.html
deleted file mode 100644
index 4e75d8f..0000000
--- a/third_party/blink/web_tests/fast/workers/chromium/shared-worker-dynamic-import.html
+++ /dev/null

@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<title>Worker: Dynamic import() on SharedWorkerGlobalScope</title>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script>
-
-// This test should not be upstreamed to WPT because this tests Chrome-specific
-// behavior.
-
-promise_test(() => {
-  const worker = new SharedWorker('resources/shared-worker-dynamic-import.js');
-  return new Promise(resolve => worker.port.onmessage = resolve)
-      .then(msg_event => {
-        assert_equals(msg_event.data.name, 'TypeError');
-        assert_equals(msg_event.data.message,
-                      'Module scripts are not supported on WorkerGlobalScope ' +
-                      'yet (see https://crbug.com/680046).');
-      });
-}, 'Dynamic import() on SharedWorkerGlobalScope should reject the promise.');
-
-</script>

diff --git a/third_party/blink/web_tests/http/tests/push_messaging/unsubscribe-in-document.html b/third_party/blink/web_tests/http/tests/push_messaging/unsubscribe-in-document.html
index 02917de..cbda144b 100644
--- a/third_party/blink/web_tests/http/tests/push_messaging/unsubscribe-in-document.html
+++ b/third_party/blink/web_tests/http/tests/push_messaging/unsubscribe-in-document.html

@@ -5,6 +5,8 @@
 <link rel="manifest" href="resources/push_manifest.json">
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="../resources/testdriver.js"></script>
+<script src="../resources/testdriver-vendor.js"></script>
 <script src="../serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
@@ -19,10 +21,12 @@
             swRegistration = serviceWorkerRegistration;
             return wait_for_state(test, swRegistration.installing, 'activated');
         })
-        .then(function() {
+        .then(async function() {
             // If running manually, grant permission when prompted.
-            if (window.testRunner)
-                testRunner.setPermission('push-messaging', 'granted', location.origin, location.origin);
+            if (window.test_driver) {
+                await test_driver.set_permission(
+                    {name: 'push', userVisibleOnly: true}, 'granted', false);
+            }
             return swRegistration.pushManager.subscribe({ userVisibleOnly: true });
         })
         .then(function(subscription) {

diff --git a/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling-expected.txt b/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling-expected.txt
new file mode 100644
index 0000000..6b0e284ed
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling-expected.txt

@@ -0,0 +1,2 @@
+Test that the profiler can record a profile with cpu throttling enabled.
+

diff --git a/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling.js b/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling.js
new file mode 100644
index 0000000..bf6df29
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/cpu-profiler/record-cpu-profile-with-cpu-throttling.js

@@ -0,0 +1,20 @@
+(async function(testRunner) {
+  const {page, session, dp} = await testRunner.startBlank(
+      'Test that the profiler can record a profile with cpu throttling enabled.');
+
+  await dp.Emulation.setCPUThrottlingRate({rate: 4});
+  await dp.Profiler.enable();
+  await dp.Profiler.start();
+
+  await session.evaluate(`
+    let count = 0;
+    for (let i = 0; i < 1e7; i++) {
+      count += i;
+    }
+    window.count = count;
+  `);
+
+  await dp.Profiler.stop();
+
+  testRunner.completeTest();
+})

