diff --git a/BUILD.gn b/BUILD.gn
index c952580..3216b4c 100644
--- a/BUILD.gn
+++ b/BUILD.gn

@@ -453,13 +453,13 @@
     }
 
     if (enable_nacl) {
-      deps += [ "//components/nacl/loader:nacl_loader_unittests" ]
+      deps += [ "//components/nacl:nacl_loader_unittests" ]
 
       if (is_linux) {
         # TODO(dpranke): Figure out what platforms should actually have this.
         deps += [
-          "//components/nacl/loader:helper_nonsfi",
-          "//components/nacl/loader:nacl_helper",
+          "//components/nacl:helper_nonsfi",
+          "//components/nacl:nacl_helper",
         ]
       }
     }

diff --git a/DEPS b/DEPS
index a3c3e58..1d04c9d 100644
--- a/DEPS
+++ b/DEPS

@@ -39,7 +39,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '4e4155df100b77d11bd14591c7716743369fde9b',
+  'skia_revision': 'a35434aadce3591241d0626529c9978ee567acd9',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -59,7 +59,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'ebc7695c60fc3e4afbfa6d9db162a71b190bf685',
+  'pdfium_revision': '1407c979a3ba8599546468d461f5403f317bddd3',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -184,7 +184,7 @@
    Var('chromium_git') + '/webm/libvpx.git' + '@' +  '23831545a0a148a066b905c0f1e011375c97d790',
 
   'src/third_party/ffmpeg':
-   Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + '8a728cadef0d39ae0af732461078015e90384abc',
+   Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + '8b946dec70ca7985098525d0e9dccc8daa42ef47',
 
   'src/third_party/libjingle/source/talk':
     Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + 'f2f143fd6169378519543704aeda9621a7c6f6dc', # commit position 10999
@@ -271,7 +271,7 @@
 
   'src/third_party/catapult':
     Var('chromium_git') + '/external/github.com/catapult-project/catapult.git' + '@' +
-    '97d95119247a42aa5590fcdf61a23554ad8899a4',
+    '506457cbd726324f327b80ae11f46c1dfeb8710d',
 
   'src/third_party/openh264/src':
     Var('chromium_git') + '/external/github.com/cisco/openh264' + '@' + 'b37cda248234162033e3e11b0335f3131cdfe488',

diff --git a/base/bind.h b/base/bind.h
index 94da5ac..9b55924 100644
--- a/base/bind.h
+++ b/base/bind.h

@@ -51,15 +51,13 @@
 base::Callback<
     typename internal::BindState<
         typename internal::FunctorTraits<Functor>::RunnableType,
-        typename internal::FunctorTraits<Functor>::RunType,
-        internal::TypeList<>>::UnboundRunType>
+        typename internal::FunctorTraits<Functor>::RunType>::UnboundRunType>
 Bind(Functor functor) {
   // Typedefs for how to store and run the functor.
   typedef typename internal::FunctorTraits<Functor>::RunnableType RunnableType;
   typedef typename internal::FunctorTraits<Functor>::RunType RunType;
 
-  typedef internal::BindState<RunnableType, RunType,
-                              internal::TypeList<>> BindState;
+  typedef internal::BindState<RunnableType, RunType> BindState;
 
   return Callback<typename BindState::UnboundRunType>(
       new BindState(internal::MakeRunnable(functor)));
@@ -70,8 +68,7 @@
     typename internal::BindState<
         typename internal::FunctorTraits<Functor>::RunnableType,
         typename internal::FunctorTraits<Functor>::RunType,
-        internal::TypeList<
-            typename internal::CallbackParamTraits<Args>::StorageType...>>
+        typename internal::CallbackParamTraits<Args>::StorageType...>
             ::UnboundRunType>
 Bind(Functor functor, const Args&... args) {
   // Typedefs for how to store and run the functor.
@@ -105,8 +102,7 @@
 
   typedef internal::BindState<
       RunnableType, RunType,
-      internal::TypeList<
-          typename internal::CallbackParamTraits<Args>::StorageType...>>
+      typename internal::CallbackParamTraits<Args>::StorageType...>
       BindState;
 
   return Callback<typename BindState::UnboundRunType>(

diff --git a/base/bind_internal.h b/base/bind_internal.h
index c6832e6..49ce0ed 100644
--- a/base/bind_internal.h
+++ b/base/bind_internal.h

@@ -39,12 +39,7 @@
 //             even if the invocation syntax differs.
 //  RunType -- A function type (as opposed to function _pointer_ type) for
 //             a Run() function.  Usually just a convenience typedef.
-//  (Bound)ArgsType -- A function type that is being (ab)used to store the
-//                     types of set of arguments.  The "return" type is always
-//                     void here.  We use this hack so that we do not need
-//                     a new type name for each arity of type. (eg.,
-//                     BindState1, BindState2).  This makes forward
-//                     declarations and friending much much easier.
+//  (Bound)Args -- A set of types that stores the arguments.
 //
 // Types:
 //  RunnableAdapter<> -- Wraps the various "function" pointer types into an
@@ -56,7 +51,6 @@
 //                     signature adapters are applied.
 //  MakeRunnable<> -- Takes a Functor and returns an object in the Runnable
 //                    type class that represents the underlying Functor.
-//                    There are |O(1)| MakeRunnable types.
 //  InvokeHelper<> -- Take a Runnable + arguments and actully invokes it.
 //                    Handle the differing syntaxes needed for WeakPtr<>
 //                    support, and for ignoring return values.  This is separate
@@ -360,19 +354,18 @@
 // Normally, this is the same as the RunType of the Runnable, but it can
 // be different if an adapter like IgnoreResult() has been used.
 //
-// BoundArgsType contains the storage type for all the bound arguments by
-// (ab)using a function type.
-template <typename Runnable, typename RunType, typename BoundArgList>
+// BoundArgs contains the storage type for all the bound arguments.
+template <typename Runnable, typename RunType, typename... BoundArgs>
 struct BindState;
 
 template <typename Runnable,
           typename R,
           typename... Args,
           typename... BoundArgs>
-struct BindState<Runnable, R(Args...), TypeList<BoundArgs...>> final
+struct BindState<Runnable, R(Args...), BoundArgs...> final
     : public BindStateBase {
  private:
-  using StorageType = BindState<Runnable, R(Args...), TypeList<BoundArgs...>>;
+  using StorageType = BindState<Runnable, R(Args...), BoundArgs...>;
   using RunnableType = Runnable;
 
   // true_type if Runnable is a method invocation and the first bound argument

diff --git a/base/bind_unittest.cc b/base/bind_unittest.cc
index afa523c..a6f3653b 100644
--- a/base/bind_unittest.cc
+++ b/base/bind_unittest.cc

@@ -752,7 +752,7 @@
   Callback<scoped_ptr<DeleteCounter>(scoped_ptr<DeleteCounter>)> cb_unbound =
       Bind(&PassThru<scoped_ptr<DeleteCounter> >);
   ptr.reset(new DeleteCounter(&deletes));
-  cb_unbound.Run(ptr.Pass());
+  cb_unbound.Run(std::move(ptr));
 }
 
 TEST_F(BindTest, UniquePtr) {

diff --git a/base/bind_unittest.nc b/base/bind_unittest.nc
index fb8f28a..70c479f0 100644
--- a/base/bind_unittest.nc
+++ b/base/bind_unittest.nc

@@ -193,7 +193,7 @@
   weak_ptr_with_non_void_return_type.Run();
 }
 
-#elif defined(NCTEST_DISALLOW_ASSIGN_DIFFERENT_TYPES)  // [r"fatal error: no viable conversion from 'Callback<typename internal::BindState<typename internal::FunctorTraits<void \(\*\)\(int\)>::RunnableType, typename internal::FunctorTraits<void \(\*\)\(int\)>::RunType, internal::TypeList<> >::UnboundRunType>' to 'Callback<void \(\)>'"]
+#elif defined(NCTEST_DISALLOW_ASSIGN_DIFFERENT_TYPES)  // [r"fatal error: no viable conversion from 'Callback<typename internal::BindState<typename internal::FunctorTraits<void \(\*\)\(int\)>::RunnableType, typename internal::FunctorTraits<void \(\*\)\(int\)>::RunType>::UnboundRunType>' to 'Callback<void \(\)>'"]
 
 // Bind result cannot be assigned to Callbacks with a mismatching type.
 void WontCompile() {

diff --git a/base/callback.h b/base/callback.h
index 00669dd..b13e627 100644
--- a/base/callback.h
+++ b/base/callback.h

@@ -165,7 +165,7 @@
 //   that doesn't expect a return value.
 //
 //   int DoSomething(int arg) { cout << arg << endl; }
-//   base::Callback<void<int>) cb =
+//   base::Callback<void(int)> cb =
 //       base::Bind(base::IgnoreResult(&DoSomething));
 //
 //
@@ -354,11 +354,9 @@
 //
 // If you are thinking of forward declaring Callback in your own header file,
 // please include "base/callback_forward.h" instead.
-template <typename Sig>
-class Callback;
 
 namespace internal {
-template <typename Runnable, typename RunType, typename BoundArgsType>
+template <typename Runnable, typename RunType, typename... BoundArgsType>
 struct BindState;
 }  // namespace internal
 
@@ -367,19 +365,17 @@
  public:
   typedef R(RunType)(Args...);
 
-  Callback() : CallbackBase(NULL) { }
+  Callback() : CallbackBase(nullptr) { }
 
-  // Note that this constructor CANNOT be explicit, and that Bind() CANNOT
-  // return the exact Callback<> type.  See base/bind.h for details.
-  template <typename Runnable, typename BindRunType, typename BoundArgsType>
-  Callback(internal::BindState<Runnable, BindRunType,
-           BoundArgsType>* bind_state)
+  template <typename Runnable, typename BindRunType, typename... BoundArgsType>
+  explicit Callback(
+      internal::BindState<Runnable, BindRunType, BoundArgsType...>* bind_state)
       : CallbackBase(bind_state) {
     // Force the assignment to a local variable of PolymorphicInvoke
     // so the compiler will typecheck that the passed in Run() method has
     // the correct type.
     PolymorphicInvoke invoke_func =
-        &internal::BindState<Runnable, BindRunType, BoundArgsType>
+        &internal::BindState<Runnable, BindRunType, BoundArgsType...>
             ::InvokerType::Run;
     polymorphic_invoke_ = reinterpret_cast<InvokeFuncStorage>(invoke_func);
   }
@@ -402,10 +398,6 @@
       typename internal::CallbackParamTraits<Args>::ForwardType...);
 };
 
-// Syntactic sugar to make Callback<void(void)> easier to declare since it
-// will be used in a lot of APIs with delayed execution.
-typedef Callback<void(void)> Closure;
-
 }  // namespace base
 
 #endif  // BASE_CALLBACK_H_

diff --git a/base/callback_forward.h b/base/callback_forward.h
index 262c3065..213023d 100644
--- a/base/callback_forward.h
+++ b/base/callback_forward.h

@@ -10,6 +10,8 @@
 template <typename Sig>
 class Callback;
 
+// Syntactic sugar to make Callback<void(void)> easier to declare since it
+// will be used in a lot of APIs with delayed execution.
 typedef Callback<void(void)> Closure;
 
 }  // namespace base

diff --git a/base/callback_list_unittest.cc b/base/callback_list_unittest.cc
index 1cae827..71e781c 100644
--- a/base/callback_list_unittest.cc
+++ b/base/callback_list_unittest.cc

@@ -4,6 +4,8 @@
 
 #include "base/callback_list.h"
 
+#include <utility>
+
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ -37,7 +39,7 @@
   }
   void SetSubscriptionToRemove(
       scoped_ptr<CallbackList<void(void)>::Subscription> sub) {
-    removal_subscription_ = sub.Pass();
+    removal_subscription_ = std::move(sub);
   }
 
   int total() const { return total_; }
@@ -247,9 +249,9 @@
       cb_reg.Add(Bind(&Listener::IncrementTotal, Unretained(&b)));
 
   // |remover_1| will remove itself.
-  remover_1.SetSubscriptionToRemove(remover_1_sub.Pass());
+  remover_1.SetSubscriptionToRemove(std::move(remover_1_sub));
   // |remover_2| will remove a.
-  remover_2.SetSubscriptionToRemove(a_subscription.Pass());
+  remover_2.SetSubscriptionToRemove(std::move(a_subscription));
 
   cb_reg.Notify();
 
@@ -322,8 +324,8 @@
   scoped_ptr<CallbackList<void(void)>::Subscription> remover_2_sub =
       cb_reg.Add(Bind(&Remover::IncrementTotalAndRemove,
           Unretained(&remover_2)));
-  remover_1.SetSubscriptionToRemove(remover_1_sub.Pass());
-  remover_2.SetSubscriptionToRemove(remover_2_sub.Pass());
+  remover_1.SetSubscriptionToRemove(std::move(remover_1_sub));
+  remover_2.SetSubscriptionToRemove(std::move(remover_2_sub));
 
   // The callback should be signaled exactly once.
   EXPECT_EQ(1, remove_count.value());

diff --git a/base/callback_unittest.cc b/base/callback_unittest.cc
index 2844aa98..5daef95 100644
--- a/base/callback_unittest.cc
+++ b/base/callback_unittest.cc

@@ -23,8 +23,6 @@
 }  // namespace
 
 namespace internal {
-template <typename Runnable, typename RunType, typename BoundArgsType>
-struct BindState;
 
 // White-box testpoints to inject into a Callback<> object for checking
 // comparators and emptiness APIs.  Use a BindState that is specialized
@@ -32,7 +30,7 @@
 // chance of colliding with another instantiation and breaking the
 // one-definition-rule.
 template <>
-struct BindState<void(void), void(void), void(FakeInvoker)>
+struct BindState<void(void), void(void), FakeInvoker>
     : public BindStateBase {
  public:
   BindState() : BindStateBase(&Destroy) {}
@@ -45,8 +43,7 @@
 };
 
 template <>
-struct BindState<void(void), void(void),
-                           void(FakeInvoker, FakeInvoker)>
+struct BindState<void(void), void(void), FakeInvoker, FakeInvoker>
     : public BindStateBase {
  public:
   BindState() : BindStateBase(&Destroy) {}
@@ -61,11 +58,10 @@
 
 namespace {
 
-typedef internal::BindState<void(void), void(void), void(FakeInvoker)>
+typedef internal::BindState<void(void), void(void), FakeInvoker>
     FakeBindState1;
-typedef internal::BindState<void(void), void(void),
-                            void(FakeInvoker, FakeInvoker)>
-   FakeBindState2;
+typedef internal::BindState<void(void), void(void), FakeInvoker, FakeInvoker>
+    FakeBindState2;
 
 class CallbackTest : public ::testing::Test {
  public:

diff --git a/base/files/file.cc b/base/files/file.cc
index 036d43b..d62767a 100644
--- a/base/files/file.cc
+++ b/base/files/file.cc

@@ -68,7 +68,7 @@
   // It would be nice if we could validate that |platform_file| was opened with
   // FILE_FLAG_OVERLAPPED on Windows but this doesn't appear to be possible.
   file.async_ = true;
-  return file.Pass();
+  return file;
 }
 
 File& File::operator=(File&& other) {

diff --git a/base/files/file_posix.cc b/base/files/file_posix.cc
index 7278db7..92721f9 100644
--- a/base/files/file_posix.cc
+++ b/base/files/file_posix.cc

@@ -381,7 +381,7 @@
   File other(other_fd);
   if (async())
     other.async_ = true;
-  return other.Pass();
+  return other;
 }
 
 // Static.

diff --git a/base/files/file_proxy.cc b/base/files/file_proxy.cc
index f995735..3761e99 100644
--- a/base/files/file_proxy.cc
+++ b/base/files/file_proxy.cc

@@ -4,6 +4,8 @@
 
 #include "base/files/file_proxy.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/files/file.h"
@@ -24,7 +26,7 @@
 class FileHelper {
  public:
    FileHelper(FileProxy* proxy, File file)
-      : file_(file.Pass()),
+      : file_(std::move(file)),
         error_(File::FILE_ERROR_FAILED),
         task_runner_(proxy->task_runner()),
         proxy_(AsWeakPtr(proxy)) {
@@ -32,7 +34,7 @@
 
    void PassFile() {
      if (proxy_)
-       proxy_->SetFile(file_.Pass());
+       proxy_->SetFile(std::move(file_));
      else if (file_.IsValid())
        task_runner_->PostTask(FROM_HERE, Bind(&FileDeleter, Passed(&file_)));
    }
@@ -52,7 +54,7 @@
 class GenericFileHelper : public FileHelper {
  public:
   GenericFileHelper(FileProxy* proxy, File file)
-      : FileHelper(proxy, file.Pass()) {
+      : FileHelper(proxy, std::move(file)) {
   }
 
   void Close() {
@@ -88,7 +90,7 @@
 class CreateOrOpenHelper : public FileHelper {
  public:
   CreateOrOpenHelper(FileProxy* proxy, File file)
-      : FileHelper(proxy, file.Pass()) {
+      : FileHelper(proxy, std::move(file)) {
   }
 
   void RunWork(const FilePath& file_path, int file_flags) {
@@ -109,7 +111,7 @@
 class CreateTemporaryHelper : public FileHelper {
  public:
   CreateTemporaryHelper(FileProxy* proxy, File file)
-      : FileHelper(proxy, file.Pass()) {
+      : FileHelper(proxy, std::move(file)) {
   }
 
   void RunWork(uint32 additional_file_flags) {
@@ -151,7 +153,7 @@
 class GetInfoHelper : public FileHelper {
  public:
   GetInfoHelper(FileProxy* proxy, File file)
-      : FileHelper(proxy, file.Pass()) {
+      : FileHelper(proxy, std::move(file)) {
   }
 
   void RunWork() {
@@ -173,7 +175,7 @@
 class ReadHelper : public FileHelper {
  public:
   ReadHelper(FileProxy* proxy, File file, int bytes_to_read)
-      : FileHelper(proxy, file.Pass()),
+      : FileHelper(proxy, std::move(file)),
         buffer_(new char[bytes_to_read]),
         bytes_to_read_(bytes_to_read),
         bytes_read_(0) {
@@ -202,7 +204,7 @@
   WriteHelper(FileProxy* proxy,
               File file,
               const char* buffer, int bytes_to_write)
-      : FileHelper(proxy, file.Pass()),
+      : FileHelper(proxy, std::move(file)),
         buffer_(new char[bytes_to_write]),
         bytes_to_write_(bytes_to_write),
         bytes_written_(0) {
@@ -266,11 +268,11 @@
 
 void FileProxy::SetFile(File file) {
   DCHECK(!file_.IsValid());
-  file_ = file.Pass();
+  file_ = std::move(file);
 }
 
 File FileProxy::TakeFile() {
-  return file_.Pass();
+  return std::move(file_);
 }
 
 PlatformFile FileProxy::GetPlatformFile() const {
@@ -279,7 +281,7 @@
 
 bool FileProxy::Close(const StatusCallback& callback) {
   DCHECK(file_.IsValid());
-  GenericFileHelper* helper = new GenericFileHelper(this, file_.Pass());
+  GenericFileHelper* helper = new GenericFileHelper(this, std::move(file_));
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&GenericFileHelper::Close, Unretained(helper)),
@@ -288,7 +290,7 @@
 
 bool FileProxy::GetInfo(const GetFileInfoCallback& callback) {
   DCHECK(file_.IsValid());
-  GetInfoHelper* helper = new GetInfoHelper(this, file_.Pass());
+  GetInfoHelper* helper = new GetInfoHelper(this, std::move(file_));
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&GetInfoHelper::RunWork, Unretained(helper)),
@@ -302,7 +304,7 @@
   if (bytes_to_read < 0)
     return false;
 
-  ReadHelper* helper = new ReadHelper(this, file_.Pass(), bytes_to_read);
+  ReadHelper* helper = new ReadHelper(this, std::move(file_), bytes_to_read);
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&ReadHelper::RunWork, Unretained(helper), offset),
@@ -318,7 +320,7 @@
     return false;
 
   WriteHelper* helper =
-      new WriteHelper(this, file_.Pass(), buffer, bytes_to_write);
+      new WriteHelper(this, std::move(file_), buffer, bytes_to_write);
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&WriteHelper::RunWork, Unretained(helper), offset),
@@ -329,7 +331,7 @@
                          Time last_modified_time,
                          const StatusCallback& callback) {
   DCHECK(file_.IsValid());
-  GenericFileHelper* helper = new GenericFileHelper(this, file_.Pass());
+  GenericFileHelper* helper = new GenericFileHelper(this, std::move(file_));
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&GenericFileHelper::SetTimes, Unretained(helper), last_access_time,
@@ -339,7 +341,7 @@
 
 bool FileProxy::SetLength(int64 length, const StatusCallback& callback) {
   DCHECK(file_.IsValid());
-  GenericFileHelper* helper = new GenericFileHelper(this, file_.Pass());
+  GenericFileHelper* helper = new GenericFileHelper(this, std::move(file_));
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&GenericFileHelper::SetLength, Unretained(helper), length),
@@ -348,7 +350,7 @@
 
 bool FileProxy::Flush(const StatusCallback& callback) {
   DCHECK(file_.IsValid());
-  GenericFileHelper* helper = new GenericFileHelper(this, file_.Pass());
+  GenericFileHelper* helper = new GenericFileHelper(this, std::move(file_));
   return task_runner_->PostTaskAndReply(
       FROM_HERE,
       Bind(&GenericFileHelper::Flush, Unretained(helper)),

diff --git a/base/files/file_proxy_unittest.cc b/base/files/file_proxy_unittest.cc
index ab3e9ae..72c430e37 100644
--- a/base/files/file_proxy_unittest.cc
+++ b/base/files/file_proxy_unittest.cc

@@ -4,6 +4,8 @@
 
 #include "base/files/file_proxy.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/files/file.h"
 #include "base/files/file_util.h"
@@ -208,7 +210,7 @@
   ASSERT_TRUE(file.IsValid());
   FileProxy proxy(file_task_runner());
   EXPECT_FALSE(proxy.IsValid());
-  proxy.SetFile(file.Pass());
+  proxy.SetFile(std::move(file));
   EXPECT_TRUE(proxy.IsValid());
   EXPECT_FALSE(file.IsValid());
 

diff --git a/base/files/file_unittest.cc b/base/files/file_unittest.cc
index 67dbbfd1..909bacb 100644
--- a/base/files/file_unittest.cc
+++ b/base/files/file_unittest.cc

@@ -3,6 +3,9 @@
 // found in the LICENSE file.
 
 #include "base/files/file.h"
+
+#include <utility>
+
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/time/time.h"
@@ -240,7 +243,7 @@
   ASSERT_TRUE(file2.IsValid());
 
   // Test passing the file around.
-  file = file2.Pass();
+  file = std::move(file2);
   EXPECT_FALSE(file2.IsValid());
   ASSERT_TRUE(file.IsValid());
 

diff --git a/base/files/file_util_unittest.cc b/base/files/file_util_unittest.cc
index 748301d..aa554731 100644
--- a/base/files/file_util_unittest.cc
+++ b/base/files/file_util_unittest.cc

@@ -21,6 +21,7 @@
 #include <algorithm>
 #include <fstream>
 #include <set>
+#include <utility>
 #include <vector>
 
 #include "base/base_paths.h"
@@ -1704,14 +1705,14 @@
 
 TEST_F(FileUtilTest, FileToFILE) {
   File file;
-  FILE* stream = FileToFILE(file.Pass(), "w");
+  FILE* stream = FileToFILE(std::move(file), "w");
   EXPECT_FALSE(stream);
 
   FilePath file_name = temp_dir_.path().Append(FPL("The file.txt"));
   file = File(file_name, File::FLAG_CREATE | File::FLAG_WRITE);
   EXPECT_TRUE(file.IsValid());
 
-  stream = FileToFILE(file.Pass(), "w");
+  stream = FileToFILE(std::move(file), "w");
   EXPECT_TRUE(stream);
   EXPECT_FALSE(file.IsValid());
   EXPECT_TRUE(CloseFile(stream));

diff --git a/base/files/memory_mapped_file.cc b/base/files/memory_mapped_file.cc
index 6c3f402..45569e3 100644
--- a/base/files/memory_mapped_file.cc
+++ b/base/files/memory_mapped_file.cc

@@ -4,6 +4,8 @@
 
 #include "base/files/memory_mapped_file.h"
 
+#include <utility>
+
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/sys_info.h"
@@ -47,7 +49,7 @@
 }
 
 bool MemoryMappedFile::Initialize(File file) {
-  return Initialize(file.Pass(), Region::kWholeFile);
+  return Initialize(std::move(file), Region::kWholeFile);
 }
 
 bool MemoryMappedFile::Initialize(File file, const Region& region) {
@@ -59,7 +61,7 @@
     DCHECK_GT(region.size, 0);
   }
 
-  file_ = file.Pass();
+  file_ = std::move(file);
 
   if (!MapFileRegionToMemory(region)) {
     CloseHandles();

diff --git a/base/files/memory_mapped_file_unittest.cc b/base/files/memory_mapped_file_unittest.cc
index c865e27f..5c48b48 100644
--- a/base/files/memory_mapped_file_unittest.cc
+++ b/base/files/memory_mapped_file_unittest.cc

@@ -4,6 +4,8 @@
 
 #include "base/files/memory_mapped_file.h"
 
+#include <utility>
+
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -93,7 +95,7 @@
   MemoryMappedFile map;
 
   File file(temp_file_path(), File::FLAG_OPEN | File::FLAG_READ);
-  map.Initialize(file.Pass(), MemoryMappedFile::Region::kWholeFile);
+  map.Initialize(std::move(file), MemoryMappedFile::Region::kWholeFile);
   ASSERT_EQ(kFileSize, map.length());
   ASSERT_TRUE(map.data() != NULL);
   EXPECT_TRUE(map.IsValid());
@@ -108,7 +110,7 @@
 
   File file(temp_file_path(), File::FLAG_OPEN | File::FLAG_READ);
   MemoryMappedFile::Region region = {0, kPartialSize};
-  map.Initialize(file.Pass(), region);
+  map.Initialize(std::move(file), region);
   ASSERT_EQ(kPartialSize, map.length());
   ASSERT_TRUE(map.data() != NULL);
   EXPECT_TRUE(map.IsValid());
@@ -124,7 +126,7 @@
 
   File file(temp_file_path(), File::FLAG_OPEN | File::FLAG_READ);
   MemoryMappedFile::Region region = {kOffset, kPartialSize};
-  map.Initialize(file.Pass(), region);
+  map.Initialize(std::move(file), region);
   ASSERT_EQ(kPartialSize, map.length());
   ASSERT_TRUE(map.data() != NULL);
   EXPECT_TRUE(map.IsValid());
@@ -141,7 +143,7 @@
 
   File file(temp_file_path(), File::FLAG_OPEN | File::FLAG_READ);
   MemoryMappedFile::Region region = {kOffset, kPartialSize};
-  map.Initialize(file.Pass(), region);
+  map.Initialize(std::move(file), region);
   ASSERT_EQ(kPartialSize, map.length());
   ASSERT_TRUE(map.data() != NULL);
   EXPECT_TRUE(map.IsValid());
@@ -158,7 +160,7 @@
 
   File file(temp_file_path(), File::FLAG_OPEN | File::FLAG_READ);
   MemoryMappedFile::Region region = {kOffset, kPartialSize};
-  map.Initialize(file.Pass(), region);
+  map.Initialize(std::move(file), region);
   ASSERT_EQ(kPartialSize, map.length());
   ASSERT_TRUE(map.data() != NULL);
   EXPECT_TRUE(map.IsValid());

diff --git a/base/memory/scoped_vector_unittest.cc b/base/memory/scoped_vector_unittest.cc
index 4dee9c9..0f1ad5c 100644
--- a/base/memory/scoped_vector_unittest.cc
+++ b/base/memory/scoped_vector_unittest.cc

@@ -4,6 +4,8 @@
 
 #include "base/memory/scoped_vector.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/memory/scoped_ptr.h"
@@ -225,7 +227,7 @@
     EXPECT_FALSE(scoped_vector.empty());
     EXPECT_TRUE(watcher.IsWatching(scoped_vector.back()));
 
-    ScopedVector<LifeCycleObject> scoped_vector_copy(scoped_vector.Pass());
+    ScopedVector<LifeCycleObject> scoped_vector_copy(std::move(scoped_vector));
     EXPECT_TRUE(scoped_vector.empty());
     EXPECT_FALSE(scoped_vector_copy.empty());
     EXPECT_TRUE(watcher.IsWatching(scoped_vector_copy.back()));
@@ -245,7 +247,7 @@
     EXPECT_FALSE(scoped_vector.empty());
     EXPECT_TRUE(watcher.IsWatching(scoped_vector.back()));
 
-    scoped_vector_assign = scoped_vector.Pass();
+    scoped_vector_assign = std::move(scoped_vector);
     EXPECT_TRUE(scoped_vector.empty());
     EXPECT_FALSE(scoped_vector_assign.empty());
     EXPECT_TRUE(watcher.IsWatching(scoped_vector_assign.back()));
@@ -275,7 +277,7 @@
 
 template <typename T>
 ScopedVector<T> PassThru(ScopedVector<T> scoper) {
-  return scoper.Pass();
+  return scoper;
 }
 
 TEST(ScopedVectorTest, Passed) {
@@ -326,7 +328,7 @@
   EXPECT_EQ(0, delete_counter);
   {
     ScopedVector<DeleteCounter> v;
-    v.push_back(elem.Pass());
+    v.push_back(std::move(elem));
     EXPECT_EQ(0, delete_counter);
   }
   EXPECT_EQ(1, delete_counter);

diff --git a/base/process/process_unittest.cc b/base/process/process_unittest.cc
index 6ff5e7f..b34ee46 100644
--- a/base/process/process_unittest.cc
+++ b/base/process/process_unittest.cc

@@ -4,6 +4,8 @@
 
 #include "base/process/process.h"
 
+#include <utility>
+
 #include "base/process/kill.h"
 #include "base/test/multiprocess_test.h"
 #include "base/test/test_timeouts.h"
@@ -49,13 +51,13 @@
   Process process2;
   EXPECT_FALSE(process2.IsValid());
 
-  process2 = process1.Pass();
+  process2 = std::move(process1);
   EXPECT_TRUE(process2.IsValid());
   EXPECT_FALSE(process1.IsValid());
   EXPECT_FALSE(process2.is_current());
 
   Process process3 = Process::Current();
-  process2 = process3.Pass();
+  process2 = std::move(process3);
   EXPECT_TRUE(process2.is_current());
   EXPECT_TRUE(process2.IsValid());
   EXPECT_FALSE(process3.IsValid());

diff --git a/build/toolchain/get_concurrent_links.py b/build/toolchain/get_concurrent_links.py
index e72c12ec4..f476f7e 100644
--- a/build/toolchain/get_concurrent_links.py
+++ b/build/toolchain/get_concurrent_links.py

@@ -55,7 +55,7 @@
           if is_lto:
             mem_total_gb -= 20 # Reserve
             # For LTO builds the RAM requirements are even higher
-            mem_per_link_gb = 20
+            mem_per_link_gb = 32
           return int(max(1, mem_total_gb / mem_per_link_gb))
     return 1
   elif sys.platform == 'darwin':

diff --git a/cc/cc.gyp b/cc/cc.gyp
index 9374fcf..24be896 100644
--- a/cc/cc.gyp
+++ b/cc/cc.gyp

@@ -435,7 +435,6 @@
         'raster/single_thread_task_graph_runner.h',
         'raster/synchronous_task_graph_runner.cc',
         'raster/synchronous_task_graph_runner.h',
-        'raster/task_category.h',
         'raster/task_graph_runner.cc',
         'raster/task_graph_runner.h',
         'raster/task_graph_work_queue.cc',

diff --git a/cc/layers/picture_layer_impl.cc b/cc/layers/picture_layer_impl.cc
index f547648..d2bdac1 100644
--- a/cc/layers/picture_layer_impl.cc
+++ b/cc/layers/picture_layer_impl.cc

@@ -407,6 +407,7 @@
 bool PictureLayerImpl::UpdateTiles(bool resourceless_software_draw) {
   if (!resourceless_software_draw) {
     visible_rect_for_tile_priority_ = visible_layer_rect();
+    screen_space_transform_for_tile_priority_ = ScreenSpaceTransform();
   }
 
   if (!CanHaveTilings()) {
@@ -495,7 +496,7 @@
   if (visible_rect_in_content_space.IsEmpty() ||
       layer_tree_impl()->DeviceViewport() != viewport_rect_for_tile_priority) {
     gfx::Transform view_to_layer(gfx::Transform::kSkipInitialization);
-    if (ScreenSpaceTransform().GetInverse(&view_to_layer)) {
+    if (screen_space_transform_for_tile_priority_.GetInverse(&view_to_layer)) {
       // Transform from view space to content space.
       visible_rect_in_content_space = MathUtil::ProjectEnclosingClippedRect(
           view_to_layer, viewport_rect_for_tile_priority);

diff --git a/cc/layers/picture_layer_impl.h b/cc/layers/picture_layer_impl.h
index 12bf80e..dbe4c083 100644
--- a/cc/layers/picture_layer_impl.h
+++ b/cc/layers/picture_layer_impl.h

@@ -161,6 +161,7 @@
   // frame that has a valid viewport for prioritizing tiles.
   gfx::Rect visible_rect_for_tile_priority_;
   gfx::Rect viewport_rect_for_tile_priority_in_content_space_;
+  gfx::Transform screen_space_transform_for_tile_priority_;
 
   gfx::Size gpu_raster_max_texture_size_;
 

diff --git a/cc/layers/picture_layer_impl_unittest.cc b/cc/layers/picture_layer_impl_unittest.cc
index a437074..6d4338e 100644
--- a/cc/layers/picture_layer_impl_unittest.cc
+++ b/cc/layers/picture_layer_impl_unittest.cc

@@ -573,15 +573,13 @@
   // software draw.
   bool resourceless_software_draw = false;
   gfx::Rect viewport = gfx::Rect(layer_bounds);
-  gfx::Transform transform;
-  host_impl_.SetExternalDrawConstraints(transform,
-                                        viewport,
-                                        viewport,
-                                        viewport,
-                                        transform,
+  gfx::Transform draw_transform;
+  gfx::Transform tile_priority_transform;
+  host_impl_.SetExternalDrawConstraints(draw_transform, viewport, viewport,
+                                        viewport, tile_priority_transform,
                                         resourceless_software_draw);
   active_layer_->draw_properties().visible_layer_rect = viewport;
-  active_layer_->draw_properties().screen_space_transform = transform;
+  active_layer_->draw_properties().screen_space_transform = draw_transform;
   active_layer_->UpdateTiles(resourceless_software_draw);
 
   gfx::Rect visible_rect_for_tile_priority =
@@ -595,38 +593,57 @@
   host_impl_.AdvanceToNextFrame(base::TimeDelta::FromMilliseconds(200));
   resourceless_software_draw = true;
   viewport = gfx::ScaleToEnclosingRect(viewport, 2);
-  transform.Translate(1.f, 1.f);
+  tile_priority_transform.Translate(1.f, 0.f);
+  draw_transform.Translate(0.f, 1.f);
   active_layer_->draw_properties().visible_layer_rect = viewport;
-  active_layer_->draw_properties().screen_space_transform = transform;
-  host_impl_.SetExternalDrawConstraints(transform,
-                                        viewport,
-                                        viewport,
-                                        viewport,
-                                        transform,
+  active_layer_->draw_properties().screen_space_transform = draw_transform;
+  host_impl_.SetExternalDrawConstraints(draw_transform, viewport, viewport,
+                                        viewport, tile_priority_transform,
                                         resourceless_software_draw);
   active_layer_->UpdateTiles(resourceless_software_draw);
 
-  // Transform for tile priority is updated.
+  // Transform for tile priority is not updated.
   EXPECT_TRANSFORMATION_MATRIX_EQ(
-      transform, active_layer_->draw_properties().screen_space_transform);
+      screen_space_transform_for_tile_priority,
+      active_layer_->screen_space_transform_for_tile_priority());
   // Visible rect for tile priority retains old value.
   EXPECT_EQ(visible_rect_for_tile_priority,
             active_layer_->visible_rect_for_tile_priority());
+  ASSERT_GT(active_layer_->picture_layer_tiling_set()->num_tilings(), 0u);
+  EXPECT_EQ(active_layer_->viewport_rect_for_tile_priority_in_content_space(),
+            active_layer_->picture_layer_tiling_set()
+                ->tiling_at(0)
+                ->GetCurrentVisibleRectForTesting());
 
   // Keep expanded viewport but mark it valid. Should update tile viewport.
   host_impl_.AdvanceToNextFrame(base::TimeDelta::FromMilliseconds(200));
   resourceless_software_draw = false;
-  host_impl_.SetExternalDrawConstraints(transform,
-                                        viewport,
-                                        viewport,
-                                        viewport,
-                                        transform,
+  host_impl_.SetExternalDrawConstraints(draw_transform, viewport, viewport,
+                                        viewport, tile_priority_transform,
                                         resourceless_software_draw);
   active_layer_->UpdateTiles(resourceless_software_draw);
 
   EXPECT_TRANSFORMATION_MATRIX_EQ(
-      transform, active_layer_->draw_properties().screen_space_transform);
+      draw_transform,
+      active_layer_->screen_space_transform_for_tile_priority());
   EXPECT_EQ(viewport, active_layer_->visible_rect_for_tile_priority());
+
+  gfx::RectF visible_rect_in_content_space(viewport);
+  gfx::Transform inverse_draw_transform;
+  gfx::Transform inverse_tile_priority_transform;
+  EXPECT_TRUE(draw_transform.GetInverse(&inverse_draw_transform));
+  EXPECT_TRUE(
+      tile_priority_transform.GetInverse(&inverse_tile_priority_transform));
+  visible_rect_in_content_space = MathUtil::ProjectClippedRect(
+      inverse_tile_priority_transform, visible_rect_in_content_space);
+  visible_rect_in_content_space = MathUtil::ProjectClippedRect(
+      inverse_draw_transform, visible_rect_in_content_space);
+
+  ASSERT_GT(active_layer_->picture_layer_tiling_set()->num_tilings(), 0u);
+  EXPECT_EQ(gfx::ToEnclosingRect(visible_rect_in_content_space),
+            active_layer_->picture_layer_tiling_set()
+                ->tiling_at(0)
+                ->GetCurrentVisibleRectForTesting());
 }
 
 TEST_F(PictureLayerImplTest, ViewportRectForTilePriorityIsCached) {

diff --git a/cc/raster/single_thread_task_graph_runner.cc b/cc/raster/single_thread_task_graph_runner.cc
index 80c85db..24994c9 100644
--- a/cc/raster/single_thread_task_graph_runner.cc
+++ b/cc/raster/single_thread_task_graph_runner.cc

@@ -112,7 +112,7 @@
   base::AutoLock lock(lock_);
 
   while (true) {
-    if (!RunTaskWithLockAcquired()) {
+    if (!work_queue_.HasReadyToRunTasks()) {
       // Exit when shutdown is set and no more tasks are pending.
       if (shutdown_)
         break;
@@ -121,29 +121,18 @@
       has_ready_to_run_tasks_cv_.Wait();
       continue;
     }
+
+    RunTaskWithLockAcquired();
   }
 }
 
-bool SingleThreadTaskGraphRunner::RunTaskWithLockAcquired() {
+void SingleThreadTaskGraphRunner::RunTaskWithLockAcquired() {
   TRACE_EVENT0("toplevel",
                "SingleThreadTaskGraphRunner::RunTaskWithLockAcquired");
 
   lock_.AssertAcquired();
 
-  // Find the first category with any tasks to run. This task graph runner
-  // treats categories as an additional priority.
-  const auto& ready_to_run_namespaces = work_queue_.ready_to_run_namespaces();
-  auto found = std::find_if(
-      ready_to_run_namespaces.cbegin(), ready_to_run_namespaces.cend(),
-      [](const std::pair<uint16_t, TaskGraphWorkQueue::TaskNamespace::Vector>&
-             pair) { return !pair.second.empty(); });
-
-  if (found == ready_to_run_namespaces.cend()) {
-    return false;
-  }
-
-  const uint16_t category = found->first;
-  auto prioritized_task = work_queue_.GetNextTaskToRun(category);
+  auto prioritized_task = work_queue_.GetNextTaskToRun();
   Task* task = prioritized_task.task;
 
   // Call WillRun() before releasing |lock_| and running task.
@@ -163,8 +152,6 @@
   if (work_queue_.HasFinishedRunningTasksInNamespace(
           prioritized_task.task_namespace))
     has_namespaces_with_finished_running_tasks_cv_.Signal();
-
-  return true;
 }
 
 }  // namespace cc

diff --git a/cc/raster/single_thread_task_graph_runner.h b/cc/raster/single_thread_task_graph_runner.h
index 3e8dec0..120cd7b 100644
--- a/cc/raster/single_thread_task_graph_runner.h
+++ b/cc/raster/single_thread_task_graph_runner.h

@@ -40,8 +40,7 @@
   void Shutdown();
 
  private:
-  // Returns true if there was a task to run.
-  bool RunTaskWithLockAcquired();
+  void RunTaskWithLockAcquired();
 
   scoped_ptr<base::SimpleThread> thread_;
 

diff --git a/cc/raster/synchronous_task_graph_runner.cc b/cc/raster/synchronous_task_graph_runner.cc
index ea7b15b..ed05cfb 100644
--- a/cc/raster/synchronous_task_graph_runner.cc
+++ b/cc/raster/synchronous_task_graph_runner.cc

@@ -4,9 +4,6 @@
 
 #include "cc/raster/synchronous_task_graph_runner.h"
 
-#include <algorithm>
-#include <utility>
-
 #include "base/threading/simple_thread.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/trace_event/trace_event.h"
@@ -46,7 +43,7 @@
 
   while (
       !TaskGraphWorkQueue::HasFinishedRunningTasksInNamespace(task_namespace)) {
-    DCHECK(RunTask());
+    RunTask();
   }
 }
 
@@ -60,27 +57,14 @@
 }
 
 void SynchronousTaskGraphRunner::RunUntilIdle() {
-  while (RunTask()) {
-  }
+  while (work_queue_.HasReadyToRunTasks())
+    RunTask();
 }
 
-bool SynchronousTaskGraphRunner::RunTask() {
+void SynchronousTaskGraphRunner::RunTask() {
   TRACE_EVENT0("toplevel", "SynchronousTaskGraphRunner::RunTask");
 
-  // Find the first category with any tasks to run. This task graph runner
-  // treats categories as an additional priority.
-  const auto& ready_to_run_namespaces = work_queue_.ready_to_run_namespaces();
-  auto found = std::find_if(
-      ready_to_run_namespaces.cbegin(), ready_to_run_namespaces.cend(),
-      [](const std::pair<uint16_t, TaskGraphWorkQueue::TaskNamespace::Vector>&
-             pair) { return !pair.second.empty(); });
-
-  if (found == ready_to_run_namespaces.cend()) {
-    return false;
-  }
-
-  const uint16_t category = found->first;
-  auto prioritized_task = work_queue_.GetNextTaskToRun(category);
+  auto prioritized_task = work_queue_.GetNextTaskToRun();
 
   Task* task = prioritized_task.task;
   task->WillRun();
@@ -88,8 +72,6 @@
   task->DidRun();
 
   work_queue_.CompleteTask(prioritized_task);
-
-  return true;
 }
 
 }  // namespace cc

diff --git a/cc/raster/synchronous_task_graph_runner.h b/cc/raster/synchronous_task_graph_runner.h
index 65a7716..89ecca2 100644
--- a/cc/raster/synchronous_task_graph_runner.h
+++ b/cc/raster/synchronous_task_graph_runner.h

@@ -28,8 +28,7 @@
   void RunUntilIdle();
 
  private:
-  // Returns true if there was a task to run.
-  bool RunTask();
+  void RunTask();
 
   // Stores the actual tasks to be run, sorted by priority.
   TaskGraphWorkQueue work_queue_;

diff --git a/cc/raster/task_graph_runner.h b/cc/raster/task_graph_runner.h
index 181a455..b5ffade 100644
--- a/cc/raster/task_graph_runner.h
+++ b/cc/raster/task_graph_runner.h

@@ -46,29 +46,19 @@
 
 // A task dependency graph describes the order in which to execute a set
 // of tasks. Dependencies are represented as edges. Each node is assigned
-// a category, a priority and a run count that matches the number of
-// dependencies. Priority range from 0 (most favorable scheduling) to UINT16_MAX
-// (least favorable). Categories range from 0 to UINT16_MAX. It is up to the
-// implementation and its consumer to determine the meaning (if any) of a
-// category. A TaskGraphRunner implementation may chose to prioritize certain
-// categories over others, regardless of the individual priorities of tasks.
+// a priority and a run count that matches the number of dependencies.
+// Priority range from 0 (most favorable scheduling) to UINT_MAX
+// (least favorable).
 struct CC_EXPORT TaskGraph {
   struct Node {
     typedef std::vector<Node> Vector;
 
-    Node(Task* task,
-         uint16_t category,
-         uint16_t priority,
-         uint32_t dependencies)
-        : task(task),
-          category(category),
-          priority(priority),
-          dependencies(dependencies) {}
+    Node(Task* task, size_t priority, size_t dependencies)
+        : task(task), priority(priority), dependencies(dependencies) {}
 
     Task* task;
-    uint16_t category;
-    uint16_t priority;
-    uint32_t dependencies;
+    size_t priority;
+    size_t dependencies;
   };
 
   struct Edge {

diff --git a/cc/raster/task_graph_runner_perftest.cc b/cc/raster/task_graph_runner_perftest.cc
index 0df0757..f571d33d 100644
--- a/cc/raster/task_graph_runner_perftest.cc
+++ b/cc/raster/task_graph_runner_perftest.cc

@@ -230,13 +230,13 @@
     for (PerfTaskImpl::Vector::const_iterator it = leaf_tasks.begin();
          it != leaf_tasks.end();
          ++it) {
-      graph->nodes.push_back(TaskGraph::Node(it->get(), 0u, 0u, 0u));
+      graph->nodes.push_back(TaskGraph::Node(it->get(), 0u, 0u));
     }
 
     for (PerfTaskImpl::Vector::const_iterator it = tasks.begin();
-         it != tasks.end(); ++it) {
-      graph->nodes.push_back(
-          TaskGraph::Node(it->get(), 0u, 0u, leaf_tasks.size()));
+         it != tasks.end();
+         ++it) {
+      graph->nodes.push_back(TaskGraph::Node(it->get(), 0u, leaf_tasks.size()));
 
       for (PerfTaskImpl::Vector::const_iterator leaf_it = leaf_tasks.begin();
            leaf_it != leaf_tasks.end();
@@ -255,7 +255,7 @@
     for (PerfTaskImpl::Vector::const_iterator it = top_level_tasks.begin();
          it != top_level_tasks.end();
          ++it) {
-      graph->nodes.push_back(TaskGraph::Node(it->get(), 0u, 0u, tasks.size()));
+      graph->nodes.push_back(TaskGraph::Node(it->get(), 0u, tasks.size()));
     }
   }
 

diff --git a/cc/raster/task_graph_work_queue.cc b/cc/raster/task_graph_work_queue.cc
index 95faedca..655a005 100644
--- a/cc/raster/task_graph_work_queue.cc
+++ b/cc/raster/task_graph_work_queue.cc

@@ -5,41 +5,11 @@
 #include "cc/raster/task_graph_work_queue.h"
 
 #include <algorithm>
-#include <map>
 #include <utility>
 
 #include "base/trace_event/trace_event.h"
 
 namespace cc {
-namespace {
-
-bool CompareTaskPriority(const TaskGraphWorkQueue::PrioritizedTask& a,
-                         const TaskGraphWorkQueue::PrioritizedTask& b) {
-  // In this system, numerically lower priority is run first.
-  return a.priority > b.priority;
-}
-
-class CompareTaskNamespacePriority {
- public:
-  explicit CompareTaskNamespacePriority(uint16_t category)
-      : category_(category) {}
-
-  bool operator()(const TaskGraphWorkQueue::TaskNamespace* a,
-                  const TaskGraphWorkQueue::TaskNamespace* b) {
-    DCHECK(!a->ready_to_run_tasks.at(category_).empty());
-    DCHECK(!b->ready_to_run_tasks.at(category_).empty());
-
-    // Compare based on task priority of the ready_to_run_tasks heap .front()
-    // will hold the max element of the heap, except after pop_heap, when max
-    // element is moved to .back().
-    return CompareTaskPriority(a->ready_to_run_tasks.at(category_).front(),
-                               b->ready_to_run_tasks.at(category_).front());
-  }
-
- private:
-  uint16_t category_;
-};
-}  // namespace
 
 TaskGraphWorkQueue::TaskNamespace::TaskNamespace() {}
 
@@ -67,9 +37,7 @@
   }
 
   // Build new "ready to run" queue and remove nodes from old graph.
-  for (auto& ready_to_run_tasks_it : task_namespace.ready_to_run_tasks) {
-    ready_to_run_tasks_it.second.clear();
-  }
+  task_namespace.ready_to_run_tasks.clear();
   for (const TaskGraph::Node& node : graph->nodes) {
     // Remove any old nodes that are associated with this task. The result is
     // that the old graph is left with all nodes not present in this graph,
@@ -98,17 +66,14 @@
                   node.task) != task_namespace.running_tasks.end())
       continue;
 
-    task_namespace.ready_to_run_tasks[node.category].push_back(PrioritizedTask(
-        node.task, &task_namespace, node.category, node.priority));
+    task_namespace.ready_to_run_tasks.push_back(
+        PrioritizedTask(node.task, &task_namespace, node.priority));
   }
 
-  // Rearrange the elements in each vector within |ready_to_run_tasks| in such a
-  // way that they form a heap.
-  for (auto& it : task_namespace.ready_to_run_tasks) {
-    auto& ready_to_run_tasks = it.second;
-    std::make_heap(ready_to_run_tasks.begin(), ready_to_run_tasks.end(),
-                   CompareTaskPriority);
-  }
+  // Rearrange the elements in |ready_to_run_tasks| in such a way that they
+  // form a heap.
+  std::make_heap(task_namespace.ready_to_run_tasks.begin(),
+                 task_namespace.ready_to_run_tasks.end(), CompareTaskPriority);
 
   // Swap task graph.
   task_namespace.graph.Swap(graph);
@@ -135,59 +100,41 @@
   }
 
   // Build new "ready to run" task namespaces queue.
-  for (auto& ready_to_run_namespaces_it : ready_to_run_namespaces_) {
-    ready_to_run_namespaces_it.second.clear();
-  }
-  for (auto& namespace_it : namespaces_) {
-    auto& task_namespace = namespace_it.second;
-    for (auto& ready_to_run_tasks_it : task_namespace.ready_to_run_tasks) {
-      auto& ready_to_run_tasks = ready_to_run_tasks_it.second;
-      uint16_t category = ready_to_run_tasks_it.first;
-      if (!ready_to_run_tasks.empty()) {
-        ready_to_run_namespaces_[category].push_back(&task_namespace);
-      }
-    }
+  ready_to_run_namespaces_.clear();
+  for (auto& it : namespaces_) {
+    if (!it.second.ready_to_run_tasks.empty())
+      ready_to_run_namespaces_.push_back(&it.second);
   }
 
   // Rearrange the task namespaces in |ready_to_run_namespaces| in such a
   // way that they form a heap.
-  for (auto& it : ready_to_run_namespaces_) {
-    uint16_t category = it.first;
-    auto& task_namespace = it.second;
-    std::make_heap(task_namespace.begin(), task_namespace.end(),
-                   CompareTaskNamespacePriority(category));
-  }
+  std::make_heap(ready_to_run_namespaces_.begin(),
+                 ready_to_run_namespaces_.end(), CompareTaskNamespacePriority);
 }
 
-TaskGraphWorkQueue::PrioritizedTask TaskGraphWorkQueue::GetNextTaskToRun(
-    uint16_t category) {
-  TaskNamespace::Vector& ready_to_run_namespaces =
-      ready_to_run_namespaces_[category];
-  DCHECK(!ready_to_run_namespaces.empty());
+TaskGraphWorkQueue::PrioritizedTask TaskGraphWorkQueue::GetNextTaskToRun() {
+  DCHECK(!ready_to_run_namespaces_.empty());
 
-  // Take top priority TaskNamespace from |ready_to_run_namespaces|.
-  std::pop_heap(ready_to_run_namespaces.begin(), ready_to_run_namespaces.end(),
-                CompareTaskNamespacePriority(category));
-  TaskNamespace* task_namespace = ready_to_run_namespaces.back();
-  ready_to_run_namespaces.pop_back();
-
-  PrioritizedTask::Vector& ready_to_run_tasks =
-      task_namespace->ready_to_run_tasks[category];
-  DCHECK(!ready_to_run_tasks.empty());
+  // Take top priority TaskNamespace from |ready_to_run_namespaces_|.
+  std::pop_heap(ready_to_run_namespaces_.begin(),
+                ready_to_run_namespaces_.end(), CompareTaskNamespacePriority);
+  TaskNamespace* task_namespace = ready_to_run_namespaces_.back();
+  ready_to_run_namespaces_.pop_back();
+  DCHECK(!task_namespace->ready_to_run_tasks.empty());
 
   // Take top priority task from |ready_to_run_tasks|.
-  std::pop_heap(ready_to_run_tasks.begin(), ready_to_run_tasks.end(),
-                CompareTaskPriority);
-  PrioritizedTask task = ready_to_run_tasks.back();
-  ready_to_run_tasks.pop_back();
+  std::pop_heap(task_namespace->ready_to_run_tasks.begin(),
+                task_namespace->ready_to_run_tasks.end(), CompareTaskPriority);
+  PrioritizedTask task = task_namespace->ready_to_run_tasks.back();
+  task_namespace->ready_to_run_tasks.pop_back();
 
-  // Add task namespace back to |ready_to_run_namespaces| if not empty after
+  // Add task namespace back to |ready_to_run_namespaces_| if not empty after
   // taking top priority task.
-  if (!ready_to_run_tasks.empty()) {
-    ready_to_run_namespaces.push_back(task_namespace);
-    std::push_heap(ready_to_run_namespaces.begin(),
-                   ready_to_run_namespaces.end(),
-                   CompareTaskNamespacePriority(category));
+  if (!task_namespace->ready_to_run_tasks.empty()) {
+    ready_to_run_namespaces_.push_back(task_namespace);
+    std::push_heap(ready_to_run_namespaces_.begin(),
+                   ready_to_run_namespaces_.end(),
+                   CompareTaskNamespacePriority);
   }
 
   // Add task to |running_tasks|.
@@ -217,26 +164,19 @@
     dependent_node.dependencies--;
     // Task is ready if it has no dependencies. Add it to |ready_to_run_tasks_|.
     if (!dependent_node.dependencies) {
-      PrioritizedTask::Vector& ready_to_run_tasks =
-          task_namespace->ready_to_run_tasks[dependent_node.category];
-
-      bool was_empty = ready_to_run_tasks.empty();
-      ready_to_run_tasks.push_back(
-          PrioritizedTask(dependent_node.task, task_namespace,
-                          dependent_node.category, dependent_node.priority));
-      std::push_heap(ready_to_run_tasks.begin(), ready_to_run_tasks.end(),
+      bool was_empty = task_namespace->ready_to_run_tasks.empty();
+      task_namespace->ready_to_run_tasks.push_back(PrioritizedTask(
+          dependent_node.task, task_namespace, dependent_node.priority));
+      std::push_heap(task_namespace->ready_to_run_tasks.begin(),
+                     task_namespace->ready_to_run_tasks.end(),
                      CompareTaskPriority);
-
       // Task namespace is ready if it has at least one ready to run task. Add
       // it to |ready_to_run_namespaces_| if it just become ready.
       if (was_empty) {
-        TaskNamespace::Vector& ready_to_run_namespaces =
-            ready_to_run_namespaces_[dependent_node.category];
-
-        DCHECK(std::find(ready_to_run_namespaces.begin(),
-                         ready_to_run_namespaces.end(),
-                         task_namespace) == ready_to_run_namespaces.end());
-        ready_to_run_namespaces.push_back(task_namespace);
+        DCHECK(std::find(ready_to_run_namespaces_.begin(),
+                         ready_to_run_namespaces_.end(),
+                         task_namespace) == ready_to_run_namespaces_.end());
+        ready_to_run_namespaces_.push_back(task_namespace);
       }
       ready_to_run_namespaces_has_heap_properties = false;
     }
@@ -245,13 +185,9 @@
   // Rearrange the task namespaces in |ready_to_run_namespaces_| in such a way
   // that they yet again form a heap.
   if (!ready_to_run_namespaces_has_heap_properties) {
-    for (auto& it : ready_to_run_namespaces_) {
-      uint16_t category = it.first;
-      auto& ready_to_run_namespaces = it.second;
-      std::make_heap(ready_to_run_namespaces.begin(),
-                     ready_to_run_namespaces.end(),
-                     CompareTaskNamespacePriority(category));
-    }
+    std::make_heap(ready_to_run_namespaces_.begin(),
+                   ready_to_run_namespaces_.end(),
+                   CompareTaskNamespacePriority);
   }
 
   // Finally add task to |completed_tasks_|.
@@ -273,7 +209,7 @@
 
   // Remove namespace if finished running tasks.
   DCHECK_EQ(0u, task_namespace.completed_tasks.size());
-  DCHECK(!HasReadyToRunTasksInNamespace(&task_namespace));
+  DCHECK_EQ(0u, task_namespace.ready_to_run_tasks.size());
   DCHECK_EQ(0u, task_namespace.running_tasks.size());
   namespaces_.erase(it);
 }

diff --git a/cc/raster/task_graph_work_queue.h b/cc/raster/task_graph_work_queue.h
index 7b6840c..8a46123 100644
--- a/cc/raster/task_graph_work_queue.h
+++ b/cc/raster/task_graph_work_queue.h

@@ -5,7 +5,6 @@
 #ifndef CC_RASTER_TASK_GRAPH_WORK_QUEUE_H_
 #define CC_RASTER_TASK_GRAPH_WORK_QUEUE_H_
 
-#include <algorithm>
 #include <map>
 #include <vector>
 
@@ -17,11 +16,6 @@
 // Implements a queue of incoming TaskGraph work. Designed for use by
 // implementations of TaskGraphRunner. Not thread safe, so the caller is
 // responsible for all necessary locking.
-//
-// Tasks in the queue are divided into categories. Tasks from a single graph may
-// be put into different categories, each of which is prioritized independently
-// from the others. It is up to the implementation of TaskGraphRunner to
-// define the meaning of the categories and handle them appropriately.
 class CC_EXPORT TaskGraphWorkQueue {
  public:
   struct TaskNamespace;
@@ -29,19 +23,12 @@
   struct PrioritizedTask {
     typedef std::vector<PrioritizedTask> Vector;
 
-    PrioritizedTask(Task* task,
-                    TaskNamespace* task_namespace,
-                    uint16_t category,
-                    uint16_t priority)
-        : task(task),
-          task_namespace(task_namespace),
-          category(category),
-          priority(priority) {}
+    PrioritizedTask(Task* task, TaskNamespace* task_namespace, size_t priority)
+        : task(task), task_namespace(task_namespace), priority(priority) {}
 
     Task* task;
     TaskNamespace* task_namespace;
-    uint16_t category;
-    uint16_t priority;
+    size_t priority;
   };
 
   // Helper classes and static methods used by dependent classes.
@@ -54,9 +41,8 @@
     // Current task graph.
     TaskGraph graph;
 
-    // Map from category to a vector of tasks that are ready to run for that
-    // category.
-    std::map<uint16_t, PrioritizedTask::Vector> ready_to_run_tasks;
+    // Ordered set of tasks that are ready to run.
+    PrioritizedTask::Vector ready_to_run_tasks;
 
     // Completed tasks not yet collected by origin thread.
     Task::Vector completed_tasks;
@@ -76,8 +62,8 @@
   // previous tasks in the graph being replaced.
   void ScheduleTasks(NamespaceToken token, TaskGraph* graph);
 
-  // Returns the next task to run for the given category.
-  PrioritizedTask GetNextTaskToRun(uint16_t category);
+  // Returns the next task to run paired with its namespace.
+  PrioritizedTask GetNextTaskToRun();
 
   // Marks a task as completed, adding it to its namespace's list of completed
   // tasks and updating the list of |ready_to_run_namespaces|.
@@ -98,35 +84,13 @@
     return &it->second;
   }
 
-  static bool HasReadyToRunTasksInNamespace(
-      const TaskNamespace* task_namespace) {
-    return std::find_if(task_namespace->ready_to_run_tasks.begin(),
-                        task_namespace->ready_to_run_tasks.end(),
-                        [](const std::pair<uint16_t, PrioritizedTask::Vector>&
-                               ready_to_run_tasks) {
-                          return !ready_to_run_tasks.second.empty();
-                        }) != task_namespace->ready_to_run_tasks.end();
-  }
-
   static bool HasFinishedRunningTasksInNamespace(
       const TaskNamespace* task_namespace) {
     return task_namespace->running_tasks.empty() &&
-           !HasReadyToRunTasksInNamespace(task_namespace);
+           task_namespace->ready_to_run_tasks.empty();
   }
 
-  bool HasReadyToRunTasks() const {
-    return std::find_if(ready_to_run_namespaces_.begin(),
-                        ready_to_run_namespaces_.end(),
-                        [](const std::pair<uint16_t, TaskNamespace::Vector>&
-                               ready_to_run_namespaces) {
-                          return !ready_to_run_namespaces.second.empty();
-                        }) != ready_to_run_namespaces_.end();
-  }
-
-  bool HasReadyToRunTasksForCategory(uint16_t category) const {
-    auto found = ready_to_run_namespaces_.find(category);
-    return found != ready_to_run_namespaces_.end() && !found->second.empty();
-  }
+  bool HasReadyToRunTasks() const { return !ready_to_run_namespaces_.empty(); }
 
   bool HasAnyNamespaces() const { return !namespaces_.empty(); }
 
@@ -138,11 +102,6 @@
                }) == namespaces_.end();
   }
 
-  const std::map<uint16_t, TaskNamespace::Vector>& ready_to_run_namespaces()
-      const {
-    return ready_to_run_namespaces_;
-  }
-
   // Helper function which ensures that graph dependencies were correctly
   // configured.
   static bool DependencyMismatch(const TaskGraph* graph);
@@ -157,13 +116,29 @@
     }
   };
 
+  static bool CompareTaskPriority(const PrioritizedTask& a,
+                                  const PrioritizedTask& b) {
+    // In this system, numerically lower priority is run first.
+    return a.priority > b.priority;
+  }
+
+  static bool CompareTaskNamespacePriority(const TaskNamespace* a,
+                                           const TaskNamespace* b) {
+    DCHECK(!a->ready_to_run_tasks.empty());
+    DCHECK(!b->ready_to_run_tasks.empty());
+
+    // Compare based on task priority of the ready_to_run_tasks heap .front()
+    // will hold the max element of the heap, except after pop_heap, when max
+    // element is moved to .back().
+    return CompareTaskPriority(a->ready_to_run_tasks.front(),
+                               b->ready_to_run_tasks.front());
+  }
+
   using TaskNamespaceMap =
       std::map<NamespaceToken, TaskNamespace, CompareToken>;
 
   TaskNamespaceMap namespaces_;
-
-  // Map from category to a vector of ready to run namespaces for that category.
-  std::map<uint16_t, TaskNamespace::Vector> ready_to_run_namespaces_;
+  TaskNamespace::Vector ready_to_run_namespaces_;
 
   // Provides a unique id to each NamespaceToken.
   int next_namespace_id_;

diff --git a/cc/raster/tile_task_worker_pool_perftest.cc b/cc/raster/tile_task_worker_pool_perftest.cc
index 70354413..1e1ff1c 100644
--- a/cc/raster/tile_task_worker_pool_perftest.cc
+++ b/cc/raster/tile_task_worker_pool_perftest.cc

@@ -223,14 +223,13 @@
 
       for (auto& decode_task : raster_task->dependencies()) {
         graph->nodes.push_back(
-            TaskGraph::Node(decode_task.get(), 0u /* group */, priority, 0u));
+            TaskGraph::Node(decode_task.get(), priority, 0u));
         graph->edges.push_back(
             TaskGraph::Edge(raster_task.get(), decode_task.get()));
       }
 
-      graph->nodes.push_back(
-          TaskGraph::Node(raster_task.get(), 0u /* group */, priority,
-                          raster_task->dependencies().size()));
+      graph->nodes.push_back(TaskGraph::Node(
+          raster_task.get(), priority, raster_task->dependencies().size()));
     }
   }
 

diff --git a/cc/raster/tile_task_worker_pool_unittest.cc b/cc/raster/tile_task_worker_pool_unittest.cc
index 941cd473..c5d3a416 100644
--- a/cc/raster/tile_task_worker_pool_unittest.cc
+++ b/cc/raster/tile_task_worker_pool_unittest.cc

@@ -195,8 +195,7 @@
 
     for (RasterTaskVector::const_iterator it = tasks_.begin();
          it != tasks_.end(); ++it) {
-      graph_.nodes.emplace_back(it->get(), 0 /* group */, priority++,
-                                0 /* dependencies */);
+      graph_.nodes.emplace_back(it->get(), priority++, 0 /* dependencies */);
     }
 
     tile_task_worker_pool_->AsTileTaskRunner()->ScheduleTasks(&graph_);

diff --git a/cc/test/fake_picture_layer_impl.h b/cc/test/fake_picture_layer_impl.h
index 291152f8..3d8431ea 100644
--- a/cc/test/fake_picture_layer_impl.h
+++ b/cc/test/fake_picture_layer_impl.h

@@ -117,6 +117,10 @@
     return visible_rect_for_tile_priority_;
   }
 
+  gfx::Transform screen_space_transform_for_tile_priority() {
+    return screen_space_transform_for_tile_priority_;
+  }
+
   gfx::Rect viewport_rect_for_tile_priority_in_content_space() {
     return viewport_rect_for_tile_priority_in_content_space_;
   }

diff --git a/cc/test/task_graph_runner_test_template.cc b/cc/test/task_graph_runner_test_template.cc
index 6797de2e..ba9d4ccf 100644
--- a/cc/test/task_graph_runner_test_template.cc
+++ b/cc/test/task_graph_runner_test_template.cc

@@ -65,13 +65,13 @@
     scoped_refptr<FakeTaskImpl> new_task(
         new FakeTaskImpl(this, it->namespace_index, it->id));
     new_graph.nodes.push_back(
-        TaskGraph::Node(new_task.get(), it->category, it->priority, 0u));
+        TaskGraph::Node(new_task.get(), it->priority, 0u));
     for (unsigned i = 0; i < it->dependent_count; ++i) {
       scoped_refptr<FakeDependentTaskImpl> new_dependent_task(
           new FakeDependentTaskImpl(this, it->namespace_index,
                                     it->dependent_id));
-      new_graph.nodes.push_back(TaskGraph::Node(
-          new_dependent_task.get(), it->category, it->priority, 1u));
+      new_graph.nodes.push_back(
+          TaskGraph::Node(new_dependent_task.get(), it->priority, 1u));
       new_graph.edges.push_back(
           TaskGraph::Edge(new_task.get(), new_dependent_task.get()));
 

diff --git a/cc/test/task_graph_runner_test_template.h b/cc/test/task_graph_runner_test_template.h
index d417543..d3989b9 100644
--- a/cc/test/task_graph_runner_test_template.h
+++ b/cc/test/task_graph_runner_test_template.h

@@ -24,20 +24,17 @@
              unsigned id,
              unsigned dependent_id,
              unsigned dependent_count,
-             unsigned category,
              unsigned priority)
         : namespace_index(namespace_index),
           id(id),
           dependent_id(dependent_id),
           dependent_count(dependent_count),
-          category(category),
           priority(priority) {}
 
     int namespace_index;
     unsigned id;
     unsigned dependent_id;
     unsigned dependent_count;
-    unsigned category;
     unsigned priority;
   };
 
@@ -129,8 +126,8 @@
     EXPECT_EQ(0u, this->run_task_ids(i).size());
     EXPECT_EQ(0u, this->on_task_completed_ids(i).size());
 
-    this->ScheduleTasks(
-        i, std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 0u, 0u, 0u)));
+    this->ScheduleTasks(i,
+                        std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 0u, 0u)));
   }
 
   for (int i = 0; i < kNamespaceCount; ++i) {
@@ -141,8 +138,8 @@
   }
 
   for (int i = 0; i < kNamespaceCount; ++i)
-    this->ScheduleTasks(
-        i, std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 1u, 0u, 0u)));
+    this->ScheduleTasks(i,
+                        std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 1u, 0u)));
 
   for (int i = 0; i < kNamespaceCount; ++i) {
     this->RunAllTasks(i);
@@ -152,8 +149,8 @@
   }
 
   for (int i = 0; i < kNamespaceCount; ++i)
-    this->ScheduleTasks(
-        i, std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 2u, 0u, 0u)));
+    this->ScheduleTasks(i,
+                        std::vector<TaskInfo>(1, TaskInfo(i, 0u, 0u, 2u, 0u)));
 
   for (int i = 0; i < kNamespaceCount; ++i) {
     this->RunAllTasks(i);
@@ -170,7 +167,7 @@
   for (int i = 0; i < kNamespaceCount; ++i) {
     this->ScheduleTasks(i, std::vector<TaskInfo>(1, TaskInfo(i, 0u, 1u,
                                                              1u,  // 1 dependent
-                                                             0u, 0u)));
+                                                             0u)));
   }
 
   for (int i = 0; i < kNamespaceCount; ++i) {
@@ -188,7 +185,7 @@
     this->ScheduleTasks(i,
                         std::vector<TaskInfo>(1, TaskInfo(i, 2u, 3u,
                                                           2u,  // 2 dependents
-                                                          0u, 0u)));
+                                                          0u)));
   }
 
   for (int i = 0; i < kNamespaceCount; ++i) {
@@ -204,60 +201,7 @@
   }
 }
 
-TYPED_TEST_P(TaskGraphRunnerTest, Categorys) {
-  const int kNamespaceCount = TaskGraphRunnerTestBase::kNamespaceCount;
-  const unsigned kCategoryCount = 3;
-  using TaskInfo = TaskGraphRunnerTestBase::TaskInfo;
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    EXPECT_EQ(0u, this->run_task_ids(i).size());
-    EXPECT_EQ(0u, this->on_task_completed_ids(i).size());
-    std::vector<TaskInfo> tasks;
-    for (unsigned j = 0; j < kCategoryCount; ++j) {
-      tasks.emplace_back(i, 0u, 0u, 0u, j, 0u);
-    }
-    this->ScheduleTasks(i, tasks);
-  }
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    this->RunAllTasks(i);
-
-    EXPECT_EQ(kCategoryCount, this->run_task_ids(i).size());
-    EXPECT_EQ(kCategoryCount, this->on_task_completed_ids(i).size());
-  }
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    std::vector<TaskInfo> tasks;
-    for (unsigned j = 0; j < kCategoryCount; ++j) {
-      tasks.emplace_back(i, 0u, 0u, 1u, j, 0u);
-    }
-    this->ScheduleTasks(i, tasks);
-  }
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    this->RunAllTasks(i);
-
-    EXPECT_EQ(kCategoryCount * 3u, this->run_task_ids(i).size());
-    EXPECT_EQ(kCategoryCount * 2u, this->on_task_completed_ids(i).size());
-  }
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    std::vector<TaskInfo> tasks;
-    for (unsigned j = 0; j < kCategoryCount; ++j) {
-      tasks.emplace_back(i, 0u, 0u, 2u, j, 0u);
-    }
-    this->ScheduleTasks(i, tasks);
-  }
-
-  for (int i = 0; i < kNamespaceCount; ++i) {
-    this->RunAllTasks(i);
-
-    EXPECT_EQ(kCategoryCount * 6u, this->run_task_ids(i).size());
-    EXPECT_EQ(kCategoryCount * 3u, this->on_task_completed_ids(i).size());
-  }
-}
-
-REGISTER_TYPED_TEST_CASE_P(TaskGraphRunnerTest, Basic, Dependencies, Categorys);
+REGISTER_TYPED_TEST_CASE_P(TaskGraphRunnerTest, Basic, Dependencies);
 
 template <typename TaskRunnerTestDelegate>
 using SingleThreadTaskGraphRunnerTest =
@@ -271,8 +215,8 @@
 
   for (int i = 0; i < kNamespaceCount; ++i) {
     TaskInfo tasks[] = {
-        TaskInfo(i, 0u, 2u, 1u, 0u, 1u),  // Priority 1
-        TaskInfo(i, 1u, 3u, 1u, 0u, 0u)   // Priority 0
+        TaskInfo(i, 0u, 2u, 1u, 1u),  // Priority 1
+        TaskInfo(i, 1u, 3u, 1u, 0u)   // Priority 0
     };
     this->ScheduleTasks(i,
                         std::vector<TaskInfo>(tasks, tasks + arraysize(tasks)));

diff --git a/cc/tiles/tile_manager.cc b/cc/tiles/tile_manager.cc
index c3a8482..6ae1235 100644
--- a/cc/tiles/tile_manager.cc
+++ b/cc/tiles/tile_manager.cc

@@ -171,10 +171,7 @@
                       [task](const TaskGraph::Node& node) {
                         return node.task == task;
                       }) == graph->nodes.end());
-
-  // TODO(ericrk): Add in more logic around category selection.
-  graph->nodes.push_back(
-      TaskGraph::Node(task, 0 /* category */, priority, dependencies));
+  graph->nodes.push_back(TaskGraph::Node(task, priority, dependencies));
 }
 
 void InsertNodesForRasterTask(TaskGraph* graph,

diff --git a/cc/trees/property_tree.cc b/cc/trees/property_tree.cc
index a6b72e6..e66ff556 100644
--- a/cc/trees/property_tree.cc
+++ b/cc/trees/property_tree.cc

@@ -844,7 +844,8 @@
 
 void TransformTree::UpdateSnapping(TransformNode* node) {
   if (!node->data.scrolls || node->data.to_screen_is_animated ||
-      !node->data.to_target.IsScaleOrTranslation()) {
+      !node->data.to_target.IsScaleOrTranslation() ||
+      !node->data.ancestors_are_invertible) {
     return;
   }
 

diff --git a/cc/trees/property_tree_unittest.cc b/cc/trees/property_tree_unittest.cc
index e9b8c2d..65cb414a 100644
--- a/cc/trees/property_tree_unittest.cc
+++ b/cc/trees/property_tree_unittest.cc

@@ -972,6 +972,47 @@
 DIRECT_AND_SERIALIZED_PROPERTY_TREE_TEST_F(
     PropertyTreeTestNonIntegerTranslationTest);
 
+class PropertyTreeTestSingularTransformSnapTest : public PropertyTreeTest {
+ protected:
+  void StartTest() override {
+    // This tests that to_target transform is not snapped when it has a singular
+    // transform.
+    TransformTree tree;
+
+    int parent = tree.Insert(TransformNode(), 0);
+    tree.Node(parent)->data.target_id = parent;
+    tree.Node(parent)->data.scrolls = true;
+
+    int child = tree.Insert(TransformNode(), parent);
+    TransformNode* child_node = tree.Node(child);
+    child_node->data.target_id = parent;
+    child_node->data.scrolls = true;
+    child_node->data.local.Scale3d(6.0f, 6.0f, 0.0f);
+    child_node->data.local.Translate(1.3f, 1.3f);
+    tree.set_needs_update(true);
+
+    tree = TransformTreeForTest(tree);
+    ComputeTransforms(&tree);
+
+    gfx::Transform from_target;
+    EXPECT_FALSE(child_node->data.to_target.GetInverse(&from_target));
+    // The following checks are to ensure that snapping is skipped because of
+    // singular transform (and not because of other reasons which also cause
+    // snapping to be skipped).
+    EXPECT_TRUE(child_node->data.scrolls);
+    EXPECT_TRUE(child_node->data.to_target.IsScaleOrTranslation());
+    EXPECT_FALSE(child_node->data.to_screen_is_animated);
+    EXPECT_FALSE(child_node->data.ancestors_are_invertible);
+
+    gfx::Transform rounded = child_node->data.to_target;
+    rounded.RoundTranslationComponents();
+    EXPECT_NE(child_node->data.to_target, rounded);
+  }
+};
+
+DIRECT_AND_SERIALIZED_PROPERTY_TREE_TEST_F(
+    PropertyTreeTestSingularTransformSnapTest);
+
 #undef DIRECT_AND_SERIALIZED_PROPERTY_TREE_TEST_F
 #undef SERIALIZED_PROPERTY_TREE_TEST_F
 #undef DIRECT_PROPERTY_TREE_TEST_F

diff --git a/chrome/VERSION b/chrome/VERSION
index 5f33eee..ecc59cf 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=49
 MINOR=0
-BUILD=2592
+BUILD=2593
 PATCH=0

diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index e7773f5f9..a47598c 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp

@@ -3675,49 +3675,53 @@
     Keyboard settings
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_SEARCH_LABEL"
-           desc="The label for 'Customize modifier keys' overlay">
+           desc="The label for customizing the search key in the 'Keyboard settings' overlay">
     Search
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_LEFT_CTRL_LABEL"
-           desc="The label for 'Customize modifier keys' overlay">
+           desc="The label for customizing the left ctrl key in the 'Keyboard settings' overlay">
     Ctrl
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_LEFT_ALT_LABEL"
-           desc="The label for 'Customize modifier keys' overlay">
+           desc="The label for customizing the left alt key in the 'Keyboard settings' overlay">
     Alt
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_CAPS_LOCK_LABEL"
-           desc="The label for 'Customize modifier keys' overlay">
+           desc="The label for customizing the caps-lock key in the 'Keyboard settings' overlay">
     Caps Lock
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_DIAMOND_KEY_LABEL"
-           desc="The label for 'Customize modifier keys' overlay">
+           desc="The label for customizing the diamond key in the 'Keyboard settings' overlay">
     Diamond
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_SEARCH"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for the search key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Search
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_LEFT_CTRL"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for the left ctrl key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Ctrl
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_LEFT_ALT"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for the left alt key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Alt
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_VOID"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for disabling the remapping in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Disabled
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_CAPS_LOCK"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for the caps-lock key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Caps Lock
   </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_ESCAPE"
-           desc="The dropdown list item for 'Customize modifier keys' overlay">
+           desc="The dropdown list item for the escape key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
     Escape
   </message>
+  <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_BACKSPACE"
+           desc="The dropdown list item for the backspace key in the 'Customize modifier keys' section in the 'Keyboard settings' overlay">
+    Backspace
+  </message>
   <message name="IDS_OPTIONS_SETTINGS_LANGUAGES_SEND_FUNCTION_KEYS"
            desc="The checkbox label for a setting to interpret the top-row keys as function keys instead.">
     Treat top-row keys as function keys

diff --git a/chrome/app/chromium_strings.grd b/chrome/app/chromium_strings.grd
index 66e3f1a..696965a 100644
--- a/chrome/app/chromium_strings.grd
+++ b/chrome/app/chromium_strings.grd

@@ -232,6 +232,12 @@
         <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is no longer supported.">
           Chromium may not function correctly because it is no longer supported on this Linux system.
         </message>
+        <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_SOON_CAN_UPGRADE" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is about to become unsupported, unless they upgrade to the 64-bit version.">
+          Future versions of 32-bit Chromium will no longer support this Linux system, please upgrade to 64-bit Chromium.
+        </message>
+        <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW_CAN_UPGRADE" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is no longer supported, unless they upgrade to the 64-bit version.">
+          32-bit Chromium may not function correctly because it is no longer supported on this Linux system. Please upgrade to 64-bit Chromium.
+        </message>
       </if>
       <if expr="is_macosx">
         <message name="IDS_MAC_10_678_OBSOLETE_SOON" desc="A message displayed on an at-launch infobar and About (Help) page warning the user that the OS version they are using is about to become unsupported.">

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 7328629..2386360 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -6415,18 +6415,6 @@
       <message name="IDS_FLAGS_SITE_ENGAGEMENT_SERVICE_DESCRIPTION" desc="Description for the flag to enable the site engagement service.">
         Enables the Site Engagement Service, which records interaction with sites and allocates resources accordingly.
       </message>
-      <message name="IDS_FLAGS_OUT_OF_PROCESS_PDF_NAME" desc="Title for the flag to enable out of process PDF.">
-        Out of process PDF
-      </message>
-      <message name="IDS_FLAGS_OUT_OF_PROCESS_PDF_DESCRIPTION" desc="Description for the flag to enable out of process PDF.">
-        Enable the out of process PDF plugin.
-      </message>
-      <message name="IDS_FLAGS_PDF_MATERIAL_UI_NAME" desc="Title for the flag to enable the new material UI in the PDF Viewer.">
-        Material UI for PDF
-      </message>
-      <message name="IDS_FLAGS_PDF_MATERIAL_UI_DESCRIPTION" desc="Description for the flag to enable the new material UI in the PDF Viewer.">
-        Enable the new material UI in the PDF Viewer.
-      </message>
       <message name="IDS_FLAGS_THREADED_SCROLLING_NAME" desc="Title for the flag for threaded scrolling.">
         Threaded scrolling
       </message>

diff --git a/chrome/app/google_chrome_strings.grd b/chrome/app/google_chrome_strings.grd
index 866aa60..2c5596f 100644
--- a/chrome/app/google_chrome_strings.grd
+++ b/chrome/app/google_chrome_strings.grd

@@ -233,6 +233,12 @@
         <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is no longer supported.">
           This computer will no longer receive Google Chrome updates because this Linux system is no longer supported.
         </message>
+        <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_SOON_CAN_UPGRADE" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is about to become unsupported, unless they upgrade to the 64-bit version.">
+          This computer will soon stop receiving 32-bit Google Chrome updates. Please upgrade to 64-bit Google Chrome.
+        </message>
+        <message name="IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW_CAN_UPGRADE" desc="A message displayed on an at-launch infobar and about:help warning the user that the computer they are using is no longer supported, unless they upgrade to the 64-bit version.">
+          This computer will no longer receive 32-bit Google Chrome updates. Please upgrade to 64-bit Google Chrome.
+        </message>
       </if>
       <if expr="is_macosx">
         <message name="IDS_MAC_10_678_OBSOLETE_SOON" desc="A message displayed on an at-launch infobar and About (Help) page warning the user that the OS version they are using is about to become unsupported.">

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 05b70ce..4ff216c 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -478,7 +478,7 @@
   if (enable_nacl) {
     sources +=
         rebase_path(gypi_values.chrome_browser_nacl_sources, ".", "//chrome")
-    deps += [ "//components/nacl/browser" ]
+    deps += [ "//components/nacl:nacl_browser" ]
   }
 
   if (enable_configuration_policy) {

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index f954b05..2b2b1e8 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -1447,12 +1447,6 @@
      kOsWin | kOsLinux,
      ENABLE_DISABLE_VALUE_TYPE(switches::kEnableSessionCrashedBubble,
                                switches::kDisableSessionCrashedBubble)},
-    {"enable-pdf-material-ui",
-     IDS_FLAGS_PDF_MATERIAL_UI_NAME,
-     IDS_FLAGS_PDF_MATERIAL_UI_DESCRIPTION,
-     kOsDesktop,
-     ENABLE_DISABLE_VALUE_TYPE(switches::kEnablePdfMaterialUI,
-                               switches::kDisablePdfMaterialUI)},
     {"disable-cast-streaming-hw-encoding",
      IDS_FLAGS_CAST_STREAMING_HW_ENCODING_NAME,
      IDS_FLAGS_CAST_STREAMING_HW_ENCODING_DESCRIPTION,

diff --git a/chrome/browser/chromeos/events/event_rewriter.cc b/chrome/browser/chromeos/events/event_rewriter.cc
index 01bb2b2..d759f56 100644
--- a/chrome/browser/chromeos/events/event_rewriter.cc
+++ b/chrome/browser/chromeos/events/event_rewriter.cc

@@ -112,6 +112,11 @@
      nullptr,
      {ui::EF_NONE, ui::DomCode::ESCAPE, ui::DomKey::ESCAPE, ui::VKEY_ESCAPE}},
     {ui::EF_NONE,
+     input_method::kBackspaceKey,
+     nullptr,
+     {ui::EF_NONE, ui::DomCode::BACKSPACE, ui::DomKey::BACKSPACE,
+      ui::VKEY_BACK}},
+    {ui::EF_NONE,
      input_method::kNumModifierKeys,
      prefs::kLanguageRemapDiamondKeyTo,
      {ui::EF_NONE, ui::DomCode::F15, ui::DomKey::F15, ui::VKEY_F15}}};

diff --git a/chrome/browser/engagement/site_engagement_service.cc b/chrome/browser/engagement/site_engagement_service.cc
index b875eb6..9c9b629 100644
--- a/chrome/browser/engagement/site_engagement_service.cc
+++ b/chrome/browser/engagement/site_engagement_service.cc

@@ -33,17 +33,20 @@
 // Global bool to ensure we only update the parameters from variations once.
 bool g_updated_from_variations = false;
 
-// Keys used in the variations params.
-const char kMaxPointsPerDayParam[] = "max_points_per_day";
-const char kNavigationPointsParam[] = "navigation_points";
-const char kUserInputPointsParam[] = "user_input_points";
-const char kVisibleMediaPlayingPointsParam[] = "visible_media_playing_points";
-const char kHiddenMediaPlayingPointsParam[] = "hidden_media_playing_points";
-const char kDecayPeriodInDaysParam[] = "decay_period_in_days";
-const char kDecayPointsParam[] = "decay_points";
+// Keys used in the variations params. Order matches
+// SiteEngagementScore::Variation enum.
+const char* kVariationNames[] = {
+  "max_points_per_day",
+  "decay_period_in_days",
+  "decay_points",
+  "navigation_points",
+  "user_input_points",
+  "visible_media_playing_points",
+  "hidden_media_playing_points",
+};
 
 // Length of time between metrics logging.
-const base::TimeDelta metrics_interval = base::TimeDelta::FromMinutes(60);
+const int kMetricsIntervalInMinutes = 60;
 
 // Delta within which to consider scores equal.
 const double kScoreDelta = 0.001;
@@ -103,73 +106,68 @@
 }  // namespace
 
 const double SiteEngagementScore::kMaxPoints = 100;
-double SiteEngagementScore::g_max_points_per_day = 5;
-double SiteEngagementScore::g_navigation_points = 0.5;
-double SiteEngagementScore::g_user_input_points = 0.05;
-double SiteEngagementScore::g_visible_media_playing_points = 0.02;
-double SiteEngagementScore::g_hidden_media_playing_points = 0.01;
-int SiteEngagementScore::g_decay_period_in_days = 7;
-double SiteEngagementScore::g_decay_points = 5;
+double SiteEngagementScore::param_values[] = {
+    5,     // MAX_POINTS_PER_DAY
+    7,     // DECAY_PERIOD_IN_DAYS
+    5,     // DECAY_POINTS
+    0.5,   // NAVIGATION_POINTS
+    0.05,  // USER_INPUT_POINTS
+    0.02,  // VISIBLE_MEDIA_POINTS
+    0.01,  // HIDDEN_MEDIA_POINTS
+};
 
 const char* SiteEngagementScore::kRawScoreKey = "rawScore";
 const char* SiteEngagementScore::kPointsAddedTodayKey = "pointsAddedToday";
 const char* SiteEngagementScore::kLastEngagementTimeKey = "lastEngagementTime";
 
+double SiteEngagementScore::GetMaxPointsPerDay() {
+  return param_values[MAX_POINTS_PER_DAY];
+}
+
+double SiteEngagementScore::GetDecayPeriodInDays() {
+  return param_values[DECAY_PERIOD_IN_DAYS];
+}
+
+double SiteEngagementScore::GetDecayPoints() {
+  return param_values[DECAY_POINTS];
+}
+
+double SiteEngagementScore::GetNavigationPoints() {
+  return param_values[NAVIGATION_POINTS];
+}
+
+double SiteEngagementScore::GetUserInputPoints() {
+  return param_values[USER_INPUT_POINTS];
+}
+
+double SiteEngagementScore::GetVisibleMediaPoints() {
+  return param_values[VISIBLE_MEDIA_POINTS];
+}
+
+double SiteEngagementScore::GetHiddenMediaPoints() {
+  return param_values[HIDDEN_MEDIA_POINTS];
+}
+
 void SiteEngagementScore::UpdateFromVariations() {
-  std::string max_points_per_day_param = variations::GetVariationParamValue(
-      SiteEngagementService::kEngagementParams, kMaxPointsPerDayParam);
-  std::string navigation_points_param = variations::GetVariationParamValue(
-      SiteEngagementService::kEngagementParams, kNavigationPointsParam);
-  std::string user_input_points_param = variations::GetVariationParamValue(
-      SiteEngagementService::kEngagementParams, kUserInputPointsParam);
-  std::string visible_media_playing_points_param =
-      variations::GetVariationParamValue(
-          SiteEngagementService::kEngagementParams,
-          kVisibleMediaPlayingPointsParam);
-  std::string hidden_media_playing_points_param =
-      variations::GetVariationParamValue(
-          SiteEngagementService::kEngagementParams,
-          kHiddenMediaPlayingPointsParam);
-  std::string decay_period_in_days_param = variations::GetVariationParamValue(
-      SiteEngagementService::kEngagementParams, kDecayPeriodInDaysParam);
-  std::string decay_points_param = variations::GetVariationParamValue(
-      SiteEngagementService::kEngagementParams, kDecayPointsParam);
+  double param_vals[MAX_VARIATION];
 
-  if (!max_points_per_day_param.empty() && !navigation_points_param.empty() &&
-      !user_input_points_param.empty() &&
-      !visible_media_playing_points_param.empty() &&
-      !hidden_media_playing_points_param.empty() &&
-      !decay_period_in_days_param.empty() && !decay_points_param.empty()) {
-    double max_points_per_day = 0;
-    double navigation_points = 0;
-    double user_input_points = 0;
-    double visible_media_playing_points = 0;
-    double hidden_media_playing_points = 0;
-    int decay_period_in_days = 0;
-    double decay_points = 0;
+  for (int i = 0; i < MAX_VARIATION; ++i) {
+    std::string param_string = variations::GetVariationParamValue(
+        SiteEngagementService::kEngagementParams, kVariationNames[i]);
 
-    if (base::StringToDouble(max_points_per_day_param, &max_points_per_day) &&
-        base::StringToDouble(navigation_points_param, &navigation_points) &&
-        base::StringToDouble(user_input_points_param, &user_input_points) &&
-        base::StringToDouble(visible_media_playing_points_param,
-                             &visible_media_playing_points) &&
-        base::StringToDouble(hidden_media_playing_points_param,
-                             &hidden_media_playing_points) &&
-        base::StringToInt(decay_period_in_days_param, &decay_period_in_days) &&
-        base::StringToDouble(decay_points_param, &decay_points) &&
-        max_points_per_day >= navigation_points &&
-        max_points_per_day >= user_input_points && navigation_points >= 0 &&
-        user_input_points >= 0 && decay_period_in_days > 0 &&
-        decay_points >= 0) {
-      g_max_points_per_day = max_points_per_day;
-      g_navigation_points = navigation_points;
-      g_user_input_points = user_input_points;
-      g_visible_media_playing_points = visible_media_playing_points;
-      g_hidden_media_playing_points = hidden_media_playing_points;
-      g_decay_period_in_days = decay_period_in_days;
-      g_decay_points = decay_points;
+    // Bail out if we didn't get a param string for the key, or if we couldn't
+    // convert the param string to a double, or if we get a negative value.
+    if (param_string.empty() ||
+        !base::StringToDouble(param_string, &param_vals[i]) ||
+        param_vals[i] < 0) {
+      return;
     }
   }
+
+  // Once we're sure everything is valid, assign the variation to the param
+  // values array.
+  for (int i = 0; i < MAX_VARIATION; ++i)
+    SiteEngagementScore::param_values[i] = param_vals[i];
 }
 
 SiteEngagementScore::SiteEngagementScore(
@@ -202,7 +200,7 @@
   }
 
   double to_add = std::min(kMaxPoints - raw_score_,
-                           g_max_points_per_day - points_added_today_);
+                           GetMaxPointsPerDay() - points_added_today_);
   to_add = std::min(to_add, points);
 
   points_added_today_ += to_add;
@@ -217,7 +215,7 @@
     return false;
   }
 
-  return points_added_today_ == g_max_points_per_day;
+  return points_added_today_ == GetMaxPointsPerDay();
 }
 
 bool SiteEngagementScore::UpdateScoreDict(base::DictionaryValue* score_dict) {
@@ -263,8 +261,8 @@
   if (days_since_engagement < 0)
     return raw_score_;
 
-  int periods = days_since_engagement / g_decay_period_in_days;
-  double decayed_score = raw_score_ - periods * g_decay_points;
+  int periods = days_since_engagement / GetDecayPeriodInDays();
+  double decayed_score = raw_score_ - periods * GetDecayPoints();
   return std::max(0.0, decayed_score);
 }
 
@@ -320,7 +318,7 @@
   if (IsEngagementNavigation(transition)) {
     SiteEngagementMetrics::RecordEngagement(
         SiteEngagementMetrics::ENGAGEMENT_NAVIGATION);
-    AddPoints(url, SiteEngagementScore::g_navigation_points);
+    AddPoints(url, SiteEngagementScore::GetNavigationPoints());
     RecordMetrics();
   }
 }
@@ -329,7 +327,7 @@
     const GURL& url,
     SiteEngagementMetrics::EngagementType type) {
   SiteEngagementMetrics::RecordEngagement(type);
-  AddPoints(url, SiteEngagementScore::g_user_input_points);
+  AddPoints(url, SiteEngagementScore::GetUserInputPoints());
   RecordMetrics();
 }
 
@@ -338,9 +336,8 @@
   SiteEngagementMetrics::RecordEngagement(
       is_hidden ? SiteEngagementMetrics::ENGAGEMENT_MEDIA_HIDDEN
                 : SiteEngagementMetrics::ENGAGEMENT_MEDIA_VISIBLE);
-  AddPoints(url, is_hidden
-                     ? SiteEngagementScore::g_hidden_media_playing_points
-                     : SiteEngagementScore::g_visible_media_playing_points);
+  AddPoints(url, is_hidden ? SiteEngagementScore::GetHiddenMediaPoints()
+                           : SiteEngagementScore::GetVisibleMediaPoints());
   RecordMetrics();
 }
 
@@ -457,7 +454,7 @@
 void SiteEngagementService::RecordMetrics() {
   base::Time now = clock_->Now();
   if (last_metrics_time_.is_null() ||
-      now - last_metrics_time_ >= metrics_interval) {
+      (now - last_metrics_time_).InMinutes() >= kMetricsIntervalInMinutes) {
     last_metrics_time_ = now;
     std::map<GURL, double> score_map = GetScoreMap();
 

diff --git a/chrome/browser/engagement/site_engagement_service.h b/chrome/browser/engagement/site_engagement_service.h
index 6489fff..17577bc 100644
--- a/chrome/browser/engagement/site_engagement_service.h
+++ b/chrome/browser/engagement/site_engagement_service.h

@@ -27,32 +27,43 @@
 
 class SiteEngagementScore {
  public:
+  // The parameters which can be varied via field trial. All "points" values
+  // should be appended to the end of the enum prior to MAX_VARIATION.
+  enum Variation {
+    // The maximum number of points that can be accrued in one day.
+    MAX_POINTS_PER_DAY = 0,
+
+    // The period over which site engagement decays.
+    DECAY_PERIOD_IN_DAYS,
+
+    // The number of points to decay per period.
+    DECAY_POINTS,
+
+    // The number of points given for navigations.
+    NAVIGATION_POINTS,
+
+    // The number of points given for user input.
+    USER_INPUT_POINTS,
+
+    // The number of points given for media playing. Initially calibrated such
+    // that at least 30 minutes of foreground media would be required to allow a
+    // site to reach the daily engagement maximum.
+    VISIBLE_MEDIA_POINTS,
+    HIDDEN_MEDIA_POINTS,
+
+    MAX_VARIATION
+  };
+
   // The maximum number of points that are allowed.
   static const double kMaxPoints;
 
-  // The maximum number of points that can be accrued in one day.
-  static double g_max_points_per_day;
-
-  // The number of points given for navigations.
-  static double g_navigation_points;
-
-  // The number of points given for user input (indicating time-on-site).
-  static double g_user_input_points;
-
-  // The number of points given for media playing. Initially calibrated such
-  // that at least 30 minutes of video watching or audio listening would be
-  // required to allow a site to reach the daily engagement maximum.
-  static double g_visible_media_playing_points;
-
-  // The number of points given for media playing in a non-visible tab.
-  static double g_hidden_media_playing_points;
-
-  // Decaying works by removing a portion of the score periodically. This
-  // constant determines how often that happens.
-  static int g_decay_period_in_days;
-
-  // How much the score decays after every kDecayPeriodInDays.
-  static double g_decay_points;
+  static double GetMaxPointsPerDay();
+  static double GetDecayPeriodInDays();
+  static double GetDecayPoints();
+  static double GetNavigationPoints();
+  static double GetUserInputPoints();
+  static double GetVisibleMediaPoints();
+  static double GetHiddenMediaPoints();
 
   // Update the default engagement settings via variations.
   static void UpdateFromVariations();
@@ -79,6 +90,9 @@
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementScoreTest, PopulatedDictionary);
   friend class SiteEngagementScoreTest;
 
+  // Array holding the values corresponding to each item in Variation array.
+  static double param_values[];
+
   // Keys used in the content settings dictionary.
   static const char* kRawScoreKey;
   static const char* kPointsAddedTodayKey;

diff --git a/chrome/browser/engagement/site_engagement_service_unittest.cc b/chrome/browser/engagement/site_engagement_service_unittest.cc
index bc5471c..f56503be 100644
--- a/chrome/browser/engagement/site_engagement_service_unittest.cc
+++ b/chrome/browser/engagement/site_engagement_service_unittest.cc

@@ -142,19 +142,19 @@
 };
 
 // Accumulate score many times on the same day. Ensure each time the score goes
-// up by g_navigation_points, but not more than g_max_points_per_day.
+// up, but not more than the maximum per day.
 TEST_F(SiteEngagementScoreTest, AccumulateOnSameDay) {
   base::Time reference_time = GetReferenceTime();
 
   test_clock_.SetNow(reference_time);
   for (int i = 0; i < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++i) {
-    score_.AddPoints(SiteEngagementScore::g_navigation_points);
-    EXPECT_EQ(std::min(SiteEngagementScore::g_max_points_per_day,
-                       (i + 1) * SiteEngagementScore::g_navigation_points),
+    score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
+    EXPECT_EQ(std::min(SiteEngagementScore::GetMaxPointsPerDay(),
+                       (i + 1) * SiteEngagementScore::GetNavigationPoints()),
               score_.Score());
   }
 
-  EXPECT_EQ(SiteEngagementScore::g_max_points_per_day, score_.Score());
+  EXPECT_EQ(SiteEngagementScore::GetMaxPointsPerDay(), score_.Score());
 }
 
 // Accumulate on the first day to max that day's engagement, then accumulate on
@@ -165,21 +165,21 @@
 
   test_clock_.SetNow(reference_time);
   for (int i = 0; i < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++i)
-    score_.AddPoints(SiteEngagementScore::g_navigation_points);
+    score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
 
-  EXPECT_EQ(SiteEngagementScore::g_max_points_per_day, score_.Score());
+  EXPECT_EQ(SiteEngagementScore::GetMaxPointsPerDay(), score_.Score());
 
   test_clock_.SetNow(later_date);
   for (int i = 0; i < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++i) {
-    score_.AddPoints(SiteEngagementScore::g_navigation_points);
+    score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
     double day_score =
-        std::min(SiteEngagementScore::g_max_points_per_day,
-                 (i + 1) * SiteEngagementScore::g_navigation_points);
-    EXPECT_EQ(day_score + SiteEngagementScore::g_max_points_per_day,
+        std::min(SiteEngagementScore::GetMaxPointsPerDay(),
+                 (i + 1) * SiteEngagementScore::GetNavigationPoints());
+    EXPECT_EQ(day_score + SiteEngagementScore::GetMaxPointsPerDay(),
               score_.Score());
   }
 
-  EXPECT_EQ(2 * SiteEngagementScore::g_max_points_per_day, score_.Score());
+  EXPECT_EQ(2 * SiteEngagementScore::GetMaxPointsPerDay(), score_.Score());
 }
 
 // Accumulate score on many consecutive days and ensure the score doesn't exceed
@@ -191,10 +191,10 @@
     current_day += base::TimeDelta::FromDays(1);
     test_clock_.SetNow(current_day);
     for (int j = 0; j < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++j)
-      score_.AddPoints(SiteEngagementScore::g_navigation_points);
+      score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
 
     EXPECT_EQ(std::min(SiteEngagementScore::kMaxPoints,
-                       (i + 1) * SiteEngagementScore::g_max_points_per_day),
+                       (i + 1) * SiteEngagementScore::GetMaxPointsPerDay()),
               score_.Score());
   }
 
@@ -211,12 +211,12 @@
     test_clock_.SetNow(current_day);
 
     for (int j = 0; j < kLessAccumulationsThanNeededToMaxDailyEngagement; ++j)
-      score_.AddPoints(SiteEngagementScore::g_navigation_points);
+      score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
 
     EXPECT_EQ(
         std::min(SiteEngagementScore::kMaxPoints,
                  (i + 1) * kLessAccumulationsThanNeededToMaxDailyEngagement *
-                     SiteEngagementScore::g_navigation_points),
+                     SiteEngagementScore::GetNavigationPoints()),
         score_.Score());
   }
 
@@ -233,7 +233,7 @@
     test_clock_.SetNow(current_day);
 
     for (int j = 0; j < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++j)
-      score_.AddPoints(SiteEngagementScore::g_navigation_points);
+      score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
   }
 
   EXPECT_EQ(SiteEngagementScore::kMaxPoints, score_.Score());
@@ -242,16 +242,16 @@
   // elapsed.
   test_clock_.SetNow(current_day +
                      base::TimeDelta::FromDays(
-                         SiteEngagementScore::g_decay_period_in_days - 1));
+                         SiteEngagementScore::GetDecayPeriodInDays() - 1));
   EXPECT_EQ(SiteEngagementScore::kMaxPoints, score_.Score());
 
   // The score should have decayed by one chunk after one decay period has
   // elapsed.
   test_clock_.SetNow(
       current_day +
-      base::TimeDelta::FromDays(SiteEngagementScore::g_decay_period_in_days));
+      base::TimeDelta::FromDays(SiteEngagementScore::GetDecayPeriodInDays()));
   EXPECT_EQ(
-      SiteEngagementScore::kMaxPoints - SiteEngagementScore::g_decay_points,
+      SiteEngagementScore::kMaxPoints - SiteEngagementScore::GetDecayPoints(),
       score_.Score());
 
   // The score should have decayed by the right number of chunks after a few
@@ -259,17 +259,17 @@
   test_clock_.SetNow(
       current_day +
       base::TimeDelta::FromDays(kLessPeriodsThanNeededToDecayMaxScore *
-                                SiteEngagementScore::g_decay_period_in_days));
+                                SiteEngagementScore::GetDecayPeriodInDays()));
   EXPECT_EQ(SiteEngagementScore::kMaxPoints -
                 kLessPeriodsThanNeededToDecayMaxScore *
-                    SiteEngagementScore::g_decay_points,
+                    SiteEngagementScore::GetDecayPoints(),
             score_.Score());
 
   // The score should not decay below zero.
   test_clock_.SetNow(
       current_day +
       base::TimeDelta::FromDays(kMorePeriodsThanNeededToDecayMaxScore *
-                                SiteEngagementScore::g_decay_period_in_days));
+                                SiteEngagementScore::GetDecayPeriodInDays()));
   EXPECT_EQ(0, score_.Score());
 }
 
@@ -283,27 +283,27 @@
     test_clock_.SetNow(current_day);
 
     for (int j = 0; j < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++j)
-      score_.AddPoints(SiteEngagementScore::g_navigation_points);
+      score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
   }
 
   double initial_score = kLessDaysThanNeededToMaxTotalEngagement *
-                         SiteEngagementScore::g_max_points_per_day;
+                         SiteEngagementScore::GetMaxPointsPerDay();
   EXPECT_EQ(initial_score, score_.Score());
 
   // Go forward a few decay periods.
   test_clock_.SetNow(
       current_day +
       base::TimeDelta::FromDays(kLessPeriodsThanNeededToDecayMaxScore *
-                                SiteEngagementScore::g_decay_period_in_days));
+                                SiteEngagementScore::GetDecayPeriodInDays()));
 
   double decayed_score = initial_score -
                          kLessPeriodsThanNeededToDecayMaxScore *
-                             SiteEngagementScore::g_decay_points;
+                             SiteEngagementScore::GetDecayPoints();
   EXPECT_EQ(decayed_score, score_.Score());
 
   // Now add some points.
-  score_.AddPoints(SiteEngagementScore::g_navigation_points);
-  EXPECT_EQ(decayed_score + SiteEngagementScore::g_navigation_points,
+  score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
+  EXPECT_EQ(decayed_score + SiteEngagementScore::GetNavigationPoints(),
             score_.Score());
 }
 
@@ -313,25 +313,25 @@
 
   test_clock_.SetNow(current_day);
   for (int i = 0; i < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++i)
-    score_.AddPoints(SiteEngagementScore::g_navigation_points);
+    score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
 
-  EXPECT_EQ(SiteEngagementScore::g_max_points_per_day, score_.Score());
+  EXPECT_EQ(SiteEngagementScore::GetMaxPointsPerDay(), score_.Score());
 
   // Adding to the score on an earlier date should be treated like another day,
   // and should not cause any decay.
   test_clock_.SetNow(current_day - base::TimeDelta::FromDays(
                                        kMorePeriodsThanNeededToDecayMaxScore *
-                                       SiteEngagementScore::g_decay_points));
+                                       SiteEngagementScore::GetDecayPoints()));
   for (int i = 0; i < kMoreAccumulationsThanNeededToMaxDailyEngagement; ++i) {
-    score_.AddPoints(SiteEngagementScore::g_navigation_points);
+    score_.AddPoints(SiteEngagementScore::GetNavigationPoints());
     double day_score =
-        std::min(SiteEngagementScore::g_max_points_per_day,
-                 (i + 1) * SiteEngagementScore::g_navigation_points);
-    EXPECT_EQ(day_score + SiteEngagementScore::g_max_points_per_day,
+        std::min(SiteEngagementScore::GetMaxPointsPerDay(),
+                 (i + 1) * SiteEngagementScore::GetNavigationPoints());
+    EXPECT_EQ(day_score + SiteEngagementScore::GetMaxPointsPerDay(),
               score_.Score());
   }
 
-  EXPECT_EQ(2 * SiteEngagementScore::g_max_points_per_day, score_.Score());
+  EXPECT_EQ(2 * SiteEngagementScore::GetMaxPointsPerDay(), score_.Score());
 }
 
 // Test that scores are read / written correctly from / to empty score
@@ -789,7 +789,7 @@
     // will not have decayed at all.
     clock->SetNow(
         GetReferenceTime() +
-        base::TimeDelta::FromDays(SiteEngagementScore::g_decay_period_in_days));
+        base::TimeDelta::FromDays(SiteEngagementScore::GetDecayPeriodInDays()));
 
     std::map<GURL, double> score_map = service->GetScoreMap();
     EXPECT_EQ(2u, score_map.size());
@@ -809,7 +809,7 @@
     // engagement score to be cleaned up.
     clock->SetNow(GetReferenceTime() +
                   base::TimeDelta::FromDays(
-                      3 * SiteEngagementScore::g_decay_period_in_days));
+                      3 * SiteEngagementScore::GetDecayPeriodInDays()));
 
     std::map<GURL, double> score_map = service->GetScoreMap();
     EXPECT_EQ(1u, score_map.size());

diff --git a/chrome/browser/extensions/context_menu_matcher.cc b/chrome/browser/extensions/context_menu_matcher.cc
index 8381ce6..24aceca 100644
--- a/chrome/browser/extensions/context_menu_matcher.cc
+++ b/chrome/browser/extensions/context_menu_matcher.cc

@@ -113,13 +113,10 @@
       menu_model_->AddItem(menu_id, title);
     } else {
       ui::SimpleMenuModel* submenu = new ui::SimpleMenuModel(delegate_);
-      extension_menu_models_.push_back(submenu);
+      extension_menu_models_.push_back(make_scoped_ptr(submenu));
       menu_model_->AddSubMenu(menu_id, title, submenu);
-      RecursivelyAppendExtensionItems(submenu_items,
-                                      can_cross_incognito,
-                                      selection_text,
-                                      submenu,
-                                      index,
+      RecursivelyAppendExtensionItems(submenu_items, can_cross_incognito,
+                                      selection_text, submenu, index,
                                       false);  // is_action_menu_top_level
     }
     if (!is_action_menu)
@@ -266,13 +263,10 @@
         menu_model->AddItem(menu_id, title);
       } else {
         ui::SimpleMenuModel* submenu = new ui::SimpleMenuModel(delegate_);
-        extension_menu_models_.push_back(submenu);
+        extension_menu_models_.push_back(make_scoped_ptr(submenu));
         menu_model->AddSubMenu(menu_id, title, submenu);
-        RecursivelyAppendExtensionItems(children,
-                                        can_cross_incognito,
-                                        selection_text,
-                                        submenu,
-                                        index,
+        RecursivelyAppendExtensionItems(children, can_cross_incognito,
+                                        selection_text, submenu, index,
                                         false);  // is_action_menu_top_level
       }
     } else if (item->type() == MenuItem::CHECKBOX) {

diff --git a/chrome/browser/extensions/context_menu_matcher.h b/chrome/browser/extensions/context_menu_matcher.h
index 1a825e0..8b7996a 100644
--- a/chrome/browser/extensions/context_menu_matcher.h
+++ b/chrome/browser/extensions/context_menu_matcher.h

@@ -6,10 +6,10 @@
 #define CHROME_BROWSER_EXTENSIONS_CONTEXT_MENU_MATCHER_H_
 
 #include <map>
+#include <vector>
 
 #include "base/callback.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/memory/scoped_vector.h"
 #include "chrome/browser/extensions/menu_manager.h"
 #include "ui/base/models/simple_menu_model.h"
 
@@ -102,7 +102,7 @@
   std::map<int, extensions::MenuItem::Id> extension_item_map_;
 
   // Keep track of and clean up menu models for submenus.
-  ScopedVector<ui::SimpleMenuModel> extension_menu_models_;
+  std::vector<scoped_ptr<ui::SimpleMenuModel>> extension_menu_models_;
 
   DISALLOW_COPY_AND_ASSIGN(ContextMenuMatcher);
 };

diff --git a/chrome/browser/media/chrome_webrtc_apprtc_browsertest.cc b/chrome/browser/media/chrome_webrtc_apprtc_browsertest.cc
index 40cd7f3..26f1cfc 100644
--- a/chrome/browser/media/chrome_webrtc_apprtc_browsertest.cc
+++ b/chrome/browser/media/chrome_webrtc_apprtc_browsertest.cc

@@ -229,10 +229,6 @@
 };
 
 IN_PROC_BROWSER_TEST_F(WebRtcApprtcBrowserTest, MANUAL_WorksOnApprtc) {
-  // Disabled on Win XP: http://code.google.com/p/webrtc/issues/detail?id=2703.
-  if (OnWinXp())
-    return;
-
   DetectErrorsInJavaScript();
   ASSERT_TRUE(LaunchApprtcInstanceOnLocalhost("9999"));
   ASSERT_TRUE(LaunchColliderOnLocalHost("http://localhost:9999", "8089"));
@@ -281,10 +277,6 @@
 
 IN_PROC_BROWSER_TEST_F(WebRtcApprtcBrowserTest,
                        MAYBE_MANUAL_FirefoxApprtcInteropTest) {
-  // Disabled on Win XP: http://code.google.com/p/webrtc/issues/detail?id=2703.
-  if (OnWinXp())
-    return;
-
   DetectErrorsInJavaScript();
   ASSERT_TRUE(LaunchApprtcInstanceOnLocalhost("9999"));
   ASSERT_TRUE(LaunchColliderOnLocalHost("http://localhost:9999", "8089"));

diff --git a/chrome/browser/media/chrome_webrtc_audio_quality_browsertest.cc b/chrome/browser/media/chrome_webrtc_audio_quality_browsertest.cc
index 286fa44..c70a5505 100644
--- a/chrome/browser/media/chrome_webrtc_audio_quality_browsertest.cc
+++ b/chrome/browser/media/chrome_webrtc_audio_quality_browsertest.cc