diff --git a/third_party/blink/web_tests/platform/linux/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/linux/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..f4a0d0a
--- /dev/null
+++ b/third_party/blink/web_tests/platform/linux/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/linux/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index 73f2b50..0000000
--- a/third_party/blink/web_tests/platform/linux/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png b/third_party/blink/web_tests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
index d2f3d56..a37fcde9 100644
--- a/third_party/blink/web_tests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/blink/web_tests/platform/linux/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..469674a3
--- /dev/null
+++ b/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index fce09b1b..0000000
--- a/third_party/blink/web_tests/platform/linux/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index f6df0002..fdaff176 100644
--- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index b8b5e15..0f6bc63 100644
--- a/third_party/blink/web_tests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/linux/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..8073cf2
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index 93a0bfc..0000000
--- a/third_party/blink/web_tests/platform/mac-mac10.10/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.10/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.10/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..8073cf2
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.10/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..68037190b
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index 1f1b5d4..0000000
--- a/third_party/blink/web_tests/platform/mac-mac10.11/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.11/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.11/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..68037190b
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.11/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.12/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.12/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..b674dde
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.12/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-6-expected.png b/third_party/blink/web_tests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-6-expected.png
index 7822c0b..e51a087a 100644
--- a/third_party/blink/web_tests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/blink/web_tests/platform/mac-mac10.12/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.12/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..b674dde
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/mac/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..3140c9e
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/mac/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index 4d49877c..0000000
--- a/third_party/blink/web_tests/platform/mac/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png b/third_party/blink/web_tests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
index 28f15b9..349a5a9 100644
--- a/third_party/blink/web_tests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/blink/web_tests/platform/mac/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/mac/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index f6df0002..8fdea784 100644
--- a/third_party/blink/web_tests/platform/mac/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/mac/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/mac/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index b8b5e15..0dd125d 100644
--- a/third_party/blink/web_tests/platform/mac/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/mac/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/win/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..7e7814e
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/win/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index c52c330..0000000
--- a/third_party/blink/web_tests/platform/win/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/svg/as-background-image/svg-as-background-6-expected.png b/third_party/blink/web_tests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
index 4ae0f19..1e957a4 100644
--- a/third_party/blink/web_tests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
+++ b/third_party/blink/web_tests/platform/win/svg/as-background-image/svg-as-background-6-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png b/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
new file mode 100644
index 0000000..c049f66
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-appearance-basic-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png b/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png
deleted file mode 100644
index fc14e234..0000000
--- a/third_party/blink/web_tests/platform/win/virtual/form-controls-refresh-disabled/fast/forms/file/file-input-disabled-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/win/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index 69a2662..c7370662 100644
--- a/third_party/blink/web_tests/platform/win/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/win/virtual/scalefactor150/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png b/third_party/blink/web_tests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
index 7c97da43..d73a8ee 100644
--- a/third_party/blink/web_tests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
+++ b/third_party/blink/web_tests/platform/win/virtual/scalefactor200withzoom/fast/hidpi/static/validation-bubble-appearance-hidpi-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/resources/testdriver-vendor.js b/third_party/blink/web_tests/resources/testdriver-vendor.js
index 9ba1cfc..cf24b02 100644
--- a/third_party/blink/web_tests/resources/testdriver-vendor.js
+++ b/third_party/blink/web_tests/resources/testdriver-vendor.js

@@ -390,6 +390,14 @@
       throw "Could not remove authenticator";
   }
 
+  window.test_driver_internal.set_permission = function(permission_params) {
+    // TODO(https://crbug.com/977612): Chromium currently lacks support for
+    // |permission_params.one_realm| and will always consider it is set to false.
+    return internals.setPermission(permission_params.descriptor,
+                                   permission_params.state,
+                                   location.origin, location.origin);
+  }
+
   // Enable automation so we don't wait for user input on unimplemented APIs
   window.test_driver_internal.in_automation = true;
 

diff --git a/third_party/blink/web_tests/virtual/json-modules/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt b/third_party/blink/web_tests/virtual/json-modules/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt
new file mode 100644
index 0000000..3dd4020
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/json-modules/external/wpt/html/semantics/scripting-1/the-script-element/json-module/non-object.tentative.any.sharedworker-expected.txt

@@ -0,0 +1,8 @@
+This is a testharness.js-based test.
+PASS Non-object: null
+PASS Non-object: true
+PASS Non-object: false
+PASS Non-object: string
+PASS Non-object: array
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/wake-lock/wakelock-request-denied.html b/third_party/blink/web_tests/wake-lock/wakelock-request-denied.html
index ff22918..fb2ac1d7 100644
--- a/third_party/blink/web_tests/wake-lock/wakelock-request-denied.html
+++ b/third_party/blink/web_tests/wake-lock/wakelock-request-denied.html

@@ -3,12 +3,13 @@
 <body>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="../resources/testdriver.js"></script>
+<script src="../resources/testdriver-vendor.js"></script>
 <script>
 'use strict';
 
 promise_test(async t => {
-  await internals.setPermission({name: 'wake-lock', type: 'screen'}, 'denied',
-                                location.origin, location.origin);
+  await test_driver.set_permission({name: 'wake-lock', type: 'screen'}, 'denied', false);
   return promise_rejects(t, "NotAllowedError", navigator.wakeLock.request('screen'));
 }, 'Denied requests should abort with NotAllowedError');
 </script>

diff --git a/third_party/blink/web_tests/wpt_internal/wake-lock/wakelock-onrelease.https.html b/third_party/blink/web_tests/wpt_internal/wake-lock/wakelock-onrelease.https.html
index d43579e..2bcbbf9f 100644
--- a/third_party/blink/web_tests/wpt_internal/wake-lock/wakelock-onrelease.https.html
+++ b/third_party/blink/web_tests/wpt_internal/wake-lock/wakelock-onrelease.https.html

@@ -2,12 +2,14 @@
 <link rel="help" href="https://w3c.github.io/wake-lock/#the-onrelease-attribute">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
 <script>
 // TODO(https://crbug.com/1015327): Move this to WPT once we can change
 // permissions via testdriver.js.
 