@@ -654,7 +654,7 @@
 void MAYBE_WebRtcAudioQualityBrowserTest::TestWithFakeDeviceGetUserMedia(
     const std::string& constraints,
     const std::string& perf_modifier) {
-  if (OnWinXp() || OnWin8()) {
+  if (OnWin8()) {
     // http://crbug.com/379798.
     LOG(ERROR) << "This test is not implemented for Windows XP/Win8.";
     return;
@@ -679,7 +679,7 @@
 
 IN_PROC_BROWSER_TEST_F(MAYBE_WebRtcAudioQualityBrowserTest,
                        MANUAL_TestCallQualityWithAudioFromWebAudio) {
-  if (OnWinXp() || OnWin8()) {
+  if (OnWin8()) {
     // http://crbug.com/379798.
     LOG(ERROR) << "This test is not implemented for Windows XP/Win8.";
     return;
@@ -754,7 +754,7 @@
     const base::FilePath::StringType& reference_filename,
     const std::string& constraints,
     const std::string& perf_modifier) {
-  if (OnWinXp() || OnWin8()) {
+  if (OnWin8()) {
     // http://crbug.com/379798.
     LOG(ERROR) << "This test is not implemented for Windows XP/Win8.";
     return;

diff --git a/chrome/browser/media/chrome_webrtc_perf_browsertest.cc b/chrome/browser/media/chrome_webrtc_perf_browsertest.cc
index 0e02d08..25d497d2 100644
--- a/chrome/browser/media/chrome_webrtc_perf_browsertest.cc
+++ b/chrome/browser/media/chrome_webrtc_perf_browsertest.cc

@@ -106,8 +106,6 @@
 // This is manual for its long execution time.
 IN_PROC_BROWSER_TEST_F(WebRtcPerfBrowserTest,
                        MANUAL_RunsAudioVideoCall60SecsAndLogsInternalMetrics) {
-  if (OnWinXp()) return;
-
   ASSERT_TRUE(test::HasReferenceFilesInCheckout());
   ASSERT_TRUE(embedded_test_server()->Start());
 
@@ -151,8 +149,6 @@
 
 IN_PROC_BROWSER_TEST_F(WebRtcPerfBrowserTest,
                        MANUAL_RunsOneWayCall60SecsAndLogsInternalMetrics) {
-  if (OnWinXp()) return;
-
   ASSERT_TRUE(test::HasReferenceFilesInCheckout());
   ASSERT_TRUE(embedded_test_server()->Start());
 

diff --git a/chrome/browser/media/chrome_webrtc_video_quality_browsertest.cc b/chrome/browser/media/chrome_webrtc_video_quality_browsertest.cc
index d8ac11e..3fb0b19 100644
--- a/chrome/browser/media/chrome_webrtc_video_quality_browsertest.cc
+++ b/chrome/browser/media/chrome_webrtc_video_quality_browsertest.cc

@@ -299,9 +299,6 @@
 
 IN_PROC_BROWSER_TEST_P(WebRtcVideoQualityBrowserTest,
                        MANUAL_TestVideoQuality) {
-  if (OnWinXp())
-    return;  // Fails on XP. http://crbug.com/353078.
-
   ASSERT_GE(TestTimeouts::action_max_timeout().InSeconds(), 150) <<
       "This is a long-running test; you must specify "
       "--ui-test-action-max-timeout to have a value of at least 150000.";

diff --git a/chrome/browser/obsolete_system/obsolete_system_linux.cc b/chrome/browser/obsolete_system/obsolete_system_linux.cc
index 9d56d40..4e343222 100644
--- a/chrome/browser/obsolete_system/obsolete_system_linux.cc
+++ b/chrome/browser/obsolete_system/obsolete_system_linux.cc

@@ -7,6 +7,7 @@
 #if defined(GOOGLE_CHROME_BUILD) && !defined(OS_CHROMEOS)
 #include <gnu/libc-version.h>
 
+#include "base/sys_info.h"
 #include "base/version.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/chromium_strings.h"
@@ -40,12 +41,21 @@
 // static
 base::string16 ObsoleteSystem::LocalizedObsoleteString() {
 #if defined(GOOGLE_CHROME_BUILD) && !defined(OS_CHROMEOS)
-  return l10n_util::GetStringUTF16(
-      IsEndOfTheLine() ? IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW
-                       : IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_SOON);
+  const bool is_eol = IsEndOfTheLine();
+  int id = is_eol ? IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW
+                  : IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_SOON;
+#if defined(ARCH_CPU_32_BITS)
+  // On 32-bit builds, check if the kernel is 64-bit. If so, tell users to
+  // switch to 64-bit Chrome.
+  if (base::SysInfo::OperatingSystemArchitecture() == "x86_64") {
+    id = is_eol ? IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_NOW_CAN_UPGRADE
+                : IDS_LINUX_WHEEZY_PRECISE_OBSOLETE_SOON_CAN_UPGRADE;
+  }
+#endif  // defined(ARCH_CPU_32_BITS)
+  return l10n_util::GetStringUTF16(id);
 #else
   return base::string16();
-#endif
+#endif  // defined(GOOGLE_CHROME_BUILD) && !defined(OS_CHROMEOS)
 }
 
 // static

diff --git a/chrome/browser/pdf/pdf_extension_test.cc b/chrome/browser/pdf/pdf_extension_test.cc
index a6129bb2f..a248f73e 100644
--- a/chrome/browser/pdf/pdf_extension_test.cc
+++ b/chrome/browser/pdf/pdf_extension_test.cc

@@ -67,10 +67,6 @@
  public:
   ~PDFExtensionTest() override {}
 
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitch(switches::kDisablePdfMaterialUI);
-  }
-
   void SetUpOnMainThread() override {
     ExtensionApiTest::SetUpOnMainThread();
     ASSERT_TRUE(embedded_test_server()->Start());
@@ -318,7 +314,7 @@
                         testing::Range(0, kNumberLoadTestParts));
 
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, Basic) {
-  RunTestsInFile("basic_test.js", "test.pdf");
+  RunTestsInFile("basic_test_material.js", "test.pdf");
 }
 
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, BasicPlugin) {
@@ -345,6 +341,16 @@
   RunTestsInFile("zoom_manager_test.js", "test.pdf");
 }
 
+IN_PROC_BROWSER_TEST_F(PDFExtensionTest, Elements) {
+  // Although this test file does not require a PDF to be loaded, loading the
+  // elements without loading a PDF is difficult.
+  RunTestsInFile("material_elements_test.js", "test.pdf");
+}
+
+IN_PROC_BROWSER_TEST_F(PDFExtensionTest, ToolbarManager) {
+  RunTestsInFile("toolbar_manager_test.js", "test.pdf");
+}
+
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, Title) {
   RunTestsInFile("title_test.js", "test-title.pdf");
 }
@@ -502,58 +508,3 @@
 #endif
 }
 
-class MaterialPDFExtensionTest : public PDFExtensionTest {
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitch(switches::kEnablePdfMaterialUI);
-  }
-};
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Basic) {
-  RunTestsInFile("basic_test_material.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, BasicPlugin) {
-  RunTestsInFile("basic_plugin_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Viewport) {
-  RunTestsInFile("viewport_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Bookmark) {
-  RunTestsInFile("bookmarks_test.js", "test-bookmarks.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Navigator) {
-  RunTestsInFile("navigator_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, ParamsParser) {
-  RunTestsInFile("params_parser_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, ZoomManager) {
-  RunTestsInFile("zoom_manager_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Elements) {
-  // Although this test file does not require a PDF to be loaded, loading the
-  // elements without loading a PDF is difficult.
-  RunTestsInFile("material_elements_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, ToolbarManager) {
-  RunTestsInFile("toolbar_manager_test.js", "test.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, Title) {
-  RunTestsInFile("title_test.js", "test-title.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, WhitespaceTitle) {
-  RunTestsInFile("whitespace_title_test.js", "test-whitespace-title.pdf");
-}
-
-IN_PROC_BROWSER_TEST_F(MaterialPDFExtensionTest, PageChange) {
-  RunTestsInFile("page_change_test.js", "test-bookmarks.pdf");
-}

diff --git a/chrome/browser/pdf/pdf_extension_util.cc b/chrome/browser/pdf/pdf_extension_util.cc
index 1987a68..774bdcf 100644
--- a/chrome/browser/pdf/pdf_extension_util.cc
+++ b/chrome/browser/pdf/pdf_extension_util.cc

@@ -6,7 +6,6 @@
 
 #include "base/strings/string_util.h"
 #include "chrome/common/chrome_content_client.h"
-#include "chrome/common/chrome_switches.h"
 #include "chrome/grit/browser_resources.h"
 #include "ui/base/resource/resource_bundle.h"
 
@@ -16,12 +15,6 @@
 
 // Tags in the manifest to be replaced.
 const char kNameTag[] = "<NAME>";
-const char kIndexTag[] = "<INDEX>";
-
-// The index html pages to load for the material and non-material version of
-// the viewer.
-const char kRegularIndex[] = "index.html";
-const char kMaterialIndex[] = "index-material.html";
 
 }  // namespace
 
@@ -41,10 +34,6 @@
   base::ReplaceFirstSubstringAfterOffset(
       &manifest_contents, 0, kNameTag, ChromeContentClient::kPDFPluginName);
 
-  DCHECK(manifest_contents.find(kIndexTag) != std::string::npos);
-  std::string index = switches::PdfMaterialUIEnabled() ?
-      kMaterialIndex : kRegularIndex;
-  base::ReplaceSubstringsAfterOffset(&manifest_contents, 0, kIndexTag, index);
   return manifest_contents;
 }
 

diff --git a/chrome/browser/resources/component_extension_resources.grd b/chrome/browser/resources/component_extension_resources.grd
index d07c263..0d2eaac 100644
--- a/chrome/browser/resources/component_extension_resources.grd
+++ b/chrome/browser/resources/component_extension_resources.grd

@@ -147,8 +147,6 @@
         <include name="IDR_SETTINGS_APP_JS" file="settings_app/settings_app.js" type="BINDATA" />
       </if>
       <if expr="enable_plugins">
-        <include name="IDR_PDF_INDEX_CSS" file="pdf/index.css" allowexternalscript="true" type="BINDATA" />
-        <include name="IDR_PDF_INDEX_HTML" file="pdf/index.html" allowexternalscript="true" type="BINDATA" />
         <include name="IDR_PDF_INDEX_MATERIAL_CSS" file="pdf/index-material.css" allowexternalscript="true" type="BINDATA" />
         <include name="IDR_PDF_INDEX_MATERIAL_HTML" file="pdf/index-material.html" allowexternalscript="true" type="BINDATA" />
         <include name="IDR_PDF_MAIN_JS" file="pdf/main.js" type="BINDATA" />
@@ -169,15 +167,9 @@
         <include name="IDR_PDF_VIEWER_BOOKMARK_JS" file="pdf/elements/viewer-bookmark/viewer-bookmark.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_BOOKMARKS_CONTENT_HTML" file="pdf/elements/viewer-bookmarks-content/viewer-bookmarks-content.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_BOOKMARKS_CONTENT_JS" file="pdf/elements/viewer-bookmarks-content/viewer-bookmarks-content.js" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_BUTTON_CSS" file="pdf/elements/viewer-button/viewer-button.css" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_BUTTON_HTML" file="pdf/elements/viewer-button/viewer-button.html" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_BUTTON_JS" file="pdf/elements/viewer-button/viewer-button.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_ERROR_SCREEN_CSS" file="pdf/elements/viewer-error-screen/viewer-error-screen.css" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_ERROR_SCREEN_HTML" file="pdf/elements/viewer-error-screen/viewer-error-screen.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_ERROR_SCREEN_JS" file="pdf/elements/viewer-error-screen/viewer-error-screen.js" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_ERROR_SCREEN_LEGACY_CSS" file="pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.css" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_ERROR_SCREEN_LEGACY_HTML" file="pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.html" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_ERROR_SCREEN_LEGACY_JS" file="pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PAGE_INDICATOR_CSS" file="pdf/elements/viewer-page-indicator/viewer-page-indicator.css" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PAGE_INDICATOR_HTML" file="pdf/elements/viewer-page-indicator/viewer-page-indicator.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PAGE_INDICATOR_JS" file="pdf/elements/viewer-page-indicator/viewer-page-indicator.js" type="BINDATA" />
@@ -186,18 +178,9 @@
         <include name="IDR_PDF_VIEWER_PAGE_SELECTOR_JS" file="pdf/elements/viewer-page-selector/viewer-page-selector.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PASSWORD_SCREEN_HTML" file="pdf/elements/viewer-password-screen/viewer-password-screen.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PASSWORD_SCREEN_JS" file="pdf/elements/viewer-password-screen/viewer-password-screen.js" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PASSWORD_SCREEN_LEGACY_CSS" file="pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.css" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PASSWORD_SCREEN_LEGACY_HTML" file="pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.html" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PASSWORD_SCREEN_LEGACY_JS" file="pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PDF_TOOLBAR_CSS" file="pdf/elements/viewer-pdf-toolbar/viewer-pdf-toolbar.css" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PDF_TOOLBAR_HTML" file="pdf/elements/viewer-pdf-toolbar/viewer-pdf-toolbar.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_PDF_TOOLBAR_JS" file="pdf/elements/viewer-pdf-toolbar/viewer-pdf-toolbar.js" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PROGRESS_BAR_CSS" file="pdf/elements/viewer-progress-bar/viewer-progress-bar.css" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PROGRESS_BAR_HTML" file="pdf/elements/viewer-progress-bar/viewer-progress-bar.html" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_PROGRESS_BAR_JS" file="pdf/elements/viewer-progress-bar/viewer-progress-bar.js" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_TOOLBAR_CSS" file="pdf/elements/viewer-toolbar/viewer-toolbar.css" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_TOOLBAR_HTML" file="pdf/elements/viewer-toolbar/viewer-toolbar.html" type="BINDATA" />
-        <include name="IDR_PDF_VIEWER_TOOLBAR_JS" file="pdf/elements/viewer-toolbar/viewer-toolbar.js" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_TOOLBAR_DROPDOWN_CSS" file="pdf/elements/viewer-toolbar-dropdown/viewer-toolbar-dropdown.css" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_TOOLBAR_DROPDOWN_HTML" file="pdf/elements/viewer-toolbar-dropdown/viewer-toolbar-dropdown.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_TOOLBAR_DROPDOWN_JS" file="pdf/elements/viewer-toolbar-dropdown/viewer-toolbar-dropdown.js" type="BINDATA" />
@@ -207,20 +190,6 @@
         <include name="IDR_PDF_VIEWER_ZOOM_SELECTOR_CSS" file="pdf/elements/viewer-zoom-toolbar/viewer-zoom-toolbar.css" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_ZOOM_SELECTOR_HTML" file="pdf/elements/viewer-zoom-toolbar/viewer-zoom-toolbar.html" type="BINDATA" />
         <include name="IDR_PDF_VIEWER_ZOOM_SELECTOR_JS" file="pdf/elements/viewer-zoom-toolbar/viewer-zoom-toolbar.js" type="BINDATA" />
-
-        <!-- Button images. -->
-        <include name="IDR_PDF_BUTTON_LOW_1" file="pdf/elements/viewer-button/img/lowDPI/button_fit_page.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_LOW_2" file="pdf/elements/viewer-button/img/lowDPI/button_fit_width.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_LOW_3" file="pdf/elements/viewer-button/img/lowDPI/button_zoom_out.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_LOW_4" file="pdf/elements/viewer-button/img/lowDPI/button_zoom_in.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_LOW_5" file="pdf/elements/viewer-button/img/lowDPI/button_save.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_LOW_6" file="pdf/elements/viewer-button/img/lowDPI/button_print.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_1" file="pdf/elements/viewer-button/img/hiDPI/button_fit_page.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_2" file="pdf/elements/viewer-button/img/hiDPI/button_fit_width.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_3" file="pdf/elements/viewer-button/img/hiDPI/button_zoom_out.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_4" file="pdf/elements/viewer-button/img/hiDPI/button_zoom_in.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_5" file="pdf/elements/viewer-button/img/hiDPI/button_save.png" type="BINDATA" />
-        <include name="IDR_PDF_BUTTON_HIGH_6" file="pdf/elements/viewer-button/img/hiDPI/button_print.png" type="BINDATA" />
       </if>
       <include name="IDR_CRYPTOTOKEN_UTIL_JS" file="cryptotoken/util.js" type="BINDATA" />
       <include name="IDR_CRYPTOTOKEN_B64_JS" file="cryptotoken/b64.js" type="BINDATA" />

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_page.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_page.png
deleted file mode 100644
index 188cdab..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_page.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_width.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_width.png
deleted file mode 100644
index a3fa6a6f..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_fit_width.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_play.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_play.png
deleted file mode 100644
index cba2c19..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_play.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_print.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_print.png
deleted file mode 100644
index fa53e85..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_print.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_save.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_save.png
deleted file mode 100644
index 7ec211f1..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_save.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_in.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_in.png
deleted file mode 100644
index fdcc5c8..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_in.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_out.png b/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_out.png
deleted file mode 100644
index 4c6a5e0..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/hiDPI/button_zoom_out.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_page.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_page.png
deleted file mode 100644
index 626e3d0..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_page.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_width.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_width.png
deleted file mode 100644
index 00c4f96..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_fit_width.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_play.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_play.png
deleted file mode 100644
index 5fb85b69..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_play.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_print.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_print.png
deleted file mode 100644
index 89b8738..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_print.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_save.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_save.png
deleted file mode 100644
index 4dc1db2..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_save.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_in.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_in.png
deleted file mode 100644
index 1fde30f2..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_in.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_out.png b/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_out.png
deleted file mode 100644
index 0a55eabd..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/img/lowDPI/button_zoom_out.png
+++ /dev/null
Binary files differ

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.css b/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.css
deleted file mode 100644
index d4aff70..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.css
+++ /dev/null

@@ -1,37 +0,0 @@
-/* Copyright 2013 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-#icon {
-  background-position: center center;
-  background-repeat: no-repeat;
-  background-size: 100% 100%;
-  height: 100%;
-  width: 100%;
-}
-
-:host {
-  -webkit-user-select: none;
-  background-image: linear-gradient(rgb(60, 80, 119), rgb(15, 24, 41));
-  border: 1px solid rgb(11, 9, 16);
-  cursor: default;
-  display: inline-block;
-  height: 36px;
-  margin: 0;
-  pointer-events: all;
-  width: 43px;
-}
-
-:host(:focus:host) {
-  outline: none;
-}
-
-:host(:hover:host) {
-  background-image: linear-gradient(rgb(73, 102, 155), rgb(32, 52, 95));
-}
-
-:host(.latchable.polymer-selected:host),
-:host(:active:host) {
-  background-color: rgb(75, 103, 156);
-  background-image: none;
-}

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.html b/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.html
deleted file mode 100644
index 9965142c..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.html
+++ /dev/null

@@ -1,9 +0,0 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="viewer-button">
-  <link rel="import" type="css" href="viewer-button.css">
-  <template>
-    <div id="icon"></div>
-  </template>
-</dom-module>
-<script src="viewer-button.js"></script>

diff --git a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.js b/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.js
deleted file mode 100644
index 063a26e1..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-button/viewer-button.js
+++ /dev/null

@@ -1,47 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-(function() {
-  var dpi = '';
-
-  Polymer({
-    is: 'viewer-button',
-
-    properties: {
-      img: {
-        type: String,
-        observer: 'imgChanged'
-      },
-
-      latchable: {
-        type: Boolean,
-        observer: 'latchableChanged'
-      }
-    },
-
-    created: function() {
-      if (!dpi) {
-        var mql = window.matchMedia('(-webkit-min-device-pixel-ratio: 1.3');
-        dpi = mql.matches ? 'hi' : 'low';
-      }
-    },
-
-    imgChanged: function() {
-      if (this.img) {
-        this.$.icon.style.backgroundImage =
-            'url(' + this.getAttribute('assetpath') + 'img/' + dpi +
-            'DPI/' + this.img + ')';
-      } else {
-        this.$.icon.style.backgroundImage = '';
-      }
-    },
-
-    latchableChanged: function() {
-      if (this.latchable)
-        this.classList.add('latchable');
-      else
-        this.classList.remove('latchable');
-    },
-  });
-})();

diff --git a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.css b/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.css
deleted file mode 100644
index 07ee91d..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.css
+++ /dev/null

@@ -1,22 +0,0 @@
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-:host {
-  background-color: #ccc;
-  color: #555;
-  font-family: sans-serif;
-  font-size: 20px;
-  height: 100%;
-  pointer-events: none;
-  position: fixed;
-  text-align: center;
-  width: 100%;
-}
-
-#load-failed-message {
-  line-height: 0;
-  position: absolute;
-  top: 50%;
-  width: 100%;
-}
\ No newline at end of file

diff --git a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.html b/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.html
deleted file mode 100644
index 57109d0..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.html
+++ /dev/null

@@ -1,9 +0,0 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="viewer-error-screen-legacy">
-  <link rel="import" type="css" href="viewer-error-screen-legacy.css">
-  <template>
-    <div id="load-failed-message">{{text}}</div>
-  </template>
-</dom-module>
-<script src="viewer-error-screen-legacy.js"></script>

diff --git a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.js b/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.js
deleted file mode 100644
index cd09aed..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-error-screen-legacy/viewer-error-screen-legacy.js
+++ /dev/null

@@ -1,14 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Polymer({
-  is: 'viewer-error-screen-legacy',
-  properties: {
-    text: String
-  },
-
-  show: function() {
-    this.style.visibility = 'visible';
-  }
-});

diff --git a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.css b/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.css
deleted file mode 100644
index 83c3fc47..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.css
+++ /dev/null

@@ -1,39 +0,0 @@
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-:host {
-  -webkit-transition: opacity 400ms ease-in-out;
-  background-color: #ccc;
-  color: #555;
-  display: table;
-  font-family: sans-serif;
-  font-size: 15px;
-  height: 100%;
-  pointer-events: none;
-  position: fixed;
-  text-align: center;
-  width: 100%;
-}
-
-#message {
-  padding-bottom: 10px;
-}
-
-.center {
-  display: table-cell;
-  vertical-align: middle;
-}
-
-.form {
-  border: 1px solid #777;
-  box-shadow: 1px 1px 1px;
-  display: inline-block;
-  padding: 10px;
-  width: 300px;
-}
-
-input {
-  color: #333;
-  pointer-events: all;
-}
\ No newline at end of file

diff --git a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.html b/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.html
deleted file mode 100644
index d484620..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.html
+++ /dev/null

@@ -1,15 +0,0 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="viewer-password-screen-legacy">
-  <link rel="import" type="css" href="viewer-password-screen-legacy.css">
-  <template>
-    <div class="center">
-      <form class="form">
-        <div id="message">{{text}}</div>
-        <input id="password" type="password" size="20"></input>
-        <input id="submit" type="submit" on-click="submit"></input>
-      </form>
-    </div>
-  </template>
-</dom-module>
-<script src="viewer-password-screen-legacy.js"></script>

diff --git a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.js b/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.js
deleted file mode 100644
index 8d09e153..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-password-screen-legacy/viewer-password-screen-legacy.js
+++ /dev/null

@@ -1,62 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Polymer({
-  is: 'viewer-password-screen-legacy',
-
-  properties: {
-    text: {
-      type: String,
-      value: 'This document is password protected. Please enter a password.',
-    },
-
-    active: {
-      type: Boolean,
-      value: false,
-      observer: 'activeChanged'
-    }
-  },
-
-  timerId: undefined,
-
-  ready: function() {
-    this.activeChanged();
-  },
-
-  accept: function() {
-    this.active = false;
-  },
-
-  deny: function() {
-    this.$.password.disabled = false;
-    this.$.submit.disabled = false;
-    this.$.password.focus();
-    this.$.password.select();
-  },
-
-  submit: function(e) {
-    // Prevent the default form submission behavior.
-    e.preventDefault();
-    if (this.$.password.value.length == 0)
-      return;
-    this.$.password.disabled = true;
-    this.$.submit.disabled = true;
-    this.fire('password-submitted', {password: this.$.password.value});
-  },
-
-  activeChanged: function() {
-    clearTimeout(this.timerId);
-    this.timerId = undefined;
-    if (this.active) {
-      this.style.visibility = 'visible';
-      this.style.opacity = 1;
-      this.$.password.focus();
-    } else {
-      this.style.opacity = 0;
-      this.timerId = setTimeout(function() {
-        this.style.visibility = 'hidden';
-      }.bind(this), 400);
-    }
-  }
-});

diff --git a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.css b/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.css
deleted file mode 100644
index ecc142b5..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.css
+++ /dev/null

@@ -1,71 +0,0 @@
-/* Copyright 2013 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-:host {
-  -webkit-transition: opacity 400ms ease-in-out;
-  background: rgb(29, 39, 57);
-  border-radius: 5px;
-  bottom: 26px;
-  box-shadow: 0 1px 2px gray, 0 3px 3px rgba(0, 0, 0, .2);
-  height: auto;
-  left: 26px;
-  pointer-events: none;
-  position: fixed;
-  width: auto;
-}
-
-.scaler {
-  -webkit-transform: scale(0.25);
-  -webkit-transform-origin: 0 0;
-  float: left;
-  height: 44px;
-  margin: 8px;
-  width: 44px;
-}
-
-#segments {
-  border-radius: 50%;
-  height: 176px;
-  list-style: none;
-  margin: 0;
-  overflow: hidden;
-  padding: 0;
-  position: absolute;
-  width: 176px;
-}
-
-.segment {
-  -webkit-transform-origin: 0 100%;
-  background: rgb(227, 234, 249);
-  box-shadow: 0 0 0 6px rgb(29, 39, 57) inset;
-  height: 50%;
-  overflow: hidden;
-  position: absolute;
-  right: 0;
-  top: 0;
-  width: 50%;
-}
-
-.center-circle {
-  background-color: rgb(29, 39, 57);
-  border-radius: 50%;
-  height: 80px;
-  left: 48px;
-  margin: 0;
-  padding: 0;
-  position: absolute;
-  top: 48px;
-  width: 80px;
-}
-
-#text {
-  color: rgb(227, 234, 249);
-  float: left;
-  font-family: sans-serif;
-  font-size: 16px;
-  font-weight: bold;
-  line-height: 58px;
-  margin-right: 10px;
-  margin-top: 1px;
-}

diff --git a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.html b/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.html
deleted file mode 100644
index 8dff9f7..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.html
+++ /dev/null

@@ -1,13 +0,0 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="viewer-progress-bar">
-  <link rel="import" type="css" href="viewer-progress-bar.css">
-  <template>
-    <div class="scaler">
-      <ul id="segments"></ul>
-      <div class="center-circle"></div>
-    </div>
-    <div id="text">{{text}}</div>
-  </template>
-</dom-module>
-<script src="viewer-progress-bar.js"></script>

diff --git a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.js b/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.js
deleted file mode 100644
index 710f01e..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-progress-bar/viewer-progress-bar.js
+++ /dev/null

@@ -1,63 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Polymer({
-  is: 'viewer-progress-bar',
-
-  properties: {
-    progress: {
-      type: Number,
-      observer: 'progressChanged'
-    },
-
-    text: {
-      type: String,
-      value: 'Loading'
-    },
-
-    numSegments: {
-      type: Number,
-      value: 8,
-      observer: 'numSegmentsChanged'
-    }
-  },
-
-  segments: [],
-
-  ready: function() {
-    this.numSegmentsChanged();
-  },
-
-  progressChanged: function() {
-    var numVisible = this.progress * this.segments.length / 100.0;
-    for (var i = 0; i < this.segments.length; i++) {
-      this.segments[i].style.visibility =
-          i < numVisible ? 'inherit' : 'hidden';
-    }
-
-    if (this.progress >= 100 || this.progress < 0)
-      this.style.opacity = 0;
-  },
-
-  numSegmentsChanged: function() {
-    // Clear the existing segments.
-    this.segments = [];
-    var segmentsElement = this.$.segments;
-    segmentsElement.innerHTML = '';
-
-    // Create the new segments.
-    var segment = document.createElement('li');
-    segment.classList.add('segment');
-    var angle = 360 / this.numSegments;
-    for (var i = 0; i < this.numSegments; ++i) {
-      var segmentCopy = segment.cloneNode(true);
-      segmentCopy.style.webkitTransform =
-          'rotate(' + (i * angle) + 'deg) skewY(' +
-          -1 * (90 - angle) + 'deg)';
-      segmentsElement.appendChild(segmentCopy);
-      this.segments.push(segmentCopy);
-    }
-    this.progressChanged();
-  }
-});

diff --git a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.css b/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.css
deleted file mode 100644
index 64be0e9f..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.css
+++ /dev/null

@@ -1,21 +0,0 @@
-/* Copyright 2013 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-:host {
-  -webkit-transition: opacity 400ms ease-in-out;
-  bottom: 0;
-  display: block;
-  font-size: 0;
-  opacity: 1;
-  padding: 30px 30px 15px 30vw;
-  pointer-events: none;
-  position: fixed;
-  right: 0;
-}
-
-#toolbar {
-  border-radius: 3px;
-  box-shadow: 0 1px 2px gray, 0 3px 3px rgba(0, 0, 0, .2);
-  overflow: hidden;
-}

diff --git a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.html b/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.html
deleted file mode 100644
index 1a06e1e..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.html
+++ /dev/null

@@ -1,11 +0,0 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
-
-<dom-module id="viewer-toolbar">
-  <link rel="import" type="css" href="viewer-toolbar.css">
-  <template>
-    <div id="toolbar">
-      <content></content>
-    </div>
-  </template>
-</dom-module>
-<script src="viewer-toolbar.js"></script>

diff --git a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.js b/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.js
deleted file mode 100644
index 28f9052..0000000
--- a/chrome/browser/resources/pdf/elements/viewer-toolbar/viewer-toolbar.js
+++ /dev/null

@@ -1,74 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Polymer({
-  is: 'viewer-toolbar',
-
-  properties: {
-    fadingIn: {
-      type: Boolean,
-      value: false,
-      observer: 'fadingInChanged'
-    }
-  },
-
-  timerId_: undefined,
-
-  inInitialFadeIn_: false,
-
-  ready: function() {
-    this.mousemoveCallback = function(e) {
-      var rect = this.getBoundingClientRect();
-      if (e.clientX >= rect.left && e.clientX <= rect.right &&
-          e.clientY >= rect.top && e.clientY <= rect.bottom) {
-        this.fadingIn = true;
-        // If we hover over the toolbar, cancel the initial fade in.
-        if (this.inInitialFadeIn_)
-          this.inInitialFadeIn_ = false;
-      } else {
-        // Initially we want to keep the toolbar up for a longer period.
-        if (!this.inInitialFadeIn_)
-          this.fadingIn = false;
-      }
-    }.bind(this);
-  },
-
-  attached: function() {
-    this.parentNode.addEventListener('mousemove', this.mousemoveCallback);
-  },
-
-  detached: function() {
-    this.parentNode.removeEventListener('mousemove', this.mousemoveCallback);
-  },
-
-  initialFadeIn: function() {
-    this.inInitialFadeIn_ = true;
-    this.fadeIn();
-    this.fadeOutAfterDelay(6000);
-  },
-
-  fadingInChanged: function() {
-    if (this.fadingIn) {
-      this.fadeIn();
-    } else {
-      if (this.timerId_ === undefined)
-        this.fadeOutAfterDelay(3000);
-    }
-  },
-
-  fadeIn: function() {
-    this.style.opacity = 1;
-    clearTimeout(this.timerId_);
-    this.timerId_ = undefined;
-  },
-
-  fadeOutAfterDelay: function(delay) {
-    this.timerId_ = setTimeout(
-      function() {
-        this.style.opacity = 0;
-        this.timerId_ = undefined;
-        this.inInitialFadeIn_ = false;
-      }.bind(this), delay);
-  }
-});

diff --git a/chrome/browser/resources/pdf/index.css b/chrome/browser/resources/pdf/index.css
deleted file mode 100644
index 36db509..0000000
--- a/chrome/browser/resources/pdf/index.css
+++ /dev/null

@@ -1,46 +0,0 @@
-/* Copyright 2014 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-body {
-  background-color: #ccc;
-  margin: 0;
-}
-
-viewer-toolbar {
-  visibility: hidden;
-  white-space: nowrap;
-  z-index: 3;
-}
-
-viewer-page-indicator {
-  visibility: hidden;
-  z-index: 3;
-}
-
-viewer-progress-bar {
-  visibility: hidden;
-  z-index: 3;
-}
-
-viewer-error-screen-legacy {
-  visibility: hidden;
-  z-index: 2;
-}
-
-viewer-password-screen-legacy {
-  visibility: hidden;
-  z-index: 2;
-}
-
-#plugin {
-  height: 100%;
-  position: fixed;
-  width: 100%;
-  z-index: 1;
-}
-
-#sizer {
-  position: absolute;
-  z-index: 0;
-}

diff --git a/chrome/browser/resources/pdf/index.html b/chrome/browser/resources/pdf/index.html
deleted file mode 100644
index cfb3551..0000000
--- a/chrome/browser/resources/pdf/index.html
+++ /dev/null

@@ -1,63 +0,0 @@
-<!doctype html>
-<html i18n-values="dir:textdirection;lang:language">
-<head>
-  <meta charset="utf-8">
-  <script src="chrome://resources/js/polymer_config.js"></script>
-  <link rel="import" href="elements/viewer-button/viewer-button.html">
-  <link rel="import" href="elements/viewer-error-screen-legacy/viewer-error-screen-legacy.html">
-  <link rel="import" href="elements/viewer-page-indicator/viewer-page-indicator.html">
-  <link rel="import" href="elements/viewer-password-screen-legacy/viewer-password-screen-legacy.html">
-  <link rel="import" href="elements/viewer-progress-bar/viewer-progress-bar.html">
-  <link rel="import" href="elements/viewer-toolbar/viewer-toolbar.html">
-  <link rel="stylesheet" href="chrome://resources/css/text_defaults.css">
-  <link rel="stylesheet" type="text/css" href="index.css">
-</head>
-<body>
-
-<div id="sizer"></div>
-<viewer-password-screen-legacy id="password-screen">
-</viewer-password-screen-legacy>
-<viewer-page-indicator id="page-indicator"></viewer-page-indicator>
-<viewer-progress-bar id="progress-bar"></viewer-progress-bar>
-
-<viewer-toolbar id="toolbar">
-  <viewer-button id="fit-to-page-button"
-      assetpath="elements/viewer-button/"
-      img="button_fit_page.png" latchable>
-  </viewer-button>
-  <viewer-button id="fit-to-width-button"
-      assetpath="elements/viewer-button/"
-      img="button_fit_width.png" latchable>
-  </viewer-button>
-  <viewer-button id="zoom-out-button"
-      assetpath="elements/viewer-button/"
-      img="button_zoom_out.png">
-  </viewer-button>
-  <viewer-button id="zoom-in-button"
-      assetpath="elements/viewer-button/"
-      img="button_zoom_in.png">
-  </viewer-button>
-  <viewer-button id="save-button"
-      assetpath="elements/viewer-button/"
-      img="button_save.png">
-  </viewer-button>
-  <viewer-button id="print-button"
-      assetpath="elements/viewer-button/"
-      img="button_print.png">
-  </viewer-button>
-</viewer-toolbar>
-
-<viewer-error-screen-legacy id="error-screen"></viewer-error-screen-legacy>
-
-</body>
-<script src="viewport.js"></script>
-<script src="open_pdf_params_parser.js"></script>
-<script src="navigator.js"></script>
-<script src="viewport_scroller.js"></script>
-<script src="zoom_manager.js"></script>
-<script src="pdf_scripting_api.js"></script>
-<script src="chrome://resources/js/util.js"></script>
-<script src="browser_api.js"></script>
-<script src="pdf.js"></script>
-<script src="main.js"></script>
-</html>

diff --git a/chrome/browser/resources/pdf/manifest.json b/chrome/browser/resources/pdf/manifest.json
index b3c4e94..9bc2307 100644
--- a/chrome/browser/resources/pdf/manifest.json
+++ b/chrome/browser/resources/pdf/manifest.json

@@ -24,8 +24,8 @@
       "js": ["content_script.js"]
     }
   ],
-  "mime_types_handler": "<INDEX>",
+  "mime_types_handler": "index-material.html",
   "web_accessible_resources": [
-    "<INDEX>"
+    "index-material.html"
   ]
 }

diff --git a/chrome/browser/resources/pdf/pdf.js b/chrome/browser/resources/pdf/pdf.js
index 4f85e600..d5ba48f 100644
--- a/chrome/browser/resources/pdf/pdf.js
+++ b/chrome/browser/resources/pdf/pdf.js

@@ -131,16 +131,13 @@
 
   this.isPrintPreview_ = this.browserApi_.getStreamInfo().originalUrl.indexOf(
                              'chrome://print') == 0;
-  this.isMaterial_ = location.pathname.substring(1) === 'index-material.html';
 
   // The sizer element is placed behind the plugin element to cause scrollbars
   // to be displayed in the window. It is sized according to the document size
   // of the pdf and zoom level.
   this.sizer_ = $('sizer');
-  this.toolbar_ = $('toolbar');
-  if (!this.isMaterial_ || this.isPrintPreview_)
+  if (this.isPrintPreview_)
     this.pageIndicator_ = $('page-indicator');
-  this.progressBar_ = $('progress-bar');
   this.passwordScreen_ = $('password-screen');
   this.passwordScreen_.addEventListener('password-submitted',
                                         this.onPasswordSubmitted_.bind(this));
@@ -154,9 +151,9 @@
 
   // Create the viewport.
   var shortWindow = window.innerHeight < PDFViewer.TOOLBAR_WINDOW_MIN_HEIGHT;
-  var topToolbarHeight =
-      (this.isMaterial_ && !this.isPrintPreview_ && !shortWindow) ?
-      PDFViewer.MATERIAL_TOOLBAR_HEIGHT : 0;
+  var topToolbarHeight = (!this.isPrintPreview_ && !shortWindow) ?
+                             PDFViewer.MATERIAL_TOOLBAR_HEIGHT :
+                             0;
   this.viewport_ = new Viewport(window,
                                 this.sizer_,
                                 this.viewportChanged_.bind(this),
@@ -196,8 +193,6 @@
   this.plugin_.setAttribute('headers', headers);
 
   var backgroundColor = PDFViewer.DARK_BACKGROUND_COLOR;
-  if (!this.isMaterial_)
-    backgroundColor = PDFViewer.LIGHT_BACKGROUND_COLOR;
   this.plugin_.setAttribute('background-color', backgroundColor);
   this.plugin_.setAttribute('top-toolbar-height', topToolbarHeight);
 
@@ -206,53 +201,38 @@
   document.body.appendChild(this.plugin_);
 
   // Setup the button event listeners.
-  if (!this.isMaterial_) {
-    $('fit-to-width-button').addEventListener('click',
-        this.viewport_.fitToWidth.bind(this.viewport_));
-    $('fit-to-page-button').addEventListener('click',
-        this.viewport_.fitToPage.bind(this.viewport_));
-    $('zoom-in-button').addEventListener('click',
-        this.viewport_.zoomIn.bind(this.viewport_));
-    $('zoom-out-button').addEventListener('click',
-        this.viewport_.zoomOut.bind(this.viewport_));
-    $('save-button').addEventListener('click', this.save_.bind(this));
-    $('print-button').addEventListener('click', this.print_.bind(this));
+  this.zoomToolbar_ = $('zoom-toolbar');
+  this.zoomToolbar_.addEventListener('fit-to-width',
+      this.viewport_.fitToWidth.bind(this.viewport_));
+  this.zoomToolbar_.addEventListener('fit-to-page',
+      this.fitToPage_.bind(this));
+  this.zoomToolbar_.addEventListener('zoom-in',
+      this.viewport_.zoomIn.bind(this.viewport_));
+  this.zoomToolbar_.addEventListener('zoom-out',
+      this.viewport_.zoomOut.bind(this.viewport_));
+
+  if (!this.isPrintPreview_) {
+    this.materialToolbar_ = $('material-toolbar');
+    this.materialToolbar_.hidden = false;
+    this.materialToolbar_.addEventListener('save', this.save_.bind(this));
+    this.materialToolbar_.addEventListener('print', this.print_.bind(this));
+    this.materialToolbar_.addEventListener('rotate-right',
+        this.rotateClockwise_.bind(this));
+    // Must attach to mouseup on the plugin element, since it eats mousedown
+    // and click events.
+    this.plugin_.addEventListener('mouseup',
+        this.materialToolbar_.hideDropdowns.bind(this.materialToolbar_));
+
+    this.materialToolbar_.docTitle =
+        getFilenameFromURL(this.browserApi_.getStreamInfo().originalUrl);
   }
 
-  if (this.isMaterial_) {
-    this.zoomToolbar_ = $('zoom-toolbar');
-    this.zoomToolbar_.addEventListener('fit-to-width',
-        this.viewport_.fitToWidth.bind(this.viewport_));
-    this.zoomToolbar_.addEventListener('fit-to-page',
-        this.fitToPage_.bind(this));
-    this.zoomToolbar_.addEventListener('zoom-in',
-        this.viewport_.zoomIn.bind(this.viewport_));
-    this.zoomToolbar_.addEventListener('zoom-out',
-        this.viewport_.zoomOut.bind(this.viewport_));
+  document.body.addEventListener('change-page', function(e) {
+    this.viewport_.goToPage(e.detail.page);
+  }.bind(this));
 
-    if (!this.isPrintPreview_) {
-      this.materialToolbar_ = $('material-toolbar');
-      this.materialToolbar_.hidden = false;
-      this.materialToolbar_.addEventListener('save', this.save_.bind(this));
-      this.materialToolbar_.addEventListener('print', this.print_.bind(this));
-      this.materialToolbar_.addEventListener('rotate-right',
-          this.rotateClockwise_.bind(this));
-      // Must attach to mouseup on the plugin element, since it eats mousedown
-      // and click events.
-      this.plugin_.addEventListener('mouseup',
-          this.materialToolbar_.hideDropdowns.bind(this.materialToolbar_));
-
-      this.materialToolbar_.docTitle =
-          getFilenameFromURL(this.browserApi_.getStreamInfo().originalUrl);
-    }
-
-    document.body.addEventListener('change-page', function(e) {
-      this.viewport_.goToPage(e.detail.page);
-    }.bind(this));
-
-    this.toolbarManager_ =
-        new ToolbarManager(window, this.materialToolbar_, this.zoomToolbar_);
-  }
+  this.toolbarManager_ =
+      new ToolbarManager(window, this.materialToolbar_, this.zoomToolbar_);
 
   // Set up the ZoomManager.
   this.zoomManager_ = new ZoomManager(
@@ -301,8 +281,7 @@
     if (shouldIgnoreKeyEvents(document.activeElement) || e.defaultPrevented)
       return;
 
-    if (this.isMaterial_)
-      this.toolbarManager_.hideToolbarsAfterTimeout(e);
+    this.toolbarManager_.hideToolbarsAfterTimeout(e);
 
     var pageUpHandler = function() {
       // Go to the previous page if we are fit-to-page.
@@ -332,7 +311,7 @@
         this.toolbarManager_.showToolbarsForKeyboardNavigation();
         return;
       case 27:  // Escape key.
-        if (this.isMaterial_ && !this.isPrintPreview_) {
+        if (!this.isPrintPreview_) {
           this.toolbarManager_.hideSingleToolbarLayer();
           return;
         }
@@ -401,8 +380,7 @@
         }
         return;
       case 71: // g key.
-        if (this.isMaterial_ && this.materialToolbar_ &&
-            (e.ctrlKey || e.metaKey)) {
+        if (this.materialToolbar_ && (e.ctrlKey || e.metaKey)) {
           this.toolbarManager_.showToolbars();
           this.materialToolbar_.selectPageNumber();
           // To prevent the default "find text" behaviour in Chrome.
@@ -425,7 +403,7 @@
         type: 'sendKeyEvent',
         keyEvent: SerializeKeyEvent(e)
       });
-    } else if (this.isMaterial_) {
+    } else {
       // Show toolbars as a fallback.
       if (!(e.shiftKey || e.ctrlKey || e.altKey))
         this.toolbarManager_.showToolbars();
@@ -433,12 +411,10 @@
   },
 
   handleMouseEvent_: function(e) {
-    if (this.isMaterial_) {
-      if (e.type == 'mousemove')
-        this.toolbarManager_.handleMouseMove(e);
-      else if (e.type == 'mouseout')
-        this.toolbarManager_.hideToolbarsForMouseOut();
-    }
+    if (e.type == 'mousemove')
+      this.toolbarManager_.handleMouseMove(e);
+    else if (e.type == 'mouseout')
+      this.toolbarManager_.hideToolbarsForMouseOut();
   },
 
   /**
@@ -541,19 +517,13 @@
    * @param {number} progress the progress as a percentage.
    */
   updateProgress_: function(progress) {
-    if (this.isMaterial_) {
-      if (this.materialToolbar_)
-        this.materialToolbar_.loadProgress = progress;
-    } else {
-      this.progressBar_.progress = progress;
-    }
+    if (this.materialToolbar_)
+      this.materialToolbar_.loadProgress = progress;
 
     if (progress == -1) {
       // Document load failed.
       this.errorScreen_.show();
       this.sizer_.style.display = 'none';
-      if (!this.isMaterial_)
-        this.toolbar_.style.visibility = 'hidden';
       if (this.passwordScreen_.active) {
         this.passwordScreen_.deny();
         this.passwordScreen_.active = false;
@@ -572,8 +542,7 @@
       while (this.delayedScriptingMessages_.length > 0)
         this.handleScriptingMessage(this.delayedScriptingMessages_.shift());
 
-      if (this.isMaterial_)
-        this.toolbarManager_.hideToolbarsAfterTimeout();
+      this.toolbarManager_.hideToolbarsAfterTimeout();
     }
   },
 
@@ -584,17 +553,9 @@
    * @param {Object} strings Dictionary of translated strings
    */
   handleStrings_: function(strings) {
-    if (this.isMaterial_) {
-      window.loadTimeData.data = strings;
-      i18nTemplate.process(document, loadTimeData);
-      this.zoomToolbar_.updateTooltips();
-    } else {
-      this.passwordScreen_.text = strings.passwordPrompt;
-      this.progressBar_.text = strings.pageLoading;
-      if (!this.isPrintPreview_)
-        this.progressBar_.style.visibility = 'visible';
-      this.errorScreen_.text = strings.pageLoadFailed;
-    }
+    window.loadTimeData.data = strings;
+    i18nTemplate.process(document, loadTimeData);
+    this.zoomToolbar_.updateTooltips();
   },
 
   /**
@@ -628,13 +589,9 @@
         if (this.pageIndicator_)
           this.pageIndicator_.initialFadeIn();
 
-        if (this.isMaterial_) {
-          if (this.materialToolbar_) {
-            this.materialToolbar_.docLength =
-                this.documentDimensions_.pageDimensions.length;
-          }
-        } else {
-          this.toolbar_.initialFadeIn();
+        if (this.materialToolbar_) {
+          this.materialToolbar_.docLength =
+              this.documentDimensions_.pageDimensions.length;
         }
         break;
       case 'email':
@@ -689,7 +646,7 @@
               getFilenameFromURL(this.browserApi_.getStreamInfo().originalUrl);
         }
         this.bookmarks_ = message.data.bookmarks;
-        if (this.isMaterial_ && this.materialToolbar_) {
+        if (this.materialToolbar_) {
           this.materialToolbar_.docTitle = document.title;
           this.materialToolbar_.bookmarks = this.bookmarks;
         }
@@ -743,54 +700,28 @@
     if (!this.documentDimensions_)
       return;
 
-    // Update the buttons selected.
-    if (!this.isMaterial_) {
-      $('fit-to-page-button').classList.remove('polymer-selected');
-      $('fit-to-width-button').classList.remove('polymer-selected');
-      if (this.viewport_.fittingType == Viewport.FittingType.FIT_TO_PAGE) {
-        $('fit-to-page-button').classList.add('polymer-selected');
-      } else if (this.viewport_.fittingType ==
-                 Viewport.FittingType.FIT_TO_WIDTH) {
-        $('fit-to-width-button').classList.add('polymer-selected');
-      }
-    }
-
     // Offset the toolbar position so that it doesn't move if scrollbars appear.
     var hasScrollbars = this.viewport_.documentHasScrollbars();
     var scrollbarWidth = this.viewport_.scrollbarWidth;
     var verticalScrollbarWidth = hasScrollbars.vertical ? scrollbarWidth : 0;
     var horizontalScrollbarWidth =
         hasScrollbars.horizontal ? scrollbarWidth : 0;
-    if (this.isMaterial_) {
-      // Shift the zoom toolbar to the left by half a scrollbar width. This
-      // gives a compromise: if there is no scrollbar visible then the toolbar
-      // will be half a scrollbar width further left than the spec but if there
-      // is a scrollbar visible it will be half a scrollbar width further right
-      // than the spec. In RTL layout, the zoom toolbar is on the left side, but
-      // the scrollbar is still on the right, so this is not necessary.
-      if (!isRTL()) {
-        this.zoomToolbar_.style.right = -verticalScrollbarWidth +
-            (scrollbarWidth / 2) + 'px';
-      }
-      // Having a horizontal scrollbar is much rarer so we don't offset the
-      // toolbar from the bottom any more than what the spec says. This means
-      // that when there is a scrollbar visible, it will be a full scrollbar
-      // width closer to the bottom of the screen than usual, but this is ok.
-      this.zoomToolbar_.style.bottom = -horizontalScrollbarWidth + 'px';
-    } else {
-      var toolbarRight = Math.max(PDFViewer.MIN_TOOLBAR_OFFSET, scrollbarWidth);
-      var toolbarBottom =
-          Math.max(PDFViewer.MIN_TOOLBAR_OFFSET, scrollbarWidth);
-      toolbarRight -= verticalScrollbarWidth;
-      toolbarBottom -= horizontalScrollbarWidth;
-      this.toolbar_.style.right = toolbarRight + 'px';
-      this.toolbar_.style.bottom = toolbarBottom + 'px';
-      // Hide the toolbar if it doesn't fit in the viewport.
-      if (this.toolbar_.offsetLeft < 0 || this.toolbar_.offsetTop < 0)
-        this.toolbar_.style.visibility = 'hidden';
-      else
-        this.toolbar_.style.visibility = 'visible';
+
+    // Shift the zoom toolbar to the left by half a scrollbar width. This
+    // gives a compromise: if there is no scrollbar visible then the toolbar
+    // will be half a scrollbar width further left than the spec but if there
+    // is a scrollbar visible it will be half a scrollbar width further right
+    // than the spec. In RTL layout, the zoom toolbar is on the left side, but
+    // the scrollbar is still on the right, so this is not necessary.
+    if (!isRTL()) {
+      this.zoomToolbar_.style.right = -verticalScrollbarWidth +
+          (scrollbarWidth / 2) + 'px';
     }
+    // Having a horizontal scrollbar is much rarer so we don't offset the
+    // toolbar from the bottom any more than what the spec says. This means
+    // that when there is a scrollbar visible, it will be a full scrollbar
+    // width closer to the bottom of the screen than usual, but this is ok.
+    this.zoomToolbar_.style.bottom = -horizontalScrollbarWidth + 'px';
 
     // Update the page indicator.
     var visiblePage = this.viewport_.getMostVisiblePage();

diff --git a/chrome/browser/resources/pdf/pdf_scripting_api.js b/chrome/browser/resources/pdf/pdf_scripting_api.js
index 06fc8b5..356edcd 100644
--- a/chrome/browser/resources/pdf/pdf_scripting_api.js
+++ b/chrome/browser/resources/pdf/pdf_scripting_api.js

@@ -274,23 +274,12 @@
   // Prevent the frame from being tab-focusable.
   iframe.setAttribute('tabindex', '-1');
 
-  // TODO(raymes): This below is a hack to tell if the material design PDF UI
-  // has been enabled. Remove this as soon as we remove the material design PDF
-  // flag.
-  var EXTENSION_URL = 'chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/';
-  var PAGE_NAME = 'index.html';
-  var MATERIAL_PAGE_NAME = 'index-material.html';
-  fetch(EXTENSION_URL + PAGE_NAME, {
-    method: 'get'
-  }).then(function() {
-    iframe.setAttribute('src', EXTENSION_URL + PAGE_NAME + '?' + src);
-  }, function() {
-    iframe.setAttribute('src', EXTENSION_URL + MATERIAL_PAGE_NAME + '?' + src);
-  }).then(function() {
-    iframe.onload = function() {
-      client.setPlugin(iframe.contentWindow);
-    };
-  });
+  var EXTENSION_URL =
+      'chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index-material.html';
+  iframe.setAttribute('src', EXTENSION_URL + '?' + src);
+  iframe.onload = function() {
+    client.setPlugin(iframe.contentWindow);
+  };
 
   // Add the functions to the iframe so that they can be called directly.
   iframe.setViewportChangedCallback =

diff --git a/chrome/browser/ui/webui/options/chromeos/keyboard_handler.cc b/chrome/browser/ui/webui/options/chromeos/keyboard_handler.cc
index 23f4045..563342e 100644
--- a/chrome/browser/ui/webui/options/chromeos/keyboard_handler.cc
+++ b/chrome/browser/ui/webui/options/chromeos/keyboard_handler.cc

@@ -35,6 +35,8 @@
     chromeos::input_method::kCapsLockKey },
   { IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_ESCAPE,
     chromeos::input_method::kEscapeKey },
+  { IDS_OPTIONS_SETTINGS_LANGUAGES_KEY_BACKSPACE,
+    chromeos::input_method::kBackspaceKey },
 };
 
 const char* kDataValuesNames[] = {
@@ -128,10 +130,12 @@
       const input_method::ModifierKey value =
           kModifierKeysSelectItems[j].value;
       const int message_id = kModifierKeysSelectItems[j].message_id;
-      // Only the seach key can be remapped to the caps lock key.
+      // Only the seach/caps-lock key can be remapped to the
+      // caps-lock/backspace key.
       if (kDataValuesNames[i] != std::string("remapSearchKeyToValue") &&
           kDataValuesNames[i] != std::string("remapCapsLockKeyToValue") &&
-          value == input_method::kCapsLockKey) {
+          (value == input_method::kCapsLockKey ||
+           value == input_method::kBackspaceKey)) {
         continue;
       }
       base::ListValue* option = new base::ListValue();

diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
index 9c79ff1..1912a22 100644
--- a/chrome/common/BUILD.gn
+++ b/chrome/common/BUILD.gn

@@ -83,7 +83,6 @@
     "//components/metrics",
     "//components/metrics:net",
     "//components/nacl/common:process_type",
-    "//components/nacl/common:switches",
     "//components/omnibox/common",
     "//components/policy:policy_component_common",
     "//components/strings",
@@ -191,7 +190,7 @@
   }
 
   if (enable_nacl) {
-    public_deps += [ "//components/nacl/common" ]
+    public_deps += [ "//components/nacl:nacl_common" ]
   }
 
   # Printing.
@@ -334,10 +333,13 @@
     "//base",
     "//base/third_party/dynamic_annotations",
     "//components/bookmarks/common",
-    "//components/nacl/common:switches",
     "//third_party/widevine/cdm:version_h",
   ]
 
+  if (enable_nacl) {
+    deps += [ "//components/nacl:nacl_switches" ]
+  }
+
   if (is_android) {
     # This dependency must only be added for Android.
     #

diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 6907863..c9c92498 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc

@@ -302,9 +302,6 @@
 const char kDisablePasswordManagerReauthentication[] =
     "disable-password-manager-reauthentication";
 
-// Disable the new material UI - requires out of process PDF plugin.
-const char kDisablePdfMaterialUI[]          = "disable-pdf-material-ui";
-
 // Disables the Permissions Blacklist, which blocks access to permissions
 // for blacklisted sites.
 const char kDisablePermissionsBlacklist[] = "disable-permissions-blacklist";
@@ -466,9 +463,6 @@
 // Enables panels (always on-top docked pop-up windows).
 const char kEnablePanels[]                  = "enable-panels";
 
-// Enable the new material UI - requires out of process PDF plugin.
-const char kEnablePdfMaterialUI[]           = "enable-pdf-material-ui";
-
 // Enables the Permissions Blacklist, which blocks access to permissions
 // for blacklisted sites.
 const char kEnablePermissionsBlacklist[] = "enable-permissions-blacklist";
@@ -1356,17 +1350,6 @@
       ::switches::kEnableMaterialDesignPolicyPage);
 }
 
-bool PdfMaterialUIEnabled() {
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(kEnablePdfMaterialUI))
-    return true;
-
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(kDisablePdfMaterialUI))
-    return false;
-
-  // Default.
-  return true;
-}
-
 bool SettingsWindowEnabled() {
 #if defined(OS_CHROMEOS)
   return !base::CommandLine::ForCurrentProcess()->HasSwitch(

diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index 31de3964..22914f1d 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h

@@ -88,7 +88,6 @@
 extern const char kDisableOfflineAutoReloadVisibleOnly[];
 extern const char kDisableOutOfProcessPac[];
 extern const char kDisablePasswordManagerReauthentication[];
-extern const char kDisablePdfMaterialUI[];
 extern const char kDisablePermissionsBlacklist[];
 extern const char kDisablePopupBlocking[];
 extern const char kDisablePreconnect[];
@@ -135,7 +134,6 @@
 extern const char kEnableOfflineAutoReload[];
 extern const char kEnableOfflineAutoReloadVisibleOnly[];
 extern const char kEnablePanels[];
-extern const char kEnablePdfMaterialUI[];
 extern const char kEnablePermissionsBlacklist[];
 extern const char kEnablePotentiallyAnnoyingSecurityFeatures[];
 extern const char kEnablePowerOverlay[];

diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
index 41b08b7..5882515 100644
--- a/chrome/renderer/BUILD.gn
+++ b/chrome/renderer/BUILD.gn

@@ -79,8 +79,8 @@
 
   if (enable_nacl) {
     deps += [
-      "//components/nacl/loader",
-      "//components/nacl/renderer",
+      "//components/nacl",
+      "//components/nacl:nacl_renderer",
     ]
   }
 

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index f393d0e..8168d92b 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -447,8 +447,8 @@
 
       if (enable_nacl) {
         data_deps += [
-          "//components/nacl/loader:nacl_helper",
-          "//components/nacl/loader:helper_nonsfi",
+          "//components/nacl:nacl_helper",
+          "//components/nacl:helper_nonsfi",
         ]
       }
 

diff --git a/chrome/test/chromedriver/net/url_request_context_getter.cc b/chrome/test/chromedriver/net/url_request_context_getter.cc
index 2d7b47c..187a2f6 100644
--- a/chrome/test/chromedriver/net/url_request_context_getter.cc
+++ b/chrome/test/chromedriver/net/url_request_context_getter.cc

@@ -6,6 +6,7 @@
 
 #include <string>
 
+#include "base/memory/scoped_ptr.h"
 #include "net/proxy/proxy_config_service_fixed.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"

diff --git a/chrome/test/chromedriver/test/run_py_tests.py b/chrome/test/chromedriver/test/run_py_tests.py
index 668de9a2..c785099 100755
--- a/chrome/test/chromedriver/test/run_py_tests.py
+++ b/chrome/test/chromedriver/test/run_py_tests.py

@@ -38,10 +38,9 @@
 
 if util.IsLinux():
   sys.path.insert(0, os.path.join(chrome_paths.GetSrc(), 'build', 'android'))
+  from devil.android import device_utils
+  from devil.android import forwarder
   from pylib import constants
-  from pylib import forwarder
-  from pylib import valgrind_tools
-  from pylib.device import device_utils
 
 
 _NEGATIVE_FILTER = [

diff --git a/chrome/test/chromedriver/test/test_environment.py b/chrome/test/chromedriver/test/test_environment.py
index be7061a6..9f7bdea3 100644
--- a/chrome/test/chromedriver/test/test_environment.py
+++ b/chrome/test/chromedriver/test/test_environment.py

@@ -19,10 +19,9 @@
 
 if util.IsLinux():
   sys.path.insert(0, os.path.join(chrome_paths.GetSrc(), 'build', 'android'))
-  from pylib import forwarder
-  from pylib import valgrind_tools
-  from pylib.device import device_errors
-  from pylib.device import device_utils
+  from devil.android import device_errors
+  from devil.android import device_utils
+  from devil.android import forwarder
 
 ANDROID_TEST_HTTP_PORT = 2311
 ANDROID_TEST_HTTPS_PORT = 2411

diff --git a/chrome/test/data/nacl/BUILD.gn b/chrome/test/data/nacl/BUILD.gn
index 97d6484..07e9135 100644
--- a/chrome/test/data/nacl/BUILD.gn
+++ b/chrome/test/data/nacl/BUILD.gn

@@ -150,19 +150,13 @@
                                [
                                  "cflags",
                                  "ldflags",
+                                 "libs",
                                ])
         deps = [
           "//ppapi:ppapi_cpp_lib",
           "//ppapi/native_client:ppapi_lib",
         ]
-        if (is_nacl_glibc) {
-          ldflags = [ "-pthread" ]
-        } else {
-          deps += [
-            "//native_client/src/untrusted/nacl",
-            "//native_client/src/untrusted/pthread",
-          ]
-        }
+        ldflags = [ "-pthread" ]
         if (defined(invoker.deps)) {
           deps += invoker.deps
         }
@@ -386,8 +380,8 @@
     ]
     deps = [
       ":ppapi_test_lib",
-      "//native_client/src/untrusted/nacl:nacl_exception",
     ]
+    libs = [ "nacl_exception" ]
     test_files = [ "irt_exception/irt_exception_test.html" ]
   }
 }

diff --git a/chrome/test/data/pdf/basic_test.js b/chrome/test/data/pdf/basic_test.js
deleted file mode 100644
index 222d317..0000000
--- a/chrome/test/data/pdf/basic_test.js
+++ /dev/null

@@ -1,41 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var tests = [
-  /**
-   * Test that some key elements exist and that they have the appropriate
-   * constructor name. This verifies that polymer is working correctly.
-   */
-  function testHasElements() {
-    var elementNames = [
-      'viewer-toolbar',
-      'viewer-page-indicator',
-      'viewer-progress-bar',
-      'viewer-password-screen-legacy',
-      'viewer-error-screen-legacy'
-    ];
-    for (var i = 0; i < elementNames.length; i++) {
-      var elements = document.querySelectorAll(elementNames[i]);
-      chrome.test.assertEq(1, elements.length);
-      var element = elements[0];
-      chrome.test.assertTrue(
-          String(element.constructor).indexOf(elementNames[i]) != -1);
-    }
-    chrome.test.succeed();
-  },
-
-  /**
-   * Test that the plugin element exists and is navigated to the correct URL.
-   */
-  function testPluginElement() {
-    var plugin = document.getElementById('plugin');
-    chrome.test.assertEq('embed', plugin.localName);
-
-    chrome.test.assertTrue(
-        plugin.getAttribute('src').indexOf('/pdf/test.pdf') != -1);
-    chrome.test.succeed();
-  },
-];
-
-chrome.test.runTests(tests);

diff --git a/chromecast/browser/media/cma_message_filter_host.cc b/chromecast/browser/media/cma_message_filter_host.cc
index 96136b5f..0a737cbb 100644
--- a/chromecast/browser/media/cma_message_filter_host.cc
+++ b/chromecast/browser/media/cma_message_filter_host.cc

@@ -350,6 +350,8 @@
   }
 
   AvPipelineClient client;
+  client.wait_for_key_cb = ::media::BindToCurrentLoop(base::Bind(
+      &CmaMessageFilterHost::OnWaitForKey, weak_this_, media_id, track_id));
   client.eos_cb = ::media::BindToCurrentLoop(base::Bind(
       &CmaMessageFilterHost::OnEos, weak_this_, media_id, track_id));
   client.playback_error_cb = ::media::BindToCurrentLoop(base::Bind(
@@ -380,6 +382,9 @@
   }
 
   VideoPipelineClient client;
+  client.av_pipeline_client.wait_for_key_cb = ::media::BindToCurrentLoop(
+      base::Bind(&CmaMessageFilterHost::OnWaitForKey, weak_this_,
+                 media_id, track_id));
   client.av_pipeline_client.eos_cb = ::media::BindToCurrentLoop(
       base::Bind(&CmaMessageFilterHost::OnEos, weak_this_,
                  media_id, track_id));
@@ -498,6 +503,11 @@
   Send(new CmaMsg_BufferingNotification(media_id, state));
 }
 
+void CmaMessageFilterHost::OnWaitForKey(int media_id, TrackId track_id) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+  Send(new CmaMsg_WaitForKey(media_id, track_id));
+}
+
 void CmaMessageFilterHost::OnEos(int media_id, TrackId track_id) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
   Send(new CmaMsg_Eos(media_id, track_id));

diff --git a/chromecast/browser/media/cma_message_filter_host.h b/chromecast/browser/media/cma_message_filter_host.h
index 6a1d6f2c..acaafe3 100644
--- a/chromecast/browser/media/cma_message_filter_host.h
+++ b/chromecast/browser/media/cma_message_filter_host.h

@@ -101,6 +101,7 @@
                     base::TimeDelta max_media_time,
                     base::TimeTicks stc);
   void OnBufferingNotification(int media_id, ::media::BufferingState state);
+  void OnWaitForKey(int media_id, TrackId track_id);
   void OnEos(int media_id, TrackId track_id);
   void OnPlaybackError(int media_id, TrackId track_id,
                        ::media::PipelineStatus status);

diff --git a/chromecast/common/media/cma_messages.h b/chromecast/common/media/cma_messages.h
index 1649cc0..e273a68 100644
--- a/chromecast/common/media/cma_messages.h
+++ b/chromecast/common/media/cma_messages.h

@@ -92,6 +92,9 @@
                      int /* Media pipeline ID */,
                      chromecast::media::TrackId /* Track ID */)
 
+IPC_MESSAGE_CONTROL2(CmaMsg_WaitForKey,
+                     int /* Media pipeline ID */,
+                     chromecast::media::TrackId /* Track ID */)
 IPC_MESSAGE_CONTROL2(CmaMsg_Eos,
                      int /* Media pipeline ID */,
                      chromecast::media::TrackId /* Track ID */)

diff --git a/chromecast/media/cma/pipeline/av_pipeline_client.h b/chromecast/media/cma/pipeline/av_pipeline_client.h
index 6928716..14525c6 100644
--- a/chromecast/media/cma/pipeline/av_pipeline_client.h
+++ b/chromecast/media/cma/pipeline/av_pipeline_client.h

@@ -19,6 +19,9 @@
   AvPipelineClient();
   ~AvPipelineClient();
 
+  // Decryption key status notification.
+  base::Closure wait_for_key_cb;
+
   // End of stream notification.
   base::Closure eos_cb;
 

diff --git a/chromecast/media/cma/pipeline/av_pipeline_impl.cc b/chromecast/media/cma/pipeline/av_pipeline_impl.cc
index ee2d97c0..71b29f1 100644
--- a/chromecast/media/cma/pipeline/av_pipeline_impl.cc
+++ b/chromecast/media/cma/pipeline/av_pipeline_impl.cc

@@ -250,6 +250,8 @@
       CMALOG(kLogControl) << "frame(pts=" << pending_buffer_->timestamp()
                           << "): waiting for key id "
                           << base::HexEncode(&key_id[0], key_id.size());
+      if (!client_.wait_for_key_cb.is_null())
+        client_.wait_for_key_cb.Run();
       return;
     }
 

diff --git a/chromecast/media/cma/pipeline/media_pipeline_impl.cc b/chromecast/media/cma/pipeline/media_pipeline_impl.cc
index 05fffcd..3f96cb0 100644
--- a/chromecast/media/cma/pipeline/media_pipeline_impl.cc
+++ b/chromecast/media/cma/pipeline/media_pipeline_impl.cc

@@ -59,7 +59,7 @@
       backend_initialized_(false),
       paused_(false),
       target_playback_rate_(1.0f),
-      enable_time_update_(false),
+      backend_started_(false),
       pending_time_update_task_(false),
       statistics_rolling_counter_(0),
       weak_factory_(this) {
@@ -201,7 +201,7 @@
   }
 
   // Enable time updates.
-  enable_time_update_ = true;
+  backend_started_ = true;
   statistics_rolling_counter_ = 0;
   if (!pending_time_update_task_) {
     pending_time_update_task_ = true;
@@ -236,8 +236,7 @@
   DCHECK(audio_pipeline_ || video_pipeline_);
   DCHECK(!pending_flush_callbacks_);
 
-  // No need to update media time anymore.
-  enable_time_update_ = false;
+  backend_started_ = false;
 
   buffering_controller_->Reset();
 
@@ -286,9 +285,7 @@
   // audio/video pipelines. This will ensure A/V Flush won't happen in
   // stopped state.
   pending_flush_callbacks_.reset();
-
-  // No need to update media time anymore.
-  enable_time_update_ = false;
+  backend_started_ = false;
 
   // Stop both the audio and video pipeline.
   if (audio_pipeline_)
@@ -307,6 +304,8 @@
   CMALOG(kLogControl) << __FUNCTION__ << " rate=" << rate;
   DCHECK(thread_checker_.CalledOnValidThread());
   target_playback_rate_ = rate;
+  if (!backend_started_)
+    return;
   if (buffering_controller_ && buffering_controller_->IsBuffering())
     return;
 
@@ -370,7 +369,7 @@
 
 void MediaPipelineImpl::UpdateMediaTime() {
   pending_time_update_task_ = false;
-  if (!enable_time_update_)
+  if (!backend_started_)
     return;
 
   if (statistics_rolling_counter_ == 0) {

diff --git a/chromecast/media/cma/pipeline/media_pipeline_impl.h b/chromecast/media/cma/pipeline/media_pipeline_impl.h
index 5ca8ea4..df0ce67 100644
--- a/chromecast/media/cma/pipeline/media_pipeline_impl.h
+++ b/chromecast/media/cma/pipeline/media_pipeline_impl.h

@@ -96,8 +96,7 @@
   float target_playback_rate_;
 
   // The media time is retrieved at regular intervals.
-  // Indicate whether time update is enabled.
-  bool enable_time_update_;
+  bool backend_started_;  // Whether or not the backend is playing/paused.
   bool pending_time_update_task_;
   base::TimeDelta last_media_time_;
 

diff --git a/chromecast/renderer/media/cma_message_filter_proxy.cc b/chromecast/renderer/media/cma_message_filter_proxy.cc
index c502ea2..c1e2c89 100644
--- a/chromecast/renderer/media/cma_message_filter_proxy.cc
+++ b/chromecast/renderer/media/cma_message_filter_proxy.cc

@@ -113,6 +113,7 @@
     IPC_MESSAGE_HANDLER(CmaMsg_NotifyPipeRead, OnPipeRead)
     IPC_MESSAGE_HANDLER(CmaMsg_MediaStateChanged, OnMediaStateChanged)
     IPC_MESSAGE_HANDLER(CmaMsg_TrackStateChanged, OnTrackStateChanged)
+    IPC_MESSAGE_HANDLER(CmaMsg_WaitForKey, OnWaitForKey)
     IPC_MESSAGE_HANDLER(CmaMsg_Eos, OnEos)
     IPC_MESSAGE_HANDLER(CmaMsg_TimeUpdate, OnTimeUpdate)
     IPC_MESSAGE_HANDLER(CmaMsg_BufferingNotification, OnBufferingNotification)
@@ -192,6 +193,17 @@
     cb.Run(status);
 }
 
+void CmaMessageFilterProxy::OnWaitForKey(int id, TrackId track_id) {
+  DelegateEntry* entry = delegates_.Lookup(id);
+  if (!entry)
+    return;
+  const base::Closure& cb = (track_id == kAudioTrackId) ?
+      entry->audio_delegate.client.wait_for_key_cb :
+      entry->video_delegate.client.av_pipeline_client.wait_for_key_cb;
+  if (!cb.is_null())
+    cb.Run();
+}
+
 void CmaMessageFilterProxy::OnEos(int id, TrackId track_id) {
   DelegateEntry* entry = delegates_.Lookup(id);
   if (!entry)

diff --git a/chromecast/renderer/media/cma_message_filter_proxy.h b/chromecast/renderer/media/cma_message_filter_proxy.h
index ab007118..360f930 100644
--- a/chromecast/renderer/media/cma_message_filter_proxy.h
+++ b/chromecast/renderer/media/cma_message_filter_proxy.h

@@ -103,6 +103,7 @@
   void OnMediaStateChanged(int id, ::media::PipelineStatus status);
   void OnTrackStateChanged(int id, TrackId track_id,
                            ::media::PipelineStatus status);
+  void OnWaitForKey(int id, TrackId track_id);
   void OnEos(int id, TrackId track_id);
   void OnTimeUpdate(int id,
                     base::TimeDelta time,

diff --git a/chromecast/renderer/media/cma_renderer.cc b/chromecast/renderer/media/cma_renderer.cc
index 0ba2b28..a2cdf74 100644
--- a/chromecast/renderer/media/cma_renderer.cc
+++ b/chromecast/renderer/media/cma_renderer.cc

@@ -110,7 +110,6 @@
   buffering_state_cb_ = buffering_state_cb;
   ended_cb_ = ended_cb;
   error_cb_ = error_cb;
-  // TODO(erickung): wire up waiting_for_decryption_key_cb.
   waiting_for_decryption_key_cb_ = waiting_for_decryption_key_cb;
 
   MediaPipelineClient media_pipeline_client;
@@ -257,6 +256,8 @@
 
   // Receive events from the audio pipeline.
   AvPipelineClient av_pipeline_client;
+  av_pipeline_client.wait_for_key_cb = ::media::BindToCurrentLoop(
+      base::Bind(&CmaRenderer::OnWaitForKey, weak_this_, true));
   av_pipeline_client.eos_cb = ::media::BindToCurrentLoop(
       base::Bind(&CmaRenderer::OnEosReached, weak_this_, true));
   av_pipeline_client.playback_error_cb =
@@ -317,6 +318,8 @@
 
   // Receive events from the video pipeline.
   VideoPipelineClient client;
+  client.av_pipeline_client.wait_for_key_cb = ::media::BindToCurrentLoop(
+      base::Bind(&CmaRenderer::OnWaitForKey, weak_this_, false));
   client.av_pipeline_client.eos_cb = ::media::BindToCurrentLoop(
       base::Bind(&CmaRenderer::OnEosReached, weak_this_, false));
   client.av_pipeline_client.playback_error_cb =
@@ -364,6 +367,10 @@
   base::ResetAndReturn(&init_cb_).Run(::media::PIPELINE_OK);
 }
 
+void CmaRenderer::OnWaitForKey(bool is_audio) {
+  waiting_for_decryption_key_cb_.Run();
+}
+
 void CmaRenderer::OnEosReached(bool is_audio) {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (state_ != kPlaying) {
@@ -444,7 +451,10 @@
   }
 
   CompleteStateTransition(kFlushed);
-  base::ResetAndReturn(&flush_cb_).Run();
+  // If OnError was called while the flush was in progress, |flush_cb_| might
+  // be null.
+  if (!flush_cb_.is_null())
+    base::ResetAndReturn(&flush_cb_).Run();
 }
 
 void CmaRenderer::OnError(::media::PipelineStatus error) {

diff --git a/chromecast/renderer/media/cma_renderer.h b/chromecast/renderer/media/cma_renderer.h
index 0e674cb3..70cbdf3 100644
--- a/chromecast/renderer/media/cma_renderer.h
+++ b/chromecast/renderer/media/cma_renderer.h

@@ -79,6 +79,7 @@
                                      ::media::PipelineStatus status);
 
   // Callbacks for AvPipelineClient.
+  void OnWaitForKey(bool is_audio);
   void OnEosReached(bool is_audio);
   void OnStatisticsUpdated(const ::media::PipelineStatistics& stats);
   void OnNaturalSizeChanged(const gfx::Size& size);

diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index f498bb8..8281d371 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM

@@ -1 +1 @@
-7739.0.0
\ No newline at end of file
+7742.0.0
\ No newline at end of file

diff --git a/chromeos/binder/command_stream.cc b/chromeos/binder/command_stream.cc
new file mode 100644
index 0000000..3e7705a
--- /dev/null
+++ b/chromeos/binder/command_stream.cc

@@ -0,0 +1,147 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chromeos/binder/command_stream.h"
+
+#include <linux/android/binder.h>
+
+#include "chromeos/binder/buffer_reader.h"
+#include "chromeos/binder/driver.h"
+#include "chromeos/binder/util.h"
+
+namespace binder {
+
+CommandStream::CommandStream(Driver* driver,
+                             IncomingCommandHandler* incoming_command_handler)
+    : driver_(driver), incoming_command_handler_(incoming_command_handler) {}
+
+CommandStream::~CommandStream() {}
+
+bool CommandStream::Fetch() {
+  DCHECK(!CanProcessIncomingCommand());
+  // Use the same value as libbinder's IPCThreadState.
+  const size_t kIncomingDataSize = 256;
+  incoming_data_.resize(kIncomingDataSize);
+
+  size_t written_bytes = 0, read_bytes = 0;
+  if (!driver_->WriteRead(nullptr, 0, incoming_data_.data(),
+                          incoming_data_.size(), &written_bytes, &read_bytes)) {
+    LOG(ERROR) << "WriteRead() failed.";
+    return false;
+  }
+  incoming_data_.resize(read_bytes);
+  incoming_data_reader_.reset(
+      new BufferReader(incoming_data_.data(), incoming_data_.size()));
+  return true;
+}
+
+bool CommandStream::CanProcessIncomingCommand() {
+  return incoming_data_reader_ && incoming_data_reader_->HasMoreData();
+}
+
+bool CommandStream::ProcessIncomingCommand() {
+  DCHECK(CanProcessIncomingCommand());
+  uint32 command = 0;
+  if (!incoming_data_reader_->Read(&command, sizeof(command)) ||
+      !OnIncomingCommand(command, incoming_data_reader_.get())) {
+    LOG(ERROR) << "Error while handling command: " << command;
+    return false;
+  }
+  return true;
+}
+
+void CommandStream::AppendOutgoingCommand(uint32 command,
+                                          const void* data,
+                                          size_t size) {
+  VLOG(1) << "Appending " << CommandToString(command) << ", this = " << this;
+
+  DCHECK_EQ(0u, size % 4);  // Must be 4-byte aligned.
+  outgoing_data_.insert(
+      outgoing_data_.end(), reinterpret_cast<const char*>(&command),
+      reinterpret_cast<const char*>(&command) + sizeof(command));
+  outgoing_data_.insert(outgoing_data_.end(),
+                        reinterpret_cast<const char*>(data),
+                        reinterpret_cast<const char*>(data) + size);
+}
+
+bool CommandStream::Flush() {
+  for (size_t pos = 0; pos < outgoing_data_.size();) {
+    size_t written_bytes = 0, read_bytes = 0;
+    if (!driver_->WriteRead(outgoing_data_.data() + pos,
+                            outgoing_data_.size() - pos, nullptr, 0,
+                            &written_bytes, &read_bytes)) {
+      LOG(ERROR) << "WriteRead() failed: pos = " << pos
+                 << ", size = " << outgoing_data_.size();
+      return false;
+    }
+    pos += written_bytes;
+  }
+  outgoing_data_.clear();
+  return true;
+}
+
+bool CommandStream::OnIncomingCommand(uint32 command, BufferReader* reader) {
+  // TODO(hashimoto): Replace all NOTIMPLEMENTED with logic to handle incoming
+  // commands.
+  VLOG(1) << "Processing " << CommandToString(command) << ", this = " << this;
+  switch (command) {
+    case BR_ERROR: {
+      int32 error = 0;
+      if (!reader->Read(&error, sizeof(error))) {
+        LOG(ERROR) << "Failed to read error code.";
+        return false;
+      }
+      break;
+    }
+    case BR_OK:
+      break;
+    case BR_TRANSACTION:
+      NOTIMPLEMENTED();
+      break;
+    case BR_REPLY:
+      NOTIMPLEMENTED();
+      break;
+    case BR_ACQUIRE_RESULT:
+      // Kernel's binder.h says this is not currently supported.
+      NOTREACHED();
+      break;
+    case BR_DEAD_REPLY:
+      NOTIMPLEMENTED();
+      break;
+    case BR_TRANSACTION_COMPLETE:
+      NOTIMPLEMENTED();
+      break;
+    case BR_INCREFS:
+    case BR_ACQUIRE:
+    case BR_RELEASE:
+    case BR_DECREFS:
+    case BR_ATTEMPT_ACQUIRE:
+      NOTIMPLEMENTED();
+      break;
+    case BR_NOOP:
+      break;
+    case BR_SPAWN_LOOPER:
+      NOTIMPLEMENTED();
+      break;
+    case BR_FINISHED:
+      // Kernel's binder.h says this is not currently supported.
+      NOTREACHED();
+      break;
+    case BR_DEAD_BINDER:
+      NOTIMPLEMENTED();
+      break;
+    case BR_CLEAR_DEATH_NOTIFICATION_DONE:
+      NOTIMPLEMENTED();
+      break;
+    case BR_FAILED_REPLY:
+      NOTIMPLEMENTED();
+      break;
+    default:
+      LOG(ERROR) << "Unexpected command: " << command;
+      return false;
+  }
+  return true;
+}
+
+}  // namespace binder

diff --git a/chromeos/binder/command_stream.h b/chromeos/binder/command_stream.h
new file mode 100644
index 0000000..823abda5
--- /dev/null
+++ b/chromeos/binder/command_stream.h

@@ -0,0 +1,67 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BINDER_COMMAND_STREAM_H_
+#define BINDER_COMMAND_STREAM_H_
+
+#include <vector>
+
+#include "base/basictypes.h"
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+
+namespace binder {
+
+class BufferReader;
+class Driver;
+
+// Stream of incoming (binder driver to user process) BR_* commands and outgoing
+// (user process to binder driver) BC_* commands.
+class CommandStream {
+ public:
+  // IncomingCommandHandler is responsible to handle incoming commands.
+  class IncomingCommandHandler {
+   public:
+    virtual ~IncomingCommandHandler() {}
+    // TODO(hashimoto): Add methods to handle incoming commands.
+  };
+
+  CommandStream(Driver* driver,
+                IncomingCommandHandler* incoming_command_handler);
+  ~CommandStream();
+
+  // Reads incoming commands from the driver to the buffer, and returns true on
+  // success.
+  bool Fetch();
+
+  // Returns true if any incoming commands are in the buffer.
+  bool CanProcessIncomingCommand();
+
+  // Processes an incoming command in the buffer, and returns true on success.
+  bool ProcessIncomingCommand();
+
+  // Appends a command to the outgoing command buffer.
+  void AppendOutgoingCommand(uint32 command, const void* data, size_t size);
+
+  // Writes buffered outgoing commands to the driver, and returns true on
+  // success.
+  bool Flush();
+
+ private:
+  // Calls the appropriate delegate method to handle the incoming command.
+  bool OnIncomingCommand(uint32 command, BufferReader* reader);
+
+  Driver* driver_;
+  IncomingCommandHandler* incoming_command_handler_;
+
+  std::vector<char> outgoing_data_;  // Buffer for outgoing commands.
+  std::vector<char> incoming_data_;  // Buffer for incoming commands.
+  scoped_ptr<BufferReader> incoming_data_reader_;
+
+  DISALLOW_COPY_AND_ASSIGN(CommandStream);
+};
+
+}  // namespace binder
+
+#endif  // BINDER_COMMAND_STREAM_H_

diff --git a/chromeos/binder/command_stream_unittest.cc b/chromeos/binder/command_stream_unittest.cc
new file mode 100644
index 0000000..ae67ab3
--- /dev/null
+++ b/chromeos/binder/command_stream_unittest.cc

@@ -0,0 +1,47 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <unistd.h>
+#include <linux/android/binder.h>
+
+#include "chromeos/binder/command_stream.h"
+#include "chromeos/binder/driver.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace binder {
+
+namespace {
+
+// TODO(hashimoto): Add tests for Fetch() and ProcessCommand().
+class BinderCommandStreamTest : public ::testing::Test,
+                                public CommandStream::IncomingCommandHandler {
+ public:
+  BinderCommandStreamTest() : command_stream_(&driver_, this) {}
+  ~BinderCommandStreamTest() override {}
+
+  void SetUp() override { ASSERT_TRUE(driver_.Initialize()); }
+
+ protected:
+  Driver driver_;
+  CommandStream command_stream_;
+};
+
+}  // namespace
+
+TEST_F(BinderCommandStreamTest, EnterLooper) {
+  command_stream_.AppendOutgoingCommand(BC_ENTER_LOOPER, nullptr, 0);
+  EXPECT_TRUE(command_stream_.Flush());
+  command_stream_.AppendOutgoingCommand(BC_EXIT_LOOPER, nullptr, 0);
+  EXPECT_TRUE(command_stream_.Flush());
+}
+
+TEST_F(BinderCommandStreamTest, Error) {
+  // Kernel's binder.h says BC_ATTEMPT_ACQUIRE is not currently supported.
+  binder_pri_desc params = {};
+  command_stream_.AppendOutgoingCommand(BC_ATTEMPT_ACQUIRE, &params,
+                                        sizeof(params));
+  EXPECT_FALSE(command_stream_.Flush());
+}
+
+}  // namespace binder

diff --git a/chromeos/chromeos.gyp b/chromeos/chromeos.gyp
index f2b405e..28b3957 100644
--- a/chromeos/chromeos.gyp
+++ b/chromeos/chromeos.gyp

@@ -389,6 +389,8 @@
     'chromeos_binder_sources': [
       'binder/buffer_reader.cc',
       'binder/buffer_reader.h',
+      'binder/command_stream.cc',
+      'binder/command_stream.h',
       'binder/driver.cc',
       'binder/driver.h',
       'binder/util.cc',
@@ -396,6 +398,7 @@
     ],
     'chromeos_binder_test_sources': [
       'binder/buffer_reader_unittest.cc',
+      'binder/command_stream_unittest.cc',
       'binder/driver_unittest.cc',
     ],
     'chromeos_test_sources': [

diff --git a/components/nacl.gyp b/components/nacl.gyp
index a9ed69c..e90fa16 100644
--- a/components/nacl.gyp
+++ b/components/nacl.gyp

@@ -63,7 +63,6 @@
     ['disable_nacl!=1', {
       'targets': [
         {
-          # GN version: //components/nacl/loader
           'target_name': 'nacl',
           'type': 'static_library',
           'variables': {
@@ -88,7 +87,6 @@
           ],
         },
         {
-          # GN version: //components/nacl/browser
           'target_name': 'nacl_browser',
           'type': 'static_library',
           'sources': [
@@ -142,7 +140,6 @@
           ],
         },
         {
-          # GN version: //components/nacl/renderer
           'target_name': 'nacl_renderer',
           'type': 'static_library',
           'sources': [
@@ -182,7 +179,6 @@
           ],
         },
         {
-          # GN version: //components/nacl/loader:nacl_loader_unittests
           'target_name': 'nacl_loader_unittests',
           'type': '<(gtest_target_type)',
           'sources': [
@@ -202,7 +198,6 @@
         ['OS=="linux"', {
           'targets': [
             {
-              # GN version: //components/nacl/loader:nacl_helper
               'target_name': 'nacl_helper',
               'type': 'executable',
               'include_dirs': [
@@ -226,7 +221,6 @@
                 'ldflags': ['-pie'],
               },
             }, {
-              # GN version: //components/nacl/loader/sandbox_linux
               'target_name': 'nacl_linux',
               'type': 'static_library',
               'include_dirs': [
@@ -314,7 +308,6 @@
               },
             },
             {
-              # GN version: //components/nacl/common:switches
               'target_name': 'nacl_switches_win64',
               'type': 'static_library',
               'sources': [
@@ -331,7 +324,6 @@
               },
             },
             {
-              # GN version: //components/nacl/common
               'target_name': 'nacl_common_win64',
               'type': 'static_library',
               'defines': [
@@ -424,7 +416,6 @@
   ],
   'targets': [
     {
-      # GN version: //components/nacl/common:switches
       'target_name': 'nacl_switches',
       'type': 'static_library',
       'sources': [
@@ -436,7 +427,6 @@
       ],
     },
     {
-      # GN version: //components/nacl/common
       'target_name': 'nacl_common',
       'type': 'static_library',
       'sources': [

diff --git a/components/nacl/BUILD.gn b/components/nacl/BUILD.gn
new file mode 100644
index 0000000..578bc70
--- /dev/null
+++ b/components/nacl/BUILD.gn

@@ -0,0 +1,380 @@
+# Copyright (c) 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/features.gni")
+import("//build/config/nacl/config.gni")
+import("//build/config/ui.gni")
+import("//testing/test.gni")
+
+if (enable_nacl) {
+  source_set("nacl") {
+    sources = [
+      "loader/nacl_ipc_adapter.cc",
+      "loader/nacl_ipc_adapter.h",
+      "loader/nacl_listener.cc",
+      "loader/nacl_listener.h",
+      "loader/nacl_main.cc",
+      "loader/nacl_main_platform_delegate.h",
+      "loader/nacl_main_platform_delegate_linux.cc",
+      "loader/nacl_main_platform_delegate_mac.mm",
+      "loader/nacl_main_platform_delegate_win.cc",
+      "loader/nacl_trusted_listener.cc",
+      "loader/nacl_trusted_listener.h",
+      "loader/nacl_validation_db.h",
+      "loader/nacl_validation_query.cc",
+      "loader/nacl_validation_query.h",
+    ]
+
+    deps = [
+      ":nacl_common",
+      ":nacl_switches",
+      "//base",
+      "//base:base_static",
+      "//content/public/common",
+      "//crypto",
+      "//ipc",
+      "//native_client/src/trusted/service_runtime:sel_main_chrome",
+      "//ppapi/c",
+      "//ppapi/proxy:ipc",
+      "//ppapi/shared_impl",
+      "//sandbox",
+      "//third_party/mojo/src/mojo/edk/system",
+    ]
+
+    if (enable_nacl_untrusted) {
+      data_deps = [
+        "//ppapi/native_client:irt",
+      ]
+    }
+    if (enable_pnacl) {
+      data_deps +=
+          [ "//ppapi/native_client/src/untrusted/pnacl_support_extension" ]
+    }
+  }
+
+  source_set("nacl_browser") {
+    sources = [
+      "browser/bad_message.cc",
+      "browser/bad_message.h",
+      "browser/nacl_broker_host_win.cc",
+      "browser/nacl_broker_host_win.h",
+      "browser/nacl_broker_service_win.cc",
+      "browser/nacl_broker_service_win.h",
+      "browser/nacl_browser.cc",
+      "browser/nacl_browser.h",
+      "browser/nacl_file_host.cc",
+      "browser/nacl_file_host.h",
+      "browser/nacl_host_message_filter.cc",
+      "browser/nacl_host_message_filter.h",
+      "browser/nacl_process_host.cc",
+      "browser/nacl_process_host.h",
+      "browser/nacl_validation_cache.cc",
+      "browser/nacl_validation_cache.h",
+      "browser/pnacl_host.cc",
+      "browser/pnacl_host.h",
+      "browser/pnacl_translation_cache.cc",
+      "browser/pnacl_translation_cache.h",
+      "common/nacl_debug_exception_handler_win.cc",
+      "common/nacl_debug_exception_handler_win.h",
+    ]
+
+    deps = [
+      ":nacl_common",
+      ":nacl_switches",
+      "//base",
+      "//base/third_party/dynamic_annotations",
+      "//components/url_formatter",
+      "//content/public/browser",
+      "//content/public/common",
+      "//ipc",
+      "//native_client/src/trusted/service_runtime:sel_main_chrome",
+      "//net",
+      "//ppapi/host",
+      "//ppapi/proxy:ipc",
+      "//ppapi/shared_impl",
+    ]
+
+    data_deps = []
+
+    if (is_linux) {
+      sources += [
+        "zygote/nacl_fork_delegate_linux.cc",
+        "zygote/nacl_fork_delegate_linux.h",
+      ]
+
+      deps += [
+        ":nacl_helper_integration",
+        "//sandbox/linux:sandbox_services",
+        "//sandbox/linux:suid_sandbox_client",
+      ]
+
+      data_deps += [ ":helper_nonsfi" ]
+    }
+  }
+
+  source_set("nacl_renderer") {
+    sources = [
+      "renderer/file_downloader.cc",
+      "renderer/file_downloader.h",
+      "renderer/histogram.cc",
+      "renderer/histogram.h",
+      "renderer/json_manifest.cc",
+      "renderer/json_manifest.h",
+      "renderer/manifest_downloader.cc",
+      "renderer/manifest_downloader.h",
+      "renderer/manifest_service_channel.cc",
+      "renderer/manifest_service_channel.h",
+      "renderer/nacl_helper.cc",
+      "renderer/nacl_helper.h",
+      "renderer/nexe_load_manager.cc",
+      "renderer/nexe_load_manager.h",
+      "renderer/platform_info.cc",
+      "renderer/platform_info.h",
+      "renderer/pnacl_translation_resource_host.cc",
+      "renderer/pnacl_translation_resource_host.h",
+      "renderer/ppb_nacl_private_impl.cc",
+      "renderer/ppb_nacl_private_impl.h",
+      "renderer/progress_event.cc",
+      "renderer/progress_event.h",
+      "renderer/trusted_plugin_channel.cc",
+      "renderer/trusted_plugin_channel.h",
+    ]
+
+    deps = [
+      ":nacl_common",
+      ":nacl_switches",
+      "renderer/plugin:nacl_trusted_plugin",
+      "//base",
+      "//content/public/common",
+      "//content/public/renderer",
+      "//ipc",
+      "//net",
+      "//ppapi/c",
+      "//ppapi/proxy:ipc",
+      "//ppapi/shared_impl",
+      "//third_party/WebKit/public:blink",
+    ]
+  }
+
+  # TODO(GYP): Delete this after we've converted everything to GN.
+  # The _run targets exist only for compatibility w/ GYP.
+  group("nacl_loader_unittests_run") {
+    testonly = true
+    deps = [
+      ":nacl_loader_unittests",
+    ]
+  }
+
+  test("nacl_loader_unittests") {
+    sources = [
+      "loader/nacl_ipc_adapter_unittest.cc",
+      "loader/nacl_validation_query_unittest.cc",
+      "loader/run_all_unittests.cc",
+    ]
+
+    deps = [
+      ":nacl",
+      "//base/test:test_support",
+      "//ipc:test_support",
+      "//ppapi/c",
+      "//testing/gtest",
+    ]
+  }
+
+  if (is_linux) {
+    executable("nacl_helper") {
+      sources = [
+        "loader/nacl_helper_linux.cc",
+        "loader/nacl_helper_linux.h",
+      ]
+
+      deps = [
+        ":nacl",
+        ":nacl_linux",
+        ":nacl_switches",
+        "//base",
+        "//build/config/sanitizers:deps",
+        "//content/public/common",
+        "//crypto",
+        "//ipc",
+        "//sandbox/linux:sandbox_services",
+      ]
+
+      cflags = [ "-fPIE" ]
+
+      ldflags = [ "-pie" ]
+
+      data_deps = [
+        "//native_client/src/trusted/service_runtime/linux:bootstrap",
+      ]
+    }
+
+    # For setting up nacl_helper.
+    source_set("nacl_helper_integration") {
+      public = [
+        "loader/nacl_helper_linux.h",
+      ]
+      data_deps = [
+        ":nacl_helper",
+      ]
+    }
+
+    source_set("nacl_linux") {
+      sources = [
+        "loader/sandbox_linux/nacl_bpf_sandbox_linux.cc",
+        "loader/sandbox_linux/nacl_sandbox_linux.cc",
+      ]
+
+      defines = [ "IN_NACL_HELPER=1" ]
+
+      deps = [
+        ":nacl",
+        ":nacl_common",
+        ":nacl_switches",
+        "//base",
+        "//content/public/common",
+        "//crypto",
+        "//ipc",
+        "//sandbox",
+        "//sandbox/linux:sandbox_services_headers",
+      ]
+
+      if (use_glib) {
+        configs += [ "//build/config/linux:glib" ]
+      }
+
+      if (use_seccomp_bpf) {
+        defines += [ "USE_SECCOMP_BPF" ]
+      }
+    }
+  }
+
+  if (is_nacl_nonsfi) {
+    executable("nacl_helper_nonsfi_nexe") {
+      output_name = "nacl_helper_nonsfi"
+      set_sources_assignment_filter([])
+      sources = [
+        "common/nacl_messages.cc",
+        "common/nacl_messages.h",
+        "common/nacl_types.cc",
+        "common/nacl_types.h",
+        "common/nacl_types_param_traits.cc",
+        "common/nacl_types_param_traits.h",
+        "loader/nacl_helper_linux.cc",
+        "loader/nacl_helper_linux.h",
+        "loader/nacl_trusted_listener.cc",
+        "loader/nacl_trusted_listener.h",
+        "loader/nonsfi/nonsfi_listener.cc",
+        "loader/nonsfi/nonsfi_listener.h",
+        "loader/nonsfi/nonsfi_main.cc",
+        "loader/nonsfi/nonsfi_main.h",
+      ]
+      deps = [
+        ":nacl_helper_nonsfi_sandbox",
+        ":nacl_switches",
+        "//base",
+        "//components/tracing",
+        "//content",
+        "//ipc",
+        "//native_client/src/nonsfi/irt:nacl_sys_private",
+        "//native_client/src/nonsfi/loader:elf_loader",
+
+        # Normally libnacl is included implicitly by libc and is part of
+        # the toolchain.  But //build/config/nacl:compiler uses
+        # -nodefaultlibs and so omits the default libnacl.
+        # When the nonsfi toolchain is more complete and that kludge
+        # is no longer required, this dependency should be removed.
+        "//native_client/src/untrusted/nacl:nacl",
+        "//ppapi/proxy",
+        "//sandbox/linux:sandbox",
+      ]
+    }
+
+    source_set("nacl_helper_nonsfi_sandbox") {
+      set_sources_assignment_filter([])
+      sources = [
+        "loader/nonsfi/nonsfi_sandbox.cc",
+        "loader/nonsfi/nonsfi_sandbox.h",
+        "loader/sandbox_linux/nacl_sandbox_linux.cc",
+        "loader/sandbox_linux/nacl_sandbox_linux.h",
+      ]
+      deps = [
+        ":nacl_switches",
+        "//base",
+        "//content",
+        "//sandbox/linux:sandbox",
+        "//sandbox/linux:sandbox_services_headers",
+      ]
+    }
+
+    copy("nacl_helper_nonsfi_copy") {
+      sources = [
+        "${root_out_dir}/nacl_helper_nonsfi",
+      ]
+      outputs = [
+        "${root_build_dir}/{{source_file_part}}",
+      ]
+      deps = [
+        ":nacl_helper_nonsfi_nexe",
+      ]
+    }
+  }
+
+  group("helper_nonsfi") {
+    deps = [
+      ":nacl_helper_nonsfi_copy(//build/toolchain/nacl:newlib_pnacl_nonsfi)",
+    ]
+  }
+}
+
+# TODO(brettw) move to //components/nacl/common:switches
+source_set("nacl_switches") {
+  sources = [
+    "common/nacl_switches.cc",
+    "common/nacl_switches.h",
+  ]
+}
+
+# TODO(brettw) move to //components/nacl/common
+source_set("nacl_common") {
+  sources = [
+    "common/nacl_cmd_line.cc",
+    "common/nacl_cmd_line.h",
+    "common/nacl_constants.cc",
+    "common/nacl_constants.h",
+    "common/nacl_host_messages.cc",
+    "common/nacl_host_messages.h",
+    "common/nacl_messages.cc",
+    "common/nacl_messages.h",
+    "common/nacl_nonsfi_util.cc",
+    "common/nacl_nonsfi_util.h",
+    "common/nacl_process_type.h",
+    "common/nacl_renderer_messages.cc",
+    "common/nacl_renderer_messages.h",
+    "common/nacl_sandbox_type.h",
+    "common/nacl_types.cc",
+    "common/nacl_types.h",
+    "common/nacl_types_param_traits.cc",
+    "common/nacl_types_param_traits.h",
+    "common/pnacl_types.cc",
+    "common/pnacl_types.h",
+  ]
+
+  deps = [
+    ":nacl_switches",
+    "//base",
+    "//content/public/common",
+    "//ipc",
+    "//url",
+  ]
+
+  if (is_linux) {
+    sources += [
+      "common/nacl_paths.cc",
+      "common/nacl_paths.h",
+    ]
+
+    defines = [ "__STDC_LIMIT_MACROS=1" ]
+  }
+}

diff --git a/components/nacl/browser/BUILD.gn b/components/nacl/browser/BUILD.gn
deleted file mode 100644
index b55fab1..0000000
--- a/components/nacl/browser/BUILD.gn
+++ /dev/null

@@ -1,65 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/features.gni")
-
-assert(enable_nacl)
-
-source_set("browser") {
-  sources = [
-    "bad_message.cc",
-    "bad_message.h",
-    "nacl_broker_host_win.cc",
-    "nacl_broker_host_win.h",
-    "nacl_broker_service_win.cc",
-    "nacl_broker_service_win.h",
-    "nacl_browser.cc",
-    "nacl_browser.h",
-    "nacl_file_host.cc",
-    "nacl_file_host.h",
-    "nacl_host_message_filter.cc",
-    "nacl_host_message_filter.h",
-    "nacl_process_host.cc",
-    "nacl_process_host.h",
-    "nacl_validation_cache.cc",
-    "nacl_validation_cache.h",
-    "pnacl_host.cc",
-    "pnacl_host.h",
-    "pnacl_translation_cache.cc",
-    "pnacl_translation_cache.h",
-  ]
-
-  deps = [
-    "//base",
-    "//base/third_party/dynamic_annotations",
-    "//components/nacl/common",
-    "//components/nacl/common:debug_exception_handler",
-    "//components/url_formatter",
-    "//content/public/browser",
-    "//content/public/common",
-    "//ipc",
-    "//native_client/src/trusted/service_runtime:sel_main_chrome",
-    "//net",
-    "//ppapi/host",
-    "//ppapi/proxy:ipc",
-    "//ppapi/shared_impl",
-  ]
-
-  data_deps = []
-
-  if (is_linux) {
-    sources += [
-      "../zygote/nacl_fork_delegate_linux.cc",
-      "../zygote/nacl_fork_delegate_linux.h",
-    ]
-
-    deps += [
-      "//components/nacl/loader:nacl_helper_integration",
-      "//sandbox/linux:sandbox_services",
-      "//sandbox/linux:suid_sandbox_client",
-    ]
-
-    data_deps += [ "//components/nacl/loader:helper_nonsfi" ]
-  }
-}

diff --git a/components/nacl/common/BUILD.gn b/components/nacl/common/BUILD.gn
index 5af9cbe..ab7fc75 100644
--- a/components/nacl/common/BUILD.gn
+++ b/components/nacl/common/BUILD.gn

@@ -2,66 +2,6 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("//build/config/features.gni")
-
-if (enable_nacl) {
-  source_set("common") {
-    sources = [
-      "nacl_cmd_line.cc",
-      "nacl_cmd_line.h",
-      "nacl_constants.cc",
-      "nacl_constants.h",
-      "nacl_host_messages.cc",
-      "nacl_host_messages.h",
-      "nacl_messages.cc",
-      "nacl_messages.h",
-      "nacl_nonsfi_util.cc",
-      "nacl_nonsfi_util.h",
-      "nacl_process_type.h",
-      "nacl_renderer_messages.cc",
-      "nacl_renderer_messages.h",
-      "nacl_sandbox_type.h",
-      "nacl_types.cc",
-      "nacl_types.h",
-      "nacl_types_param_traits.cc",
-      "nacl_types_param_traits.h",
-      "pnacl_types.cc",
-      "pnacl_types.h",
-    ]
-
-    public_deps = [
-      ":switches",
-    ]
-
-    deps = [
-      "//base",
-      "//content/public/common",
-      "//ipc",
-      "//url",
-    ]
-
-    if (is_linux) {
-      sources += [
-        "nacl_paths.cc",
-        "nacl_paths.h",
-      ]
-
-      defines = [ "__STDC_LIMIT_MACROS=1" ]
-    }
-  }
-
-  source_set("debug_exception_handler") {
-    sources = [
-      "nacl_debug_exception_handler_win.cc",
-      "nacl_debug_exception_handler_win.h",
-    ]
-
-    deps = [
-      "//base",
-    ]
-  }
-}
-
 # Depending on this allows targets to unconditionally include
 # nacl_process_type.h without testing whether nacl is enabled.
 source_set("process_type") {
@@ -73,10 +13,3 @@
     "//content/public/common",
   ]
 }
-
-source_set("switches") {
-  sources = [
-    "nacl_switches.cc",
-    "nacl_switches.h",
-  ]
-}

diff --git a/components/nacl/loader/BUILD.gn b/components/nacl/loader/BUILD.gn
deleted file mode 100644
index ed8f335..0000000
--- a/components/nacl/loader/BUILD.gn
+++ /dev/null

@@ -1,189 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/features.gni")
-import("//build/config/nacl/config.gni")
-import("//testing/test.gni")
-
-assert(enable_nacl)
-
-source_set("loader") {
-  sources = [
-    "nacl_ipc_adapter.cc",
-    "nacl_ipc_adapter.h",
-    "nacl_listener.cc",
-    "nacl_listener.h",
-    "nacl_main.cc",
-    "nacl_main_platform_delegate.h",
-    "nacl_main_platform_delegate_linux.cc",
-    "nacl_main_platform_delegate_mac.mm",
-    "nacl_main_platform_delegate_win.cc",
-    "nacl_trusted_listener.cc",
-    "nacl_trusted_listener.h",
-    "nacl_validation_db.h",
-    "nacl_validation_query.cc",
-    "nacl_validation_query.h",
-  ]
-
-  deps = [
-    "//base",
-    "//base:base_static",
-    "//components/nacl/common",
-    "//content/public/common",
-    "//crypto",
-    "//ipc",
-    "//native_client/src/trusted/service_runtime:sel_main_chrome",
-    "//ppapi/c",
-    "//ppapi/proxy:ipc",
-    "//ppapi/shared_impl",
-    "//sandbox",
-    "//third_party/mojo/src/mojo/edk/system",
-  ]
-
-  if (enable_nacl_untrusted) {
-    data_deps = [
-      "//ppapi/native_client:irt",
-    ]
-  }
-  if (enable_pnacl) {
-    data_deps +=
-        [ "//ppapi/native_client/src/untrusted/pnacl_support_extension" ]
-  }
-}
-
-# TODO(GYP): Delete this after we've converted everything to GN.
-# The _run targets exist only for compatibility w/ GYP.
-group("nacl_loader_unittests_run") {
-  testonly = true
-  deps = [
-    ":nacl_loader_unittests",
-  ]
-}
-
-test("nacl_loader_unittests") {
-  sources = [
-    "nacl_ipc_adapter_unittest.cc",
-    "nacl_validation_query_unittest.cc",
-    "run_all_unittests.cc",
-  ]
-
-  deps = [
-    ":loader",
-    "//base/test:test_support",
-    "//ipc:test_support",
-    "//ppapi/c",
-    "//testing/gtest",
-  ]
-}
-
-if (is_linux) {
-  executable("nacl_helper") {
-    sources = [
-      "nacl_helper_linux.cc",
-      "nacl_helper_linux.h",
-    ]
-
-    deps = [
-      ":loader",
-      "//base",
-      "//build/config/sanitizers:deps",
-      "//components/nacl/common:switches",
-      "//components/nacl/loader/sandbox_linux",
-      "//content/public/common",
-      "//crypto",
-      "//ipc",
-      "//sandbox/linux:sandbox_services",
-    ]
-
-    cflags = [ "-fPIE" ]
-
-    ldflags = [ "-pie" ]
-
-    data_deps = [
-      "//native_client/src/trusted/service_runtime/linux:bootstrap",
-    ]
-  }
-
-  # For setting up nacl_helper.
-  source_set("nacl_helper_integration") {
-    public = [
-      "nacl_helper_linux.h",
-    ]
-    data_deps = [
-      ":nacl_helper",
-    ]
-  }
-}
-
-if (is_nacl_nonsfi) {
-  executable("nacl_helper_nonsfi_nexe") {
-    output_name = "nacl_helper_nonsfi"
-    set_sources_assignment_filter([])
-    sources = [
-      # TODO(brettw) can this just depend on //components/nacl/common?
-      "../common/nacl_messages.cc",
-      "../common/nacl_messages.h",
-      "../common/nacl_types.cc",
-      "../common/nacl_types.h",
-      "../common/nacl_types_param_traits.cc",
-      "../common/nacl_types_param_traits.h",
-      "nacl_helper_linux.cc",
-      "nacl_helper_linux.h",
-      "nacl_trusted_listener.cc",
-      "nacl_trusted_listener.h",
-      "nonsfi/nonsfi_listener.cc",
-      "nonsfi/nonsfi_listener.h",
-      "nonsfi/nonsfi_main.cc",
-      "nonsfi/nonsfi_main.h",
-    ]
-    deps = [
-      ":nacl_helper_nonsfi_sandbox",
-      "//base",
-      "//components/nacl/common:switches",
-      "//components/tracing",
-      "//content",
-      "//ipc",
-      "//native_client/src/nonsfi/irt:nacl_sys_private",
-      "//native_client/src/nonsfi/loader:elf_loader",
-      "//native_client/src/untrusted/nacl:nacl",
-      "//ppapi/proxy",
-      "//sandbox/linux:sandbox",
-    ]
-  }
-
-  source_set("nacl_helper_nonsfi_sandbox") {
-    set_sources_assignment_filter([])
-    sources = [
-      "nonsfi/nonsfi_sandbox.cc",
-      "nonsfi/nonsfi_sandbox.h",
-      "sandbox_linux/nacl_sandbox_linux.cc",
-      "sandbox_linux/nacl_sandbox_linux.h",
-    ]
-    deps = [
-      "//base",
-      "//components/nacl/common:switches",
-      "//content",
-      "//sandbox/linux:sandbox",
-      "//sandbox/linux:sandbox_services_headers",
-    ]
-  }
-
-  copy("nacl_helper_nonsfi_copy") {
-    sources = [
-      "${root_out_dir}/nacl_helper_nonsfi",
-    ]
-    outputs = [
-      "${root_build_dir}/{{source_file_part}}",
-    ]
-    deps = [
-      ":nacl_helper_nonsfi_nexe",
-    ]
-  }
-}
-
-group("helper_nonsfi") {
-  deps = [
-    ":nacl_helper_nonsfi_copy(//build/toolchain/nacl:newlib_pnacl_nonsfi)",
-  ]
-}

diff --git a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
index cf880745..d16db146 100644
--- a/components/nacl/loader/nonsfi/nonsfi_sandbox.cc
+++ b/components/nacl/loader/nonsfi/nonsfi_sandbox.cc

@@ -75,9 +75,10 @@
   // the return value of F_GETFL, so we need to allow O_ACCMODE in
   // addition to O_NONBLOCK.
   const uint64_t kAllowedMask = O_ACCMODE | O_NONBLOCK;
-  return If((cmd == F_SETFD && long_arg == FD_CLOEXEC) || cmd == F_GETFL ||
-                (cmd == F_SETFL && (long_arg & ~kAllowedMask) == 0),
-            Allow()).Else(CrashSIGSYS());
+  return If(AnyOf(AllOf(cmd == F_SETFD, long_arg == FD_CLOEXEC), cmd == F_GETFL,
+                  AllOf(cmd == F_SETFL, (long_arg & ~kAllowedMask) == 0)),
+            Allow())
+      .Else(CrashSIGSYS());
 }
 
 ResultExpr RestrictClone() {
@@ -116,9 +117,9 @@
 ResultExpr RestrictSocketcall() {
   // We only allow shutdown(), sendmsg(), and recvmsg().
   const Arg<int> call(0);
-  return If(
-      call == SYS_SHUTDOWN || call == SYS_SENDMSG || call == SYS_RECVMSG,
-      Allow()).Else(CrashSIGSYS());
+  return Switch(call)
+      .CASES((SYS_SHUTDOWN, SYS_SENDMSG, SYS_RECVMSG), Allow())
+      .Default(CrashSIGSYS());
 }
 #endif
 