 async_test(async t => {
-  window.testRunner.setPermission('wake-lock-screen', 'granted', location.origin, location.origin);
+  await test_driver.set_permission({name: 'wake-lock', type: 'screen'}, 'granted', false);
 
   const lock = await navigator.wakeLock.request("screen");
   lock.onrelease = t.step_func_done((ev) => {

diff --git a/third_party/blink/web_tests/wpt_internal/wake-lock/wakelockpermissiondescriptor.https.html b/third_party/blink/web_tests/wpt_internal/wake-lock/wakelockpermissiondescriptor.https.html
index 1c00faf..b64e885 100644
--- a/third_party/blink/web_tests/wpt_internal/wake-lock/wakelockpermissiondescriptor.https.html
+++ b/third_party/blink/web_tests/wpt_internal/wake-lock/wakelockpermissiondescriptor.https.html

@@ -2,18 +2,24 @@
 <link rel="help" href="https://w3c.github.io/wake-lock/#the-wakelockpermissiondescriptor-dictionary">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
 <script>
 // TODO(https://crbug.com/1015327): Move this to WPT once we can change
 // permissions via testdriver.js.
 
-promise_test(t => {
+promise_test(async t => {
+  await test_driver.set_permission({name: 'wake-lock', type: 'screen'}, 'denied', false);
+
   return navigator.permissions.query({name:'wake-lock', type: 'screen'}).then(status => {
     assert_class_string(status, "PermissionStatus");
     assert_equals(status.state, "denied");
   });
 }, "WakeLockPermissionDescriptor with type=screen works");
 
-promise_test(t => {
+promise_test(async t => {
+  await test_driver.set_permission({name: 'wake-lock', type: 'system'}, 'denied', false);
+
   return navigator.permissions.query({ name: 'wake-lock', type: 'system' }).then(status => {
     assert_class_string(status, "PermissionStatus");
     assert_equals(status.state, "denied");

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 8e5793d..1d632cb 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -19204,6 +19204,7 @@
   <int value="660" label="ReportDeviceGraphicsStatus"/>
   <int value="661" label="DeviceLoginScreenAccessibilityShortcutsEnabled"/>
   <int value="662" label="LocalDiscoveryEnabled"/>
+  <int value="663" label="ChromeVariations"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations">

diff --git a/ui/base/x/x11_drag_drop_client.cc b/ui/base/x/x11_drag_drop_client.cc
index 0d499eb5..4b83a009 100644
--- a/ui/base/x/x11_drag_drop_client.cc
+++ b/ui/base/x/x11_drag_drop_client.cc

@@ -282,7 +282,7 @@
       EndMoveLoop();
       return;
     }
-    set_source_state(SourceState::kDropped);
+    source_state_ = SourceState::kDropped;
     SendXdndDrop(source_window);
     return;
   }
@@ -352,6 +352,7 @@
 }
 
 void XDragDropClient::InitDrag(int operation) {
+  source_state_ = SourceState::kOther;
   waiting_on_status_ = false;
   next_position_message_.reset();
   status_received_since_enter_ = false;
@@ -404,7 +405,7 @@
       if (status_received_since_enter()) {
         // If we are waiting for an XdndStatus message, we need to wait for it
         // to complete.
-        set_source_state(SourceState::kPendingDrop);
+        source_state_ = SourceState::kPendingDrop;
 
         // Start timer to end the move loop if the target takes too long to send
         // the XdndStatus and XdndFinished messages.
@@ -425,7 +426,7 @@
       StartEndMoveLoopTimer();
 
       // We have negotiated an action with the other end.
-      set_source_state(SourceState::kDropped);
+      source_state_ = SourceState::kDropped;
       SendXdndDrop(source_current_window());
       return;
     }

diff --git a/ui/base/x/x11_drag_drop_client.h b/ui/base/x/x11_drag_drop_client.h
index cfcfdd7..0132cd99 100644
--- a/ui/base/x/x11_drag_drop_client.h
+++ b/ui/base/x/x11_drag_drop_client.h

@@ -76,44 +76,52 @@
   XDragDropClient(const XDragDropClient&) = delete;
   XDragDropClient& operator=(const XDragDropClient&) = delete;
 