@@ -138,20 +139,24 @@
   // so we do not need to allow PROT_EXEC in mmap.
   const uint64_t kAllowedProtMask = PROT_READ | PROT_WRITE;
   const Arg<int> prot(2), flags(3);
-  return If((prot & ~kAllowedProtMask) == 0 && (flags & ~kAllowedFlagMask) == 0,
-            Allow()).Else(CrashSIGSYS());
+  return If(AllOf((prot & ~kAllowedProtMask) == 0,
+                  (flags & ~kAllowedFlagMask) == 0),
+            Allow())
+      .Else(CrashSIGSYS());
 }
 
 ResultExpr RestrictTgkill(int policy_pid) {
   const Arg<int> tgid(0), tid(1), signum(2);
   // Only sending SIGUSR1 to a thread in the same process is allowed.
-  return If(tgid == policy_pid &&
-            // Arg does not support a greater-than operator, so two separate
-            // checks are needed to ensure tid is positive.
-            tid != 0 &&
-            (tid & (1u << 31)) == 0 &&  // tid is non-negative.
-            signum == LINUX_SIGUSR1,
-            Allow()).Else(CrashSIGSYS());
+  return If(AllOf(
+                tgid == policy_pid,
+                // Arg does not support a greater-than operator, so two separate
+                // checks are needed to ensure tid is positive.
+                tid != 0,
+                (tid & (1u << 31)) == 0,  // tid is non-negative.
+                signum == LINUX_SIGUSR1),
+            Allow())
+      .Else(CrashSIGSYS());
 }
 
 bool IsGracefullyDenied(int sysno) {

diff --git a/components/nacl/loader/sandbox_linux/BUILD.gn b/components/nacl/loader/sandbox_linux/BUILD.gn
deleted file mode 100644
index ce1d404..0000000
--- a/components/nacl/loader/sandbox_linux/BUILD.gn
+++ /dev/null

@@ -1,37 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/features.gni")
-import("//build/config/ui.gni")
-
-assert(is_linux)
-assert(enable_nacl)
-
-source_set("sandbox_linux") {
-  sources = [
-    "nacl_bpf_sandbox_linux.cc",
-    "nacl_sandbox_linux.cc",
-  ]
-
-  defines = [ "IN_NACL_HELPER=1" ]
-
-  deps = [
-    "//base",
-    "//components/nacl/common",
-    "//components/nacl/loader",
-    "//content/public/common",
-    "//crypto",
-    "//ipc",
-    "//sandbox",
-    "//sandbox/linux:sandbox_services_headers",
-  ]
-
-  if (use_glib) {
-    configs += [ "//build/config/linux:glib" ]
-  }
-
-  if (use_seccomp_bpf) {
-    defines += [ "USE_SECCOMP_BPF" ]
-  }
-}

diff --git a/components/nacl/renderer/BUILD.gn b/components/nacl/renderer/BUILD.gn
deleted file mode 100644
index f6f5992..0000000
--- a/components/nacl/renderer/BUILD.gn
+++ /dev/null

@@ -1,50 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/features.gni")
-
-assert(enable_nacl)
-
-source_set("renderer") {
-  sources = [
-    "file_downloader.cc",
-    "file_downloader.h",
-    "histogram.cc",
-    "histogram.h",
-    "json_manifest.cc",
-    "json_manifest.h",
-    "manifest_downloader.cc",
-    "manifest_downloader.h",
-    "manifest_service_channel.cc",
-    "manifest_service_channel.h",
-    "nacl_helper.cc",
-    "nacl_helper.h",
-    "nexe_load_manager.cc",
-    "nexe_load_manager.h",
-    "platform_info.cc",
-    "platform_info.h",
-    "pnacl_translation_resource_host.cc",
-    "pnacl_translation_resource_host.h",
-    "ppb_nacl_private_impl.cc",
-    "ppb_nacl_private_impl.h",
-    "progress_event.cc",
-    "progress_event.h",
-    "trusted_plugin_channel.cc",
-    "trusted_plugin_channel.h",
-  ]
-
-  deps = [
-    "//base",
-    "//components/nacl/common",
-    "//components/nacl/renderer/plugin:nacl_trusted_plugin",
-    "//content/public/common",
-    "//content/public/renderer",
-    "//ipc",
-    "//net",
-    "//ppapi/c",
-    "//ppapi/proxy:ipc",
-    "//ppapi/shared_impl",
-    "//third_party/WebKit/public:blink",
-  ]
-}

diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
index c476371..73a21c4 100644
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc

@@ -643,10 +643,10 @@
   }
 
   // Start a download and return the item.
-  DownloadItem* StartDownloadAndReturnItem(GURL url) {
+  DownloadItem* StartDownloadAndReturnItem(Shell* shell, GURL url) {
     scoped_ptr<DownloadCreateObserver> observer(
-        new DownloadCreateObserver(DownloadManagerForShell(shell())));
-    shell()->LoadURL(url);
+        new DownloadCreateObserver(DownloadManagerForShell(shell)));
+    shell->LoadURL(url);
     return observer->WaitForFinished();
   }
 
@@ -690,6 +690,67 @@
   scoped_ptr<TestShellDownloadManagerDelegate> test_delegate_;
 };
 
+// Parameters for DownloadResumptionContentTest.
+enum class DownloadResumptionTestType {
+  RESUME_WITH_RENDERER,  // Resume() is called while the originating WebContents
+                         // is still alive.
+  RESUME_WITHOUT_RENDERER  // Resume() is called after the originating
+                           // WebContents has been deleted.
+};
+
+// Parameterized test for download resumption. Tests using this fixure will be
+// run once with RESUME_WITH_RENDERER and once with RESUME_WITHOUT_RENDERER.
+// Use initiator_shell_for_resumption() to retrieve the Shell object that should
+// be used as the originator for the initial download. Prior to calling
+// Resume(), call PrepareToResume() which will cause the originating Shell to be
+// deleted if the test parameter is RESUME_WITHOUT_RENDERER.
+class DownloadResumptionContentTest
+    : public DownloadContentTest,
+      public ::testing::WithParamInterface<DownloadResumptionTestType> {
+ public:
+  void SetUpOnMainThread() override {
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        switches::kEnableDownloadResumption);
+    DownloadContentTest::SetUpOnMainThread();
+
+    if (GetParam() == DownloadResumptionTestType::RESUME_WITHOUT_RENDERER)
+      initiator_shell_for_resumption_ = CreateBrowser();
+    else
+      initiator_shell_for_resumption_ = shell();
+
+    ASSERT_EQ(DownloadManagerForShell(shell()),
+              DownloadManagerForShell(initiator_shell_for_resumption()));
+  }
+
+  // Shell to use for initiating a download. Only valid *before*
+  // PrepareToResume() is called.
+  Shell* initiator_shell_for_resumption() const {
+    DCHECK(initiator_shell_for_resumption_);
+    return initiator_shell_for_resumption_;
+  }
+
+  // Should be called once before calling DownloadItem::Resume() on an
+  // interrupted download. This may cause initiator_shell_for_resumption() to
+  // become invalidated.
+  void PrepareToResume() {
+    if (GetParam() == DownloadResumptionTestType::RESUME_WITH_RENDERER)
+      return;
+    DCHECK_NE(initiator_shell_for_resumption(), shell());
+    DCHECK(initiator_shell_for_resumption());
+    initiator_shell_for_resumption_->Close();
+    initiator_shell_for_resumption_ = nullptr;
+  }
+
+ private:
+  Shell* initiator_shell_for_resumption_ = nullptr;
+};
+
+INSTANTIATE_TEST_CASE_P(
+    _,
+    DownloadResumptionContentTest,
+    ::testing::Values(DownloadResumptionTestType::RESUME_WITH_RENDERER,
+                      DownloadResumptionTestType::RESUME_WITHOUT_RENDERER));
+
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadCancelled) {
@@ -698,7 +759,7 @@
   // Create a download, wait until it's started, and confirm
   // we're in the expected state.
   DownloadItem* download = StartDownloadAndReturnItem(
-      GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
+      shell(), GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
   ASSERT_EQ(DownloadItem::IN_PROGRESS, download->GetState());
 
   // Cancel the download and wait for download system quiesce.
@@ -719,12 +780,12 @@
   // Create a download, wait until it's started, and confirm
   // we're in the expected state.
   DownloadItem* download1 = StartDownloadAndReturnItem(
-      GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
+      shell(), GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
   ASSERT_EQ(DownloadItem::IN_PROGRESS, download1->GetState());
 
   // Start the second download and wait until it's done.
   GURL url(net::URLRequestMockHTTPJob::GetMockUrl("download-test.lib"));
-  DownloadItem* download2 = StartDownloadAndReturnItem(url);
+  DownloadItem* download2 = StartDownloadAndReturnItem(shell(), url);
   WaitForCompletion(download2);
 
   ASSERT_EQ(DownloadItem::IN_PROGRESS, download1->GetState());
@@ -890,7 +951,7 @@
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, MAYBE_ShutdownInProgress) {
   // Create a download that won't complete.
   DownloadItem* download = StartDownloadAndReturnItem(
-      GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
+      shell(), GURL(net::URLRequestSlowDownloadJob::kUnknownSizeUrl));
 
   EXPECT_EQ(DownloadItem::IN_PROGRESS, download->GetState());
 
@@ -990,10 +1051,7 @@
 }
 
 // Test resumption with a response that contains strong validators.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, Resume_WithStrongValidators) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
-
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest, StrongValidators) {
   TestDownloadRequestHandler request_handler;
   TestDownloadRequestHandler::Parameters parameters =
       TestDownloadRequestHandler::Parameters::WithSingleInterruption();
@@ -1001,12 +1059,14 @@
       parameters.injected_errors.front();
   request_handler.StartServing(parameters);
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   ASSERT_EQ(interruption.offset, download->GetReceivedBytes());
   ASSERT_EQ(parameters.size, download->GetTotalBytes());
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
 
@@ -1049,10 +1109,8 @@
 // (as opposed to If-Match), the behavior for a precondition failure is also to
 // respond with a 200. So this test case covers both validation failure and
 // ignoring the range request.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest,
-                       Resume_RestartIfNotPartialResponse) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       RestartIfNotPartialResponse) {
   const int kOriginalPatternGeneratorSeed = 1;
   const int kNewPatternGeneratorSeed = 2;
 
@@ -1065,7 +1123,8 @@
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(parameters);
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   ASSERT_EQ(interruption.offset, download->GetReceivedBytes());
@@ -1076,6 +1135,7 @@
   parameters.pattern_generator_seed = kNewPatternGeneratorSeed;
   request_handler.StartServing(parameters);
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
 
@@ -1113,9 +1173,7 @@
 }
 
 // Confirm we restart if we don't have a verifier.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, Resume_RestartIfNoETag) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest, RestartIfNoETag) {
   const int kOriginalPatternGeneratorSeed = 1;
   const int kNewPatternGeneratorSeed = 2;
 
@@ -1127,13 +1185,15 @@
 
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(parameters);
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   parameters.pattern_generator_seed = kNewPatternGeneratorSeed;
   parameters.ClearInjectedErrors();
   request_handler.StartServing(parameters);
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
 
@@ -1157,15 +1217,14 @@
 
 // Partial file goes missing before the download is resumed. The download should
 // restart.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, Resume_RestartIfNoPartialFile) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest, RestartIfNoPartialFile) {
   TestDownloadRequestHandler::Parameters parameters =
       TestDownloadRequestHandler::Parameters::WithSingleInterruption();
 
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(parameters);
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   // Delete the intermediate file.
@@ -1175,6 +1234,7 @@
   parameters.ClearInjectedErrors();
   request_handler.StartServing(parameters);
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
 
@@ -1185,15 +1245,14 @@
       download->GetTargetFilePath()));
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, Resume_RecoverFromInitFileError) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       RecoverFromInitFileError) {
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(TestDownloadRequestHandler::Parameters());
 
   // Setup the error injector.
-  scoped_refptr<TestFileErrorInjector> injector(
-      TestFileErrorInjector::Create(DownloadManagerForShell(shell())));
+  scoped_refptr<TestFileErrorInjector> injector(TestFileErrorInjector::Create(
+      DownloadManagerForShell(initiator_shell_for_resumption())));
 
   const TestFileErrorInjector::FileErrorInfo err = {
       request_handler.url().spec(),
@@ -1203,7 +1262,8 @@
   injector->InjectErrors();
 
   // Start and watch for interrupt.
-  DownloadItem* download(StartDownloadAndReturnItem(request_handler.url()));
+  DownloadItem* download(StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url()));
   WaitForInterrupt(download);
   ASSERT_EQ(DownloadItem::INTERRUPTED, download->GetState());
   EXPECT_EQ(DOWNLOAD_INTERRUPT_REASON_FILE_NO_SPACE,
@@ -1224,21 +1284,20 @@
   injector->InjectErrors();
 
   // Resume and watch completion.
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
   EXPECT_EQ(download->GetState(), DownloadItem::COMPLETE);
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest,
-                       Resume_RecoverFromIntermediateFileRenameError) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       RecoverFromIntermediateFileRenameError) {
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(TestDownloadRequestHandler::Parameters());
 
   // Setup the error injector.
-  scoped_refptr<TestFileErrorInjector> injector(
-      TestFileErrorInjector::Create(DownloadManagerForShell(shell())));
+  scoped_refptr<TestFileErrorInjector> injector(TestFileErrorInjector::Create(
+      DownloadManagerForShell(initiator_shell_for_resumption())));
 
   const TestFileErrorInjector::FileErrorInfo err = {
       request_handler.url().spec(),
@@ -1248,7 +1307,8 @@
   injector->InjectErrors();
 
   // Start and watch for interrupt.
-  DownloadItem* download(StartDownloadAndReturnItem(request_handler.url()));
+  DownloadItem* download(StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url()));
   WaitForInterrupt(download);
   ASSERT_EQ(DownloadItem::INTERRUPTED, download->GetState());
   EXPECT_EQ(DOWNLOAD_INTERRUPT_REASON_FILE_NO_SPACE,
@@ -1270,23 +1330,23 @@
   injector->ClearErrors();
   injector->InjectErrors();
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
   EXPECT_EQ(download->GetState(), DownloadItem::COMPLETE);
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest,
-                       Resume_RecoverFromFinalRenameError) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       RecoverFromFinalRenameError) {
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(TestDownloadRequestHandler::Parameters());
 
   // Setup the error injector.
-  scoped_refptr<TestFileErrorInjector> injector(
-      TestFileErrorInjector::Create(DownloadManagerForShell(shell())));
+  scoped_refptr<TestFileErrorInjector> injector(TestFileErrorInjector::Create(
+      DownloadManagerForShell(initiator_shell_for_resumption())));
 
-  DownloadManagerForShell(shell())->RemoveAllDownloads();
+  DownloadManagerForShell(initiator_shell_for_resumption())
+      ->RemoveAllDownloads();
   TestFileErrorInjector::FileErrorInfo err = {
       request_handler.url().spec(),
       TestFileErrorInjector::FILE_OPERATION_RENAME_ANNOTATE, 0,
@@ -1295,7 +1355,8 @@
   injector->InjectErrors();
 
   // Start and watch for interrupt.
-  DownloadItem* download(StartDownloadAndReturnItem(request_handler.url()));
+  DownloadItem* download(StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url()));
   WaitForInterrupt(download);
   ASSERT_EQ(DownloadItem::INTERRUPTED, download->GetState());
   EXPECT_EQ(DOWNLOAD_INTERRUPT_REASON_FILE_NO_SPACE,
@@ -1315,6 +1376,7 @@
   injector->ClearErrors();
   injector->InjectErrors();
 
+  PrepareToResume();
   download->Resume();
   WaitForCompletion(download);
   EXPECT_EQ(download->GetState(), DownloadItem::COMPLETE);
@@ -1322,14 +1384,14 @@
 
 // An interrupted download should remove the intermediate file when it is
 // cancelled.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, CancelInterruptedDownload) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       CancelInterruptedDownload) {
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(
       TestDownloadRequestHandler::Parameters::WithSingleInterruption());
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   base::FilePath intermediate_path = download->GetFullPath();
@@ -1345,14 +1407,14 @@
   EXPECT_TRUE(download->GetFullPath().empty());
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, RemoveInterruptedDownload) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest,
+                       RemoveInterruptedDownload) {
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(
       TestDownloadRequestHandler::Parameters::WithSingleInterruption());
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   base::FilePath intermediate_path = download->GetFullPath();
@@ -1374,7 +1436,8 @@
   request_handler.StartServing(TestDownloadRequestHandler::Parameters());
   scoped_ptr<DownloadTestObserver> completion_observer(
       CreateWaiter(shell(), 1));
-  DownloadItem* download(StartDownloadAndReturnItem(request_handler.url()));
+  DownloadItem* download(
+      StartDownloadAndReturnItem(shell(), request_handler.url()));
   completion_observer->WaitForFinished();
 
   // The target path should exist.
@@ -1388,15 +1451,14 @@
   EXPECT_TRUE(base::PathExists(target_path));
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, RemoveResumingDownload) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest, RemoveResumingDownload) {
   TestDownloadRequestHandler::Parameters parameters =
       TestDownloadRequestHandler::Parameters::WithSingleInterruption();
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(parameters);
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   base::FilePath intermediate_path(download->GetFullPath());
@@ -1405,13 +1467,15 @@
 
   // Resume and remove download. We expect only a single OnDownloadCreated()
   // call, and that's for the second download created below.
-  MockDownloadManagerObserver dm_observer(DownloadManagerForShell(shell()));
+  MockDownloadManagerObserver dm_observer(
+      DownloadManagerForShell(initiator_shell_for_resumption()));
   EXPECT_CALL(dm_observer, OnDownloadCreated(_,_)).Times(1);
 
   TestRequestStartHandler request_start_handler;
   parameters.on_start_handler = request_start_handler.GetOnStartHandler();
   request_handler.StartServing(parameters);
 
+  PrepareToResume();
   download->Resume();
   request_start_handler.WaitForCallback();
 
@@ -1439,15 +1503,14 @@
   EXPECT_TRUE(EnsureNoPendingDownloads());
 }
 
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, CancelResumingDownload) {
-  base::CommandLine::ForCurrentProcess()->AppendSwitch(
-      switches::kEnableDownloadResumption);
+IN_PROC_BROWSER_TEST_P(DownloadResumptionContentTest, CancelResumingDownload) {
   TestDownloadRequestHandler::Parameters parameters =
       TestDownloadRequestHandler::Parameters::WithSingleInterruption();
   TestDownloadRequestHandler request_handler;
   request_handler.StartServing(parameters);
 
-  DownloadItem* download = StartDownloadAndReturnItem(request_handler.url());
+  DownloadItem* download = StartDownloadAndReturnItem(
+      initiator_shell_for_resumption(), request_handler.url());
   WaitForInterrupt(download);
 
   base::FilePath intermediate_path(download->GetFullPath());
@@ -1456,13 +1519,15 @@
 
   // Resume and remove download. We expect only a single OnDownloadCreated()
   // call, and that's for the second download created below.
-  MockDownloadManagerObserver dm_observer(DownloadManagerForShell(shell()));
+  MockDownloadManagerObserver dm_observer(
+      DownloadManagerForShell(initiator_shell_for_resumption()));
   EXPECT_CALL(dm_observer, OnDownloadCreated(_,_)).Times(1);
 
   TestRequestStartHandler request_start_handler;
   parameters.on_start_handler = request_start_handler.GetOnStartHandler();
   request_handler.StartServing(parameters);
 
+  PrepareToResume();
   download->Resume();
   request_start_handler.WaitForCallback();
 

diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 64cd0966..f93f87c 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc

@@ -259,11 +259,20 @@
   if (delegate_ && render_frame_created_)
     delegate_->RenderFrameDeleted(this);
 
-  // If this was swapped out, it already decremented the active frame count of
-  // the SiteInstance it belongs to.
-  if (IsRFHStateActive(rfh_state_))
+  bool is_active = IsRFHStateActive(rfh_state_);
+
+  // If this RenderFrameHost is swapped out, it already decremented the active
+  // frame count of the SiteInstance it belongs to.
+  if (is_active)
     GetSiteInstance()->decrement_active_frame_count();
 
+  // If this RenderFrameHost is swapping with a RenderFrameProxyHost, the
+  // RenderFrame will already be deleted in the renderer process. Main frame
+  // RenderFrames will be cleaned up as part of deleting its RenderView. In all
+  // other cases, the RenderFrame should be cleaned up (if it exists).
+  if (is_active && !frame_tree_node_->IsMainFrame() && render_frame_created_)
+    Send(new FrameMsg_Delete(routing_id_));
+
   // NULL out the swapout timer; in crash dumps this member will be null only if
   // the dtor has run.
   swapout_event_monitor_timeout_.reset();

diff --git a/content/browser/renderer_host/media/audio_output_device_enumerator.cc b/content/browser/renderer_host/media/audio_output_device_enumerator.cc
index 13f875f6..70a4320 100644
--- a/content/browser/renderer_host/media/audio_output_device_enumerator.cc
+++ b/content/browser/renderer_host/media/audio_output_device_enumerator.cc

@@ -91,6 +91,11 @@
   cache_policy_ = policy;
 }
 
+bool AudioOutputDeviceEnumerator::IsCacheEnabled() {
+  DCHECK(thread_checker_.CalledOnValidThread());
+  return cache_policy_ != CACHE_POLICY_NO_CACHING;
+}
+
 void AudioOutputDeviceEnumerator::DoEnumerateDevices() {
   DCHECK(thread_checker_.CalledOnValidThread());
   is_enumeration_ongoing_ = true;

diff --git a/content/browser/renderer_host/media/audio_output_device_enumerator.h b/content/browser/renderer_host/media/audio_output_device_enumerator.h
index 9ca251e..740e9c6 100644
--- a/content/browser/renderer_host/media/audio_output_device_enumerator.h
+++ b/content/browser/renderer_host/media/audio_output_device_enumerator.h

@@ -72,6 +72,10 @@
   // Sets the cache policy.
   void SetCachePolicy(CachePolicy cache_policy);
 
+  // Returns true if the caching policy is different from
+  // CACHE_POLICY_NO_CACHING, false otherwise.
+  bool IsCacheEnabled();
+
  private:
   void InitializeOnIOThread();
   void DoEnumerateDevices();

diff --git a/content/browser/renderer_host/media/audio_renderer_host.cc b/content/browser/renderer_host/media/audio_renderer_host.cc
index 9f88003..29c9d7f 100644
--- a/content/browser/renderer_host/media/audio_renderer_host.cc
+++ b/content/browser/renderer_host/media/audio_renderer_host.cc

@@ -107,6 +107,22 @@
   return true;
 }
 
+bool IsDefaultDeviceId(const std::string& device_id) {
+  return device_id.empty() ||
+         device_id == media::AudioManagerBase::kDefaultDeviceId;
+}
+
+AudioOutputDeviceInfo GetDefaultDeviceInfoOnDeviceThread(
+    media::AudioManager* audio_manager) {
+  DCHECK(audio_manager->GetWorkerTaskRunner()->BelongsToCurrentThread());
+  AudioOutputDeviceInfo default_device_info = {
+      media::AudioManagerBase::kDefaultDeviceId,
+      audio_manager->GetDefaultDeviceName(),
+      audio_manager->GetDefaultOutputStreamParameters()};
+
+  return default_device_info;
+}
+
 void NotifyRenderProcessHostThatAudioStateChanged(int render_process_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -475,10 +491,25 @@
     return;
   }
 
-  media_stream_manager_->audio_output_device_enumerator()->Enumerate(base::Bind(
-      &AudioRendererHost::TranslateDeviceID, this, device_id,
-      gurl_security_origin,
-      base::Bind(&AudioRendererHost::OnDeviceIDTranslated, this, stream_id)));
+  // If enumerator caching is disabled, avoid the enumeration if the default
+  // device is requested, since no device ID translation is needed.
+  // If enumerator caching is enabled, it is better to use its cache, even
+  // for the default device.
+  if (IsDefaultDeviceId(device_id) &&
+      !media_stream_manager_->audio_output_device_enumerator()
+           ->IsCacheEnabled()) {
+    base::PostTaskAndReplyWithResult(
+        audio_manager_->GetWorkerTaskRunner().get(), FROM_HERE,
+        base::Bind(&GetDefaultDeviceInfoOnDeviceThread, audio_manager_),
+        base::Bind(&AudioRendererHost::OnDeviceIDTranslated, this, stream_id,
+                   true));
+  } else {
+    media_stream_manager_->audio_output_device_enumerator()->Enumerate(
+        base::Bind(&AudioRendererHost::TranslateDeviceID, this, device_id,
+                   gurl_security_origin,
+                   base::Bind(&AudioRendererHost::OnDeviceIDTranslated, this,
+                              stream_id)));
+  }
 }
 
 void AudioRendererHost::OnDeviceIDTranslated(

diff --git a/content/browser/renderer_host/media/media_stream_manager.cc b/content/browser/renderer_host/media/media_stream_manager.cc
index 3c2bd841..6639741a 100644
--- a/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/content/browser/renderer_host/media/media_stream_manager.cc

@@ -180,8 +180,6 @@
          !BrowserThread::IsMessageLoopValid(BrowserThread::IO);
 }
 
-void DummyEnumerationCallback(const AudioOutputDeviceEnumeration& e) {}
-
 }  // namespace
 
 
@@ -907,13 +905,6 @@
   monitoring_started_ = true;
   base::SystemMonitor::Get()->AddDevicesChangedObserver(this);
 
-  // Enable caching for audio output device enumerations and do an enumeration
-  // to populate the cache.
-  audio_output_device_enumerator_->SetCachePolicy(
-      AudioOutputDeviceEnumerator::CACHE_POLICY_MANUAL_INVALIDATION);
-  audio_output_device_enumerator_->Enumerate(
-      base::Bind(&DummyEnumerationCallback));
-
   // Enumerate both the audio and video input devices to cache the device lists
   // and send them to media observer.
   ++active_enumeration_ref_count_[MEDIA_DEVICE_AUDIO_CAPTURE];
@@ -2009,7 +2000,6 @@
   MediaStreamType stream_type;
   if (device_type == base::SystemMonitor::DEVTYPE_AUDIO_CAPTURE) {
     stream_type = MEDIA_DEVICE_AUDIO_CAPTURE;
-    audio_output_device_enumerator_->InvalidateCache();
   } else if (device_type == base::SystemMonitor::DEVTYPE_VIDEO_CAPTURE) {
     stream_type = MEDIA_DEVICE_VIDEO_CAPTURE;
   } else {

diff --git a/content/browser/service_worker/service_worker_browsertest.cc b/content/browser/service_worker/service_worker_browsertest.cc
index 0f28ab96..8b73778 100644
--- a/content/browser/service_worker/service_worker_browsertest.cc
+++ b/content/browser/service_worker/service_worker_browsertest.cc

@@ -470,6 +470,10 @@
         pattern,
         wrapper()->context()->storage()->NewRegistrationId(),
         wrapper()->context()->AsWeakPtr());
+    // Set the update check time to avoid triggering updates in the middle of
+    // tests.
+    registration_->set_last_update_check(base::Time::Now());
+
     version_ = new ServiceWorkerVersion(
         registration_.get(),
         embedded_test_server()->GetURL(worker_url),

diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 7e8c1cf..3c7a42c 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc

@@ -29,6 +29,7 @@
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/browser/resource_dispatcher_host.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -4367,4 +4368,140 @@
   EXPECT_EQ(1, child_count);
 }
 
+// This test ensures that the RenderFrame isn't leaked in the renderer process
+// if a pending cross-process navigation is cancelled. The test works by trying
+// to create a new RenderFrame with the same routing id. If there is an
+// entry with the same routing ID, a CHECK is hit and the process crashes.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       SubframePendingAndBackToSameSiteInstance) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  NavigateToURL(shell(), main_url);
+
+  // Capture the FrameTreeNode this test will be navigating.
+  FrameTreeNode* node = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root()
+                            ->child_at(0);
+  EXPECT_TRUE(node);
+  EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
+            node->parent()->current_frame_host()->GetSiteInstance());
+
+  // Navigate to the site of the parent, but to a page that will not commit.
+  GURL same_site_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  NavigationStallDelegate stall_delegate(same_site_url);
+  ResourceDispatcherHost::Get()->SetDelegate(&stall_delegate);
+  {
+    NavigationController::LoadURLParams params(same_site_url);
+    params.transition_type = ui::PAGE_TRANSITION_LINK;
+    params.frame_tree_node_id = node->frame_tree_node_id();
+    node->navigator()->GetController()->LoadURLWithParams(params);
+  }
+
+  // Grab the routing id of the pending RenderFrameHost and set up a process
+  // observer to ensure there is no crash when a new RenderFrame creation is
+  // attempted.
+  RenderProcessHost* process =
+      node->render_manager()->pending_frame_host()->GetProcess();
+  RenderProcessHostWatcher watcher(
+      process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  int frame_routing_id =
+      node->render_manager()->pending_frame_host()->GetRoutingID();
+  int proxy_routing_id =
+      node->render_manager()->GetProxyToParent()->GetRoutingID();
+
+  // Now go to c.com so the navigation to a.com is cancelled and send an IPC
+  // to create a new RenderFrame with the routing id of the previously pending
+  // one.
+  NavigateFrameToURL(node,
+                     embedded_test_server()->GetURL("c.com", "/title2.html"));
+  {
+    FrameMsg_NewFrame_Params params;
+    params.routing_id = frame_routing_id;
+    params.proxy_routing_id = proxy_routing_id;
+    params.opener_routing_id = MSG_ROUTING_NONE;
+    params.parent_routing_id =
+        shell()->web_contents()->GetMainFrame()->GetRoutingID();
+    params.previous_sibling_routing_id = MSG_ROUTING_NONE;
+    params.widget_params.routing_id = MSG_ROUTING_NONE;
+    params.widget_params.hidden = true;
+
+    process->Send(new FrameMsg_NewFrame(params));
+  }
+
+  // The test must wait for the process to exit, but if there is no leak, the
+  // RenderFrame will be properly created and there will be no crash.
+  // Therefore, navigate the main frame to completely different site, which
+  // will cause the original process to exit cleanly.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("d.com", "/title3.html")));
+  watcher.Wait();
+  EXPECT_TRUE(watcher.did_exit_normally());
+
+  ResourceDispatcherHost::Get()->SetDelegate(nullptr);
+}
+
+// This test ensures that the RenderFrame isn't leaked in the renderer process
+// when a remote parent detaches a child frame. The test works by trying
+// to create a new RenderFrame with the same routing id. If there is an
+// entry with the same routing ID, a CHECK is hit and the process crashes.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ParentDetachRemoteChild) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b,b)"));
+  NavigateToURL(shell(), main_url);
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_EQ(2U, web_contents->GetFrameTree()->root()->child_count());
+
+  // Capture the FrameTreeNode this test will be navigating.
+  FrameTreeNode* node = web_contents->GetFrameTree()->root()->child_at(0);
+  EXPECT_TRUE(node);
+  EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
+            node->parent()->current_frame_host()->GetSiteInstance());
+
+  // Grab the routing id of the first child RenderFrameHost and set up a process
+  // observer to ensure there is no crash when a new RenderFrame creation is
+  // attempted.
+  RenderProcessHost* process = node->current_frame_host()->GetProcess();
+  RenderProcessHostWatcher watcher(
+      process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  int frame_routing_id = node->current_frame_host()->GetRoutingID();
+  int widget_routing_id =
+      node->current_frame_host()->GetRenderWidgetHost()->GetRoutingID();
+  int parent_routing_id =
+      node->parent()->render_manager()->GetRoutingIdForSiteInstance(
+          node->current_frame_host()->GetSiteInstance());
+
+  // Have the parent frame remove the child frame from its DOM. This should
+  // result in the child RenderFrame being deleted in the remote process.
+  EXPECT_TRUE(ExecuteScript(web_contents,
+                            "document.body.removeChild("
+                            "document.querySelectorAll('iframe')[0])"));
+  EXPECT_EQ(1U, web_contents->GetFrameTree()->root()->child_count());
+
+  {
+    FrameMsg_NewFrame_Params params;
+    params.routing_id = frame_routing_id;
+    params.proxy_routing_id = MSG_ROUTING_NONE;
+    params.opener_routing_id = MSG_ROUTING_NONE;
+    params.parent_routing_id = parent_routing_id;
+    params.previous_sibling_routing_id = MSG_ROUTING_NONE;
+    params.widget_params.routing_id = widget_routing_id;
+    params.widget_params.hidden = true;
+
+    process->Send(new FrameMsg_NewFrame(params));
+  }
+
+  // The test must wait for the process to exit, but if there is no leak, the
+  // RenderFrame will be properly created and there will be no crash.
+  // Therefore, navigate the remaining subframe to completely different site,
+  // which will cause the original process to exit cleanly.
+  NavigateFrameToURL(
+      web_contents->GetFrameTree()->root()->child_at(0),
+      embedded_test_server()->GetURL("d.com", "/title3.html"));
+  watcher.Wait();
+  EXPECT_TRUE(watcher.did_exit_normally());
+}
+
 }  // namespace content

diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 3e7e8e49..be2f16ef 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h

@@ -523,6 +523,9 @@
 // Instructs the renderer to create a new RenderFrame object.
 IPC_MESSAGE_CONTROL1(FrameMsg_NewFrame, FrameMsg_NewFrame_Params /* params */)
 
+// Instructs the renderer to delete the RenderFrame.
+IPC_MESSAGE_ROUTED0(FrameMsg_Delete)
+
 // Instructs the renderer to create a new RenderFrameProxy object with
 // |routing_id|.  |render_view_routing_id| identifies the
 // RenderView to be associated with this proxy.  The new proxy's opener should

diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 92d135e..9803488c 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi

@@ -240,6 +240,9 @@
       'renderer/input/input_handler_wrapper.h',
       'renderer/input/main_thread_input_event_filter.cc',
       'renderer/input/main_thread_input_event_filter.h',
+      'renderer/input/render_widget_input_handler.cc',
+      'renderer/input/render_widget_input_handler.h',
+      'renderer/input/render_widget_input_handler_delegate.h',
       'renderer/internal_document_state_data.cc',
       'renderer/internal_document_state_data.h',
       'renderer/java/gin_java_bridge_dispatcher.cc',

diff --git a/content/renderer/input/render_widget_input_handler.cc b/content/renderer/input/render_widget_input_handler.cc
new file mode 100644
index 0000000..275b77e
--- /dev/null
+++ b/content/renderer/input/render_widget_input_handler.cc

@@ -0,0 +1,490 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/input/render_widget_input_handler.h"
+
+#include "base/auto_reset.h"
+#include "base/metrics/histogram_macros.h"
+#include "base/trace_event/trace_event_synthetic_delay.h"
+#include "cc/trees/swap_promise_monitor.h"
+#include "components/scheduler/renderer/renderer_scheduler.h"
+#include "content/common/input/input_event_ack.h"
+#include "content/common/input/input_event_ack_state.h"
+#include "content/common/input/web_input_event_traits.h"
+#include "content/renderer/gpu/render_widget_compositor.h"
+#include "content/renderer/ime_event_guard.h"
+#include "content/renderer/input/render_widget_input_handler_delegate.h"
+#include "content/renderer/render_thread_impl.h"
+#include "content/renderer/render_widget.h"
+#include "third_party/WebKit/public/platform/WebFloatPoint.h"
+#include "third_party/WebKit/public/platform/WebFloatSize.h"
+#include "ui/events/latency_info.h"
+#include "ui/gfx/geometry/point_conversions.h"
+
+#if defined(OS_ANDROID)
+#include <android/keycodes.h>
+#endif
+
+using blink::WebFloatPoint;
+using blink::WebFloatSize;
+using blink::WebGestureEvent;
+using blink::WebInputEvent;
+using blink::WebInputEventResult;
+using blink::WebKeyboardEvent;
+using blink::WebMouseEvent;
+using blink::WebMouseWheelEvent;
+using blink::WebTouchEvent;
+using blink::WebTouchPoint;
+
+namespace content {
+
+namespace {
+
+// TODO(brianderson): Replace the hard-coded threshold with a fraction of
+// the BeginMainFrame interval.
+// 4166us will allow 1/4 of a 60Hz interval or 1/2 of a 120Hz interval to
+// be spent in input hanlders before input starts getting throttled.
+const int kInputHandlingTimeThrottlingThresholdMicroseconds = 4166;
+
+int64 GetEventLatencyMicros(double event_timestamp, base::TimeTicks now) {
+  return (now - base::TimeDelta::FromSecondsD(event_timestamp))
+      .ToInternalValue();
+}
+
+void LogInputEventLatencyUmaImpl(WebInputEvent::Type event_type,
+                                 double event_timestamp,
+                                 base::TimeTicks now) {
+  UMA_HISTOGRAM_CUSTOM_COUNTS("Event.AggregatedLatency.Renderer2",
+                              GetEventLatencyMicros(event_timestamp, now), 1,
+                              10000000, 100);
+
+#define CASE_TYPE(t)                                                         \
+  case WebInputEvent::t:                                                     \
+    UMA_HISTOGRAM_CUSTOM_COUNTS("Event.Latency.Renderer2." #t,               \
+                                GetEventLatencyMicros(event_timestamp, now), \
+                                1, 10000000, 100);                           \
+    break;
+
+  switch (event_type) {
+    CASE_TYPE(Undefined);
+    CASE_TYPE(MouseDown);
+    CASE_TYPE(MouseUp);
+    CASE_TYPE(MouseMove);
+    CASE_TYPE(MouseEnter);
+    CASE_TYPE(MouseLeave);
+    CASE_TYPE(ContextMenu);
+    CASE_TYPE(MouseWheel);
+    CASE_TYPE(RawKeyDown);
+    CASE_TYPE(KeyDown);
+    CASE_TYPE(KeyUp);
+    CASE_TYPE(Char);
+    CASE_TYPE(GestureScrollBegin);
+    CASE_TYPE(GestureScrollEnd);
+    CASE_TYPE(GestureScrollUpdate);
+    CASE_TYPE(GestureFlingStart);
+    CASE_TYPE(GestureFlingCancel);
+    CASE_TYPE(GestureShowPress);
+    CASE_TYPE(GestureTap);
+    CASE_TYPE(GestureTapUnconfirmed);
+    CASE_TYPE(GestureTapDown);
+    CASE_TYPE(GestureTapCancel);
+    CASE_TYPE(GestureDoubleTap);
+    CASE_TYPE(GestureTwoFingerTap);
+    CASE_TYPE(GestureLongPress);
+    CASE_TYPE(GestureLongTap);
+    CASE_TYPE(GesturePinchBegin);
+    CASE_TYPE(GesturePinchEnd);
+    CASE_TYPE(GesturePinchUpdate);
+    CASE_TYPE(TouchStart);
+    CASE_TYPE(TouchMove);
+    CASE_TYPE(TouchEnd);
+    CASE_TYPE(TouchCancel);
+    default:
+      // Must include default to let blink::WebInputEvent add new event types
+      // before they're added here.
+      DLOG(WARNING) << "Unhandled WebInputEvent type: " << event_type;
+      break;
+  }
+
+#undef CASE_TYPE
+}
+
+void LogInputEventLatencyUma(const WebInputEvent& event,
+                             base::TimeTicks now,
+                             const ui::LatencyInfo& latency_info) {
+  LogInputEventLatencyUmaImpl(event.type, event.timeStampSeconds, now);
+  for (size_t i = 0; i < latency_info.coalesced_events_size(); i++) {
+    LogInputEventLatencyUmaImpl(
+        event.type, latency_info.timestamps_of_coalesced_events()[i], now);
+  }
+}
+
+void LogPassiveLatency(int64 latency) {
+  UMA_HISTOGRAM_CUSTOM_COUNTS("Event.PassiveListeners.Latency", latency, 1,
+                              10000000, 100);
+}
+
+void LogPassiveEventListenersUma(WebInputEventResult result,
+                                 bool passive,
+                                 bool cancelable,
+                                 double event_timestamp,
+                                 const ui::LatencyInfo& latency_info) {
+  enum {
+    PASSIVE_LISTENER_UMA_ENUM_PASSIVE,
+    PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE,
+    PASSIVE_LISTENER_UMA_ENUM_SUPPRESSED,
+    PASSIVE_LISTENER_UMA_ENUM_CANCELABLE,
+    PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED,
+    PASSIVE_LISTENER_UMA_ENUM_COUNT
+  };
+
+  int enum_value;
+  if (passive)
+    enum_value = PASSIVE_LISTENER_UMA_ENUM_PASSIVE;
+  else if (!cancelable)
+    enum_value = PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE;
+  else if (result == WebInputEventResult::HandledApplication)
+    enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED;
+  else if (result == WebInputEventResult::HandledSuppressed)
+    enum_value = PASSIVE_LISTENER_UMA_ENUM_SUPPRESSED;
+  else
+    enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE;
+
+  UMA_HISTOGRAM_ENUMERATION("Event.PassiveListeners", enum_value,
+                            PASSIVE_LISTENER_UMA_ENUM_COUNT);
+
+  if (enum_value == PASSIVE_LISTENER_UMA_ENUM_CANCELABLE &&
+      base::TimeTicks::IsHighResolution()) {
+    base::TimeTicks now = base::TimeTicks::Now();
+    LogPassiveLatency(GetEventLatencyMicros(event_timestamp, now));
+    for (size_t i = 0; i < latency_info.coalesced_events_size(); i++)
+      LogPassiveLatency(GetEventLatencyMicros(
+          latency_info.timestamps_of_coalesced_events()[i], now));
+  }
+}
+
+}  // namespace
+
+RenderWidgetInputHandler::RenderWidgetInputHandler(
+    RenderWidgetInputHandlerDelegate* delegate,
+    RenderWidget* widget)
+    : delegate_(delegate),
+      widget_(widget),
+      handling_input_event_(false),
+      handling_event_overscroll_(nullptr),
+      handling_event_type_(WebInputEvent::Undefined),
+      context_menu_source_type_(ui::MENU_SOURCE_MOUSE),
+      suppress_next_char_events_(false),
+      ignore_ack_for_mouse_move_from_debugger_(false) {
+  DCHECK(delegate);
+  DCHECK(widget);
+}
+
+RenderWidgetInputHandler::~RenderWidgetInputHandler() {}
+
+void RenderWidgetInputHandler::HandleInputEvent(
+    const WebInputEvent& input_event,
+    const ui::LatencyInfo& latency_info) {
+  // TODO(dtapuska): Passive support not implemented yet crbug.com/489802
+  bool passive = false;
+  base::AutoReset<bool> handling_input_event_resetter(&handling_input_event_,
+                                                      true);
+  base::AutoReset<WebInputEvent::Type> handling_event_type_resetter(
+      &handling_event_type_, input_event.type);
+
+  // Calls into |didOverscroll()| while handling this event will populate
+  // |event_overscroll|, which in turn will be bundled with the event ack.
+  scoped_ptr<DidOverscrollParams> event_overscroll;
+  base::AutoReset<scoped_ptr<DidOverscrollParams>*>
+      handling_event_overscroll_resetter(&handling_event_overscroll_,
+                                         &event_overscroll);
+
+#if defined(OS_ANDROID)
+  const bool is_keyboard_event =
+      WebInputEvent::isKeyboardEventType(input_event.type);
+
+  // For non-keyboard events, we want the change source to be FROM_NON_IME.
+  ImeEventGuard guard(widget_, false, is_keyboard_event);
+#endif
+
+  base::TimeTicks start_time;
+  if (base::TimeTicks::IsHighResolution())
+    start_time = base::TimeTicks::Now();
+
+  TRACE_EVENT1("renderer,benchmark",
+               "RenderWidgetInputHandler::OnHandleInputEvent", "event",
+               WebInputEventTraits::GetName(input_event.type));
+  TRACE_EVENT_SYNTHETIC_DELAY_BEGIN("blink.HandleInputEvent");
+  TRACE_EVENT_WITH_FLOW1("input,benchmark", "LatencyInfo.Flow",
+                         TRACE_ID_DONT_MANGLE(latency_info.trace_id()),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT,
+                         "step", "HandleInputEventMain");
+
+  // If we don't have a high res timer, these metrics won't be accurate enough
+  // to be worth collecting. Note that this does introduce some sampling bias.
+  if (!start_time.is_null())
+    LogInputEventLatencyUma(input_event, start_time, latency_info);
+
+  scoped_ptr<cc::SwapPromiseMonitor> latency_info_swap_promise_monitor;
+  ui::LatencyInfo swap_latency_info(latency_info);
+  if (widget_->compositor()) {
+    latency_info_swap_promise_monitor =
+        widget_->compositor()->CreateLatencyInfoSwapPromiseMonitor(
+            &swap_latency_info);
+  }
+
+  bool prevent_default = false;
+  if (WebInputEvent::isMouseEventType(input_event.type)) {
+    const WebMouseEvent& mouse_event =
+        static_cast<const WebMouseEvent&>(input_event);
+    TRACE_EVENT2("renderer", "HandleMouseMove", "x", mouse_event.x, "y",
+                 mouse_event.y);
+    context_menu_source_type_ = ui::MENU_SOURCE_MOUSE;
+    prevent_default = delegate_->WillHandleMouseEvent(mouse_event);
+  }
+
+  if (WebInputEvent::isKeyboardEventType(input_event.type)) {
+    context_menu_source_type_ = ui::MENU_SOURCE_KEYBOARD;
+#if defined(OS_ANDROID)
+    // The DPAD_CENTER key on Android has a dual semantic: (1) in the general
+    // case it should behave like a select key (i.e. causing a click if a button
+    // is focused). However, if a text field is focused (2), its intended
+    // behavior is to just show the IME and don't propagate the key.
+    // A typical use case is a web form: the DPAD_CENTER should bring up the IME
+    // when clicked on an input text field and cause the form submit if clicked
+    // when the submit button is focused, but not vice-versa.
+    // The UI layer takes care of translating DPAD_CENTER into a RETURN key,
+    // but at this point we have to swallow the event for the scenario (2).
+    const WebKeyboardEvent& key_event =
+        static_cast<const WebKeyboardEvent&>(input_event);
+    if (key_event.nativeKeyCode == AKEYCODE_DPAD_CENTER &&
+        widget_->GetTextInputType() != ui::TEXT_INPUT_TYPE_NONE) {
+      widget_->showImeIfNeeded();
+      prevent_default = true;
+    }
+#endif
+  }
+
+  if (WebInputEvent::isGestureEventType(input_event.type)) {
+    const WebGestureEvent& gesture_event =
+        static_cast<const WebGestureEvent&>(input_event);
+    context_menu_source_type_ = ui::MENU_SOURCE_TOUCH;
+    prevent_default =
+        prevent_default || delegate_->WillHandleGestureEvent(gesture_event);
+  }
+
+  WebInputEventResult processed = prevent_default
+                                      ? WebInputEventResult::HandledSuppressed
+                                      : WebInputEventResult::NotHandled;
+  if (input_event.type != WebInputEvent::Char || !suppress_next_char_events_) {
+    suppress_next_char_events_ = false;
+    if (processed == WebInputEventResult::NotHandled && widget_->webwidget())
+      processed = widget_->webwidget()->handleInputEvent(input_event);
+  }
+
+  // TODO(dtapuska): Use the input_event.timeStampSeconds as the start
+  // ideally this should be when the event was sent by the compositor to the
+  // renderer. crbug.com/565348
+  if (input_event.type == WebInputEvent::TouchStart ||
+      input_event.type == WebInputEvent::TouchMove ||
+      input_event.type == WebInputEvent::TouchEnd) {
+    LogPassiveEventListenersUma(
+        processed, passive,
+        static_cast<const WebTouchEvent&>(input_event).cancelable,
+        input_event.timeStampSeconds, latency_info);
+  } else if (input_event.type == WebInputEvent::MouseWheel) {
+    LogPassiveEventListenersUma(processed, passive, !passive,
+                                input_event.timeStampSeconds, latency_info);
+  }
+
+  // If this RawKeyDown event corresponds to a browser keyboard shortcut and
+  // it's not processed by webkit, then we need to suppress the upcoming Char
+  // events.
+  bool is_keyboard_shortcut =
+      input_event.type == WebInputEvent::RawKeyDown &&
+      static_cast<const WebKeyboardEvent&>(input_event).isBrowserShortcut;
+  if (processed == WebInputEventResult::NotHandled && is_keyboard_shortcut)
+    suppress_next_char_events_ = true;
+
+  InputEventAckState ack_result = processed == WebInputEventResult::NotHandled
+                                      ? INPUT_EVENT_ACK_STATE_NOT_CONSUMED
+                                      : INPUT_EVENT_ACK_STATE_CONSUMED;
+  if (processed == WebInputEventResult::NotHandled &&
+      input_event.type == WebInputEvent::TouchStart) {
+    const WebTouchEvent& touch_event =
+        static_cast<const WebTouchEvent&>(input_event);
+    // Hit-test for all the pressed touch points. If there is a touch-handler
+    // for any of the touch points, then the renderer should continue to receive
+    // touch events.
+    ack_result = INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+    for (size_t i = 0; i < touch_event.touchesLength; ++i) {
+      if (touch_event.touches[i].state == WebTouchPoint::StatePressed &&
+          delegate_->HasTouchEventHandlersAt(
+              gfx::ToFlooredPoint(touch_event.touches[i].position))) {
+        ack_result = INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+        break;
+      }
+    }
+  }
+
+  // Send mouse wheel events and their disposition to the compositor thread, so
+  // that they can be used to produce the elastic overscroll effect on Mac.
+  if (input_event.type == WebInputEvent::MouseWheel) {
+    delegate_->ObserveWheelEventAndResult(
+        static_cast<const WebMouseWheelEvent&>(input_event),
+        event_overscroll ? event_overscroll->latest_overscroll_delta
+                         : gfx::Vector2dF(),
+        processed != WebInputEventResult::NotHandled);
+  }
+
+  bool frame_pending =
+      widget_->compositor() && widget_->compositor()->BeginMainFrameRequested();
+
+  // If we don't have a fast and accurate Now(), we assume the input handlers
+  // are heavy and rate limit them.
+  bool rate_limiting_wanted = input_event.type == WebInputEvent::MouseMove ||
+                              input_event.type == WebInputEvent::MouseWheel;
+  if (rate_limiting_wanted && !start_time.is_null()) {
+    base::TimeTicks end_time = base::TimeTicks::Now();
+    total_input_handling_time_this_frame_ += (end_time - start_time);
+    rate_limiting_wanted =
+        total_input_handling_time_this_frame_.InMicroseconds() >
+        kInputHandlingTimeThrottlingThresholdMicroseconds;
+  }
+
+  TRACE_EVENT_SYNTHETIC_DELAY_END("blink.HandleInputEvent");
+
+  // Note that we can't use handling_event_type_ here since it will be overriden
+  // by reentrant calls for events after the paused one.
+  bool no_ack = ignore_ack_for_mouse_move_from_debugger_ &&
+                input_event.type == WebInputEvent::MouseMove;
+  if (WebInputEventTraits::WillReceiveAckFromRenderer(input_event) && !no_ack) {
+    scoped_ptr<InputEventAck> response(new InputEventAck(
+        input_event.type, ack_result, swap_latency_info,
+        event_overscroll.Pass(),
+        WebInputEventTraits::GetUniqueTouchEventId(input_event)));
+    if (rate_limiting_wanted && frame_pending && !widget_->is_hidden()) {
+      // We want to rate limit the input events in this case, so we'll wait for
+      // painting to finish before ACKing this message.
+      TRACE_EVENT_INSTANT0(
+          "renderer",
+          "RenderWidgetInputHandler::OnHandleInputEvent ack throttled",
+          TRACE_EVENT_SCOPE_THREAD);
+      if (pending_input_event_ack_) {
+        TRACE_EVENT_ASYNC_END0(
+            "input", "RenderWidgetInputHandler::ThrottledInputEventAck",
+            pending_input_event_ack_.get());
+        // As two different kinds of events could cause us to postpone an ack
+        // we send it now, if we have one pending. The Browser should never
+        // send us the same kind of event we are delaying the ack for.
+        delegate_->OnInputEventAck(std::move(pending_input_event_ack_));
+      }
+      pending_input_event_ack_ = std::move(response);
+      TRACE_EVENT_ASYNC_BEGIN0(
+          "input", "RenderWidgetInputHandler::ThrottledInputEventAck",
+          pending_input_event_ack_.get());
+      if (widget_->compositor())
+        widget_->compositor()->NotifyInputThrottledUntilCommit();
+    } else {
+      delegate_->OnInputEventAck(std::move(response));
+    }
+  } else {
+    DCHECK(!event_overscroll) << "Unexpected overscroll for un-acked event";
+  }
+  if (!no_ack && RenderThreadImpl::current()) {
+    RenderThreadImpl::current()
+        ->GetRendererScheduler()
+        ->DidHandleInputEventOnMainThread(input_event);
+  }
+  if (input_event.type == WebInputEvent::MouseMove)
+    ignore_ack_for_mouse_move_from_debugger_ = false;
+
+#if defined(OS_ANDROID)
+  // Allow the IME to be shown when the focus changes as a consequence
+  // of a processed touch end event.
+  if (input_event.type == WebInputEvent::TouchEnd &&
+      processed != WebInputEventResult::NotHandled) {
+    delegate_->UpdateTextInputState(ShowIme::IF_NEEDED,
+                                    ChangeSource::FROM_NON_IME);
+  }
+#elif defined(USE_AURA)
+  // Show the virtual keyboard if enabled and a user gesture triggers a focus
+  // change.
+  if (processed != WebInputEventResult::NotHandled &&
+      (input_event.type == WebInputEvent::TouchEnd ||
+       input_event.type == WebInputEvent::MouseUp)) {
+    delegate_->UpdateTextInputState(ShowIme::IF_NEEDED, ChangeSource::FROM_IME);
+  }
+#endif
+
+  if (!prevent_default && WebInputEvent::isKeyboardEventType(input_event.type))
+    delegate_->OnDidHandleKeyEvent();
+
+// TODO(rouslan): Fix ChromeOS and Windows 8 behavior of autofill popup with
+// virtual keyboard.
+#if !defined(OS_ANDROID)
+  // Virtual keyboard is not supported, so react to focus change immediately.
+  if (processed != WebInputEventResult::NotHandled &&
+      (input_event.type == WebInputEvent::TouchEnd ||
+       input_event.type == WebInputEvent::MouseUp)) {
+    delegate_->FocusChangeComplete();
+  }
+#endif
+}
+
+void RenderWidgetInputHandler::DidOverscrollFromBlink(
+    const WebFloatSize& unusedDelta,
+    const WebFloatSize& accumulatedRootOverScroll,
+    const WebFloatPoint& position,
+    const WebFloatSize& velocity) {
+  scoped_ptr<DidOverscrollParams> params(new DidOverscrollParams());
+  params->accumulated_overscroll = gfx::Vector2dF(
+      accumulatedRootOverScroll.width, accumulatedRootOverScroll.height);
+  params->latest_overscroll_delta =
+      gfx::Vector2dF(unusedDelta.width, unusedDelta.height);
+  // TODO(sataya.m): don't negate velocity once http://crbug.com/499743 is
+  // fixed.
+  params->current_fling_velocity =
+      gfx::Vector2dF(-velocity.width, -velocity.height);
+  params->causal_event_viewport_point = gfx::PointF(position.x, position.y);
+
+  // If we're currently handling an event, stash the overscroll data such that
+  // it can be bundled in the event ack.
+  if (handling_event_overscroll_) {
+    *handling_event_overscroll_ = std::move(params);
+    return;
+  }
+
+  delegate_->OnDidOverscroll(*params);
+}
+
+bool RenderWidgetInputHandler::SendAckForMouseMoveFromDebugger() {
+  if (handling_event_type_ == WebInputEvent::MouseMove) {
+    // If we pause multiple times during a single mouse move event, we should
+    // only send ACK once.
+    if (!ignore_ack_for_mouse_move_from_debugger_) {
+      scoped_ptr<InputEventAck> ack(new InputEventAck(
+          handling_event_type_, INPUT_EVENT_ACK_STATE_CONSUMED));
+      delegate_->OnInputEventAck(std::move(ack));
+      return true;
+    }
+  }
+  return false;
+}
+
+void RenderWidgetInputHandler::IgnoreAckForMouseMoveFromDebugger() {
+  ignore_ack_for_mouse_move_from_debugger_ = true;
+}
+
+void RenderWidgetInputHandler::FlushPendingInputEventAck() {
+  if (pending_input_event_ack_) {
+    TRACE_EVENT_ASYNC_END0("input",
+                           "RenderWidgetInputHandler::ThrottledInputEventAck",
+                           pending_input_event_ack_.get());
+    delegate_->OnInputEventAck(std::move(pending_input_event_ack_));
+  }
+  total_input_handling_time_this_frame_ = base::TimeDelta();
+}
+
+}  // namespace content

diff --git a/content/renderer/input/render_widget_input_handler.h b/content/renderer/input/render_widget_input_handler.h
new file mode 100644
index 0000000..a44e020
--- /dev/null
+++ b/content/renderer/input/render_widget_input_handler.h