-  // We maintain a mapping of live XDragDropClient objects to their X11 windows,
-  // so that we'd able to short circuit sending X11 messages to windows in our
-  // process.
-  static XDragDropClient* GetForWindow(XID window);
-
   // Handlers and callbacks that the subclass should implement.
+
+  // Creates the window finder.
   virtual std::unique_ptr<XTopmostWindowFinder> CreateWindowFinder() = 0;
-  virtual SelectionFormatMap GetFormatMap() const = 0;
-  virtual void RetrieveTargets(std::vector<Atom>* targets) const = 0;
+
+  // Handling XdndPosition can be paused while waiting for more data; this is
+  // called either synchronously from OnXdndPosition, or asynchronously after
+  // we've received data requested from the other window.
   virtual int GetDragOperation(const gfx::Point& screen_point) = 0;
-  // Drops data at the current location and returns the resulting operation.
-  virtual int PerformDrop() = 0;
-  // Called when data from another application enters the window.
-  virtual void OnBeginForeignDrag(XID window) = 0;
-  // Called when data from another application is about to leave the window.
-  virtual void OnEndForeignDrag() = 0;
+
+  // Updates the mouse cursor shape.
   virtual void UpdateCursor(
       DragDropTypes::DragOperation negotiated_operation) = 0;
+
+  // Returns a representation of the data we're offering in this drag.  This is
+  // done to bypass an asynchronous roundtrip with the X11 server.
+  virtual SelectionFormatMap GetFormatMap() const = 0;
+
+  // Extracts available targets from the data provider.
+  virtual void RetrieveTargets(std::vector<Atom>* targets) const = 0;
+
+  // Called when data from another application enters the window.
+  virtual void OnBeginForeignDrag(XID window) = 0;
+
+  // Called when data from another application is about to leave the window.
+  virtual void OnEndForeignDrag() = 0;
+
   // Called just before the drag leaves the window.
   virtual void OnBeforeDragLeave() = 0;
+
+  // Drops data at the current location and returns the resulting operation.
+  virtual int PerformDrop() = 0;
+
   // Called to end the move loop that is maintained by the subclass.
   virtual void EndMoveLoop() = 0;
 
   Display* xdisplay() const { return xdisplay_; }
   XID xwindow() const { return xwindow_; }
-
-  XID source_current_window() { return source_current_window_; }
+  XID source_current_window() const { return source_current_window_; }
   void set_source_current_window(XID window) {
     source_current_window_ = window;
   }
-
   XDragContext* target_current_context() {
     return target_current_context_.get();
   }
-
   SourceState source_state() const { return source_state_; }
-  void set_source_state(SourceState state) { source_state_ = state; }
-
   bool waiting_on_status() const { return waiting_on_status_; }
   int drag_operation() const { return drag_operation_; }
   DragDropTypes::DragOperation negotiated_operation() const {
@@ -126,9 +134,10 @@
   // Resets the drag state so the object is ready to handle the drag.
   void InitDrag(int operation);
 
+  // Updates |current_modifier_state_| with the given set of flags.
   void UpdateModifierState(int flags);
 
-  // Resets the drag context.
+  // Resets the drag context.  Calls |OnEndForeignDrag()| if necessary.
   void ResetDragContext();
 
   void StopRepeatMouseMoveTimer();
@@ -163,6 +172,11 @@
   void SendXdndDrop(XID dest_window);
 
  private:
+  // We maintain a mapping of live XDragDropClient objects to their X11 windows,
+  // so that we'd able to short circuit sending X11 messages to windows in our
+  // process.
+  static XDragDropClient* GetForWindow(XID window);
+
   Display* const xdisplay_;
   const XID xwindow_;
 

diff --git a/ui/events/blink/blink_features.cc b/ui/events/blink/blink_features.cc
index d68116d..7cfdb77 100644
--- a/ui/events/blink/blink_features.cc
+++ b/ui/events/blink/blink_features.cc

@@ -7,7 +7,7 @@
 namespace features {
 
 const base::Feature kResamplingScrollEvents{"ResamplingScrollEvents",
-                                            base::FEATURE_ENABLED_BY_DEFAULT};
+                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
 const base::Feature kFilteringScrollPrediction{
     "FilteringScrollPrediction", base::FEATURE_DISABLED_BY_DEFAULT};

diff --git a/ui/file_manager/file_manager/foreground/js/quick_view_controller.js b/ui/file_manager/file_manager/foreground/js/quick_view_controller.js
index 64670790..b5c84a4a 100644
--- a/ui/file_manager/file_manager/foreground/js/quick_view_controller.js
+++ b/ui/file_manager/file_manager/foreground/js/quick_view_controller.js

@@ -295,14 +295,11 @@
 
   /**
    * @param {!FileEntry} entry
-   * @return {!Promise<!Array<!chrome.fileManagerPrivate.FileTask>>}
+   * @return {!Promise<!FileTasks>}
    * @private
    */
   getAvailableTasks_(entry) {
-    return this.taskController_.getEntryFileTasks(entry).then(tasks => {
-      this.tasks_ = tasks;
-      return tasks.getTaskItems();
-    });
+    return this.taskController_.getEntryFileTasks(entry);
   }
 
   /**
@@ -322,6 +319,7 @@
     assert(this.entries_.length > 0);
     const entry = this.entries_[this.currentSelection_];
     this.quickViewModel_.setSelectedEntry(entry);
+    this.tasks_ = null;
 
     requestIdleCallback(() => {
       this.quickViewUma_.onEntryChanged(entry);
@@ -334,9 +332,7 @@
         ])
         .then(values => {
           const items = (/**@type{Array<MetadataItem>}*/ (values[0]));
-          const tasks =
-              (/**@type{!Array<!chrome.fileManagerPrivate.FileTask>}*/ (
-                  values[1]));
+          const tasks = (/**@type{!FileTasks}*/ (values[1]));
           return this.onMetadataLoaded_(entry, items, tasks);
         })
         .catch(error => {
@@ -354,10 +350,12 @@
    *
    * @param {!FileEntry} entry
    * @param {Array<MetadataItem>} items
-   * @param {!Array<!chrome.fileManagerPrivate.FileTask>} tasks
+   * @param {!FileTasks} fileTasks
    * @private
    */
-  onMetadataLoaded_(entry, items, tasks) {
+  onMetadataLoaded_(entry, items, fileTasks) {
+    const tasks = fileTasks.getTaskItems();
+
     return this.getQuickViewParameters_(entry, items, tasks).then(params => {
       if (this.quickViewModel_.getSelectedEntry() != entry) {
         return;  // Bail: there's no point drawing a stale selection.
@@ -374,6 +372,8 @@
         autoplay: params.autoplay || false,
         browsable: params.browsable || false,
       });
+
+      this.tasks_ = fileTasks;
     });
   }
 

diff --git a/ui/file_manager/integration_tests/file_manager/quick_view.js b/ui/file_manager/integration_tests/file_manager/quick_view.js
index 91ba9a1..c2e818bb 100644
--- a/ui/file_manager/integration_tests/file_manager/quick_view.js
+++ b/ui/file_manager/integration_tests/file_manager/quick_view.js

@@ -67,6 +67,48 @@
   }
 
   /**
+   * Opens the Quick View dialog with given file |names|. The files must be
+   * present and check-selected in the Files app file list.
+   *
+   * @param {string} appId Files app windowId.
+   * @param {Array<string>} names File names.
+   */
+  async function openQuickViewMultipleSelection(appId, names) {
+    const caller = getCaller();
+
+    function checkQuickViewElementsDisplayBlock(elements) {
+      const haveElements = Array.isArray(elements) && elements.length !== 0;
+      if (!haveElements || elements[0].styles.display !== 'block') {
+        return pending(caller, 'Waiting for Quick View to open.');
+      }
+      return;
+    }
+
+    // Get the file-list rows that are check-selected (multi-selected).
+    const selectedRows = await remoteCall.callRemoteTestUtil(
+        'deepQueryAllElements', appId, ['#file-list li[selected]']);
+
+    // Check: the selection should contain the given file names.
+    chrome.test.assertEq(names.length, selectedRows.length);
+    for (let i = 0; i < names.length; i++) {
+      chrome.test.assertTrue(
+          selectedRows[i].attributes['file-name'].includes(names[i]));
+    }
+
+    // Open Quick View via its keyboard shortcut.
+    const space = ['#file-list', ' ', false, false, false];
+    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+
+    // Check: the Quick View dialog should be shown.
+    await repeatUntil(async () => {
+      const elements = ['#quick-view', '#dialog[open]'];
+      return checkQuickViewElementsDisplayBlock(
+          await remoteCall.callRemoteTestUtil(
+              'deepQueryAllElements', appId, [elements, ['display']]));
+    });
+  }
+
+  /**
    * Assuming that Quick View is currently open per openQuickView above, closes
    * the Quick View dialog.
    *
@@ -1239,18 +1281,8 @@
         !!await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, ctrlSpace),
         'Ctrl+Space failed');
 
-    // Check: both items should be selected.
-    const selectedRows = await remoteCall.callRemoteTestUtil(
-        'deepQueryAllElements', appId, ['#file-list li[selected]']);
-    chrome.test.assertEq(2, selectedRows.length);
-    chrome.test.assertTrue(
-        selectedRows[0].attributes['file-name'].includes(['Desktop']));
-    chrome.test.assertTrue(
-        selectedRows[1].attributes['file-name'].includes(['hello']));
-
-    // Open Quick View via its keyboard shortcut.
-    const space = ['#file-list', ' ', false, false, false];
-    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+    // Open Quick View with the check-selected files.
+    await openQuickViewMultipleSelection(appId, ['Desktop', 'hello']);
 
     // Wait for the Quick View <webview> to load and display its content.
     function checkWebViewImageLoaded(elements) {
@@ -1313,18 +1345,8 @@
         !!await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, ctrlSpace),
         'Ctrl+Space failed');
 