@@ -0,0 +1,111 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_H_
+#define CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_H_
+
+#include "base/memory/scoped_ptr.h"
+#include "base/time/time.h"
+#include "content/common/input/did_overscroll_params.h"
+#include "content/common/input/input_event_ack.h"
+#include "third_party/WebKit/public/web/WebInputEvent.h"
+#include "ui/base/ui_base_types.h"
+
+namespace blink {
+struct WebFloatPoint;
+struct WebFloatSize;
+}
+
+namespace ui {
+class LatencyInfo;
+}
+
+namespace content {
+
+class RenderWidget;
+class RenderWidgetInputHandlerDelegate;
+
+// RenderWidgetInputHandler is an IPC-agnostic input handling class.
+// IPC transport code should live in RenderWidget or RenderWidgetMusConnection.
+class CONTENT_EXPORT RenderWidgetInputHandler {
+ public:
+  RenderWidgetInputHandler(RenderWidgetInputHandlerDelegate* delegate,
+                           RenderWidget* widget);
+  ~RenderWidgetInputHandler();
+
+  // Handle input events from the input event provider.
+  void HandleInputEvent(const blink::WebInputEvent& input_event,
+                        const ui::LatencyInfo& latency_info);
+
+  // Handle overscroll from Blink.
+  void DidOverscrollFromBlink(
+      const blink::WebFloatSize& unusedDelta,
+      const blink::WebFloatSize& accumulatedRootOverScroll,
+      const blink::WebFloatPoint& position,
+      const blink::WebFloatSize& velocity);
+
+  // When paused in debugger, we send ack for mouse event early. This ensures
+  // that we continue receiving mouse moves and pass them to debugger. Returns
+  // whether we are paused in mouse move event and have sent the ack.
+  bool SendAckForMouseMoveFromDebugger();
+
+  // When resumed from pause in debugger while handling mouse move,
+  // we should not send an extra ack (see SendAckForMouseMoveFromDebugger).
+  void IgnoreAckForMouseMoveFromDebugger();
+
+  // Issue the pending InputEventAck if one exists.
+  void FlushPendingInputEventAck();
+
+  bool handling_input_event() const { return handling_input_event_; }
+  void set_handling_input_event(bool handling_input_event) {
+    handling_input_event_ = handling_input_event;
+  }
+
+  blink::WebInputEvent::Type handling_event_type() const {
+    return handling_event_type_;
+  }
+
+  ui::MenuSourceType context_menu_source_type() const {
+    return context_menu_source_type_;
+  }
+  void set_context_menu_source_type(ui::MenuSourceType source_type) {
+    context_menu_source_type_ = source_type;
+  }
+
+ private:
+  RenderWidgetInputHandlerDelegate* const delegate_;
+
+  RenderWidget* const widget_;
+
+  // Are we currently handling an input event?
+  bool handling_input_event_;
+
+  // Used to intercept overscroll notifications while an event is being
+  // handled. If the event causes overscroll, the overscroll metadata can be
+  // bundled in the event ack, saving an IPC.  Note that we must continue
+  // supporting overscroll IPC notifications due to fling animation updates.
+  scoped_ptr<DidOverscrollParams>* handling_event_overscroll_;
+
+  // Type of the input event we are currently handling.
+  blink::WebInputEvent::Type handling_event_type_;
+
+  ui::MenuSourceType context_menu_source_type_;
+
+  // Indicates if the next sequence of Char events should be suppressed or not.
+  bool suppress_next_char_events_;
+
+  // The time spent in input handlers this frame. Used to throttle input acks.
+  base::TimeDelta total_input_handling_time_this_frame_;
+
+  // Whether we should not send ack for the current mouse move.
+  bool ignore_ack_for_mouse_move_from_debugger_;
+
+  scoped_ptr<InputEventAck> pending_input_event_ack_;
+
+  DISALLOW_COPY_AND_ASSIGN(RenderWidgetInputHandler);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_H_

diff --git a/content/renderer/input/render_widget_input_handler_delegate.h b/content/renderer/input/render_widget_input_handler_delegate.h
new file mode 100644
index 0000000..37ed7a1
--- /dev/null
+++ b/content/renderer/input/render_widget_input_handler_delegate.h

@@ -0,0 +1,85 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_DELEGATE_H_
+#define CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_DELEGATE_H_
+
+#include "base/memory/scoped_ptr.h"
+#include "content/common/content_export.h"
+#include "content/common/input/input_event_ack.h"
+
+namespace blink {
+class WebGestureEvent;
+class WebMouseEvent;
+class WebMouseWheelEvent;
+}
+
+namespace gfx {
+class Point;
+class Vector2dF;
+}
+
+namespace content {
+
+enum class ShowIme { IF_NEEDED, HIDE_IME };
+
+enum class ChangeSource {
+  FROM_NON_IME,
+  FROM_IME,
+};
+
+// Consumers of RenderWidgetInputHandler implement this delegate in order to
+// transport input handling information across processes.
+class CONTENT_EXPORT RenderWidgetInputHandlerDelegate {
+ public:
+  // Called when animations due to focus change have completed (if any).
+  virtual void FocusChangeComplete() = 0;
+
+  // Check whether the WebWidget has any touch event handlers registered
+  // at the given point.
+  virtual bool HasTouchEventHandlersAt(const gfx::Point& point) const = 0;
+
+  // Called to forward a mouse wheel event to the compositor thread, to effect
+  // the elastic overscroll effect.
+  virtual void ObserveWheelEventAndResult(
+      const blink::WebMouseWheelEvent& wheel_event,
+      const gfx::Vector2dF& wheel_unused_delta,
+      bool event_processed) = 0;
+
+  // Notifies that a key event was just handled.
+  virtual void OnDidHandleKeyEvent() = 0;
+
+  // Notifies that an overscroll was completed from Blink.
+  virtual void OnDidOverscroll(const DidOverscrollParams& params) = 0;
+
+  // Called when an ACK is ready to be sent to the input event provider.
+  virtual void OnInputEventAck(scoped_ptr<InputEventAck> input_event_ack) = 0;
+
+  // |show_ime| should be ShowIme::IF_NEEDED iff the update may cause the ime to
+  // be displayed, e.g. after a tap on an input field on mobile.
+  // |change_source| should be ChangeSource::FROM_NON_IME when the renderer has
+  // to wait for the browser to acknowledge the change before the renderer
+  // handles any more IME events. This is when the text change did not originate
+  // from the IME in the browser side, such as changes by JavaScript or
+  // autofill.
+  virtual void UpdateTextInputState(ShowIme show_ime,
+                                    ChangeSource change_source) = 0;
+
+  // Notifies that a gesture event is about to be handled.
+  // Returns true if no further handling is needed. In that case, the event
+  // won't be sent to WebKit.
+  virtual bool WillHandleGestureEvent(const blink::WebGestureEvent& event) = 0;
+
+  // Notifies that a mouse event is about to be handled.
+  // Returns true if no further handling is needed. In that case, the event
+  // won't be sent to WebKit or trigger DidHandleMouseEvent().
+  virtual bool WillHandleMouseEvent(const blink::WebMouseEvent& event) = 0;
+
+ protected:
+  virtual ~RenderWidgetInputHandlerDelegate() {}
+};
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_INPUT_RENDER_WIDGET_INPUT_HANDLER_DELEGATE_H_

diff --git a/content/renderer/media/media_recorder_handler.cc b/content/renderer/media/media_recorder_handler.cc
index 6b8b0541..5654dc7 100644
--- a/content/renderer/media/media_recorder_handler.cc
+++ b/content/renderer/media/media_recorder_handler.cc

@@ -10,6 +10,7 @@
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "content/renderer/media/audio_track_recorder.h"
+#include "content/renderer/media/media_stream_audio_track.h"
 #include "content/renderer/media/media_stream_track.h"
 #include "content/renderer/media/video_track_recorder.h"
 #include "content/renderer/media/webrtc_uma_histograms.h"
@@ -103,17 +104,14 @@
   media_stream_.videoTracks(video_tracks);
   media_stream_.audioTracks(audio_tracks);
 
-
   if (video_tracks.isEmpty() && audio_tracks.isEmpty()) {
     LOG(WARNING) << __FUNCTION__ << ": no media tracks.";
     return false;
   }
 
-  // We cannot add ourselves as sink to a remote audio track, see
-  // http://crbug.com/121673 and MediaStreamAudioSink::AddToAudioTrack();
-  const bool use_audio_tracks = !audio_tracks.isEmpty() &&
-      MediaStreamTrack::GetTrack(audio_tracks[0]) &&
-      MediaStreamTrack::GetTrack(audio_tracks[0])->is_local_track();
+  const bool use_audio_tracks =
+      !audio_tracks.isEmpty() &&
+      MediaStreamAudioTrack::GetTrack(audio_tracks[0]);
 
   webm_muxer_.reset(new media::WebmMuxer(
       use_vp9_ ? media::kCodecVP9 : media::kCodecVP8,

diff --git a/content/renderer/media/webrtc_audio_device_impl.cc b/content/renderer/media/webrtc_audio_device_impl.cc
index 9057187..8931f75 100644
--- a/content/renderer/media/webrtc_audio_device_impl.cc
+++ b/content/renderer/media/webrtc_audio_device_impl.cc

@@ -42,7 +42,7 @@
 WebRtcAudioDeviceImpl::~WebRtcAudioDeviceImpl() {
   DVLOG(1) << "WebRtcAudioDeviceImpl::~WebRtcAudioDeviceImpl()";
   DCHECK(main_thread_checker_.CalledOnValidThread());
-  Terminate();
+  DCHECK(!initialized_) << "Terminate must have been called.";
 }
 
 int32_t WebRtcAudioDeviceImpl::AddRef() const {

diff --git a/content/renderer/raster_worker_pool.cc b/content/renderer/raster_worker_pool.cc
index ddeb57d..89ed6d6 100644
--- a/content/renderer/raster_worker_pool.cc
+++ b/content/renderer/raster_worker_pool.cc

@@ -4,8 +4,6 @@
 
 #include "content/renderer/raster_worker_pool.h"
 
-#include <utility>
-
 #include "base/strings/stringprintf.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/trace_event/trace_event.h"
@@ -49,8 +47,7 @@
       if (!graph_.nodes.empty())
         dependencies = 1;
 
-      cc::TaskGraph::Node node(graph_task.get(), 0u /* category */,
-                               0u /* priority */, dependencies);
+      cc::TaskGraph::Node node(graph_task.get(), 0, dependencies);
       if (dependencies) {
         graph_.edges.push_back(
             cc::TaskGraph::Edge(graph_.nodes.back().task, node.task));
@@ -151,9 +148,7 @@
   tasks_.push_back(make_scoped_refptr(new ClosureTask(task)));
   graph_.Reset();
   for (const auto& graph_task : tasks_)
-    graph_.nodes.push_back(
-        cc::TaskGraph::Node(graph_task.get(), 0u /* category */,
-                            0u /* priority */, 0u /* dependencies */));
+    graph_.nodes.push_back(cc::TaskGraph::Node(graph_task.get(), 0, 0));
 
   ScheduleTasksWithLockAcquired(namespace_token_, &graph_);
   completed_tasks_.clear();
@@ -169,7 +164,7 @@
   base::AutoLock lock(lock_);
 
   while (true) {
-    if (!RunTaskWithLockAcquired()) {
+    if (!work_queue_.HasReadyToRunTasks()) {
       // Exit when shutdown is set and no more tasks are pending.
       if (shutdown_)
         break;
@@ -178,6 +173,8 @@
       has_ready_to_run_tasks_cv_.Wait();
       continue;
     }
+
+    RunTaskWithLockAcquired();
   }
 }
 
@@ -261,28 +258,12 @@
   work_queue_.CollectCompletedTasks(token, completed_tasks);
 }
 
-bool RasterWorkerPool::RunTaskWithLockAcquired() {
+void RasterWorkerPool::RunTaskWithLockAcquired() {
   TRACE_EVENT0("toplevel", "TaskGraphRunner::RunTask");
 
   lock_.AssertAcquired();
 
-  // Find the first category with any tasks to run. This task graph runner
-  // treats categories as an additional priority.
-  // TODO(ericrk): Add more category/thread logic.
-  const auto& ready_to_run_namespaces = work_queue_.ready_to_run_namespaces();
-  auto found = std::find_if(
-      ready_to_run_namespaces.cbegin(), ready_to_run_namespaces.cend(),
-      [](const std::pair<uint16_t,
-                         cc::TaskGraphWorkQueue::TaskNamespace::Vector>& pair) {
-        return !pair.second.empty();
-      });
-
-  if (found == ready_to_run_namespaces.cend()) {
-    return false;
-  }
-
-  const uint16_t category = found->first;
-  auto prioritized_task = work_queue_.GetNextTaskToRun(category);
+  auto prioritized_task = work_queue_.GetNextTaskToRun();
   cc::Task* task = prioritized_task.task;
 
   // There may be more work available, so wake up another worker thread.
@@ -307,8 +288,6 @@
   if (work_queue_.HasFinishedRunningTasksInNamespace(
           prioritized_task.task_namespace))
     has_namespaces_with_finished_running_tasks_cv_.Broadcast();
-
-  return true;
 }
 
 RasterWorkerPool::ClosureTask::ClosureTask(const base::Closure& closure)

diff --git a/content/renderer/raster_worker_pool.h b/content/renderer/raster_worker_pool.h
index e7473a9..547eeb8 100644
--- a/content/renderer/raster_worker_pool.h
+++ b/content/renderer/raster_worker_pool.h

@@ -74,9 +74,9 @@
   class RasterWorkerPoolSequencedTaskRunner;
   friend class RasterWorkerPoolSequencedTaskRunner;
 
-  // Run next task. Caller must acquire |lock_| prior to calling this function.
-  // Returns true if there was a task available to run.
-  bool RunTaskWithLockAcquired();
+  // Run next task. Caller must acquire |lock_| prior to calling this function
+  // and make sure at least one task is ready to run.
+  void RunTaskWithLockAcquired();
 
   // Simple Task for the TaskGraphRunner that wraps a closure.
   // This class is used to schedule TaskRunner tasks on the

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 4858362..9e014065 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -704,6 +704,10 @@
         replicated_state.scope, WebString::fromUTF8(replicated_state.name),
         replicated_state.sandbox_flags, render_frame,
         previous_sibling_web_frame, frame_owner_properties);
+
+    // The RenderFrame is created and inserted into the frame tree in the above
+    // call to createLocalChild.
+    render_frame->in_frame_tree_ = true;
   } else {
     RenderFrameProxy* proxy =
         RenderFrameProxy::FromRoutingID(proxy_routing_id);
@@ -808,6 +812,8 @@
 RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
     : frame_(NULL),
       is_main_frame_(true),
+      in_browser_initiated_detach_(false),
+      in_frame_tree_(false),
       render_view_(params.render_view->AsWeakPtr()),
       routing_id_(params.routing_id),
       is_swapped_out_(false),
@@ -1004,8 +1010,8 @@
   if (instance != render_view_->focused_pepper_plugin())
     return;
 
-  GetRenderWidget()->UpdateTextInputState(
-      RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+  GetRenderWidget()->UpdateTextInputState(ShowIme::HIDE_IME,
+                                          ChangeSource::FROM_NON_IME);
 
   FocusedNodeChangedForAccessibility(WebNode());
 }
@@ -1211,6 +1217,7 @@
     IPC_MESSAGE_HANDLER(FrameMsg_Navigate, OnNavigate)
     IPC_MESSAGE_HANDLER(FrameMsg_BeforeUnload, OnBeforeUnload)
     IPC_MESSAGE_HANDLER(FrameMsg_SwapOut, OnSwapOut)
+    IPC_MESSAGE_HANDLER(FrameMsg_Delete, OnDeleteFrame)
     IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
@@ -1466,6 +1473,18 @@
   }
 }
 
+void RenderFrameImpl::OnDeleteFrame() {
+  // TODO(nasko): If this message is received right after a commit has
+  // swapped a RenderFrameProxy with this RenderFrame, the proxy needs to be
+  // recreated in addition to the RenderFrame being deleted.
+  // See https://crbug.com/569683 for details.
+  in_browser_initiated_detach_ = true;
+
+  // This will result in a call to RendeFrameImpl::frameDetached, which
+  // deletes the object. Do not access |this| after detach.
+  frame_->detach();
+}
+
 void RenderFrameImpl::OnContextMenuClosed(
     const CustomContextMenuContext& custom_context) {
   if (custom_context.request_id) {
@@ -2467,6 +2486,7 @@
 
   // Add the frame to the frame tree and initialize it.
   parent->appendChild(web_frame);
+  child_render_frame->in_frame_tree_ = true;
   child_render_frame->Initialize();
 
   return web_frame;
@@ -2498,9 +2518,8 @@
                     FrameDetached(frame));
 
   // We only notify the browser process when the frame is being detached for
-  // removal. If the frame is being detached for swap, we don't need to do this
-  // since we are not modifiying the frame tree.
-  if (type == DetachType::Remove)
+  // removal and it was initiated from the renderer process.
+  if (!in_browser_initiated_detach_ && type == DetachType::Remove)
     Send(new FrameHostMsg_Detach(routing_id_));
 
   // The |is_detaching_| flag disables Send(). FrameHostMsg_Detach must be
@@ -2523,10 +2542,13 @@
   g_frame_map.Get().erase(it);
 
   // Only remove the frame from the renderer's frame tree if the frame is
-  // being detached for removal. In the case of a swap, the frame needs to
-  // remain in the tree so WebFrame::swap() can replace it with the new frame.
-  if (!is_main_frame_ && type == DetachType::Remove)
+  // being detached for removal and is already inserted in the frame tree.
+  // In the case of a swap, the frame needs to remain in the tree so
+  // WebFrame::swap() can replace it with the new frame.
+  if (!is_main_frame_ && in_frame_tree_ &&
+      type == DetachType::Remove) {
     frame->parent()->removeChild(frame);
+  }
 
   // |frame| is invalid after here.  Be sure to clear frame_ as well, since this
   // object may not be deleted immediately and other methods may try to access
@@ -2964,6 +2986,7 @@
 
     proxy->web_frame()->swap(frame_);
     proxy_routing_id_ = MSG_ROUTING_NONE;
+    in_frame_tree_ = true;
 
     // If this is the main frame going from a remote frame to a local frame,
     // it needs to set RenderViewImpl's pointer for the main frame to itself
@@ -3343,7 +3366,8 @@
 }
 
 void RenderFrameImpl::didChangeSelection(bool is_empty_selection) {
-  if (!GetRenderWidget()->handling_input_event() && !handling_select_range_)
+  if (!GetRenderWidget()->input_handler().handling_input_event() &&
+      !handling_select_range_)
     return;
 
   if (is_empty_selection)
@@ -3354,8 +3378,8 @@
   // was changed, and SyncSelectionIfRequired may send SelectionChanged
   // to notify the selection was changed.  Focus change should be notified
   // before selection change.
-  GetRenderWidget()->UpdateTextInputState(
-      RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+  GetRenderWidget()->UpdateTextInputState(ShowIme::HIDE_IME,
+                                          ChangeSource::FROM_NON_IME);
   SyncSelectionIfRequired();
 }
 
@@ -3435,7 +3459,8 @@
   GetRenderWidget()->convertViewportToWindow(&position_in_window);
   params.x = position_in_window.x;
   params.y = position_in_window.y;
-  params.source_type = GetRenderWidget()->context_menu_source_type();
+  params.source_type =
+      GetRenderWidget()->input_handler().context_menu_source_type();
   GetRenderWidget()->OnShowHostContextMenu(&params);
   if (GetRenderWidget()->has_host_context_menu_location()) {
     params.x = GetRenderWidget()->host_context_menu_location().x();

diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index ab782145..f743bbf 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h

@@ -707,6 +707,7 @@
   void OnSwapOut(int proxy_routing_id,
                  bool is_loading,
                  const FrameReplicationState& replicated_frame_state);
+  void OnDeleteFrame();
   void OnStop();
   void OnShowContextMenu(const gfx::Point& location);
   void OnContextMenuClosed(const CustomContextMenuContext& custom_context);
@@ -945,6 +946,24 @@
   // |frame_| has been invalidated.
   bool is_main_frame_;
 
+  // When a frame is detached in response to a message from the browser process,
+  // this RenderFrame should not be sending notifications back to it. This
+  // boolean is used to indicate this case.
+  bool in_browser_initiated_detach_;
+
+  // Indicates whether the frame has been inserted into the frame tree yet or
+  // not.
+  //
+  // When a frame is created by the browser process, it is for a pending
+  // navigation. In this case, it is not immediately attached to the frame tree
+  // if there is a RenderFrameProxy for the same frame. It is inserted into the
+  // frame tree at the time the pending navigation commits.
+  // Frames added by the parent document are created from the renderer process
+  // and are immediately inserted in the frame tree.
+  // TODO(dcheng): Remove this once we have FrameTreeHandle and can use the
+  // Blink Web* layer to check for provisional frames.
+  bool in_frame_tree_;
+
   base::WeakPtr<RenderViewImpl> render_view_;
   int routing_id_;
   bool is_swapped_out_;

diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
index 87773de..e509aa9 100644
--- a/content/renderer/render_view_browsertest.cc
+++ b/content/renderer/render_view_browsertest.cc

@@ -1098,8 +1098,7 @@
 
     // Update the IME status and verify if our IME backend sends an IPC message
     // to activate IMEs.
-    view()->UpdateTextInputState(
-        RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+    view()->UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
     const IPC::Message* msg = render_thread_->sink().GetMessageAt(0);
     EXPECT_TRUE(msg != NULL);
     EXPECT_EQ(ViewHostMsg_TextInputStateChanged::ID, msg->type());
@@ -1120,8 +1119,7 @@
 
     // Update the IME status and verify if our IME backend sends an IPC message
     // to de-activate IMEs.
-    view()->UpdateTextInputState(
-          RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+    view()->UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
     msg = render_thread_->sink().GetMessageAt(0);
     EXPECT_TRUE(msg != NULL);
     EXPECT_EQ(ViewHostMsg_TextInputStateChanged::ID, msg->type());
@@ -1144,8 +1142,8 @@
 
       // Update the IME status and verify if our IME backend sends an IPC
       // message to activate IMEs.
-      view()->UpdateTextInputState(
-          RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+      view()->UpdateTextInputState(ShowIme::HIDE_IME,
+                                   ChangeSource::FROM_NON_IME);
       ProcessPendingMessages();
       const IPC::Message* msg = render_thread_->sink().GetMessageAt(0);
       EXPECT_TRUE(msg != NULL);
@@ -1280,8 +1278,7 @@
 
     // Update the status of our IME back-end.
     // TODO(hbono): we should verify messages to be sent from the back-end.
-    view()->UpdateTextInputState(
-        RenderWidget::NO_SHOW_IME, RenderWidget::FROM_NON_IME);
+    view()->UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
     ProcessPendingMessages();
     render_thread_->sink().ClearMessages();
 
@@ -2072,7 +2069,7 @@
   view()->set_send_content_state_immediately(true);
   LoadHTML("<textarea id=\"test\"></textarea>");
 
-  view()->handling_input_event_ = true;
+  view()->SetHandlingInputEventForTesting(true);
   ExecuteJavaScriptForTests("document.getElementById('test').focus();");
 
   bool is_input_type_called = false;

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 6b6b146c..407ab17 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -1184,7 +1184,7 @@
   else if (focused_pepper_plugin_ == instance)
     focused_pepper_plugin_ = NULL;
 
-  UpdateTextInputState(NO_SHOW_IME, FROM_NON_IME);
+  UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
   UpdateSelectionBounds();
 }
 
@@ -1254,6 +1254,56 @@
     webview()->transferActiveWheelFlingAnimation(params);
 }
 
+// RenderWidgetInputHandlerDelegate -----------------------------------------
+
+void RenderViewImpl::FocusChangeComplete() {
+  RenderWidget::FocusChangeComplete();
+  FOR_EACH_OBSERVER(RenderViewObserver, observers_, FocusChangeComplete());
+}
+
+bool RenderViewImpl::HasTouchEventHandlersAt(const gfx::Point& point) const {
+  if (!webview())
+    return false;
+  return webview()->hasTouchEventHandlersAt(point);
+}
+
+void RenderViewImpl::OnDidHandleKeyEvent() {
+  ClearEditCommands();
+}
+
+bool RenderViewImpl::WillHandleGestureEvent(
+    const blink::WebGestureEvent& event) {
+  possible_drag_event_info_.event_source =
+      ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH;
+  possible_drag_event_info_.event_location =
+      gfx::Point(event.globalX, event.globalY);
+  return false;
+}
+
+bool RenderViewImpl::WillHandleMouseEvent(const blink::WebMouseEvent& event) {
+  possible_drag_event_info_.event_source =
+      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
+  possible_drag_event_info_.event_location =
+      gfx::Point(event.globalX, event.globalY);
+
+#if defined(ENABLE_PLUGINS)
+  // This method is called for every mouse event that the render view receives.
+  // And then the mouse event is forwarded to WebKit, which dispatches it to the
+  // event target. Potentially a Pepper plugin will receive the event.
+  // In order to tell whether a plugin gets the last mouse event and which it
+  // is, we set |pepper_last_mouse_event_target_| to NULL here. If a plugin gets
+  // the event, it will notify us via DidReceiveMouseEvent() and set itself as
+  // |pepper_last_mouse_event_target_|.
+  pepper_last_mouse_event_target_ = NULL;
+#endif
+
+  // If the mouse is locked, only the current owner of the mouse lock can
+  // process mouse events.
+  return mouse_lock_dispatcher_->WillHandleMouseEvent(event);
+}
+
+// IPC::Listener implementation ----------------------------------------------
+
 bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
   WebFrame* main_frame = webview() ? webview()->mainFrame() : NULL;
   if (main_frame && main_frame->isWebLocalFrame())
@@ -1362,9 +1412,9 @@
   if (!webview())
     return;
 
-  handling_input_event_ = true;
+  input_handler_.set_handling_input_event(true);
   webview()->focusedFrame()->selectWordAroundCaret();
-  handling_input_event_ = false;
+  input_handler_.set_handling_input_event(false);
 }
 
 void RenderViewImpl::OnCopyImageAt(int x, int y) {
@@ -1651,7 +1701,7 @@
 
 void RenderViewImpl::printPage(WebLocalFrame* frame) {
   FOR_EACH_OBSERVER(RenderViewObserver, observers_,
-                    PrintPage(frame, handling_input_event_));
+                    PrintPage(frame, input_handler().handling_input_event()));
 }
 
 void RenderViewImpl::saveImageFromDataURL(const blink::WebString& data_url) {
@@ -2982,47 +3032,6 @@
   RenderThread::Get()->Send(new ViewHostMsg_Close_ACK(routing_id_));
 }
 
-void RenderViewImpl::DidHandleKeyEvent() {
-  ClearEditCommands();
-}
-
-bool RenderViewImpl::WillHandleMouseEvent(const blink::WebMouseEvent& event) {
-  possible_drag_event_info_.event_source =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_MOUSE;
-  possible_drag_event_info_.event_location =
-      gfx::Point(event.globalX, event.globalY);
-
-#if defined(ENABLE_PLUGINS)
-  // This method is called for every mouse event that the render view receives.
-  // And then the mouse event is forwarded to WebKit, which dispatches it to the
-  // event target. Potentially a Pepper plugin will receive the event.
-  // In order to tell whether a plugin gets the last mouse event and which it
-  // is, we set |pepper_last_mouse_event_target_| to NULL here. If a plugin gets
-  // the event, it will notify us via DidReceiveMouseEvent() and set itself as
-  // |pepper_last_mouse_event_target_|.
-  pepper_last_mouse_event_target_ = NULL;
-#endif
-
-  // If the mouse is locked, only the current owner of the mouse lock can
-  // process mouse events.
-  return mouse_lock_dispatcher_->WillHandleMouseEvent(event);
-}
-
-bool RenderViewImpl::WillHandleGestureEvent(
-    const blink::WebGestureEvent& event) {
-  possible_drag_event_info_.event_source =
-      ui::DragDropTypes::DRAG_EVENT_SOURCE_TOUCH;
-  possible_drag_event_info_.event_location =
-      gfx::Point(event.globalX, event.globalY);
-  return false;
-}
-
-bool RenderViewImpl::HasTouchEventHandlersAt(const gfx::Point& point) const {
-  if (!webview())
-    return false;
-  return webview()->hasTouchEventHandlersAt(point);
-}
-
 void RenderViewImpl::OnWasHidden() {
   RenderWidget::OnWasHidden();
 
@@ -3260,11 +3269,6 @@
   RenderWidget::GetSelectionBounds(start, end);
 }
 
-void RenderViewImpl::FocusChangeComplete() {
-  RenderWidget::FocusChangeComplete();
-  FOR_EACH_OBSERVER(RenderViewObserver, observers_, FocusChangeComplete());
-}
-
 void RenderViewImpl::GetCompositionCharacterBounds(
     std::vector<gfx::Rect>* bounds_in_window) {
   DCHECK(bounds_in_window);
@@ -3507,7 +3511,7 @@
 
 void RenderViewImpl::OnShowContextMenu(
     ui::MenuSourceType source_type, const gfx::Point& location) {
-  context_menu_source_type_ = source_type;
+  input_handler_.set_context_menu_source_type(source_type);
   has_host_context_menu_location_ = true;
   host_context_menu_location_ = location;
   if (webview())

diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index 12ee60e..e8924b3 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h

@@ -326,6 +326,15 @@
                                   const gfx::Size& max_size);
   void DisableAutoResizeForTesting(const gfx::Size& new_size);
 
+  // RenderWidgetInputHandlerDelegate implementation ---------------------------
+
+  // Most methods are handled by RenderWidget
+  void FocusChangeComplete() override;
+  bool HasTouchEventHandlersAt(const gfx::Point& point) const override;
+  void OnDidHandleKeyEvent() override;
+  bool WillHandleGestureEvent(const blink::WebGestureEvent& event) override;
+  bool WillHandleMouseEvent(const blink::WebMouseEvent& event) override;
+
   // IPC::Listener implementation ----------------------------------------------
 
   bool OnMessageReceived(const IPC::Message& msg) override;
@@ -466,10 +475,6 @@
   void DidInitiatePaint() override;
   void DidFlushPaint() override;
   gfx::Vector2d GetScrollOffset() override;
-  void DidHandleKeyEvent() override;
-  bool WillHandleMouseEvent(const blink::WebMouseEvent& event) override;
-  bool WillHandleGestureEvent(const blink::WebGestureEvent& event) override;
-  bool HasTouchEventHandlersAt(const gfx::Point& point) const override;
   void OnSetFocus(bool enable) override;
   void OnWasHidden() override;
   void OnWasShown(bool needs_repainting,
@@ -488,7 +493,6 @@
   void OnOrientationChange() override;
   ui::TextInputType GetTextInputType() override;
   void GetSelectionBounds(gfx::Rect* start, gfx::Rect* end) override;
-  void FocusChangeComplete() override;
   void GetCompositionCharacterBounds(
       std::vector<gfx::Rect>* character_bounds_in_window) override;
   void GetCompositionRange(gfx::Range* range) override;

diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 0ae4993..e263f2c 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc

@@ -166,128 +166,12 @@
   return it->second;
 }
 
-// TODO(brianderson): Replace the hard-coded threshold with a fraction of
-// the BeginMainFrame interval.
-// 4166us will allow 1/4 of a 60Hz interval or 1/2 of a 120Hz interval to
-// be spent in input hanlders before input starts getting throttled.
-const int kInputHandlingTimeThrottlingThresholdMicroseconds = 4166;
-
-int64 GetEventLatencyMicros(double event_timestamp, base::TimeTicks now) {
-  return (now - base::TimeDelta::FromSecondsD(event_timestamp))
-      .ToInternalValue();
-}
-
-void LogInputEventLatencyUmaImpl(WebInputEvent::Type event_type,
-                                 double event_timestamp,
-                                 base::TimeTicks now) {
-  UMA_HISTOGRAM_CUSTOM_COUNTS("Event.AggregatedLatency.Renderer2",
-                              GetEventLatencyMicros(event_timestamp, now), 1,
-                              10000000, 100);
-
-#define CASE_TYPE(t)                                                         \
-  case WebInputEvent::t:                                                     \
-    UMA_HISTOGRAM_CUSTOM_COUNTS("Event.Latency.Renderer2." #t,               \
-                                GetEventLatencyMicros(event_timestamp, now), \
-                                1, 10000000, 100);                           \
-    break;
-
-  switch (event_type) {
-    CASE_TYPE(Undefined);
-    CASE_TYPE(MouseDown);
-    CASE_TYPE(MouseUp);
-    CASE_TYPE(MouseMove);
-    CASE_TYPE(MouseEnter);
-    CASE_TYPE(MouseLeave);
-    CASE_TYPE(ContextMenu);
-    CASE_TYPE(MouseWheel);
-    CASE_TYPE(RawKeyDown);
-    CASE_TYPE(KeyDown);
-    CASE_TYPE(KeyUp);
-    CASE_TYPE(Char);
-    CASE_TYPE(GestureScrollBegin);
-    CASE_TYPE(GestureScrollEnd);
-    CASE_TYPE(GestureScrollUpdate);
-    CASE_TYPE(GestureFlingStart);
-    CASE_TYPE(GestureFlingCancel);
-    CASE_TYPE(GestureShowPress);
-    CASE_TYPE(GestureTap);
-    CASE_TYPE(GestureTapUnconfirmed);
-    CASE_TYPE(GestureTapDown);
-    CASE_TYPE(GestureTapCancel);
-    CASE_TYPE(GestureDoubleTap);
-    CASE_TYPE(GestureTwoFingerTap);
-    CASE_TYPE(GestureLongPress);
-    CASE_TYPE(GestureLongTap);
-    CASE_TYPE(GesturePinchBegin);
-    CASE_TYPE(GesturePinchEnd);
-    CASE_TYPE(GesturePinchUpdate);
-    CASE_TYPE(TouchStart);
-    CASE_TYPE(TouchMove);
-    CASE_TYPE(TouchEnd);
-    CASE_TYPE(TouchCancel);
-    default:
-      // Must include default to let blink::WebInputEvent add new event types
-      // before they're added here.
-      DLOG(WARNING) << "Unhandled WebInputEvent type: " << event_type;
-      break;
-  }
-
-#undef CASE_TYPE
-}
-
-void LogInputEventLatencyUma(const WebInputEvent& event, base::TimeTicks now,
-                             const ui::LatencyInfo& latency_info) {
-  LogInputEventLatencyUmaImpl(event.type, event.timeStampSeconds, now);
-  for (size_t i = 0; i < latency_info.coalesced_events_size(); i++) {
-    LogInputEventLatencyUmaImpl(
-        event.type,
-        latency_info.timestamps_of_coalesced_events()[i],
-        now);
-  }
-}
-
-void LogPassiveLatency(int64 latency) {
-  UMA_HISTOGRAM_CUSTOM_COUNTS("Event.PassiveListeners.Latency", latency, 1,
-                              10000000, 100);
-}
-
-void LogPassiveEventListenersUma(WebInputEventResult result,
-                                 bool passive,
-                                 bool cancelable,
-                                 double event_timestamp,
-                                 const ui::LatencyInfo& latency_info) {
-  enum {
-    PASSIVE_LISTENER_UMA_ENUM_PASSIVE,
-    PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE,
-    PASSIVE_LISTENER_UMA_ENUM_SUPPRESSED,
-    PASSIVE_LISTENER_UMA_ENUM_CANCELABLE,
-    PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED,
-    PASSIVE_LISTENER_UMA_ENUM_COUNT
-  };
-
-  int enum_value;
-  if (passive)
-    enum_value = PASSIVE_LISTENER_UMA_ENUM_PASSIVE;
-  else if (!cancelable)
-    enum_value = PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE;
-  else if (result == WebInputEventResult::HandledApplication)
-    enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED;
-  else if (result == WebInputEventResult::HandledSuppressed)
-    enum_value = PASSIVE_LISTENER_UMA_ENUM_SUPPRESSED;
-  else
-    enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE;
-
-  UMA_HISTOGRAM_ENUMERATION("Event.PassiveListeners", enum_value,
-                            PASSIVE_LISTENER_UMA_ENUM_COUNT);
-
-  if (enum_value == PASSIVE_LISTENER_UMA_ENUM_CANCELABLE &&
-      base::TimeTicks::IsHighResolution()) {
-    base::TimeTicks now = base::TimeTicks::Now();
-    LogPassiveLatency(GetEventLatencyMicros(event_timestamp, now));
-    for (size_t i = 0; i < latency_info.coalesced_events_size(); i++)
-      LogPassiveLatency(GetEventLatencyMicros(
-          latency_info.timestamps_of_coalesced_events()[i], now));
-  }
+bool IsDateTimeInput(ui::TextInputType type) {
+  return type == ui::TEXT_INPUT_TYPE_DATE ||
+         type == ui::TEXT_INPUT_TYPE_DATE_TIME ||
+         type == ui::TEXT_INPUT_TYPE_DATE_TIME_LOCAL ||
+         type == ui::TEXT_INPUT_TYPE_MONTH ||
+         type == ui::TEXT_INPUT_TYPE_TIME || type == ui::TEXT_INPUT_TYPE_WEEK;
 }
 
 }  // namespace
@@ -550,11 +434,7 @@
       compositor_never_visible_(never_visible),
       is_fullscreen_granted_(false),
       display_mode_(blink::WebDisplayModeUndefined),
-      handling_input_event_(false),
-      handling_event_overscroll_(nullptr),
       ime_event_guard_(nullptr),
-      handling_event_type_(WebInputEvent::Undefined),
-      ignore_ack_for_mouse_move_from_debugger_(false),
       closing_(false),
       host_closing_(false),
       is_swapped_out_(swapped_out),
@@ -565,7 +445,7 @@
       can_compose_inline_(true),
       popup_type_(popup_type),
       pending_window_rect_count_(0),
-      suppress_next_char_events_(false),
+      input_handler_(this, this),
       screen_info_(screen_info),
       device_scale_factor_(screen_info_.deviceScaleFactor),
       next_output_surface_id_(0),
@@ -575,7 +455,6 @@
       popup_origin_scale_for_emulation_(0.f),
       frame_swap_message_queue_(new FrameSwapMessageQueue()),
       resizing_mode_selector_(new ResizingModeSelector()),
-      context_menu_source_type_(ui::MENU_SOURCE_MOUSE),
       has_host_context_menu_location_(false) {
   if (!swapped_out)
     RenderProcess::current()->AddRefProcess();
@@ -1150,251 +1029,7 @@
                                       const ui::LatencyInfo& latency_info) {
   if (!input_event)
     return;
-
-  // TODO(dtapuska): Passive support not implemented yet crbug.com/489802
-  bool passive = false;
-  base::AutoReset<bool> handling_input_event_resetter(&handling_input_event_,
-                                                      true);
-  base::AutoReset<WebInputEvent::Type> handling_event_type_resetter(
-      &handling_event_type_, input_event->type);
-
-  // Calls into |didOverscroll()| while handling this event will populate
-  // |event_overscroll|, which in turn will be bundled with the event ack.
-  scoped_ptr<DidOverscrollParams> event_overscroll;
-  base::AutoReset<scoped_ptr<DidOverscrollParams>*>
-      handling_event_overscroll_resetter(&handling_event_overscroll_,
-                                         &event_overscroll);
-
-#if defined(OS_ANDROID)
-  const bool is_keyboard_event =
-      WebInputEvent::isKeyboardEventType(input_event->type);
-
-  // For non-keyboard events, we want the change source to be FROM_NON_IME.
-  ImeEventGuard guard(this, false, is_keyboard_event);
-#endif
-
-  base::TimeTicks start_time;
-  if (base::TimeTicks::IsHighResolution())
-    start_time = base::TimeTicks::Now();
-
-  TRACE_EVENT1("renderer,benchmark", "RenderWidget::OnHandleInputEvent",
-               "event", WebInputEventTraits::GetName(input_event->type));
-  TRACE_EVENT_SYNTHETIC_DELAY_BEGIN("blink.HandleInputEvent");
-  TRACE_EVENT_WITH_FLOW1("input,benchmark",
-                         "LatencyInfo.Flow",
-                         TRACE_ID_DONT_MANGLE(latency_info.trace_id()),
-                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT,
-                         "step", "HandleInputEventMain");
-
-  // If we don't have a high res timer, these metrics won't be accurate enough
-  // to be worth collecting. Note that this does introduce some sampling bias.
-  if (!start_time.is_null())
-    LogInputEventLatencyUma(*input_event, start_time, latency_info);
-
-  scoped_ptr<cc::SwapPromiseMonitor> latency_info_swap_promise_monitor;
-  ui::LatencyInfo swap_latency_info(latency_info);
-  if (compositor_) {
-    latency_info_swap_promise_monitor =
-        compositor_->CreateLatencyInfoSwapPromiseMonitor(&swap_latency_info)
-            .Pass();
-  }
-
-  bool prevent_default = false;
-  if (WebInputEvent::isMouseEventType(input_event->type)) {
-    const WebMouseEvent& mouse_event =
-        *static_cast<const WebMouseEvent*>(input_event);
-    TRACE_EVENT2("renderer", "HandleMouseMove",
-                 "x", mouse_event.x, "y", mouse_event.y);
-    context_menu_source_type_ = ui::MENU_SOURCE_MOUSE;
-    prevent_default = WillHandleMouseEvent(mouse_event);
-  }
-
-  if (WebInputEvent::isKeyboardEventType(input_event->type)) {
-    context_menu_source_type_ = ui::MENU_SOURCE_KEYBOARD;
-#if defined(OS_ANDROID)
-    // The DPAD_CENTER key on Android has a dual semantic: (1) in the general
-    // case it should behave like a select key (i.e. causing a click if a button
-    // is focused). However, if a text field is focused (2), its intended
-    // behavior is to just show the IME and don't propagate the key.
-    // A typical use case is a web form: the DPAD_CENTER should bring up the IME
-    // when clicked on an input text field and cause the form submit if clicked
-    // when the submit button is focused, but not vice-versa.
-    // The UI layer takes care of translating DPAD_CENTER into a RETURN key,
-    // but at this point we have to swallow the event for the scenario (2).
-    const WebKeyboardEvent& key_event =
-        *static_cast<const WebKeyboardEvent*>(input_event);
-    if (key_event.nativeKeyCode == AKEYCODE_DPAD_CENTER &&
-        GetTextInputType() != ui::TEXT_INPUT_TYPE_NONE) {
-      OnShowImeIfNeeded();
-      prevent_default = true;
-    }
-#endif
-  }
-
-  if (WebInputEvent::isGestureEventType(input_event->type)) {
-    const WebGestureEvent& gesture_event =
-        *static_cast<const WebGestureEvent*>(input_event);
-    context_menu_source_type_ = ui::MENU_SOURCE_TOUCH;
-    prevent_default = prevent_default || WillHandleGestureEvent(gesture_event);
-  }
-
-  WebInputEventResult processed =
-      prevent_default ? WebInputEventResult::HandledSuppressed
-                      : WebInputEventResult::NotHandled;
-  if (input_event->type != WebInputEvent::Char || !suppress_next_char_events_) {
-    suppress_next_char_events_ = false;
-    if (processed == WebInputEventResult::NotHandled && webwidget_)
-      processed = webwidget_->handleInputEvent(*input_event);
-  }
-
-  // TODO(dtapuska): Use the input_event->timeStampSeconds as the start
-  // ideally this should be when the event was sent by the compositor to the
-  // renderer. crbug.com/565348
-  if (input_event->type == WebInputEvent::TouchStart ||
-      input_event->type == WebInputEvent::TouchMove ||
-      input_event->type == WebInputEvent::TouchEnd) {
-    LogPassiveEventListenersUma(
-        processed, passive,
-        static_cast<const WebTouchEvent*>(input_event)->cancelable,
-        input_event->timeStampSeconds, latency_info);
-  } else if (input_event->type == WebInputEvent::MouseWheel) {
-    LogPassiveEventListenersUma(processed, passive, !passive,
-                                input_event->timeStampSeconds, latency_info);
-  }
-
-  // If this RawKeyDown event corresponds to a browser keyboard shortcut and
-  // it's not processed by webkit, then we need to suppress the upcoming Char
-  // events.
-  bool is_keyboard_shortcut =
-      input_event->type == WebInputEvent::RawKeyDown &&
-      static_cast<const WebKeyboardEvent*>(input_event)->isBrowserShortcut;
-  if (processed == WebInputEventResult::NotHandled && is_keyboard_shortcut)
-    suppress_next_char_events_ = true;
-
-  InputEventAckState ack_result = processed == WebInputEventResult::NotHandled
-                                      ? INPUT_EVENT_ACK_STATE_NOT_CONSUMED
-                                      : INPUT_EVENT_ACK_STATE_CONSUMED;
-  if (processed == WebInputEventResult::NotHandled &&
-      input_event->type == WebInputEvent::TouchStart) {
-    const WebTouchEvent& touch_event =
-        *static_cast<const WebTouchEvent*>(input_event);
-    // Hit-test for all the pressed touch points. If there is a touch-handler
-    // for any of the touch points, then the renderer should continue to receive
-    // touch events.
-    ack_result = INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
-    for (size_t i = 0; i < touch_event.touchesLength; ++i) {
-      if (touch_event.touches[i].state == WebTouchPoint::StatePressed &&
-          HasTouchEventHandlersAt(
-              gfx::ToFlooredPoint(touch_event.touches[i].position))) {
-        ack_result = INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
-        break;
-      }
-    }
-  }
-
-  // Send mouse wheel events and their disposition to the compositor thread, so
-  // that they can be used to produce the elastic overscroll effect on Mac.
-  if (input_event->type == WebInputEvent::MouseWheel) {
-    ObserveWheelEventAndResult(
-        static_cast<const WebMouseWheelEvent&>(*input_event),
-        event_overscroll ? event_overscroll->latest_overscroll_delta
-                         : gfx::Vector2dF(),
-        processed != WebInputEventResult::NotHandled);
-  }
-
-  bool frame_pending = compositor_ && compositor_->BeginMainFrameRequested();
-
-  // If we don't have a fast and accurate Now(), we assume the input handlers
-  // are heavy and rate limit them.
-  bool rate_limiting_wanted =
-      input_event->type == WebInputEvent::MouseMove ||
-      input_event->type == WebInputEvent::MouseWheel;
-  if (rate_limiting_wanted && !start_time.is_null()) {
-      base::TimeTicks end_time = base::TimeTicks::Now();
-      total_input_handling_time_this_frame_ += (end_time - start_time);
-      rate_limiting_wanted =
-          total_input_handling_time_this_frame_.InMicroseconds() >
-          kInputHandlingTimeThrottlingThresholdMicroseconds;
-  }
-
-  TRACE_EVENT_SYNTHETIC_DELAY_END("blink.HandleInputEvent");
-
-  // Note that we can't use handling_event_type_ here since it will be overriden
-  // by reentrant calls for events after the paused one.
-  bool no_ack = ignore_ack_for_mouse_move_from_debugger_ &&
-      input_event->type == WebInputEvent::MouseMove;
-  if (WebInputEventTraits::WillReceiveAckFromRenderer(*input_event) &&
-      !no_ack) {
-    InputEventAck ack(input_event->type, ack_result, swap_latency_info,
-                      event_overscroll.Pass(),
-                      WebInputEventTraits::GetUniqueTouchEventId(*input_event));
-    scoped_ptr<IPC::Message> response(
-        new InputHostMsg_HandleInputEvent_ACK(routing_id_, ack));
-    if (rate_limiting_wanted && frame_pending && !is_hidden_) {
-      // We want to rate limit the input events in this case, so we'll wait for
-      // painting to finish before ACKing this message.
-      TRACE_EVENT_INSTANT0("renderer",
-        "RenderWidget::OnHandleInputEvent ack throttled",
-        TRACE_EVENT_SCOPE_THREAD);
-      if (pending_input_event_ack_) {
-        TRACE_EVENT_ASYNC_END0("input", "RenderWidget::ThrottledInputEventAck",
-                               pending_input_event_ack_.get());
-        // As two different kinds of events could cause us to postpone an ack
-        // we send it now, if we have one pending. The Browser should never
-        // send us the same kind of event we are delaying the ack for.
-        Send(pending_input_event_ack_.release());
-      }
-      pending_input_event_ack_ = response.Pass();
-      TRACE_EVENT_ASYNC_BEGIN0("input", "RenderWidget::ThrottledInputEventAck",
-                               pending_input_event_ack_.get());
-      if (compositor_)
-        compositor_->NotifyInputThrottledUntilCommit();
-    } else {
-      Send(response.release());
-    }
-  } else {
-    DCHECK(!event_overscroll) << "Unexpected overscroll for un-acked event";
-  }
-  if (!no_ack && RenderThreadImpl::current()) {
-    RenderThreadImpl::current()
-        ->GetRendererScheduler()
-        ->DidHandleInputEventOnMainThread(*input_event);
-  }
-  if (input_event->type == WebInputEvent::MouseMove)
-    ignore_ack_for_mouse_move_from_debugger_ = false;
-
-#if defined(OS_ANDROID)
-  // Allow the IME to be shown when the focus changes as a consequence
-  // of a processed touch end event.
-  if (input_event->type == WebInputEvent::TouchEnd &&
-      processed != WebInputEventResult::NotHandled) {
-    UpdateTextInputState(SHOW_IME_IF_NEEDED, FROM_NON_IME);
-  }
-#elif defined(USE_AURA)
-  // Show the virtual keyboard if enabled and a user gesture triggers a focus
-  // change.
-  if (processed != WebInputEventResult::NotHandled &&
-      (input_event->type == WebInputEvent::TouchEnd ||
-       input_event->type == WebInputEvent::MouseUp)) {
-    UpdateTextInputState(SHOW_IME_IF_NEEDED, FROM_IME);
-  }
-#endif
-
-  if (!prevent_default) {
-    if (WebInputEvent::isKeyboardEventType(input_event->type))
-      DidHandleKeyEvent();
-  }
-
-// TODO(rouslan): Fix ChromeOS and Windows 8 behavior of autofill popup with
-// virtual keyboard.
-#if !defined(OS_ANDROID)
-  // Virtual keyboard is not supported, so react to focus change immediately.
-  if (processed != WebInputEventResult::NotHandled &&
-      (input_event->type == WebInputEvent::TouchEnd ||
-       input_event->type == WebInputEvent::MouseUp)) {
-    FocusChangeComplete();
-  }
-#endif
+  input_handler_.HandleInputEvent(*input_event, latency_info);
 }
 
 void RenderWidget::OnCursorVisibilityChange(bool is_visible) {
@@ -1412,13 +1047,116 @@
     webwidget_->setFocus(enable);
 }
 
-void RenderWidget::FlushPendingInputEventAck() {
-  if (pending_input_event_ack_) {
-    TRACE_EVENT_ASYNC_END0("input", "RenderWidget::ThrottledInputEventAck",
-                           pending_input_event_ack_.get());
-    Send(pending_input_event_ack_.release());
+///////////////////////////////////////////////////////////////////////////////
+// RenderWidgetInputHandlerDelegate
+
+void RenderWidget::FocusChangeComplete() {}
+
+bool RenderWidget::HasTouchEventHandlersAt(const gfx::Point& point) const {
+  return true;
+}
+
+void RenderWidget::ObserveWheelEventAndResult(
+    const blink::WebMouseWheelEvent& wheel_event,
+    const gfx::Vector2dF& wheel_unused_delta,
+    bool event_processed) {
+  if (!compositor_deps_->IsElasticOverscrollEnabled())
+    return;
+
+  cc::InputHandlerScrollResult scroll_result;
+  scroll_result.did_scroll = event_processed;
+  scroll_result.did_overscroll_root = !wheel_unused_delta.IsZero();
+  scroll_result.unused_scroll_delta = wheel_unused_delta;
+
+  RenderThreadImpl* render_thread = RenderThreadImpl::current();
+  InputHandlerManager* input_handler_manager =
+      render_thread ? render_thread->input_handler_manager() : NULL;
+  if (input_handler_manager) {
+    input_handler_manager->ObserveWheelEventAndResultOnMainThread(
+        routing_id_, wheel_event, scroll_result);
   }
-  total_input_handling_time_this_frame_ = base::TimeDelta();
+}
+
+void RenderWidget::OnDidHandleKeyEvent() {}
+
+void RenderWidget::OnDidOverscroll(const DidOverscrollParams& params) {
+  Send(new InputHostMsg_DidOverscroll(routing_id_, params));
+}
+
+void RenderWidget::OnInputEventAck(scoped_ptr<InputEventAck> input_event_ack) {
+  Send(new InputHostMsg_HandleInputEvent_ACK(routing_id_, *input_event_ack));
+}
+
+void RenderWidget::UpdateTextInputState(ShowIme show_ime,
+                                        ChangeSource change_source) {
+  TRACE_EVENT0("renderer", "RenderWidget::UpdateTextInputState");
+  if (ime_event_guard_) {
+    // show_ime should still be effective even if it was set inside the IME
+    // event guard.
+    if (show_ime == ShowIme::IF_NEEDED) {
+      ime_event_guard_->set_show_ime(true);
+    }
+    return;
+  }
+
+  ui::TextInputType new_type = GetTextInputType();
+  if (IsDateTimeInput(new_type))
+    return;  // Not considered as a text input field in WebKit/Chromium.
+
+  blink::WebTextInputInfo new_info;
+  if (webwidget_)
+    new_info = webwidget_->textInputInfo();
+  const ui::TextInputMode new_mode = ConvertInputMode(new_info.inputMode);
+
+  bool new_can_compose_inline = CanComposeInline();
+
+  // Only sends text input params if they are changed or if the ime should be
+  // shown.
+  if (show_ime == ShowIme::IF_NEEDED ||
+      (text_input_type_ != new_type || text_input_mode_ != new_mode ||
+       text_input_info_ != new_info ||
+       can_compose_inline_ != new_can_compose_inline)
+#if defined(OS_ANDROID)
+      || text_field_is_dirty_
+#endif
+      ) {
+    ViewHostMsg_TextInputState_Params params;
+    params.type = new_type;
+    params.mode = new_mode;
+    params.flags = new_info.flags;
+    params.value = new_info.value.utf8();
+    params.selection_start = new_info.selectionStart;
+    params.selection_end = new_info.selectionEnd;
+    params.composition_start = new_info.compositionStart;
+    params.composition_end = new_info.compositionEnd;
+    params.can_compose_inline = new_can_compose_inline;
+    params.show_ime_if_needed = (show_ime == ShowIme::IF_NEEDED);
+#if defined(USE_AURA)
+    params.is_non_ime_change = true;
+#endif
+#if defined(OS_ANDROID)
+    params.is_non_ime_change =
+        (change_source == ChangeSource::FROM_NON_IME) || text_field_is_dirty_;
+    if (params.is_non_ime_change)
+      OnImeEventSentForAck(new_info);
+    text_field_is_dirty_ = false;
+#endif
+    Send(new ViewHostMsg_TextInputStateChanged(routing_id(), params));
+
+    text_input_info_ = new_info;
+    text_input_type_ = new_type;
+    text_input_mode_ = new_mode;
+    can_compose_inline_ = new_can_compose_inline;
+    text_input_flags_ = new_info.flags;
+  }
+}
+
+bool RenderWidget::WillHandleGestureEvent(const blink::WebGestureEvent& event) {
+  return false;
+}
+
+bool RenderWidget::WillHandleMouseEvent(const blink::WebMouseEvent& event) {
+  return false;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -1500,7 +1238,7 @@
   // The UpdateTextInputState can result in further layout and possibly
   // enable GPU acceleration so they need to be called before any painting
   // is done.
-  UpdateTextInputState(NO_SHOW_IME, FROM_NON_IME);
+  UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
   UpdateSelectionBounds();
 }
 
@@ -1513,7 +1251,7 @@
   FOR_EACH_OBSERVER(RenderFrameImpl, video_hole_frames_,
                     DidCommitCompositorFrame());
 #endif  // defined(VIDEO_HOLE)
-  FlushPendingInputEventAck();
+  input_handler_.FlushPendingInputEventAck();
 }
 
 void RenderWidget::DidCommitAndDrawCompositorFrame() {
@@ -1782,14 +1520,14 @@
   if (!ShouldHandleImeEvent())
     return;
   ImeEventGuard guard(this);
-  handling_input_event_ = true;
+  input_handler_.set_handling_input_event(true);
   if (text.length())
     webwidget_->confirmComposition(text);
   else if (keep_selection)
     webwidget_->confirmComposition(WebWidget::KeepSelection);
   else
     webwidget_->confirmComposition(WebWidget::DoNotKeepSelection);
-  handling_input_event_ = false;
+  input_handler_.set_handling_input_event(false);
   UpdateCompositionInfo(true);
 }
 
@@ -1848,6 +1586,36 @@
   OnShowImeIfNeeded();
 }
 
+ui::TextInputType RenderWidget::GetTextInputType() {
+  if (webwidget_)
+    return WebKitToUiTextInputType(webwidget_->textInputType());
+  return ui::TEXT_INPUT_TYPE_NONE;
+}
+
+void RenderWidget::UpdateCompositionInfo(bool should_update_range) {
+#if defined(OS_ANDROID)
+// TODO(yukawa): Start sending character bounds when the browser side
+// implementation becomes ready (crbug.com/424866).
+#else
+  TRACE_EVENT0("renderer", "RenderWidget::UpdateCompositionInfo");
+  gfx::Range range = gfx::Range();
+  if (should_update_range) {
+    GetCompositionRange(&range);
+  } else {
+    range = composition_range_;
+  }
+  std::vector<gfx::Rect> character_bounds;
+  GetCompositionCharacterBounds(&character_bounds);
+
+  if (!ShouldUpdateCompositionInfo(range, character_bounds))
+    return;
+  composition_character_bounds_ = character_bounds;
+  composition_range_ = range;
+  Send(new InputHostMsg_ImeCompositionRangeChanged(
+      routing_id(), composition_range_, composition_character_bounds_));
+#endif
+}
+
 void RenderWidget::convertViewportToWindow(blink::WebRect* rect) {
   if (IsUseZoomForDSFEnabled()) {
     float reverse = 1 / device_scale_factor_;
@@ -1864,7 +1632,7 @@
 
 void RenderWidget::OnShowImeIfNeeded() {
 #if defined(OS_ANDROID) || defined(USE_AURA)
-  UpdateTextInputState(SHOW_IME_IF_NEEDED, FROM_NON_IME);
+  UpdateTextInputState(ShowIme::IF_NEEDED, ChangeSource::FROM_NON_IME);
 #endif
 
 // TODO(rouslan): Fix ChromeOS and Windows 8 behavior of autofill popup with
@@ -1906,23 +1674,6 @@
 #endif
 }
 
-bool RenderWidget::SendAckForMouseMoveFromDebugger() {
-  if (handling_event_type_ == WebInputEvent::MouseMove) {
-    // If we pause multiple times during a single mouse move event, we should
-    // only send ACK once.
-    if (!ignore_ack_for_mouse_move_from_debugger_) {
-      InputEventAck ack(handling_event_type_, INPUT_EVENT_ACK_STATE_CONSUMED);
-      Send(new InputHostMsg_HandleInputEvent_ACK(routing_id_, ack));
-      return true;
-    }
-  }
-  return false;
-}
-
-void RenderWidget::IgnoreAckForMouseMoveFromDebugger() {
-  ignore_ack_for_mouse_move_from_debugger_ = true;
-}
-
 void RenderWidget::SetDeviceScaleFactor(float device_scale_factor) {
   if (device_scale_factor_ == device_scale_factor)
     return;
@@ -1961,7 +1712,7 @@
   // The status has changed.  Tell the RenderThread about it and ensure
   // throttled acks are released in case frame production ceases.
   is_hidden_ = hidden;
-  FlushPendingInputEventAck();
+  input_handler_.FlushPendingInputEventAck();
 
   if (is_hidden_)
     RenderThreadImpl::current()->WidgetHidden();
@@ -1995,15 +1746,6 @@
   next_paint_flags_ |= ViewHostMsg_UpdateRect_Flags::IS_REPAINT_ACK;
 }
 
-static bool IsDateTimeInput(ui::TextInputType type) {
-  return type == ui::TEXT_INPUT_TYPE_DATE ||
-      type == ui::TEXT_INPUT_TYPE_DATE_TIME ||
-      type == ui::TEXT_INPUT_TYPE_DATE_TIME_LOCAL ||
-      type == ui::TEXT_INPUT_TYPE_MONTH ||
-      type == ui::TEXT_INPUT_TYPE_TIME ||
-      type == ui::TEXT_INPUT_TYPE_WEEK;
-}
-
 void RenderWidget::OnImeEventGuardStart(ImeEventGuard* guard) {
   if (!ime_event_guard_)
     ime_event_guard_ = guard;
@@ -2030,76 +1772,11 @@
   UpdateSelectionBounds();
 #if defined(OS_ANDROID)
   UpdateTextInputState(
-      guard->show_ime() ? SHOW_IME_IF_NEEDED : NO_SHOW_IME,
-      guard->from_ime() ? FROM_IME : FROM_NON_IME);
+      guard->show_ime() ? ShowIme::IF_NEEDED : ShowIme::HIDE_IME,
+      guard->from_ime() ? ChangeSource::FROM_IME : ChangeSource::FROM_NON_IME);
 #endif
 }
 
-void RenderWidget::UpdateTextInputState(ShowIme show_ime,
-                                        ChangeSource change_source) {
-  TRACE_EVENT0("renderer", "RenderWidget::UpdateTextInputState");
-  if (ime_event_guard_) {
-    // show_ime should still be effective even if it was set inside the IME
-    // event guard.
-    if (show_ime == SHOW_IME_IF_NEEDED) {
-      ime_event_guard_->set_show_ime(true);
-    }
-    return;
-  }
-
-  ui::TextInputType new_type = GetTextInputType();
-  if (IsDateTimeInput(new_type))
-    return;  // Not considered as a text input field in WebKit/Chromium.
-
-  blink::WebTextInputInfo new_info;
-  if (webwidget_)
-    new_info = webwidget_->textInputInfo();
-  const ui::TextInputMode new_mode = ConvertInputMode(new_info.inputMode);
-
-  bool new_can_compose_inline = CanComposeInline();
-
-  // Only sends text input params if they are changed or if the ime should be
-  // shown.
-  if (show_ime == SHOW_IME_IF_NEEDED ||
-      (text_input_type_ != new_type ||
-       text_input_mode_ != new_mode ||
-       text_input_info_ != new_info ||
-       can_compose_inline_ != new_can_compose_inline)
-#if defined(OS_ANDROID)
-      || text_field_is_dirty_
-#endif
-      ) {
-    ViewHostMsg_TextInputState_Params params;
-    params.type = new_type;
-    params.mode = new_mode;
-    params.flags = new_info.flags;
-    params.value = new_info.value.utf8();
-    params.selection_start = new_info.selectionStart;
-    params.selection_end = new_info.selectionEnd;
-    params.composition_start = new_info.compositionStart;
-    params.composition_end = new_info.compositionEnd;
-    params.can_compose_inline = new_can_compose_inline;
-    params.show_ime_if_needed = (show_ime == SHOW_IME_IF_NEEDED);
-#if defined(USE_AURA)
-    params.is_non_ime_change = true;
-#endif
-#if defined(OS_ANDROID)
-    params.is_non_ime_change = (change_source == FROM_NON_IME) ||
-                         text_field_is_dirty_;
-    if (params.is_non_ime_change)
-      OnImeEventSentForAck(new_info);
-    text_field_is_dirty_ = false;
-#endif
-    Send(new ViewHostMsg_TextInputStateChanged(routing_id(), params));
-
-    text_input_info_ = new_info;
-    text_input_type_ = new_type;
-    text_input_mode_ = new_mode;
-    can_compose_inline_ = new_can_compose_inline;
-    text_input_flags_ = new_info.flags;
-  }
-}
-
 void RenderWidget::GetSelectionBounds(gfx::Rect* focus, gfx::Rect* anchor) {
   WebRect focus_webrect;
   WebRect anchor_webrect;
@@ -2182,36 +1859,6 @@
   return static_cast<ui::TextInputType>(type);
 }
 
-ui::TextInputType RenderWidget::GetTextInputType() {
-  if (webwidget_)
-    return WebKitToUiTextInputType(webwidget_->textInputType());
-  return ui::TEXT_INPUT_TYPE_NONE;
-}
-
-void RenderWidget::UpdateCompositionInfo(bool should_update_range) {
-#if defined(OS_ANDROID)
-  // TODO(yukawa): Start sending character bounds when the browser side
-  // implementation becomes ready (crbug.com/424866).
-#else
-  TRACE_EVENT0("renderer", "RenderWidget::UpdateCompositionInfo");
-  gfx::Range range = gfx::Range();
-  if (should_update_range) {
-    GetCompositionRange(&range);
-  } else {
-    range = composition_range_;
-  }
-  std::vector<gfx::Rect> character_bounds;
-  GetCompositionCharacterBounds(&character_bounds);
-
-  if (!ShouldUpdateCompositionInfo(range, character_bounds))
-    return;
-  composition_character_bounds_ = character_bounds;
-  composition_range_ = range;
-  Send(new InputHostMsg_ImeCompositionRangeChanged(
-      routing_id(), composition_range_, composition_character_bounds_));
-#endif
-}
-
 void RenderWidget::GetCompositionCharacterBounds(
     std::vector<gfx::Rect>* bounds) {
   DCHECK(bounds);
@@ -2272,7 +1919,7 @@
     const WebPoint& tapped_position,
     const WebNode& tapped_node,
     bool page_changed) {
-  DCHECK(handling_input_event_);
+  DCHECK(input_handler_.handling_input_event());
   bool should_trigger = !page_changed && tapped_node.isTextNode() &&
                         !tapped_node.isContentEditable() &&
                         !tapped_node.isInsideFocusableElementOrARIAWidget();
@@ -2290,13 +1937,13 @@
   if (event_cancelled)
     return;
   if (event.type == WebInputEvent::GestureTap) {
-    UpdateTextInputState(SHOW_IME_IF_NEEDED, FROM_NON_IME);
+    UpdateTextInputState(ShowIme::IF_NEEDED, ChangeSource::FROM_NON_IME);
   } else if (event.type == WebInputEvent::GestureLongPress) {
     DCHECK(webwidget_);
     if (webwidget_->textInputInfo().value.isEmpty())
-      UpdateTextInputState(NO_SHOW_IME, FROM_NON_IME);
+      UpdateTextInputState(ShowIme::HIDE_IME, ChangeSource::FROM_NON_IME);
     else
-      UpdateTextInputState(SHOW_IME_IF_NEEDED, FROM_NON_IME);
+      UpdateTextInputState(ShowIme::IF_NEEDED, ChangeSource::FROM_NON_IME);
   }
 #endif
 }
@@ -2306,25 +1953,8 @@
     const blink::WebFloatSize& accumulatedRootOverScroll,
     const blink::WebFloatPoint& position,
     const blink::WebFloatSize& velocity) {
-  DidOverscrollParams params;
-  params.accumulated_overscroll = gfx::Vector2dF(
-      accumulatedRootOverScroll.width, accumulatedRootOverScroll.height);
-  params.latest_overscroll_delta =
-      gfx::Vector2dF(unusedDelta.width, unusedDelta.height);
-  // TODO(sataya.m): don't negate velocity once http://crbug.com/499743 is
-  // fixed.
-  params.current_fling_velocity =
-      gfx::Vector2dF(-velocity.width, -velocity.height);
-  params.causal_event_viewport_point = gfx::PointF(position.x, position.y);
-
-  // If we're currently handling an event, stash the overscroll data such that
-  // it can be bundled in the event ack.
-  if (handling_event_overscroll_) {
-    handling_event_overscroll_->reset(new DidOverscrollParams(params));
-    return;
-  }
-
-  Send(new InputHostMsg_DidOverscroll(routing_id_, params));
+  input_handler_.DidOverscrollFromBlink(unusedDelta, accumulatedRootOverScroll,
+                                        position, velocity);
 }
 
 void RenderWidget::StartCompositor() {
@@ -2364,34 +1994,16 @@
   return compositor_.get();
 }
 
-bool RenderWidget::WillHandleMouseEvent(const blink::WebMouseEvent& event) {
-  return false;
+void RenderWidget::SetHandlingInputEventForTesting(bool handling_input_event) {
+  input_handler_.set_handling_input_event(handling_input_event);
 }
 
-bool RenderWidget::WillHandleGestureEvent(
-    const blink::WebGestureEvent& event) {
-  return false;
+bool RenderWidget::SendAckForMouseMoveFromDebugger() {
+  return input_handler_.SendAckForMouseMoveFromDebugger();
 }
 
-void RenderWidget::ObserveWheelEventAndResult(
-    const blink::WebMouseWheelEvent& wheel_event,
-    const gfx::Vector2dF& wheel_unused_delta,
-    bool event_processed) {
-  if (!compositor_deps_->IsElasticOverscrollEnabled())
-    return;
-
-  cc::InputHandlerScrollResult scroll_result;
-  scroll_result.did_scroll = event_processed;
-  scroll_result.did_overscroll_root = !wheel_unused_delta.IsZero();
-  scroll_result.unused_scroll_delta = wheel_unused_delta;
-
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  InputHandlerManager* input_handler_manager =
-      render_thread ? render_thread->input_handler_manager() : NULL;
-  if (input_handler_manager) {
-    input_handler_manager->ObserveWheelEventAndResultOnMainThread(
-        routing_id_, wheel_event, scroll_result);
-  }
+void RenderWidget::IgnoreAckForMouseMoveFromDebugger() {
+  input_handler_.IgnoreAckForMouseMoveFromDebugger();
 }
 
 void RenderWidget::hasTouchEventHandlers(bool has_handlers) {
@@ -2410,7 +2022,7 @@
 
   // Ignore setTouchAction calls that result from synthetic touch events (eg.
   // when blink is emulating touch with mouse).
-  if (handling_event_type_ != WebInputEvent::TouchStart)
+  if (input_handler_.handling_event_type() != WebInputEvent::TouchStart)
     return;
 
   // Verify the same values are used by the types so we can cast between them.
@@ -2438,10 +2050,6 @@
 #endif
 }
 
-bool RenderWidget::HasTouchEventHandlersAt(const gfx::Point& point) const {
-  return true;
-}
-
 scoped_ptr<WebGraphicsContext3DCommandBufferImpl>
 RenderWidget::CreateGraphicsContext3D(bool compositor) {
   if (!webwidget_)

diff --git a/content/renderer/render_widget.h b/content/renderer/render_widget.h
index f9b2d4f1..748482c 100644
--- a/content/renderer/render_widget.h
+++ b/content/renderer/render_widget.h

@@ -19,6 +19,8 @@
 #include "content/common/cursors/webcursor.h"
 #include "content/common/gpu/client/webgraphicscontext3d_command_buffer_impl.h"
 #include "content/common/input/synthetic_gesture_params.h"
+#include "content/renderer/input/render_widget_input_handler.h"
+#include "content/renderer/input/render_widget_input_handler_delegate.h"
 #include "content/renderer/message_delivery_policy.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
@@ -106,6 +108,7 @@
     : public IPC::Listener,
       public IPC::Sender,
       NON_EXPORTED_BASE(virtual public blink::WebWidgetClient),
+      public RenderWidgetInputHandlerDelegate,
       public base::RefCounted<RenderWidget> {
  public:
   // Creates a new RenderWidget.  The opener_id is the routing ID of the
@@ -134,14 +137,10 @@
   bool is_fullscreen_granted() const { return is_fullscreen_granted_; }
   blink::WebDisplayMode display_mode() const { return display_mode_; }
   bool is_hidden() const { return is_hidden_; }
-  bool handling_input_event() const { return handling_input_event_; }
   // Temporary for debugging purposes...
   bool closing() const { return closing_; }
   bool is_swapped_out() { return is_swapped_out_; }
   bool for_oopif() { return for_oopif_; }
-  ui::MenuSourceType context_menu_source_type() {
-    return context_menu_source_type_;
-  }
   bool has_host_context_menu_location() {
     return has_host_context_menu_location_;
   }
@@ -172,6 +171,20 @@
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
 
+  // RenderWidgetInputHandlerDelegate
+  void FocusChangeComplete() override;
+  bool HasTouchEventHandlersAt(const gfx::Point& point) const override;
+  void ObserveWheelEventAndResult(const blink::WebMouseWheelEvent& wheel_event,
+                                  const gfx::Vector2dF& wheel_unused_delta,
+                                  bool event_processed) override;
+  void OnDidHandleKeyEvent() override;
+  void OnDidOverscroll(const DidOverscrollParams& params) override;
+  void OnInputEventAck(scoped_ptr<InputEventAck> input_event_ack) override;
+  void UpdateTextInputState(ShowIme show_ime,
+                            ChangeSource change_source) override;
+  bool WillHandleGestureEvent(const blink::WebGestureEvent& event) override;
+  bool WillHandleMouseEvent(const blink::WebMouseEvent& event) override;
+
   // blink::WebWidgetClient
   void didAutoResize(const blink::WebSize& new_size) override;
   void initializeLayerTreeView() override;
@@ -197,6 +210,12 @@
                      const blink::WebFloatSize& velocity) override;
   void showImeIfNeeded() override;
 
+  // Override point to obtain that the current input method state and caret
+  // position.
+  virtual ui::TextInputType GetTextInputType();
+  virtual ui::TextInputType WebKitToUiTextInputType(
+      blink::WebTextInputType type);
+
   // Converts the |rect| from Viewport coordinates to Window coordinates.
   // See RenderView::convertViewportToWindow for more details.
   void convertViewportToWindow(blink::WebRect* rect);
@@ -227,6 +246,21 @@
 
   RenderWidgetCompositor* compositor() const;
 
+  const RenderWidgetInputHandler& input_handler() const {
+    return input_handler_;
+  }
+
+  void SetHandlingInputEventForTesting(bool handling_input_event);
+
+  // When paused in debugger, we send ack for mouse event early. This ensures
+  // that we continue receiving mouse moves and pass them to debugger. Returns
+  // whether we are paused in mouse move event and have sent the ack.
+  bool SendAckForMouseMoveFromDebugger();
+
+  // When resumed from pause in debugger while handling mouse move,
+  // we should not send an extra ack (see SendAckForMouseMoveFromDebugger).
+  void IgnoreAckForMouseMoveFromDebugger();
+
   virtual scoped_ptr<cc::OutputSurface> CreateOutputSurface(bool fallback);
 
   // Callback for use with synthetic gestures (e.g. BeginSmoothScroll).
@@ -260,15 +294,6 @@
   // Called by the compositor when page scale animation completed.
   virtual void DidCompletePageScaleAnimation() {}
 
-  // When paused in debugger, we send ack for mouse event early. This ensures
-  // that we continue receiving mouse moves and pass them to debugger. Returns
-  // whether we are paused in mouse move event and have sent the ack.
-  bool SendAckForMouseMoveFromDebugger();
-
-  // When resumed from pause in debugger while handling mouse move,
-  // we should not send an extra ack (see SendAckForMouseMoveFromDebugger).
-  void IgnoreAckForMouseMoveFromDebugger();
-
   // ScreenMetricsEmulator class manages screen emulation inside a render
   // widget. This includes resizing, placing view on the screen at desired
   // position, changing device scale factor, and scaling down the whole
@@ -314,28 +339,6 @@
 
   void OnShowHostContextMenu(ContextMenuParams* params);
 
-  enum ShowIme {
-    SHOW_IME_IF_NEEDED,
-    NO_SHOW_IME,
-  };
-
-  enum ChangeSource {
-    FROM_NON_IME,
-    FROM_IME,
-  };
-
-  // |show_ime| should be SHOW_IME_IF_NEEDED iff the update may cause the ime to
-  // be displayed, e.g. after a tap on an input field on mobile.
-  // |change_source| should be FROM_NON_IME when the renderer has to wait for
-  // the browser to acknowledge the change before the renderer handles any more
-  // IME events. This is when the text change did not originate from the IME in
-  // the browser side, such as changes by JavaScript or autofill.
-  void UpdateTextInputState(ShowIme show_ime, ChangeSource change_source);
-
-  // Called when animations due to focus change have completed (if any). Can be
-  // called from the renderer, browser, or compositor.
-  virtual void FocusChangeComplete() {}
-
   // Checks if the composition range or composition character bounds have been
   // changed. If they are changed, the new value will be sent to the browser
   // process. This method does nothing when the browser process is not able to
@@ -389,7 +392,6 @@
   // are no other active RenderWidgets.
   void WasSwappedOut();
 
-  void FlushPendingInputEventAck();
   void DoDeferredClose();
   void NotifyOnClose();
 
@@ -507,12 +509,6 @@
       scoped_refptr<IPC::SyncMessageFilter> sync_message_filter,
       int source_frame_number);
 
-  // Override point to obtain that the current input method state and caret
-  // position.
-  virtual ui::TextInputType GetTextInputType();
-  virtual ui::TextInputType WebKitToUiTextInputType(
-      blink::WebTextInputType type);
-
   // Override point to obtain that the current composition character bounds.
   // In the case of surrogate pairs, the character is treated as two characters:
   // the bounds for first character is actual one, and the bounds for second
@@ -542,32 +538,6 @@
   // GetWindowRect() we'll use this pending window rect as the size.
   void SetPendingWindowRect(const blink::WebRect& r);
 
-  // Called by OnHandleInputEvent() to notify subclasses that a key event was
-  // just handled.
-  virtual void DidHandleKeyEvent() {}
-
-  // Called by OnHandleInputEvent() to notify subclasses that a mouse event is
-  // about to be handled.
-  // Returns true if no further handling is needed. In that case, the event
-  // won't be sent to WebKit or trigger DidHandleMouseEvent().
-  virtual bool WillHandleMouseEvent(const blink::WebMouseEvent& event);
-
-  // Called by OnHandleInputEvent() to notify subclasses that a gesture event is
-  // about to be handled.
-  // Returns true if no further handling is needed. In that case, the event
-  // won't be sent to WebKit.
-  virtual bool WillHandleGestureEvent(const blink::WebGestureEvent& event);
-
-  // Called by OnHandleInputEvent() to forward a mouse wheel event to the
-  // compositor thread, to effect the elastic overscroll effect.
-  void ObserveWheelEventAndResult(const blink::WebMouseWheelEvent& wheel_event,
-                                  const gfx::Vector2dF& wheel_unused_delta,
-                                  bool event_processed);
-
-  // Check whether the WebWidget has any touch event handlers registered
-  // at the given point.
-  virtual bool HasTouchEventHandlersAt(const gfx::Point& point) const;
-
   // Check whether the WebWidget has any touch event handlers registered.
   void hasTouchEventHandlers(bool has_handlers) override;
 
@@ -659,25 +629,10 @@
   // Indicates the display mode.
   blink::WebDisplayMode display_mode_;
 
-  // Are we currently handling an input event?
-  bool handling_input_event_;
-
-  // Used to intercept overscroll notifications while an event is being
-  // handled. If the event causes overscroll, the overscroll metadata can be
-  // bundled in the event ack, saving an IPC.  Note that we must continue
-  // supporting overscroll IPC notifications due to fling animation updates.
-  scoped_ptr<DidOverscrollParams>* handling_event_overscroll_;
-
   // It is possible that one ImeEventGuard is nested inside another
   // ImeEventGuard. We keep track of the outermost one, and update it as needed.
   ImeEventGuard* ime_event_guard_;
 
-  // Type of the input event we are currently handling.
-  blink::WebInputEvent::Type handling_event_type_;
-
-  // Whether we should not send ack for the current mouse move.
-  bool ignore_ack_for_mouse_move_from_debugger_;
-
   // True if we have requested this widget be closed.  No more messages will
   // be sent, except for a Close.
   bool closing_;
@@ -736,14 +691,11 @@
   gfx::Rect view_screen_rect_;
   gfx::Rect window_screen_rect_;
 
-  scoped_ptr<IPC::Message> pending_input_event_ack_;
+  RenderWidgetInputHandler input_handler_;
 
   // The time spent in input handlers this frame. Used to throttle input acks.
   base::TimeDelta total_input_handling_time_this_frame_;
 
-  // Indicates if the next sequence of Char events should be suppressed or not.
-  bool suppress_next_char_events_;
-
   // Properties of the screen hosting this RenderWidget instance.
   blink::WebScreenInfo screen_info_;
 
@@ -797,7 +749,6 @@
   // visibility state for example.
   base::ObserverList<RenderFrameImpl> render_frames_;
 
-  ui::MenuSourceType context_menu_source_type_;
   bool has_host_context_menu_location_;
   gfx::Point host_context_menu_location_;
 

diff --git a/content/renderer/usb/web_usb_client_impl.cc b/content/renderer/usb/web_usb_client_impl.cc
index 33d7f37..0760848 100644
--- a/content/renderer/usb/web_usb_client_impl.cc
+++ b/content/renderer/usb/web_usb_client_impl.cc

@@ -46,8 +46,8 @@
   return make_scoped_web_callbacks(
       callbacks,
       base::Bind(&RejectCallbacksWithError<CallbacksType>,
-                 blink::WebUSBError(blink::WebUSBError::Error::Service,
-                                    base::UTF8ToUTF16(kNoServiceError))));
+                 blink::WebUSBError(blink::WebUSBError::Error::NotFound,
+                                    base::ASCIIToUTF16(kNoServiceError))));
 }
 
 void OnGetDevicesComplete(
@@ -78,8 +78,9 @@
 
     scoped_callbacks->onSuccess(blink::adoptWebPtr(web_usb_device));
   } else {
-    scoped_callbacks->onSuccess(
-        blink::adoptWebPtr<blink::WebUSBDevice>(nullptr));
+    scoped_callbacks->onError(
+        blink::WebUSBError(blink::WebUSBError::Error::NotFound,
+                           base::ASCIIToUTF16("No device selected.")));
   }
 }
 

diff --git a/content/renderer/usb/web_usb_device_impl.cc b/content/renderer/usb/web_usb_device_impl.cc
index beeec4f..0b6ccb9 100644
--- a/content/renderer/usb/web_usb_device_impl.cc
+++ b/content/renderer/usb/web_usb_device_impl.cc

@@ -41,17 +41,9 @@
 }
 
 template <typename CallbacksType>
-void RejectWithDeviceError(const std::string& message,
-                           scoped_ptr<CallbacksType> callbacks) {
-  RejectWithError(blink::WebUSBError(blink::WebUSBError::Error::Device,
-                                     base::UTF8ToUTF16(message)),
-                  callbacks.Pass());
-}
-
-template <typename CallbacksType>
 void RejectWithTransferError(scoped_ptr<CallbacksType> callbacks) {
-  RejectWithError(blink::WebUSBError(blink::WebUSBError::Error::Transfer,
-                                     base::UTF8ToUTF16(kTransferFailed)),
+  RejectWithError(blink::WebUSBError(blink::WebUSBError::Error::Network,
+                                     base::ASCIIToUTF16(kTransferFailed)),
                   callbacks.Pass());
 }
 
@@ -63,8 +55,8 @@
   return make_scoped_web_callbacks(
       callbacks,
       base::Bind(&RejectWithError<CallbacksType>,
-                 blink::WebUSBError(blink::WebUSBError::Error::Device,
-                                    base::UTF8ToUTF16(kDeviceUnavailable))));
+                 blink::WebUSBError(blink::WebUSBError::Error::NotFound,
+                                    base::ASCIIToUTF16(kDeviceUnavailable))));
 }
 
 void OnOpenDevice(
@@ -77,8 +69,8 @@
       break;
     case device::usb::OPEN_DEVICE_ERROR_ACCESS_DENIED:
       scoped_callbacks->onError(blink::WebUSBError(
-          blink::WebUSBError::Error::Device,
-          base::UTF8ToUTF16(kDeviceNoAccess)));
+          blink::WebUSBError::Error::Security,
+          base::ASCIIToUTF16(kDeviceNoAccess)));
       break;
     default:
       NOTREACHED();
@@ -94,10 +86,13 @@
     ScopedWebCallbacks<blink::WebUSBDeviceGetConfigurationCallbacks> callbacks,
     uint8_t configuration_value) {
   auto scoped_callbacks = callbacks.PassCallbacks();
-  if (configuration_value == 0)
-    RejectWithDeviceError(kDeviceNotConfigured, scoped_callbacks.Pass());
-  else
+  if (configuration_value == 0) {
+    RejectWithError(blink::WebUSBError(blink::WebUSBError::Error::NotFound,
+                                       kDeviceNotConfigured),
+                    scoped_callbacks.Pass());
+  } else {
     scoped_callbacks->onSuccess(configuration_value);
+  }
 }
 
 void HandlePassFailDeviceOperation(
@@ -106,10 +101,13 @@
     const std::string& failure_message,
     bool success) {
   auto scoped_callbacks = callbacks.PassCallbacks();
-  if (success)
+  if (success) {
     scoped_callbacks->onSuccess();
-  else
-    RejectWithDeviceError(failure_message, scoped_callbacks.Pass());
+  } else {
+    RejectWithError(blink::WebUSBError(blink::WebUSBError::Error::Network,
+                                       base::ASCIIToUTF16(failure_message)),
+                    scoped_callbacks.Pass());
+  }
 }
 
 void OnTransferIn(

diff --git a/content/test/gpu/gpu_tests/webgl_conformance_expectations.py b/content/test/gpu/gpu_tests/webgl_conformance_expectations.py
index 4671d29..bfe9ad50 100644
--- a/content/test/gpu/gpu_tests/webgl_conformance_expectations.py
+++ b/content/test/gpu/gpu_tests/webgl_conformance_expectations.py

@@ -331,12 +331,6 @@
         ['android', 'android-webview-shell'], bug=352645)
     self.Skip('conformance/textures/misc/texture-npot-video.html',
         ['android', 'android-webview-shell'], bug=352645)
-    # Recent regressions have caused these to fail on multiple devices
-    self.Fail('conformance/textures/video/tex-image-and-sub-image-2d-with-' +
-        'video-rgb-rgb-unsigned_byte.html',
-        ['android', 'android-content-shell'], bug=499555)
-    self.Fail('conformance/textures/misc/texture-npot-video.html',
-        ['android', 'android-content-shell'], bug=520638)
     # These are failing on the Nexus 5 and 6
     self.Fail('conformance/extensions/oes-texture-float-with-canvas.html',
               ['android', 'qualcomm'], bug=499555)
@@ -360,6 +354,10 @@
     self.Fail('conformance/extensions/oes-texture-float-with-image.html',
               ['android', ('qualcomm', 'Adreno (TM) 420')], bug=499555)
     self.Fail('conformance/textures/video/tex-image-and-sub-image-2d-with-' +
+        'video-rgb-rgb-unsigned_byte.html',
+        ['android', 'android-content-shell',
+         ('qualcomm', 'Adreno (TM) 420')], bug=499555)
+    self.Fail('conformance/textures/video/tex-image-and-sub-image-2d-with-' +
         'video-rgba-rgba-unsigned_byte.html',
         ['android', 'android-content-shell',
          ('qualcomm', 'Adreno (TM) 420')], bug=499555)

diff --git a/extensions/browser/api/declarative/rules_registry_service.cc b/extensions/browser/api/declarative/rules_registry_service.cc
index bca6fd5..d5c3b2f 100644
--- a/extensions/browser/api/declarative/rules_registry_service.cc
+++ b/extensions/browser/api/declarative/rules_registry_service.cc

@@ -78,7 +78,7 @@
     // Create a RulesCacheDelegate.
     web_request_cache_delegate =
         new RulesCacheDelegate(true /*log_storage_init_delay*/);
-    cache_delegates_.push_back(web_request_cache_delegate);
+    cache_delegates_.push_back(make_scoped_ptr(web_request_cache_delegate));
   }
   scoped_refptr<WebRequestRulesRegistry> web_request_rules_registry(
       new WebRequestRulesRegistry(browser_context_, web_request_cache_delegate,
@@ -95,7 +95,7 @@
   if (rules_registry_id == kDefaultRulesRegistryID) {
     RulesCacheDelegate* content_rules_cache_delegate =
         new RulesCacheDelegate(false /*log_storage_init_delay*/);
-    cache_delegates_.push_back(content_rules_cache_delegate);
+    cache_delegates_.push_back(make_scoped_ptr(content_rules_cache_delegate));
     scoped_refptr<ContentRulesRegistry> content_rules_registry =
         ExtensionsAPIClient::Get()->CreateContentRulesRegistry(
             browser_context_, content_rules_cache_delegate);

diff --git a/extensions/browser/api/declarative/rules_registry_service.h b/extensions/browser/api/declarative/rules_registry_service.h
index 60b720b..97f2e95 100644
--- a/extensions/browser/api/declarative/rules_registry_service.h
+++ b/extensions/browser/api/declarative/rules_registry_service.h

@@ -12,7 +12,6 @@
 
 #include "base/callback_forward.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/scoped_vector.h"
 #include "base/scoped_observer.h"
 #include "extensions/browser/api/declarative/rules_registry.h"
 #include "extensions/browser/browser_context_keyed_api_factory.h"
@@ -133,7 +132,7 @@
   RulesRegistryMap rule_registries_;
 
   // We own the parts of the registries which need to run on the UI thread.
-  ScopedVector<RulesCacheDelegate> cache_delegates_;
+  std::vector<scoped_ptr<RulesCacheDelegate>> cache_delegates_;
 
   // Weak pointer into rule_registries_ to make it easier to handle content rule
   // conditions.

diff --git a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc
index 1b4dcdb0..17bdd22 100644
--- a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc
+++ b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc

@@ -5,10 +5,11 @@
 #include "extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.h"
 
 #include <algorithm>
+#include <utility>
+#include <vector>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
-#include "base/memory/scoped_vector.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
@@ -351,19 +352,20 @@
 
    private:
     // Takes ownership of the content of both |name_match| and |value_match|.
-    HeaderMatchTest(ScopedVector<const StringMatchTest>* name_match,
-                    ScopedVector<const StringMatchTest>* value_match);
+    HeaderMatchTest(std::vector<scoped_ptr<const StringMatchTest>> name_match,
+                    std::vector<scoped_ptr<const StringMatchTest>> value_match);
 
     // Tests to be passed by a header's name.
-    const ScopedVector<const StringMatchTest> name_match_;
+    const std::vector<scoped_ptr<const StringMatchTest>> name_match_;
     // Tests to be passed by a header's value.
-    const ScopedVector<const StringMatchTest> value_match_;
+    const std::vector<scoped_ptr<const StringMatchTest>> value_match_;
+
     DISALLOW_COPY_AND_ASSIGN(HeaderMatchTest);
   };
 
-  explicit HeaderMatcher(ScopedVector<const HeaderMatchTest>* tests);
+  explicit HeaderMatcher(std::vector<scoped_ptr<const HeaderMatchTest>> tests);
 
-  const ScopedVector<const HeaderMatchTest> tests_;
+  const std::vector<scoped_ptr<const HeaderMatchTest>> tests_;
 
   DISALLOW_COPY_AND_ASSIGN(HeaderMatcher);
 };
@@ -375,7 +377,7 @@
 // static
 scoped_ptr<const HeaderMatcher> HeaderMatcher::Create(
     const base::ListValue* tests) {
-  ScopedVector<const HeaderMatchTest> header_tests;
+  std::vector<scoped_ptr<const HeaderMatchTest>> header_tests;
   for (base::ListValue::const_iterator it = tests->begin();
        it != tests->end(); ++it) {
     const base::DictionaryValue* tests = NULL;
@@ -386,10 +388,11 @@
         HeaderMatchTest::Create(tests));
     if (header_test.get() == NULL)
       return scoped_ptr<const HeaderMatcher>();
-    header_tests.push_back(header_test.Pass());
+    header_tests.push_back(std::move(header_test));
   }
 
-  return scoped_ptr<const HeaderMatcher>(new HeaderMatcher(&header_tests));
+  return scoped_ptr<const HeaderMatcher>(
+      new HeaderMatcher(std::move(header_tests)));
 }
 
 bool HeaderMatcher::TestNameValue(const std::string& name,
@@ -401,8 +404,9 @@
   return false;
 }
 
-HeaderMatcher::HeaderMatcher(ScopedVector<const HeaderMatchTest>* tests)
-  : tests_(tests->Pass()) {}
+HeaderMatcher::HeaderMatcher(
+    std::vector<scoped_ptr<const HeaderMatchTest>> tests)
+    : tests_(std::move(tests)) {}
 
 // HeaderMatcher::StringMatchTest implementation.
 
@@ -453,18 +457,18 @@
 // HeaderMatcher::HeaderMatchTest implementation.
 
 HeaderMatcher::HeaderMatchTest::HeaderMatchTest(
-    ScopedVector<const StringMatchTest>* name_match,
-    ScopedVector<const StringMatchTest>* value_match)
-    : name_match_(name_match->Pass()),
-      value_match_(value_match->Pass()) {}
+    std::vector<scoped_ptr<const StringMatchTest>> name_match,
+    std::vector<scoped_ptr<const StringMatchTest>> value_match)
+    : name_match_(std::move(name_match)),
+      value_match_(std::move(value_match)) {}
 
 HeaderMatcher::HeaderMatchTest::~HeaderMatchTest() {}
 
 // static
 scoped_ptr<const HeaderMatcher::HeaderMatchTest>
 HeaderMatcher::HeaderMatchTest::Create(const base::DictionaryValue* tests) {
-  ScopedVector<const StringMatchTest> name_match;
-  ScopedVector<const StringMatchTest> value_match;
+  std::vector<scoped_ptr<const StringMatchTest>> name_match;
+  std::vector<scoped_ptr<const StringMatchTest>> value_match;
 
   for (base::DictionaryValue::Iterator it(*tests);
        !it.IsAtEnd(); it.Advance()) {
@@ -496,7 +500,7 @@
     }
     const base::Value* content = &it.value();
 
-    ScopedVector<const StringMatchTest>* tests =
+    std::vector<scoped_ptr<const StringMatchTest>>* tests =
         is_name ? &name_match : &value_match;
     switch (content->GetType()) {
       case base::Value::TYPE_LIST: {
@@ -504,14 +508,14 @@
         CHECK(content->GetAsList(&list));
         for (base::ListValue::const_iterator it = list->begin();
              it != list->end(); ++it) {
-          tests->push_back(
-              StringMatchTest::Create(*it, match_type, !is_name).release());
+          tests->push_back(make_scoped_ptr(
+              StringMatchTest::Create(*it, match_type, !is_name).release()));
         }
         break;
       }
       case base::Value::TYPE_STRING: {
-        tests->push_back(
-            StringMatchTest::Create(content, match_type, !is_name).release());
+        tests->push_back(make_scoped_ptr(
+            StringMatchTest::Create(content, match_type, !is_name).release()));
         break;
       }
       default: {
@@ -522,7 +526,7 @@
   }
 
   return scoped_ptr<const HeaderMatchTest>(
-      new HeaderMatchTest(&name_match, &value_match));
+      new HeaderMatchTest(std::move(name_match), std::move(value_match)));
 }
 
 bool HeaderMatcher::HeaderMatchTest::Matches(const std::string& name,

diff --git a/extensions/browser/api/printer_provider/printer_provider_apitest.cc b/extensions/browser/api/printer_provider/printer_provider_apitest.cc
index 643499c..46148d5 100644
--- a/extensions/browser/api/printer_provider/printer_provider_apitest.cc
+++ b/extensions/browser/api/printer_provider/printer_provider_apitest.cc

@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <utility>
+#include <vector>
+
 #include "base/bind.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
@@ -9,7 +12,6 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/json/json_string_value_serializer.h"
 #include "base/memory/ref_counted_memory.h"
-#include "base/memory/scoped_vector.h"
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
@@ -325,11 +327,11 @@
   // in |expoected_printers| are unique.
   void ValidatePrinterListValue(
       const base::ListValue& printers,
-      const ScopedVector<base::Value>& expected_printers) {
+      const std::vector<scoped_ptr<base::Value>> expected_printers) {
     ASSERT_EQ(expected_printers.size(), printers.GetSize());
-    for (const base::Value* printer_value : expected_printers) {
-      EXPECT_TRUE(printers.Find(*printer_value) != printers.end())
-          << "Unable to find " << *printer_value << " in " << printers;
+    for (const auto& printer_value : expected_printers) {
+      EXPECT_TRUE(printers.Find(*printer_value.get()) != printers.end())
+          << "Unable to find " << *printer_value.get() << " in " << printers;
     }
   }
 
@@ -484,7 +486,7 @@
 
   run_loop.Run();
 
-  ScopedVector<base::Value> expected_printers;
+  std::vector<scoped_ptr<base::Value>> expected_printers;
   expected_printers.push_back(
       DictionaryBuilder()
           .Set("description", "Test printer")
@@ -502,7 +504,7 @@
           .Set("name", "Printer 2")
           .Build());
 
-  ValidatePrinterListValue(printers, expected_printers);
+  ValidatePrinterListValue(printers, std::move(expected_printers));
 }
 
 IN_PROC_BROWSER_TEST_F(PrinterProviderApiTest, GetPrintersAsyncSuccess) {
@@ -523,7 +525,7 @@
 
   run_loop.Run();
 
-  ScopedVector<base::Value> expected_printers;
+  std::vector<scoped_ptr<base::Value>> expected_printers;
   expected_printers.push_back(
       DictionaryBuilder()
           .Set("description", "Test printer")
@@ -533,7 +535,7 @@
           .Set("name", "Printer 1")
           .Build());
 
-  ValidatePrinterListValue(printers, expected_printers);
+  ValidatePrinterListValue(printers, std::move(expected_printers));
 }
 
 IN_PROC_BROWSER_TEST_F(PrinterProviderApiTest, GetPrintersTwoExtensions) {
@@ -561,7 +563,7 @@
 
   run_loop.Run();
 
-  ScopedVector<base::Value> expected_printers;
+  std::vector<scoped_ptr<base::Value>> expected_printers;
   expected_printers.push_back(
       DictionaryBuilder()
           .Set("description", "Test printer")
@@ -595,7 +597,7 @@
           .Set("name", "Printer 2")
           .Build());
 
-  ValidatePrinterListValue(printers, expected_printers);
+  ValidatePrinterListValue(printers, std::move(expected_printers));
 }
 
 IN_PROC_BROWSER_TEST_F(PrinterProviderApiTest,
@@ -656,7 +658,7 @@
 
   run_loop.Run();
 
-  ScopedVector<base::Value> expected_printers;
+  std::vector<scoped_ptr<base::Value>> expected_printers;
   expected_printers.push_back(
       DictionaryBuilder()
           .Set("description", "Test printer")
@@ -674,7 +676,7 @@
           .Set("name", "Printer 2")
           .Build());
 
-  ValidatePrinterListValue(printers, expected_printers);
+  ValidatePrinterListValue(printers, std::move(expected_printers));
 }
 
 IN_PROC_BROWSER_TEST_F(PrinterProviderApiTest,
@@ -703,7 +705,7 @@
 
   run_loop.Run();
 
-  ScopedVector<base::Value> expected_printers;
+  std::vector<scoped_ptr<base::Value>> expected_printers;
   expected_printers.push_back(
       DictionaryBuilder()
           .Set("description", "Test printer")
@@ -721,7 +723,7 @@
           .Set("name", "Printer 2")
           .Build());
 
-  ValidatePrinterListValue(printers, expected_printers);
+  ValidatePrinterListValue(printers, std::move(expected_printers));
 }
 
 IN_PROC_BROWSER_TEST_F(PrinterProviderApiTest, GetPrintersNoListener) {

diff --git a/extensions/browser/extension_throttle_simulation_unittest.cc b/extensions/browser/extension_throttle_simulation_unittest.cc
index be55453e4..2c9318b 100644
--- a/extensions/browser/extension_throttle_simulation_unittest.cc
+++ b/extensions/browser/extension_throttle_simulation_unittest.cc

@@ -18,7 +18,6 @@
 
 #include "base/environment.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/memory/scoped_vector.h"
 #include "base/message_loop/message_loop.h"
 #include "base/rand_util.h"
 #include "base/time/time.h"
@@ -487,7 +486,7 @@
   const size_t kNumClients = 50;
   DiscreteTimeSimulation simulation;
   ExtensionThrottleManager manager;
-  ScopedVector<Requester> requesters;
+  std::vector<scoped_ptr<Requester>> requesters;
   for (size_t i = 0; i < kNumAttackers; ++i) {
     // Use a tiny time_between_requests so the attackers will ping the
     // server at every tick of the simulation.
@@ -500,7 +499,7 @@
         new Requester(throttler_entry.get(), TimeDelta::FromMilliseconds(1),
                       server, attacker_results);
     attacker->SetStartupJitter(TimeDelta::FromSeconds(120));
-    requesters.push_back(attacker);
+    requesters.push_back(make_scoped_ptr(attacker));
     simulation.AddActor(attacker);
   }
   for (size_t i = 0; i < kNumClients; ++i) {
@@ -515,7 +514,7 @@
                       client_results);
     client->SetStartupJitter(TimeDelta::FromSeconds(120));
     client->SetRequestJitter(TimeDelta::FromMinutes(1));
-    requesters.push_back(client);
+    requesters.push_back(make_scoped_ptr(client));
     simulation.AddActor(client);
   }
   simulation.AddActor(server);

diff --git a/extensions/shell/BUILD.gn b/extensions/shell/BUILD.gn
index 0f8af6e..829ef00 100644
--- a/extensions/shell/BUILD.gn
+++ b/extensions/shell/BUILD.gn

@@ -89,6 +89,28 @@
     sources += chromeos_sources
   }
 
+  # TODO(GYP): Enable this when //components/nacl GN is done. See
+  # http://crbug.com/430602
+  if (false) {
+    if (enable_nacl) {
+      if (is_linux) {
+        deps += [ "//components/nacl:nacl_helper" ]
+      }
+      deps += [
+        "//components/nacl",
+        "//components/nacl:browser",
+        "//components/nacl:common",
+        "//components/nacl:renderer",
+        "//components/nacl:switches",
+      ]
+      nacl_sources =
+          rebase_path(app_shell_gypi_values.app_shell_lib_sources_nacl,
+                      ".",
+                      "//extensions/shell")
+      sources += nacl_sources
+    }
+  }
+
   if (enable_nacl) {
     sources += [
       "browser/shell_nacl_browser_delegate.cc",
@@ -96,15 +118,16 @@
     ]
 
     deps += [
-      "//components/nacl/browser",
-      "//components/nacl/common",
-      "//components/nacl/loader",
-      "//components/nacl/renderer",
+      "//components/nacl",
+      "//components/nacl:nacl_browser",
+      "//components/nacl:nacl_common",
+      "//components/nacl:nacl_renderer",
+      "//components/nacl:nacl_switches",
       "//components/nacl/renderer/plugin:nacl_trusted_plugin",
     ]
 
     if (is_linux) {
-      deps += [ "//components/nacl/loader:nacl_helper" ]
+      deps += [ "//components/nacl:nacl_helper" ]
     }
   }
 

diff --git a/ipc/ipc_message_start.h b/ipc/ipc_message_start.h
index b0942bd..8ec7f3c 100644
--- a/ipc/ipc_message_start.h
+++ b/ipc/ipc_message_start.h

@@ -134,6 +134,7 @@
   ArcInstanceHostMsgStart,
   DistillerMsgStart,
   StartupMetricMsgStart,
+  ArcCameraMsgStart,
   DWriteFontProxyMsgStart,
   LastIPCMsgStart  // Must come last.
 };

diff --git a/media/audio/audio_manager.cc b/media/audio/audio_manager.cc
index b0d866ca..3602240 100644
--- a/media/audio/audio_manager.cc
+++ b/media/audio/audio_manager.cc

@@ -40,15 +40,17 @@
 // |g_last_created|.
 AudioManagerFactory* g_audio_manager_factory = nullptr;
 
-// Maximum number of failed pings to the audio thread allowed. A crash will be
-// issued once this count is reached.  We require at least two pings before
-// crashing to ensure unobservable power events aren't mistakenly caught (e.g.,
-// the system suspends before a OnSuspend() event can be fired.).
-const int kMaxHangFailureCount = 2;
+// Maximum number of failed pings to the audio thread allowed. A UMA will be
+// recorded once this count is reached; if enabled, a non-crash dump will be
+// captured as well. We require at least three failed pings before recording to
+// ensure unobservable power events aren't mistakenly caught (e.g., the system
+// suspends before a OnSuspend() event can be fired).
+const int kMaxFailedPingsCount = 3;
 
-// Helper class for managing global AudioManager data and hang timers. If the
-// audio thread is unresponsive for more than two minutes we want to crash the
-// process so we can catch offenders quickly in the field.
+// Helper class for managing global AudioManager data and hang monitor. If the
+// audio thread is hung for > |kMaxFailedPingsCount| * |max_hung_task_time_|, we
+// want to record a UMA and optionally a non-crash dump to find offenders in the
+// field.
 class AudioManagerHelper : public base::PowerObserver {
  public:
   // These values are histogrammed over time; do not change their ordinal
@@ -75,7 +77,7 @@
     CHECK(!monitor_task_runner_);
     monitor_task_runner_ = monitor_task_runner;
     base::PowerMonitor::Get()->AddObserver(this);
-    hang_failures_ = 0;
+    failed_pings_ = 0;
     io_task_running_ = audio_task_running_ = true;
     UpdateLastAudioThreadTimeTick();
     RecordAudioThreadStatus();
@@ -85,7 +87,7 @@
   void OnSuspend() override {
     base::AutoLock lock(hang_lock_);
     hang_detection_enabled_ = false;
-    hang_failures_ = 0;
+    failed_pings_ = successful_pings_ = 0;
   }
 
   // Reenable hang detection once the system comes out of the suspend state.
@@ -93,7 +95,7 @@
     base::AutoLock lock(hang_lock_);
     hang_detection_enabled_ = true;
     last_audio_thread_timer_tick_ = base::TimeTicks::Now();
-    hang_failures_ = 0;
+    failed_pings_ = successful_pings_ = 0;
 
     // If either of the tasks were stopped during suspend, start them now.
     if (!audio_task_running_) {
@@ -127,18 +129,23 @@
       const base::TimeTicks now = base::TimeTicks::Now();
       const base::TimeDelta tick_delta = now - last_audio_thread_timer_tick_;
       if (tick_delta > max_hung_task_time_) {
-        if (++hang_failures_ >= kMaxHangFailureCount &&
+        successful_pings_ = 0;
+        if (++failed_pings_ >= kMaxFailedPingsCount &&
             audio_thread_status_ < THREAD_HUNG) {
           if (enable_crash_key_logging_)
             LogAudioDriverCrashKeys();
           HistogramThreadStatus(THREAD_HUNG);
         }
       } else {
-        hang_failures_ = 0;
-        if (audio_thread_status_ == THREAD_NONE)
+        failed_pings_ = 0;
+        ++successful_pings_;
+        if (audio_thread_status_ == THREAD_NONE) {
           HistogramThreadStatus(THREAD_STARTED);
-        else if (audio_thread_status_ == THREAD_HUNG)
+        } else if (audio_thread_status_ == THREAD_HUNG &&
+                   successful_pings_ >= kMaxFailedPingsCount) {
+          // Require just as many successful pings to recover from failure.
           HistogramThreadStatus(THREAD_RECOVERED);
+        }
       }
     }
 
@@ -154,7 +161,7 @@
     {
       base::AutoLock lock(hang_lock_);
       last_audio_thread_timer_tick_ = base::TimeTicks::Now();
-      hang_failures_ = 0;
+      failed_pings_ = 0;
 
       // Don't post our task if the system is or will be suspended.
       if (!hang_detection_enabled_) {
@@ -222,11 +229,12 @@
   base::Lock hang_lock_;
   bool hang_detection_enabled_ = true;
   base::TimeTicks last_audio_thread_timer_tick_;
-  int hang_failures_ = 0;
+  uint32_t failed_pings_ = 0;
   bool io_task_running_ = false;
   bool audio_task_running_ = false;
   ThreadStatus audio_thread_status_ = THREAD_NONE;
   bool enable_crash_key_logging_ = false;
+  uint32_t successful_pings_ = 0;
 
 #if defined(OS_WIN)
   scoped_ptr<base::win::ScopedCOMInitializer> com_initializer_for_testing_;

diff --git a/media/filters/vpx_video_decoder.cc b/media/filters/vpx_video_decoder.cc
index d9721b0..1e041e6a 100644
--- a/media/filters/vpx_video_decoder.cc
+++ b/media/filters/vpx_video_decoder.cc

@@ -463,7 +463,9 @@
     return false;
   }
 
-  CopyVpxImageToVideoFrame(vpx_image, video_frame);
+  if (!CopyVpxImageToVideoFrame(vpx_image, video_frame))
+    return false;
+
   (*video_frame)->set_timestamp(base::TimeDelta::FromMicroseconds(timestamp));
 
   // Default to the color space from the config, but if the bistream specifies
@@ -543,18 +545,25 @@
   return true;
 }
 
-void VpxVideoDecoder::CopyVpxImageToVideoFrame(
+bool VpxVideoDecoder::CopyVpxImageToVideoFrame(
     const struct vpx_image* vpx_image,
     scoped_refptr<VideoFrame>* video_frame) {
   DCHECK(vpx_image);
-  DCHECK(vpx_image->fmt == VPX_IMG_FMT_I420 ||
-         vpx_image->fmt == VPX_IMG_FMT_I444);
 
-  VideoPixelFormat codec_format = PIXEL_FORMAT_YV12;
-  if (vpx_image->fmt == VPX_IMG_FMT_I444)
-    codec_format = PIXEL_FORMAT_YV24;
-  else if (vpx_codec_alpha_)
-    codec_format = PIXEL_FORMAT_YV12A;
+  VideoPixelFormat codec_format;
+  switch (vpx_image->fmt) {
+    case VPX_IMG_FMT_I420:
+      codec_format = vpx_codec_alpha_ ? PIXEL_FORMAT_YV12A : PIXEL_FORMAT_YV12;
+      break;
+
+    case VPX_IMG_FMT_I444:
+      codec_format = PIXEL_FORMAT_YV24;
+      break;
+
+    default:
+      DLOG(ERROR) << "Unsupported pixel format: " << vpx_image->fmt;
+      return false;
+  }
 
   // The mixed |w|/|d_h| in |coded_size| is intentional. Setting the correct
   // coded width is necessary to allow coalesced memory access, which may avoid
@@ -585,7 +594,7 @@
         "Media.Vpx.VideoDecoderBuffersInUseByDecoderAndVideoFrame",
         memory_pool_->NumberOfFrameBuffersInUseByDecoderAndVideoFrame());
 
-    return;
+    return true;
   }
 
   DCHECK(codec_format == PIXEL_FORMAT_YV12 ||
@@ -606,6 +615,8 @@
       (*video_frame)->visible_data(VideoFrame::kVPlane),
       (*video_frame)->stride(VideoFrame::kVPlane), coded_size.width(),
       coded_size.height());
+
+  return true;
 }
 
 }  // namespace media

diff --git a/media/filters/vpx_video_decoder.h b/media/filters/vpx_video_decoder.h
index 1938dca..73dd3de 100644
--- a/media/filters/vpx_video_decoder.h
+++ b/media/filters/vpx_video_decoder.h

@@ -66,7 +66,7 @@
   bool VpxDecode(const scoped_refptr<DecoderBuffer>& buffer,
                  scoped_refptr<VideoFrame>* video_frame);
 
-  void CopyVpxImageToVideoFrame(const struct vpx_image* vpx_image,
+  bool CopyVpxImageToVideoFrame(const struct vpx_image* vpx_image,
                                 scoped_refptr<VideoFrame>* video_frame);
 
   base::ThreadChecker thread_checker_;

diff --git a/mojo/edk/system/message_pipe_dispatcher.cc b/mojo/edk/system/message_pipe_dispatcher.cc
index b4938fe..beb1824 100644
--- a/mojo/edk/system/message_pipe_dispatcher.cc
+++ b/mojo/edk/system/message_pipe_dispatcher.cc