-    // Check: both items should be selected.
-    const selectedRows = await remoteCall.callRemoteTestUtil(
-        'deepQueryAllElements', appId, ['#file-list li[selected]']);
-    chrome.test.assertEq(2, selectedRows.length);
-    chrome.test.assertTrue(
-        selectedRows[0].attributes['file-name'].includes(['small']));
-    chrome.test.assertTrue(
-        selectedRows[1].attributes['file-name'].includes(['hello']));
-
-    // Attempt to open Quick View via its keyboard shortcut.
-    const space = ['#file-list', ' ', false, false, false];
-    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+    // Open Quick View with the check-selected files.
+    await openQuickViewMultipleSelection(appId, ['small', 'hello']);
 
     // Wait for the Quick View <webview> to load and display its content.
     function checkWebViewImageLoaded(elements) {
@@ -1416,18 +1438,8 @@
         !!await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, ctrlSpace),
         'Ctrl+Space failed');
 
-    // Check: both items should be selected.
-    const selectedRows = await remoteCall.callRemoteTestUtil(
-        'deepQueryAllElements', appId, ['#file-list li[selected]']);
-    chrome.test.assertEq(2, selectedRows.length);
-    chrome.test.assertTrue(
-        selectedRows[0].attributes['file-name'].includes(['small']));
-    chrome.test.assertTrue(
-        selectedRows[1].attributes['file-name'].includes(['tall']));
-
-    // Attempt to open Quick View via its keyboard shortcut.
-    const space = ['#file-list', ' ', false, false, false];
-    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+    // Open Quick View with the check-selected files.
+    await openQuickViewMultipleSelection(appId, ['small', 'tall']);
 
     // Wait for the Quick View <webview> to load and display its content.
     function checkWebViewImageLoaded(elements) {
@@ -1519,18 +1531,8 @@
         !!await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, ctrlSpace),
         'Ctrl+Space failed');
 
-    // Check: both items should be selected.
-    const selectedRows = await remoteCall.callRemoteTestUtil(
-        'deepQueryAllElements', appId, ['#file-list li[selected]']);
-    chrome.test.assertEq(2, selectedRows.length);
-    chrome.test.assertTrue(
-        selectedRows[0].attributes['file-name'].includes(['tall']));
-    chrome.test.assertTrue(
-        selectedRows[1].attributes['file-name'].includes(['hello']));
-
-    // Attempt to open Quick View via its keyboard shortcut.
-    const space = ['#file-list', ' ', false, false, false];
-    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+    // Open Quick View with the check-selected files.
+    await openQuickViewMultipleSelection(appId, ['tall', 'hello']);
 
     // Wait for the Quick View <webview> to load and display its content.
     function checkWebViewTextLoaded(elements) {
@@ -1619,18 +1621,8 @@
         !!await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, ctrlSpace),
         'Ctrl+Space failed');
 
-    // Check: both items should be selected.
-    const selectedRows = await remoteCall.callRemoteTestUtil(
-        'deepQueryAllElements', appId, ['#file-list li[selected]']);
-    chrome.test.assertEq(2, selectedRows.length);
-    chrome.test.assertTrue(
-        selectedRows[0].attributes['file-name'].includes(['tall']));
-    chrome.test.assertTrue(
-        selectedRows[1].attributes['file-name'].includes(['hello']));
-
-    // Attempt to open Quick View via its keyboard shortcut.
-    const space = ['#file-list', ' ', false, false, false];
-    await remoteCall.callRemoteTestUtil('fakeKeyDown', appId, space);
+    // Open Quick View with the check-selected files.
+    await openQuickViewMultipleSelection(appId, ['tall', 'hello']);
 
     // Wait for the Quick View <webview> to load and display its content.
     function checkWebViewTextLoaded(elements) {

diff --git a/ui/views/controls/label.cc b/ui/views/controls/label.cc
index b2fc78e..e06eb597 100644
--- a/ui/views/controls/label.cc
+++ b/ui/views/controls/label.cc

@@ -67,17 +67,17 @@
              int text_context,
              int text_style,
              gfx::DirectionalityMode directionality_mode)
-    : text_context_(text_context), context_menu_contents_(this) {
+    : text_context_(text_context),
+      text_style_(text_style),
+      context_menu_contents_(this) {
   Init(text, style::GetFont(text_context, text_style), directionality_mode);
   SetLineHeight(style::GetLineHeight(text_context, text_style));
-
-  // If an explicit style is given, ignore color changes due to the NativeTheme.
-  if (text_style != style::STYLE_PRIMARY)
-    SetEnabledColor(style::GetColor(*this, text_context, text_style));
 }
 
 Label::Label(const base::string16& text, const CustomFont& font)
-    : text_context_(style::CONTEXT_LABEL), context_menu_contents_(this) {
+    : text_context_(style::CONTEXT_LABEL),
+      text_style_(style::STYLE_PRIMARY),
+      context_menu_contents_(this) {
   Init(text, font.font_list, gfx::DirectionalityMode::DIRECTIONALITY_FROM_TEXT);
 }
 
@@ -1059,7 +1059,7 @@
   ui::NativeTheme* theme = GetNativeTheme();
   if (!enabled_color_set_) {
     requested_enabled_color_ =
-        style::GetColor(*this, text_context_, style::STYLE_PRIMARY);
+        style::GetColor(*this, text_context_, text_style_);
   }
   if (!background_color_set_) {
     background_color_ =

diff --git a/ui/views/controls/label.h b/ui/views/controls/label.h
index fd5657b..d6e1ad6 100644
--- a/ui/views/controls/label.h
+++ b/ui/views/controls/label.h

@@ -373,6 +373,7 @@
   void BuildContextMenuContents();
 
   const int text_context_;
+  const int text_style_;
 
   // An un-elided and single-line RenderText object used for preferred sizing.
   std::unique_ptr<gfx::RenderText> full_text_;

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc
index 4629ba8..7421a4b 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc

@@ -200,46 +200,6 @@
   move_loop_ = CreateMoveLoop(this);
 }
 
-void DesktopDragDropClientAuraX11::OnBeginForeignDrag(XID window) {
-  DCHECK(target_current_context());
-  DCHECK(!target_current_context()->source_client());
-
-  ui::PlatformEventSource::GetInstance()->AddPlatformEventDispatcher(this);
-  source_window_events_ =
-      std::make_unique<ui::XScopedEventSelector>(window, PropertyChangeMask);
-}
-
-void DesktopDragDropClientAuraX11::OnEndForeignDrag() {
-  DCHECK(target_current_context());
-  DCHECK(!target_current_context()->source_client());
-
-  ui::PlatformEventSource::GetInstance()->RemovePlatformEventDispatcher(this);
-}
-
-void DesktopDragDropClientAuraX11::OnBeforeDragLeave() {
-  NotifyDragLeave();
-}
-
-void DesktopDragDropClientAuraX11::UpdateCursor(
-    ui::DragDropTypes::DragOperation negotiated_operation) {
-  ui::CursorType cursor_type = ui::CursorType::kNull;
-  switch (negotiated_operation) {
-    case ui::DragDropTypes::DRAG_NONE:
-      cursor_type = ui::CursorType::kDndNone;
-      break;
-    case ui::DragDropTypes::DRAG_MOVE:
-      cursor_type = ui::CursorType::kDndMove;
-      break;
-    case ui::DragDropTypes::DRAG_COPY:
-      cursor_type = ui::CursorType::kDndCopy;
-      break;
-    case ui::DragDropTypes::DRAG_LINK:
-      cursor_type = ui::CursorType::kDndLink;
-      break;
-  }
-  move_loop_->UpdateCursor(cursor_manager_->GetInitializedCursor(cursor_type));
-}
-
 int DesktopDragDropClientAuraX11::StartDragAndDrop(
     std::unique_ptr<ui::OSExchangeData> data,
     aura::Window* root_window,
@@ -253,7 +213,6 @@
   set_source_current_window(x11::None);
   DCHECK(!g_current_drag_drop_client);
   g_current_drag_drop_client = this;
-  set_source_state(SourceState::kOther);
   InitDrag(operation);
 
   const ui::OSExchangeData::Provider* provider = &data->provider();
@@ -397,10 +356,6 @@
   return base::WrapUnique(new X11WholeScreenMoveLoop(this));
 }
 
-void DesktopDragDropClientAuraX11::EndMoveLoop() {
-  move_loop_->EndMoveLoop();
-}
-
 void DesktopDragDropClientAuraX11::DragTranslate(
     const gfx::Point& root_window_location,
     std::unique_ptr<ui::OSExchangeData>* data,
@@ -472,9 +427,9 @@
   target_window_ = nullptr;
 }
 
-ui::SelectionFormatMap DesktopDragDropClientAuraX11::GetFormatMap() const {
-  return source_provider_ ? source_provider_->GetFormatMap()
-                          : ui::SelectionFormatMap();
+std::unique_ptr<ui::XTopmostWindowFinder>
+DesktopDragDropClientAuraX11::CreateWindowFinder() {
+  return std::make_unique<X11TopmostWindowFinder>();
 }
 
 int DesktopDragDropClientAuraX11::GetDragOperation(
@@ -492,6 +447,56 @@
   return drag_operation;
 }
 
+void DesktopDragDropClientAuraX11::UpdateCursor(
+    ui::DragDropTypes::DragOperation negotiated_operation) {
+  ui::CursorType cursor_type = ui::CursorType::kNull;
+  switch (negotiated_operation) {
+    case ui::DragDropTypes::DRAG_NONE:
+      cursor_type = ui::CursorType::kDndNone;
+      break;
+    case ui::DragDropTypes::DRAG_MOVE:
+      cursor_type = ui::CursorType::kDndMove;
+      break;
+    case ui::DragDropTypes::DRAG_COPY:
+      cursor_type = ui::CursorType::kDndCopy;
+      break;
+    case ui::DragDropTypes::DRAG_LINK:
+      cursor_type = ui::CursorType::kDndLink;
+      break;
+  }
+  move_loop_->UpdateCursor(cursor_manager_->GetInitializedCursor(cursor_type));
+}
+
+ui::SelectionFormatMap DesktopDragDropClientAuraX11::GetFormatMap() const {
+  return source_provider_ ? source_provider_->GetFormatMap()
+                          : ui::SelectionFormatMap();
+}
+
+void DesktopDragDropClientAuraX11::RetrieveTargets(
+    std::vector<Atom>* targets) const {
+  source_provider_->RetrieveTargets(targets);
+}
+
+void DesktopDragDropClientAuraX11::OnBeginForeignDrag(XID window) {
+  DCHECK(target_current_context());
+  DCHECK(!target_current_context()->source_client());
+
+  ui::PlatformEventSource::GetInstance()->AddPlatformEventDispatcher(this);
+  source_window_events_ =
+      std::make_unique<ui::XScopedEventSelector>(window, PropertyChangeMask);
+}
+
+void DesktopDragDropClientAuraX11::OnEndForeignDrag() {
+  DCHECK(target_current_context());
+  DCHECK(!target_current_context()->source_client());
+
+  ui::PlatformEventSource::GetInstance()->RemovePlatformEventDispatcher(this);
+}
+
+void DesktopDragDropClientAuraX11::OnBeforeDragLeave() {
+  NotifyDragLeave();
+}
+
 int DesktopDragDropClientAuraX11::PerformDrop() {
   DCHECK(target_current_context());
 
@@ -529,14 +534,8 @@
   return drag_operation;
 }
 
-void DesktopDragDropClientAuraX11::RetrieveTargets(
-    std::vector<Atom>* targets) const {
-  source_provider_->RetrieveTargets(targets);
-}
-
-std::unique_ptr<ui::XTopmostWindowFinder>
-DesktopDragDropClientAuraX11::CreateWindowFinder() {
-  return std::make_unique<X11TopmostWindowFinder>();
+void DesktopDragDropClientAuraX11::EndMoveLoop() {
+  move_loop_->EndMoveLoop();
 }
 
 }  // namespace views

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.h b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.h
index 68c3776..ca7255ff 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.h
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.h

@@ -101,9 +101,6 @@
       X11MoveLoopDelegate* delegate);
 
  private:
-  // Ends the move loop.
-  void EndMoveLoop() override;
-
   // When we receive a position X11 message, we need to translate that into
   // the underlying aura::Window representation, as moves internal to the X11
   // window can cause internal drag leave and enter messages.
@@ -116,25 +113,18 @@
   // then unsubscribes |target_window_| from ourselves and forgets it.
   void NotifyDragLeave();
 
-  // This returns a representation of the data we're offering in this
-  // drag. This is done to bypass an asynchronous roundtrip with the X11
-  // server.
-  ui::SelectionFormatMap GetFormatMap() const override;
-
-  // Handling XdndPosition can be paused while waiting for more data; this is
-  // called either synchronously from OnXdndPosition, or asynchronously after
-  // we've received data requested from the other window.
+  // ui::XDragDropClient
+  std::unique_ptr<ui::XTopmostWindowFinder> CreateWindowFinder() override;
   int GetDragOperation(const gfx::Point& screen_point) override;
-  int PerformDrop() override;
-  void OnBeginForeignDrag(XID window) override;
-  void OnEndForeignDrag() override;
   void UpdateCursor(
       ui::DragDropTypes::DragOperation negotiated_operation) override;
-  void OnBeforeDragLeave() override;
-
+  ui::SelectionFormatMap GetFormatMap() const override;
   void RetrieveTargets(std::vector<Atom>* targets) const override;
-
-  std::unique_ptr<ui::XTopmostWindowFinder> CreateWindowFinder() override;
+  void OnBeginForeignDrag(XID window) override;
+  void OnEndForeignDrag() override;
+  void OnBeforeDragLeave() override;
+  int PerformDrop() override;
+  void EndMoveLoop() override;
 
   // A nested run loop that notifies this object of events through the
   // X11MoveLoopDelegate interface.