@@ -618,7 +618,7 @@
     uint32_t* num_dispatchers,
     MojoReadMessageFlags flags) {
   lock().AssertAcquired();
-  if (channel_) {
+  if (transferable_ && channel_) {
     channel_->EnsureLazyInitialized();
   } else if (!transferable_) {
     if (non_transferable_state_ == WAITING_FOR_READ_OR_WRITE) {
@@ -718,7 +718,7 @@
     uintptr_t context,
     HandleSignalsState* signals_state) {
   lock().AssertAcquired();
-  if (channel_) {
+  if (transferable_ && channel_) {
     channel_->EnsureLazyInitialized();
   } else if (!transferable_ &&
              non_transferable_state_ == WAITING_FOR_READ_OR_WRITE) {

diff --git a/mojo/edk/system/routed_raw_channel.cc b/mojo/edk/system/routed_raw_channel.cc
index 825fc2fa..b985f56 100644
--- a/mojo/edk/system/routed_raw_channel.cc
+++ b/mojo/edk/system/routed_raw_channel.cc

@@ -132,8 +132,13 @@
 void RoutedRawChannel::OnError(Error error) {
   DCHECK(internal::g_io_thread_task_runner->RunsTasksOnCurrentThread());
 
-  channel_->Shutdown();
-  channel_ = nullptr;
+  // This needs to match non-multiplexed MessagePipeDispatcher's destruction of
+  // the channel only when read errors occur.
+  if (error != ERROR_WRITE) {
+    channel_->Shutdown();
+    channel_ = nullptr;
+  }
+
   if (routes_.empty()) {
     delete this;
     return;

diff --git a/net/docs/bug-triage.md b/net/docs/bug-triage.md
index a8fadfb..38a7f63 100644
--- a/net/docs/bug-triage.md
+++ b/net/docs/bug-triage.md

@@ -96,3 +96,6 @@
 
 See [bug-triage-labels.md](bug-triage-labels.md) for labeling tips for network
 and non-network bugs.
+
+See [crash-course-in-net-internals.md](crash-course-in-net-internals.md) for
+some help on getting started with about:net-internals debugging.
\ No newline at end of file

diff --git a/net/docs/crash-course-in-net-internals.md b/net/docs/crash-course-in-net-internals.md
new file mode 100644
index 0000000..5dcfb24
--- /dev/null
+++ b/net/docs/crash-course-in-net-internals.md

@@ -0,0 +1,183 @@
+# A Crash Course in Debugging with about:net-internals
+
+This document is intended to help get people started debugging network errors
+with about:net-internals, with some commonly useful tips and tricks.  This
+document is aimed more at how to get started using some of its features to
+investigate bug reports, rather than as a feature overview.
+
+It would probably be useful to read [life-of-a-url-request.md](
+life-of-a-url-request.md) before this document.
+
+# What Data Net-Internals Contains
+
+about:net-internals provides a view of browser activity from net/'s perspective.
+For this reason, it lacks knowledge of tabs, navigation, frames, resource types,
+etc.
+
+The top level network stack object is the URLRequestContext.  The Events View
+has information for all Chrome URLRequestContexts that are hooked up to the
+single, global, ChromeNetLog object.  This includes both incognito and non-
+incognito profiles, among other things.  The Events view only shows events for
+the period that net-internals was open and running, and is incrementally updated
+as events occur.  The code attempts to add a top level event for URLRequests
+that were active when the tab was opened, to help debug hung requests, but
+that's best-effort only, and only includes requests for the current profile and
+the system URLRequestContext.
+
+The other views are all snapshots of the current state of the main
+URLRequestContext's components, and are updated on a 5 second timer.  These will
+show objects that were created before about:net-internals was opened.  Most
+debugging is done with the Events view (which will be all this document
+covers), but it's good to be aware of this distinction.
+
+# Events vs Sources
+
+The Event View shows events logged by the NetLog.  The NetLog model is that
+long-lived network stack objects, called sources, emit events over their
+lifetime.  Some events have a beginning and end point (during which other
+subevents may occur), and some only occur at a single point in time.  Generally
+only one event can be occuring for a source at a time.  If there can be multiple
+events doing completely independent thing, the code often uses new sources to
+represent the parallelism.
+
+"Sources" correspond to certain net objects, however, multiple layers of net/
+will often log to a single source.  Here are the main source types and what they
+include (Excluding HTTP2 [SPDY]/QUIC):
+
+* URL_REQUEST:  This corresponds to the URLRequest object.  It includes events
+from all the URLRequestJobs, HttpCache::Transactions, NetworkTransactions,
+HttpStreamFactoryImpl::Requests, HttpStream implementations, and
+HttpStreamParsers used to service a response.  If the URL_REQUEST follows HTTP
+redirects, it will include each redirect.  This is a lot of stuff, but generally
+only object is doing work at a time.  This event source includes the full URL
+and generally includes the request / response headers (Except when the cache
+handles the response).
+
+* HTTP_STREAM_JOB:  This corresponds to HttpStreamFactoryImpl::Job (Note that
+one Request can have multiple Jobs).  It also includes its proxy and DNS
+lookups.  HTTP_STREAM_JOB log events are separate from URL_REQUEST because
+two stream jobs may be created and races against each other, in some cases -
+one for one for QUIC, and one for HTTP.  One of the final events of this source
+indicates how an HttpStream was created (Reusing an existing SOCKET /
+HTTP2_SESSION / QUIC_SESSION, or creating a new one).
+
+* CONNECT_JOB:  This corresponds to the ConnectJob subclasses that each socket
+pool uses.  A successful CONNECT_JOB return a SOCKET.  The events here vary a
+lot by job type.  Their main event is generally either to create a socket, or
+request a socket from another socket pool (Which creates another CONNECT_JOB)
+and then do some extra work on top of that - like establish an SSL connection on
+top of a TCP connection.
+
+* SOCKET:  These correspond to TCPSockets, but may also have other classes
+layered on top of them (Like an SSLClientSocket).  This is a bit different from
+the other classes, where the name corresponds to the topmost class, instead of
+the bottommost one.  This is largely an artifact of the fact the socket is
+created first, and then SSL (Or a proxy connection) is layered on top of it.
+SOCKETs may be reused between multiple requests, and a request may end up
+getting a socket created for another request.
+
+* HOST_RESOLVER_IMPL_JOB:  These correspond to HostResolverImpl::Job.  The
+include information about how long the lookup was queued, each DNS request that
+was attempted (With the platform or built-in resolver) and all the other sources
+that are waiting on the job.
+
+When one source depends on another, the code generally logs an event with
+"source_dependency" value to both sources, which lets you jump between the two
+related events.
+
+# Debugging
+
+When you receive a report from the user, the first thing you'll generally want
+to do find the URL_REQUEST[s] that are misbehaving.  If the user gives an ERR_*
+code or the exact URL of the resource that won't load, you can just search for
+it.  If it's an upload, you can search for "post", or if it's a redirect issue,
+you can search for "redirect".  However, you often won't have much information
+about the actual problem.  There are two filters in net-internals that can help
+in a lot of cases:
+
+* "type:URL_REQUEST is:error" will restrict the list to URL_REQUEST object with
+an error of some sort (red background).  Cache errors are often non-fatal, so
+you should generally ignore those, and look for a more interesting one.
+
+* "type:URL_REQUEST sort:duration" will show the lonest-lived requests (as of
+when about:net-internals was opened) first.  This is often useful in finding
+hung or slow requests.
+
+For a list of other filter commands, you can mouse over the question mark on
+about:net-internals.
+
+Once you locate the problematic request, the next is to figure out where the
+problem is - it's often one of the last events, though it could also be related
+to response or request headers.  You can use "source_dependency" links to drill
+down into other related sources, or up from layers below URL_REQUEST.
+
+You can use the name of an event to search for the code responsible for that
+event, and try to deduce what went wrong before/after a particular event.  Note
+that the event names used in net-internals are not the entire string names, so
+you should not do an entire string match.
+
+Some things to look for while debugging:
+
+* CANCELLED events almost always come from outside the network stack.
+
+* Changing networks and entering / exiting suspend mode can have all sorts of
+fun and exciting effects on underway network activity.  Network changes log a
+top level NETWORK_CHANGED event with no source - the event itself is treated as
+its own source.  Suspend events are currently not logged.
+
+* URL_REQUEST_DELEGATE / DELEGATE_INFO events mean a URL_REQUEST is blocked on a
+URLRequest::Delegate or the NetworkDelegate, which are implemented outside the
+network stack.  A request will sometimes be CANCELED here for reasons known only
+to the delegate.  Or the delegate may cause a hang.  In general, to debug issues
+related to delegates, one needs to figure out which method of which object is
+causing the problem.  The object may be the a NetworkDelegate, a
+ResourceThrottle, a ResourceHandler, the ResourceLoader itself, or the
+ResourceDispatcherHost.
+
+* Sockets are often reused between requests.  If a request is on a stale
+(reused) socket, what was the previous request that used the socket, how long
+ago was it made?
+
+* SSL negotation is a process fraught with peril, particularly with broken
+proxies.  These will generally stall or fail in the SSL_CONNECT phase at the
+SOCKET layer.
+
+* Range requests have magic to handle them at the cache layer, and are often
+issued by the media and PDF code.
+
+* Late binding:  HTTP_STREAM_JOBs are not associated with any CONNECT_JOB until
+a CONNECT_JOB actually connects.  This is so the highest priority pending job
+gets the first available socket (Which may be a new socket, or an old one that's
+freed up).  For this reason, it can be a little tricky to relate hung
+HTTP_STREAM_JOBs to CONNECT_JOBs.
+
+* Each CONNECT_JOB belongs to a "group", which has a limit of 6 connections.  If
+all CONNECT_JOBs beling to a group (The CONNECT_JOB's description field) are
+stalled waiting on an available socket, the group probably has 6 sockets that
+that are hung - either hung trying to connect, or used by stalled requests and
+thus outside the socket pool's control.
+
+* There's a limit on number of DNS resolutions that can be started at once.  If
+everything is stalled while resolving DNS addresses, you've probably hit this
+limit, and the DNS lookups are also misbehaving in some fashion.
+
+# Miscellany
+
+These are just miscellaneous things you may notice when looking through the
+logs.
+
+* URLRequests that look to start twice for no obvious reason.  These are
+typically main frame requests, and the first request is AppCache.  Can just
+ignore it and move on with your life.
+
+* Some HTTP requests are not handled by URLRequestHttpJobs.  These include
+things like HSTS redirects (URLRequestRedirectJob), AppCache, ServiceWorker,
+etc.  These generally don't log as much information, so it can be tricky to
+figure out what's going on with these.
+
+* Non-HTTP requests also appear in the log, and also generally don't log much
+(blob URLs, chrome URLs, etc).
+
+* Preconnects create a "HTTP_STREAM_JOB" event that may create multiple
+CONNECT_JOBs (or none) and is then destroyed.  These can be identified by the
+"SOCKET_POOL_CONNECTING_N_SOCKETS" events.

diff --git a/net/http/http_auth_handler_mock.cc b/net/http/http_auth_handler_mock.cc
index f800c19..04a09e4 100644
--- a/net/http/http_auth_handler_mock.cc
+++ b/net/http/http_auth_handler_mock.cc

@@ -161,7 +161,7 @@
 
 void HttpAuthHandlerMock::Factory::AddMockHandler(
     HttpAuthHandler* handler, HttpAuth::Target target) {
-  handlers_[target].push_back(handler);
+  handlers_[target].push_back(make_scoped_ptr(handler));
 }
 
 int HttpAuthHandlerMock::Factory::CreateAuthHandler(
@@ -174,8 +174,8 @@
     scoped_ptr<HttpAuthHandler>* handler) {
   if (handlers_[target].empty())
     return ERR_UNEXPECTED;
-  scoped_ptr<HttpAuthHandler> tmp_handler(handlers_[target][0]);
-  std::vector<HttpAuthHandler*>& handlers = handlers_[target].get();
+  scoped_ptr<HttpAuthHandler> tmp_handler = std::move(handlers_[target][0]);
+  std::vector<scoped_ptr<HttpAuthHandler>>& handlers = handlers_[target];
   handlers.erase(handlers.begin());
   if (do_init_from_challenge_ &&
       !tmp_handler->InitFromChallenge(challenge, target, origin, net_log))

diff --git a/net/http/http_auth_handler_mock.h b/net/http/http_auth_handler_mock.h
index 32b416d..26775268 100644
--- a/net/http/http_auth_handler_mock.h
+++ b/net/http/http_auth_handler_mock.h

@@ -6,8 +6,9 @@
 #define NET_HTTP_HTTP_AUTH_HANDLER_MOCK_H_
 
 #include <string>
+#include <vector>
 
-#include "base/memory/scoped_vector.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "net/http/http_auth_handler.h"
 #include "net/http/http_auth_handler_factory.h"
@@ -51,7 +52,8 @@
                           scoped_ptr<HttpAuthHandler>* handler) override;
 
    private:
-    ScopedVector<HttpAuthHandler> handlers_[HttpAuth::AUTH_NUM_TARGETS];
+    std::vector<scoped_ptr<HttpAuthHandler>>
+        handlers_[HttpAuth::AUTH_NUM_TARGETS];
     bool do_init_from_challenge_;
   };
 

diff --git a/net/net.gypi b/net/net.gypi
index 72214aa..b8d4ce0 100644
--- a/net/net.gypi
+++ b/net/net.gypi

@@ -1928,6 +1928,7 @@
       'docs/bug-triage-labels.md',
       'docs/bug-triage-suggested-workflow.md',
       'docs/code-patterns.md',
+      'docs/crash-course-in-net-internals.md',
       'docs/life-of-a-url-request.md',
       'sdch/README.md',
     ],

diff --git a/net/quic/p2p/quic_p2p_session.cc b/net/quic/p2p/quic_p2p_session.cc
index 866f487..1177105 100644
--- a/net/quic/p2p/quic_p2p_session.cc
+++ b/net/quic/p2p/quic_p2p_session.cc

@@ -56,7 +56,8 @@
   return stream;
 }
 
-QuicP2PStream* QuicP2PSession::CreateOutgoingDynamicStream() {
+QuicP2PStream* QuicP2PSession::CreateOutgoingDynamicStream(
+    net::SpdyPriority priority) {
   QuicP2PStream* stream = new QuicP2PStream(GetNextOutgoingStreamId(), this);
   if (stream) {
     ActivateStream(stream);

diff --git a/net/quic/p2p/quic_p2p_session.h b/net/quic/p2p/quic_p2p_session.h
index 992e7b5..9f8d9472 100644
--- a/net/quic/p2p/quic_p2p_session.h
+++ b/net/quic/p2p/quic_p2p_session.h

@@ -48,7 +48,8 @@
 
   // QuicSession overrides.
   void Initialize() override;
-  QuicP2PStream* CreateOutgoingDynamicStream() override;
+  QuicP2PStream* CreateOutgoingDynamicStream(
+      net::SpdyPriority priority) override;
 
   // QuicConnectionVisitorInterface overrides.
   void OnConnectionClosed(QuicErrorCode error, bool from_peer) override;

diff --git a/net/quic/p2p/quic_p2p_session_test.cc b/net/quic/p2p/quic_p2p_session_test.cc
index 129e347..c70961d 100644
--- a/net/quic/p2p/quic_p2p_session_test.cc
+++ b/net/quic/p2p/quic_p2p_session_test.cc

@@ -272,7 +272,8 @@
 void QuicP2PSessionTest::TestStreamConnection(QuicP2PSession* from_session,
                                               QuicP2PSession* to_session,
                                               QuicStreamId expected_stream_id) {
-  QuicP2PStream* outgoing_stream = from_session->CreateOutgoingDynamicStream();
+  QuicP2PStream* outgoing_stream =
+      from_session->CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_TRUE(outgoing_stream);
   TestP2PStreamDelegate outgoing_stream_delegate;
   outgoing_stream->SetDelegate(&outgoing_stream_delegate);
@@ -339,7 +340,8 @@
   TestP2PSessionDelegate session_delegate;
   session1_->SetDelegate(&session_delegate);
 
-  QuicP2PStream* stream = session1_->CreateOutgoingDynamicStream();
+  QuicP2PStream* stream =
+      session1_->CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_TRUE(stream);
   TestP2PStreamDelegate stream_delegate;
   stream->SetDelegate(&stream_delegate);
@@ -369,7 +371,8 @@
   TestP2PSessionDelegate session_delegate;
   session1_->SetDelegate(&session_delegate);
 
-  QuicP2PStream* stream = session1_->CreateOutgoingDynamicStream();
+  QuicP2PStream* stream =
+      session1_->CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_TRUE(stream);
   TestP2PStreamDelegate stream_delegate;
   stream->SetDelegate(&stream_delegate);

diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
index 4aabc7a2..edc6e8e 100644
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc

@@ -413,7 +413,7 @@
 }
 
 QuicReliableClientStream*
-QuicChromiumClientSession::CreateOutgoingDynamicStream() {
+QuicChromiumClientSession::CreateOutgoingDynamicStream(SpdyPriority priority) {
   if (!crypto_stream_->encryption_established()) {
     DVLOG(1) << "Encryption not active so no outgoing stream created.";
     return nullptr;

diff --git a/net/quic/quic_chromium_client_session.h b/net/quic/quic_chromium_client_session.h
index 72424c2c..174d436 100644
--- a/net/quic/quic_chromium_client_session.h
+++ b/net/quic/quic_chromium_client_session.h

@@ -150,7 +150,8 @@
 
   // QuicSession methods:
   void OnStreamFrame(const QuicStreamFrame& frame) override;
-  QuicReliableClientStream* CreateOutgoingDynamicStream() override;
+  QuicReliableClientStream* CreateOutgoingDynamicStream(
+      SpdyPriority priority) override;
   QuicCryptoClientStream* GetCryptoStream() override;
   void CloseStream(QuicStreamId stream_id) override;
   void SendRstStream(QuicStreamId id,

diff --git a/net/quic/quic_chromium_client_session_test.cc b/net/quic/quic_chromium_client_session_test.cc
index ab79a0a..ec7cb69 100644
--- a/net/quic/quic_chromium_client_session_test.cc
+++ b/net/quic/quic_chromium_client_session_test.cc

@@ -124,11 +124,12 @@
 
   std::vector<QuicReliableClientStream*> streams;
   for (size_t i = 0; i < kDefaultMaxStreamsPerConnection; i++) {
-    QuicReliableClientStream* stream = session_.CreateOutgoingDynamicStream();
+    QuicReliableClientStream* stream =
+        session_.CreateOutgoingDynamicStream(kDefaultPriority);
     EXPECT_TRUE(stream);
     streams.push_back(stream);
   }
-  EXPECT_FALSE(session_.CreateOutgoingDynamicStream());
+  EXPECT_FALSE(session_.CreateOutgoingDynamicStream(kDefaultPriority));
 
   EXPECT_EQ(kDefaultMaxStreamsPerConnection,
             session_.GetNumOpenOutgoingStreams());
@@ -137,12 +138,12 @@
   QuicStreamId stream_id = streams[0]->id();
   session_.CloseStream(stream_id);
 
-  EXPECT_FALSE(session_.CreateOutgoingDynamicStream());
+  EXPECT_FALSE(session_.CreateOutgoingDynamicStream(kDefaultPriority));
   QuicRstStreamFrame rst1(stream_id, QUIC_STREAM_NO_ERROR, 0);
   session_.OnRstStream(rst1);
   EXPECT_EQ(kDefaultMaxStreamsPerConnection - 1,
             session_.GetNumOpenOutgoingStreams());
-  EXPECT_TRUE(session_.CreateOutgoingDynamicStream());
+  EXPECT_TRUE(session_.CreateOutgoingDynamicStream(kDefaultPriority));
 }
 
 TEST_P(QuicChromiumClientSessionTest, MaxNumStreamsViaRequest) {
@@ -150,7 +151,8 @@
 
   std::vector<QuicReliableClientStream*> streams;
   for (size_t i = 0; i < kDefaultMaxStreamsPerConnection; i++) {
-    QuicReliableClientStream* stream = session_.CreateOutgoingDynamicStream();
+    QuicReliableClientStream* stream =
+        session_.CreateOutgoingDynamicStream(kDefaultPriority);
     EXPECT_TRUE(stream);
     streams.push_back(stream);
   }
@@ -179,7 +181,7 @@
   // streams.
   session_.connection()->OnGoAwayFrame(
       QuicGoAwayFrame(QUIC_PEER_GOING_AWAY, 1u, "Going away."));
-  EXPECT_EQ(nullptr, session_.CreateOutgoingDynamicStream());
+  EXPECT_EQ(nullptr, session_.CreateOutgoingDynamicStream(kDefaultPriority));
 }
 
 TEST_P(QuicChromiumClientSessionTest, CanPool) {

diff --git a/net/quic/quic_connection.h b/net/quic/quic_connection.h
index 39965dc..ec7b370c 100644
--- a/net/quic/quic_connection.h
+++ b/net/quic/quic_connection.h

@@ -148,7 +148,7 @@
 // points.  Implementations must not mutate the state of the connection
 // as a result of these callbacks.
 class NET_EXPORT_PRIVATE QuicConnectionDebugVisitor
-    : public QuicPacketGenerator::DebugDelegate,
+    : public QuicPacketCreator::DebugDelegate,
       public QuicSentPacketManager::DebugDelegate {
  public:
   ~QuicConnectionDebugVisitor() override {}

diff --git a/net/quic/quic_flags.cc b/net/quic/quic_flags.cc
index d8aa2707..25efadf 100644
--- a/net/quic/quic_flags.cc
+++ b/net/quic/quic_flags.cc

@@ -127,3 +127,6 @@
 // address token using the primary config, even if no server config id
 // is present in the client hello.
 bool FLAGS_quic_validate_stk_without_scid = true;
+
+// If true, use the new write blocked list for QUIC.
+bool FLAGS_quic_new_blocked_list = true;

diff --git a/net/quic/quic_flags.h b/net/quic/quic_flags.h
index 6aec58ad..39dd46d 100644
--- a/net/quic/quic_flags.h
+++ b/net/quic/quic_flags.h

@@ -39,4 +39,5 @@
 NET_EXPORT_PRIVATE extern bool FLAGS_quic_use_primary_config_for_proof;
 NET_EXPORT_PRIVATE extern bool FLAGS_quic_distinguish_incoming_outgoing_streams;
 NET_EXPORT_PRIVATE extern bool FLAGS_quic_validate_stk_without_scid;
+NET_EXPORT_PRIVATE extern bool FLAGS_quic_new_blocked_list;
 #endif  // NET_QUIC_QUIC_FLAGS_H_

diff --git a/net/quic/quic_http_stream.cc b/net/quic/quic_http_stream.cc
index 9b473d7..eff3a69 100644
--- a/net/quic/quic_http_stream.cc
+++ b/net/quic/quic_http_stream.cc

@@ -122,7 +122,7 @@
   }
 
   SpdyPriority priority = ConvertRequestPriorityToQuicPriority(priority_);
-  stream_->set_priority(priority);
+  stream_->SetPriority(priority);
   // Store the serialized request headers.
   CreateSpdyHeadersFromHttpRequest(*request_info_, request_headers, HTTP2,
                                    /*direct=*/true, &request_headers_);

diff --git a/net/quic/quic_packet_creator.cc b/net/quic/quic_packet_creator.cc
index d2e0885..7c1cade 100644
--- a/net/quic/quic_packet_creator.cc
+++ b/net/quic/quic_packet_creator.cc

@@ -86,6 +86,7 @@
                                      QuicRandom* random_generator,
                                      DelegateInterface* delegate)
     : delegate_(delegate),
+      debug_delegate_(nullptr),
       connection_id_(connection_id),
       encryption_level_(ENCRYPTION_NONE),
       has_ack_(false),
@@ -716,6 +717,9 @@
   if (needs_padding) {
     needs_padding_ = true;
   }
+  if (debug_delegate_ != nullptr) {
+    debug_delegate_->OnFrameAddedToPacket(frame);
+  }
 
   return true;
 }

diff --git a/net/quic/quic_packet_creator.h b/net/quic/quic_packet_creator.h
index 41186fe8..f06e55a 100644
--- a/net/quic/quic_packet_creator.h
+++ b/net/quic/quic_packet_creator.h

@@ -44,6 +44,17 @@
     virtual void OnResetFecGroup() = 0;
   };
 
+  // Interface which gets callbacks from the QuicPacketCreator at interesting
+  // points.  Implementations must not mutate the state of the creator
+  // as a result of these callbacks.
+  class NET_EXPORT_PRIVATE DebugDelegate {
+   public:
+    virtual ~DebugDelegate() {}
+
+    // Called when a frame has been added to the current packet.
+    virtual void OnFrameAddedToPacket(const QuicFrame& frame) {}
+  };
+
   // QuicRandom* required for packet entropy.
   QuicPacketCreator(QuicConnectionId connection_id,
                     QuicFramer* framer,
@@ -257,6 +268,10 @@
     should_fec_protect_next_packet_ = should_fec_protect_next_packet;
   }
 
+  void set_debug_delegate(DebugDelegate* debug_delegate) {
+    debug_delegate_ = debug_delegate;
+  }
+
  private:
   friend class test::QuicPacketCreatorPeer;
 
@@ -344,8 +359,10 @@
   // Fails if |buffer_len| isn't long enough for the encrypted packet.
   SerializedPacket SerializeFec(char* buffer, size_t buffer_len);
 
-  // Does not own this delegate.
+  // Does not own these delegates.
   DelegateInterface* delegate_;
+  DebugDelegate* debug_delegate_;
+
   QuicConnectionId connection_id_;
   EncryptionLevel encryption_level_;
   // True if an ack is queued in queued_frames_.

diff --git a/net/quic/quic_packet_generator.cc b/net/quic/quic_packet_generator.cc
index 5fefa02..c5d5f4a 100644
--- a/net/quic/quic_packet_generator.cc
+++ b/net/quic/quic_packet_generator.cc

@@ -21,7 +21,6 @@
                                          QuicRandom* random_generator,
                                          DelegateInterface* delegate)
     : delegate_(delegate),
-      debug_delegate_(nullptr),
       packet_creator_(connection_id, framer, random_generator, this),
       batch_mode_(false),
       should_send_ack_(false),
@@ -133,9 +132,6 @@
 
     // A stream frame is created and added.
     size_t bytes_consumed = frame.stream_frame->frame_length;
-    if (debug_delegate_ != nullptr) {
-      debug_delegate_->OnFrameAddedToPacket(frame);
-    }
 
     if (listener != nullptr) {
       ack_listeners_.push_back(AckListenerWrapper(listener, bytes_consumed));
@@ -194,7 +190,7 @@
 
   // Send the probe packet with the new length.
   SetMaxPacketLength(target_mtu, /*force=*/true);
-  const bool success = AddFrame(frame, /*needs_padding=*/true);
+  const bool success = packet_creator_.AddPaddedSavedFrame(frame);
   if (listener != nullptr) {
     ack_listeners_.push_back(AckListenerWrapper(listener, 0));
   }
@@ -277,8 +273,8 @@
   if (should_send_ack_) {
     delegate_->PopulateAckFrame(&pending_ack_frame_);
     // If we can't this add the frame now, then we still need to do so later.
-    should_send_ack_ = !AddFrame(QuicFrame(&pending_ack_frame_),
-                                 /*needs_padding=*/false);
+    should_send_ack_ =
+        !packet_creator_.AddSavedFrame(QuicFrame(&pending_ack_frame_));
     // Return success if we have cleared out this flag (i.e., added the frame).
     // If we still need to send, then the frame is full, and we have failed.
     return !should_send_ack_;
@@ -288,8 +284,7 @@
     delegate_->PopulateStopWaitingFrame(&pending_stop_waiting_frame_);
     // If we can't this add the frame now, then we still need to do so later.
     should_send_stop_waiting_ =
-        !AddFrame(QuicFrame(&pending_stop_waiting_frame_),
-                  /*needs_padding=*/false);
+        !packet_creator_.AddSavedFrame(QuicFrame(&pending_stop_waiting_frame_));
     // Return success if we have cleared out this flag (i.e., added the frame).
     // If we still need to send, then the frame is full, and we have failed.
     return !should_send_stop_waiting_;
@@ -297,7 +292,7 @@
 
   LOG_IF(DFATAL, queued_control_frames_.empty())
       << "AddNextPendingFrame called with no queued control frames.";
-  if (!AddFrame(queued_control_frames_.back(), /*needs_padding=*/false)) {
+  if (!packet_creator_.AddSavedFrame(queued_control_frames_.back())) {
     // Packet was full.
     return false;
   }
@@ -305,16 +300,6 @@
   return true;
 }
 
-bool QuicPacketGenerator::AddFrame(const QuicFrame& frame,
-                                   bool needs_padding) {
-  bool success = needs_padding ? packet_creator_.AddPaddedSavedFrame(frame)
-                               : packet_creator_.AddSavedFrame(frame);
-  if (success && debug_delegate_) {
-    debug_delegate_->OnFrameAddedToPacket(frame);
-  }
-  return success;
-}
-
 void QuicPacketGenerator::StopSendingVersion() {
   packet_creator_.StopSendingVersion();
 }

diff --git a/net/quic/quic_packet_generator.h b/net/quic/quic_packet_generator.h
index e3b6f8d..9f12da2 100644
--- a/net/quic/quic_packet_generator.h
+++ b/net/quic/quic_packet_generator.h

@@ -84,17 +84,6 @@
     virtual void OnResetFecGroup() = 0;
   };
 
-  // Interface which gets callbacks from the QuicPacketGenerator at interesting
-  // points.  Implementations must not mutate the state of the generator
-  // as a result of these callbacks.
-  class NET_EXPORT_PRIVATE DebugDelegate {
-   public:
-    virtual ~DebugDelegate() {}
-
-    // Called when a frame has been added to the current packet.
-    virtual void OnFrameAddedToPacket(const QuicFrame& frame) {}
-  };
-
   QuicPacketGenerator(QuicConnectionId connection_id,
                       QuicFramer* framer,
                       QuicRandom* random_generator,
@@ -216,8 +205,8 @@
                       QuicPacketNumber least_packet_awaited_by_peer,
                       QuicPacketCount max_packets_in_flight);
 
-  void set_debug_delegate(DebugDelegate* debug_delegate) {
-    debug_delegate_ = debug_delegate;
+  void set_debug_delegate(QuicPacketCreator::DebugDelegate* debug_delegate) {
+    packet_creator_.set_debug_delegate(debug_delegate);
   }
 
   void set_rtt_multiplier_for_fec_timeout(float rtt_multiplier_for_fec_timeout);
@@ -240,11 +229,8 @@
   // Returns false and flushes current open packet if the pending frame cannot
   // fit into current open packet.
   bool AddNextPendingFrame();
-  // Adds a |frame| and pads it if |needs_padding| is true.
-  bool AddFrame(const QuicFrame& frame, bool needs_padding);
 
   DelegateInterface* delegate_;
-  DebugDelegate* debug_delegate_;
 
   QuicPacketCreator packet_creator_;
   QuicFrames queued_control_frames_;

diff --git a/net/quic/quic_packet_generator_test.cc b/net/quic/quic_packet_generator_test.cc
index fbd39877..7b3ee58 100644
--- a/net/quic/quic_packet_generator_test.cc
+++ b/net/quic/quic_packet_generator_test.cc

@@ -233,7 +233,7 @@
   struct iovec iov_;
 };
 
-class MockDebugDelegate : public QuicPacketGenerator::DebugDelegate {
+class MockDebugDelegate : public QuicPacketCreator::DebugDelegate {
  public:
   MOCK_METHOD1(OnFrameAddedToPacket,
                void(const QuicFrame&));

diff --git a/net/quic/quic_reliable_client_stream.h b/net/quic/quic_reliable_client_stream.h
index bb0787f..17ef55e 100644
--- a/net/quic/quic_reliable_client_stream.h
+++ b/net/quic/quic_reliable_client_stream.h

@@ -65,7 +65,7 @@
 
   // While the server's set_priority shouldn't be called externally, the creator
   // of client-side streams should be able to set the priority.
-  using QuicSpdyStream::set_priority;
+  using QuicSpdyStream::SetPriority;
 
   int WriteStreamData(base::StringPiece data,
                       bool fin,

diff --git a/net/quic/quic_session.h b/net/quic/quic_session.h
index edc60f79..2e7de4d8 100644
--- a/net/quic/quic_session.h
+++ b/net/quic/quic_session.h

@@ -219,7 +219,8 @@
 
   // Create a new stream, owned by the caller, to handle a locally-initiated
   // stream.  Returns nullptr if max streams have already been opened.
-  virtual ReliableQuicStream* CreateOutgoingDynamicStream() = 0;
+  virtual ReliableQuicStream* CreateOutgoingDynamicStream(
+      SpdyPriority priority) = 0;
 
   // Return the reserved crypto stream.
   virtual QuicCryptoStream* GetCryptoStream() = 0;
@@ -260,6 +261,9 @@
     largest_peer_created_stream_id_ = largest_peer_created_stream_id;
   }
   void set_error(QuicErrorCode error) { error_ = error; }
+  QuicWriteBlockedList* write_blocked_streams() {
+    return &write_blocked_streams_;
+  }
 
   size_t GetNumDynamicOutgoingStreams() const;
 

diff --git a/net/quic/quic_session_test.cc b/net/quic/quic_session_test.cc
index eec3bea..d080eead 100644
--- a/net/quic/quic_session_test.cc
+++ b/net/quic/quic_session_test.cc

@@ -47,7 +47,6 @@
 namespace {
 
 const SpdyPriority kHighestPriority = kV3HighestPriority;
-const SpdyPriority kSomeMiddlePriority = 3;
 
 class TestCryptoStream : public QuicCryptoStream {
  public:
@@ -96,8 +95,6 @@
     WriteOrBufferData(data, fin, nullptr);
   }
 
-  using QuicSpdyStream::set_priority;
-
   MOCK_METHOD0(OnCanWrite, void());
 };
 
@@ -110,7 +107,7 @@
   }
 
   void MarkConnectionLevelWriteBlocked() {
-    session_->MarkConnectionLevelWriteBlocked(stream_id_, kSomeMiddlePriority);
+    session_->MarkConnectionLevelWriteBlocked(stream_id_, kDefaultPriority);
   }
 
   void MarkHighPriorityWriteBlocked() {
@@ -133,8 +130,9 @@
 
   TestCryptoStream* GetCryptoStream() override { return &crypto_stream_; }
 
-  TestStream* CreateOutgoingDynamicStream() override {
+  TestStream* CreateOutgoingDynamicStream(SpdyPriority priority) override {
     TestStream* stream = new TestStream(GetNextOutgoingStreamId(), this);
+    stream->SetPriority(priority);
     ActivateStream(stream);
     return stream;
   }
@@ -308,9 +306,9 @@
 }
 
 TEST_P(QuicSessionTestServer, IsClosedStreamLocallyCreated) {
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_EQ(2u, stream2->id());
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_EQ(4u, stream4->id());
 
   CheckClosedStreams();
@@ -372,13 +370,13 @@
 }
 
 TEST_P(QuicSessionTestServer, DebugDFatalIfMarkingClosedStreamWriteBlocked) {
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   QuicStreamId closed_stream_id = stream2->id();
   // Close the stream.
   EXPECT_CALL(*connection_, SendRstStream(closed_stream_id, _, _));
   stream2->Reset(QUIC_BAD_APPLICATION_PAYLOAD);
   EXPECT_DEBUG_DFATAL(session_.MarkConnectionLevelWriteBlocked(
-                          closed_stream_id, kSomeMiddlePriority),
+                          closed_stream_id, kDefaultPriority),
                       "Marking unknown stream 2 blocked.");
 }
 
@@ -386,7 +384,7 @@
        DebugDFatalIfMarkWriteBlockedCalledWithWrongPriority) {
   const SpdyPriority kDifferentPriority = 0;
 
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_NE(kDifferentPriority, stream2->Priority());
   EXPECT_DEBUG_DFATAL(session_.MarkConnectionLevelWriteBlocked(
                           stream2->id(), kDifferentPriority),
@@ -394,13 +392,13 @@
 }
 
 TEST_P(QuicSessionTestServer, OnCanWrite) {
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream6 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream6 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
-  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kSomeMiddlePriority);
+  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kDefaultPriority);
 
   InSequence s;
   StreamBlocker stream2_blocker(&session_, stream2->id());
@@ -428,13 +426,13 @@
 
 TEST_P(QuicSessionTestServer, TestBatchedWrites) {
   ValueRestore<bool> old_flag(&FLAGS_quic_batch_writes, true);
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream6 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream6 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
   session_.set_writev_consumes_all_data(true);
-  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kSomeMiddlePriority);
+  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kDefaultPriority);
 
   StreamBlocker stream2_blocker(&session_, stream2->id());
   StreamBlocker stream4_blocker(&session_, stream4->id());
@@ -476,7 +474,7 @@
   // Now let stream 4 do the 2nd of its 3 writes, but add a block for a high
   // priority stream 6.  4 should be preempted.  6 will write but *not* block so
   // will cede back to 4.
-  stream6->set_priority(kHighestPriority);
+  stream6->SetPriority(kHighestPriority);
   EXPECT_CALL(*stream4, OnCanWrite())
       .WillOnce(DoAll(testing::IgnoreResult(Invoke(CreateFunctor(
                           &session_, &TestSession::SendLargeFakeData,
@@ -516,13 +514,13 @@
   MockSendAlgorithm* send_algorithm = new StrictMock<MockSendAlgorithm>;
   QuicConnectionPeer::SetSendAlgorithm(session_.connection(), send_algorithm);
 
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream6 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream6 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
-  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kSomeMiddlePriority);
+  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kDefaultPriority);
 
   EXPECT_CALL(*send_algorithm, TimeUntilSend(_, _, _)).WillRepeatedly(
       Return(QuicTime::Delta::Zero()));
@@ -557,13 +555,13 @@
   MockSendAlgorithm* send_algorithm = new StrictMock<MockSendAlgorithm>;
   QuicConnectionPeer::SetSendAlgorithm(session_.connection(), send_algorithm);
 
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream6 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream6 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
-  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kSomeMiddlePriority);
+  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kDefaultPriority);
 
   StreamBlocker stream2_blocker(&session_, stream2->id());
   EXPECT_CALL(*send_algorithm, TimeUntilSend(_, _, _)).WillOnce(Return(
@@ -598,12 +596,12 @@
   EXPECT_FALSE(session_.HasPendingHandshake());  // Default value.
 
   // Test that blocking other streams does not change our status.
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   StreamBlocker stream2_blocker(&session_, stream2->id());
   stream2_blocker.MarkConnectionLevelWriteBlocked();
   EXPECT_FALSE(session_.HasPendingHandshake());
 
-  TestStream* stream3 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream3 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   StreamBlocker stream3_blocker(&session_, stream3->id());
   stream3_blocker.MarkConnectionLevelWriteBlocked();
   EXPECT_FALSE(session_.HasPendingHandshake());
@@ -612,7 +610,7 @@
   session_.MarkConnectionLevelWriteBlocked(kCryptoStreamId, kHighestPriority);
   EXPECT_TRUE(session_.HasPendingHandshake());
 
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   StreamBlocker stream4_blocker(&session_, stream4->id());
   stream4_blocker.MarkConnectionLevelWriteBlocked();
   EXPECT_TRUE(session_.HasPendingHandshake());
@@ -639,13 +637,13 @@
 }
 
 TEST_P(QuicSessionTestServer, OnCanWriteWithClosedStream) {
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream4 = session_.CreateOutgoingDynamicStream();
-  TestStream* stream6 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream4 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  TestStream* stream6 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
-  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kSomeMiddlePriority);
-  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kSomeMiddlePriority);
+  session_.MarkConnectionLevelWriteBlocked(stream2->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream6->id(), kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream4->id(), kDefaultPriority);
   CloseStream(stream6->id());
 
   InSequence s;
@@ -669,8 +667,8 @@
 
   // Create a data stream, and although it is write blocked we never expect it
   // to be allowed to write as we are connection level flow control blocked.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
-  session_.MarkConnectionLevelWriteBlocked(stream->id(), kSomeMiddlePriority);
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
+  session_.MarkConnectionLevelWriteBlocked(stream->id(), kDefaultPriority);
   EXPECT_CALL(*stream, OnCanWrite()).Times(0);
 
   // The crypto and headers streams should be called even though we are
@@ -761,7 +759,7 @@
   session_.set_writev_consumes_all_data(true);
 
   // Create a stream, and send enough data to make it flow control blocked.
-  TestStream* stream2 = session_.CreateOutgoingDynamicStream();
+  TestStream* stream2 = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   string body(kMinimumFlowControlSendWindow, '.');
   EXPECT_FALSE(stream2->flow_controller()->IsBlocked());
   EXPECT_FALSE(session_.IsConnectionFlowControlBlocked());
@@ -887,7 +885,7 @@
   // our connection level flow control receive window.
   // On close, the stream should mark as consumed all bytes between the highest
   // byte consumed so far and the final byte offset from the RST frame.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
   const QuicStreamOffset kByteOffset =
       1 + kInitialSessionFlowControlWindowForTest / 2;
@@ -913,7 +911,7 @@
   // The bytes between highest consumed byte, and the final byte offset that we
   // determined when the FIN arrived, should be marked as consumed at the
   // connection level flow controller when the stream is reset.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
 
   const QuicStreamOffset kByteOffset =
       kInitialSessionFlowControlWindowForTest / 2;
@@ -948,7 +946,7 @@
   session_.flow_controller()->AddBytesConsumed(kInitialConnectionBytesConsumed);
 
   // Reset our stream: this results in the stream being closed locally.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_CALL(*connection_, SendRstStream(stream->id(), _, _));
   stream->Reset(QUIC_STREAM_CANCELLED);
 
@@ -985,7 +983,7 @@
   session_.flow_controller()->AddBytesConsumed(kInitialConnectionBytesConsumed);
 
   // Reset our stream: this results in the stream being closed locally.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_CALL(*connection_, SendRstStream(stream->id(), _, _));
   stream->Reset(QUIC_STREAM_CANCELLED);
   EXPECT_TRUE(ReliableQuicStreamPeer::read_side_closed(stream));
@@ -1037,7 +1035,7 @@
       .Times(2);
 
   // Check that stream frame + FIN results in connection close.
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_CALL(*connection_, SendRstStream(stream->id(), _, _));
   stream->Reset(QUIC_STREAM_CANCELLED);
   QuicStreamFrame frame(stream->id(), true, kLargeOffset, StringPiece());
@@ -1162,7 +1160,7 @@
   // Verify that an incoming FIN is recorded in a stream object even if the read
   // side has been closed.  This prevents an entry from being made in
   // locally_closed_streams_highest_offset_ (which will never be deleted).
-  TestStream* stream = session_.CreateOutgoingDynamicStream();
+  TestStream* stream = session_.CreateOutgoingDynamicStream(kDefaultPriority);
   QuicStreamId stream_id = stream->id();
 
   // Close the read side manually.

diff --git a/net/quic/quic_spdy_session.cc b/net/quic/quic_spdy_session.cc
index b33094a..a13c9e22 100644
--- a/net/quic/quic_spdy_session.cc
+++ b/net/quic/quic_spdy_session.cc

@@ -76,6 +76,20 @@
   // Implemented in Chromium for stats tracking.
 }
 
+void QuicSpdySession::RegisterStreamPriority(QuicStreamId id,
+                                             SpdyPriority priority) {
+  write_blocked_streams()->RegisterStream(id, priority);
+}
+
+void QuicSpdySession::UnregisterStreamPriority(QuicStreamId id) {
+  write_blocked_streams()->UnregisterStream(id);
+}
+
+void QuicSpdySession::UpdateStreamPriority(QuicStreamId id,
+                                           SpdyPriority new_priority) {
+  write_blocked_streams()->UpdateStreamPriority(id, new_priority);
+}
+
 QuicSpdyStream* QuicSpdySession::GetSpdyDataStream(
     const QuicStreamId stream_id) {
   return static_cast<QuicSpdyStream*>(GetOrCreateDynamicStream(stream_id));

diff --git a/net/quic/quic_spdy_session.h b/net/quic/quic_spdy_session.h
index 7355c612..56783dd 100644
--- a/net/quic/quic_spdy_session.h
+++ b/net/quic/quic_spdy_session.h

@@ -55,12 +55,22 @@
   // |delta| indicates how long that piece of data has been blocked.
   virtual void OnHeadersHeadOfLineBlocking(QuicTime::Delta delta);
 
+  // Called by the stream on creation to set priority in the write blocked list.
+  void RegisterStreamPriority(QuicStreamId id, SpdyPriority priority);
+  // Called by the stream on deletion to clear priority crom the write blocked
+  // list.
+  void UnregisterStreamPriority(QuicStreamId id);
+  // Called by the stream on SetPriority to update priority on the write blocked
+  // list.
+  void UpdateStreamPriority(QuicStreamId id, SpdyPriority new_priority);
+
  protected:
   // Override CreateIncomingDynamicStream() and CreateOutgoingDynamicStream()
   // with QuicSpdyStream return type to make sure that all data streams are
   // QuicSpdyStreams.
   QuicSpdyStream* CreateIncomingDynamicStream(QuicStreamId id) override = 0;
-  QuicSpdyStream* CreateOutgoingDynamicStream() override = 0;
+  QuicSpdyStream* CreateOutgoingDynamicStream(SpdyPriority priority) override =
+      0;
 
   QuicSpdyStream* GetSpdyDataStream(const QuicStreamId stream_id);
 

diff --git a/net/quic/quic_spdy_stream.cc b/net/quic/quic_spdy_stream.cc
index 982d416..a3f2fb0b 100644
--- a/net/quic/quic_spdy_stream.cc
+++ b/net/quic/quic_spdy_stream.cc

@@ -20,16 +20,6 @@
   (session()->perspective() == Perspective::IS_SERVER ? "Server: " : "Client:" \
                                                                      " ")
 
-namespace {
-
-// This is somewhat arbitrary.  It's possible, but unlikely, we will either fail
-// to set a priority client-side, or cancel a stream before stripping the
-// priority from the wire server-side.  In either case, start out with a
-// priority in the middle.
-SpdyPriority kDefaultPriority = 3;
-
-}  // namespace
-
 QuicSpdyStream::QuicSpdyStream(QuicStreamId id, QuicSpdySession* spdy_session)
     : ReliableQuicStream(id, spdy_session),
       spdy_session_(spdy_session),
@@ -41,9 +31,12 @@
   // Don't receive any callbacks from the sequencer until headers
   // are complete.
   sequencer()->SetBlockedUntilFlush();
+  spdy_session_->RegisterStreamPriority(id, priority_);
 }
 
-QuicSpdyStream::~QuicSpdyStream() {}
+QuicSpdyStream::~QuicSpdyStream() {
+  spdy_session_->UnregisterStreamPriority(id());
+}
 
 void QuicSpdyStream::CloseWriteSide() {
   if (version() > QUIC_VERSION_28 && !fin_received() && !rst_received() &&
@@ -156,8 +149,9 @@
   decompressed_trailers_.erase(0, bytes_consumed);
 }
 
-void QuicSpdyStream::set_priority(SpdyPriority priority) {
+void QuicSpdyStream::SetPriority(SpdyPriority priority) {
   DCHECK_EQ(0u, stream_bytes_written());
+  spdy_session_->UpdateStreamPriority(id(), priority);
   priority_ = priority;
 }
 
@@ -176,7 +170,7 @@
 
 void QuicSpdyStream::OnStreamHeadersPriority(SpdyPriority priority) {
   DCHECK_EQ(Perspective::IS_SERVER, session()->connection()->perspective());
-  set_priority(priority);
+  SetPriority(priority);
 }
 
 void QuicSpdyStream::OnStreamHeadersComplete(bool fin, size_t frame_len) {

diff --git a/net/quic/quic_spdy_stream.h b/net/quic/quic_spdy_stream.h
index e975c61d..c8d2843 100644
--- a/net/quic/quic_spdy_stream.h
+++ b/net/quic/quic_spdy_stream.h

@@ -33,6 +33,12 @@
 
 class QuicSpdySession;
 
+// This is somewhat arbitrary.  It's possible, but unlikely, we will either fail
+// to set a priority client-side, or cancel a stream before stripping the
+// priority from the wire server-side.  In either case, start out with a
+// priority in the middle.
+const SpdyPriority kDefaultPriority = 3;
+
 // A QUIC stream that can send and receive HTTP2 (SPDY) headers.
 class NET_EXPORT_PRIVATE QuicSpdyStream : public ReliableQuicStream {
  public:
@@ -129,16 +135,16 @@
 
   SpdyPriority priority() const { return priority_; }
 
+  // Sets priority_ to priority.  This should only be called before bytes are
+  // written to the server.
+  void SetPriority(SpdyPriority priority);
+
  protected:
   // Called by OnStreamHeadersComplete depending on which type (initial or
   // trailing) headers are expected next.
   virtual void OnInitialHeadersComplete(bool fin, size_t frame_len);
   virtual void OnTrailingHeadersComplete(bool fin, size_t frame_len);
 
-  // Sets priority_ to priority.  This should only be called before bytes are
-  // written to the server.
-  void set_priority(SpdyPriority priority);
-
   // Returns true if headers have been fully read and consumed.
   bool FinishedReadingHeaders() const;
 

diff --git a/net/quic/quic_write_blocked_list.h b/net/quic/quic_write_blocked_list.h
index da91c08..53d3e353 100644
--- a/net/quic/quic_write_blocked_list.h
+++ b/net/quic/quic_write_blocked_list.h

@@ -10,6 +10,7 @@
 #include "net/base/net_export.h"
 #include "net/quic/quic_flags.h"
 #include "net/quic/quic_protocol.h"
+#include "net/spdy/priority_write_scheduler.h"
 #include "net/spdy/write_blocked_list.h"
 
 namespace net {
@@ -20,13 +21,18 @@
 class NET_EXPORT_PRIVATE QuicWriteBlockedList {
  private:
   typedef WriteBlockedList<QuicStreamId> QuicWriteBlockedListBase;
+  typedef PriorityWriteScheduler<QuicStreamId> QuicPriorityWriteScheduler;
 
  public:
   QuicWriteBlockedList();
   ~QuicWriteBlockedList();
 
   bool HasWriteBlockedDataStreams() const {
-    return base_write_blocked_list_.HasWriteBlockedStreams();
+    if (use_new_blocked_list_) {
+      return priority_write_scheduler_.HasReadyStreams();
+    } else {
+      return base_write_blocked_list_.HasWriteBlockedStreams();
+    }
   }
 
   bool HasWriteBlockedCryptoOrHeadersStream() const {
@@ -34,7 +40,9 @@
   }
 
   size_t NumBlockedStreams() const {
-    size_t num_blocked = base_write_blocked_list_.NumBlockedStreams();
+    size_t num_blocked = use_new_blocked_list_
+                             ? priority_write_scheduler_.NumReadyStreams()
+                             : base_write_blocked_list_.NumBlockedStreams();
     if (crypto_stream_blocked_) {
       ++num_blocked;
     }
@@ -58,11 +66,23 @@
       return kHeadersStreamId;
     }
 
-    SpdyPriority priority =
-        base_write_blocked_list_.GetHighestPriorityWriteBlockedList();
-    QuicStreamId id = base_write_blocked_list_.PopFront(priority);
+    SpdyPriority priority;
+    QuicStreamId id;
 
-    if (base_write_blocked_list_.NumBlockedStreams(priority) == 0) {
+    if (use_new_blocked_list_) {
+      id = priority_write_scheduler_.PopNextReadyStream();
+      priority = priority_write_scheduler_.GetStreamPriority(id);
+    } else {
+      priority = base_write_blocked_list_.GetHighestPriorityWriteBlockedList();
+      id = base_write_blocked_list_.PopFront(priority);
+    }
+
+    size_t num_blocked_for_priority =
+        use_new_blocked_list_
+            ? priority_write_scheduler_.NumReadyStreams(priority)
+            : base_write_blocked_list_.NumBlockedStreams(priority);
+
+    if (num_blocked_for_priority == 0) {
       // If no streams are blocked, don't bother latching.  This stream will be
       // the first popped for its priority anyway.
       batch_write_stream_id_[priority] = 0;
@@ -77,6 +97,24 @@
     return id;
   }
 
+  void RegisterStream(QuicStreamId stream_id, SpdyPriority priority) {
+    if (use_new_blocked_list_) {
+      priority_write_scheduler_.RegisterStream(stream_id, priority);
+    }
+  }
+
+  void UnregisterStream(QuicStreamId stream_id) {
+    if (use_new_blocked_list_) {
+      priority_write_scheduler_.UnregisterStream(stream_id);
+    }
+  }
+
+  void UpdateStreamPriority(QuicStreamId stream_id, SpdyPriority new_priority) {
+    if (use_new_blocked_list_) {
+      priority_write_scheduler_.UpdateStreamPriority(stream_id, new_priority);
+    }
+  }
+
   void UpdateBytesForStream(QuicStreamId stream_id, size_t bytes) {
     if (batch_write_stream_id_[last_priority_popped_] == stream_id) {
       // If this was the last data stream popped by PopFront, update the
@@ -95,9 +133,9 @@
     }
   }
 
-  // Pushes a stream to the back of the std::list for this priority level
+  // Pushes a stream to the back of the list for this priority level
   // *unless* it is latched for doing batched writes in which case it goes to
-  // the front of the std::list for this priority level.
+  // the front of the list for this priority level.
   // Headers and crypto streams are special cased to always resume first.
   void AddStream(QuicStreamId stream_id, SpdyPriority priority) {
     if (stream_id == kCryptoStreamId) {
@@ -113,9 +151,15 @@
       headers_stream_blocked_ = true;
       return;
     }
-    if (FLAGS_quic_batch_writes &&
-        stream_id == batch_write_stream_id_[last_priority_popped_] &&
-        bytes_left_for_batch_write_[last_priority_popped_] > 0) {
+    if (use_new_blocked_list_) {
+      bool push_front =
+          FLAGS_quic_batch_writes &&
+          stream_id == batch_write_stream_id_[last_priority_popped_] &&
+          bytes_left_for_batch_write_[last_priority_popped_] > 0;
+      priority_write_scheduler_.MarkStreamReady(stream_id, push_front);
+    } else if (FLAGS_quic_batch_writes &&
+               stream_id == batch_write_stream_id_[last_priority_popped_] &&
+               bytes_left_for_batch_write_[last_priority_popped_] > 0) {
       // If the batch write stream has more data to write, push it to the front
       // for its priority level.
       base_write_blocked_list_.PushFront(stream_id, priority);
@@ -130,6 +174,8 @@
 
  private:
   QuicWriteBlockedListBase base_write_blocked_list_;
+  QuicPriorityWriteScheduler priority_write_scheduler_;
+  bool use_new_blocked_list_ = FLAGS_quic_new_blocked_list;
 
   // If performing batch writes, this will be the stream ID of the stream doing
   // batch writes for this priority level.  We will allow this stream to write

diff --git a/net/quic/quic_write_blocked_list_test.cc b/net/quic/quic_write_blocked_list_test.cc
index 774ccbc1..bb5ff23 100644
--- a/net/quic/quic_write_blocked_list_test.cc
+++ b/net/quic/quic_write_blocked_list_test.cc

@@ -19,6 +19,12 @@
 
   // Mark streams blocked in roughly reverse priority order, and
   // verify that streams are sorted.
+  write_blocked_list.RegisterStream(40, kV3LowestPriority);
+  write_blocked_list.RegisterStream(23, kV3HighestPriority);
+  write_blocked_list.RegisterStream(17, kV3HighestPriority);
+  write_blocked_list.RegisterStream(kHeadersStreamId, kV3HighestPriority);
+  write_blocked_list.RegisterStream(kCryptoStreamId, kV3HighestPriority);
+
   write_blocked_list.AddStream(40, kV3LowestPriority);
   write_blocked_list.AddStream(23, kV3HighestPriority);
   write_blocked_list.AddStream(17, kV3HighestPriority);
@@ -45,6 +51,7 @@
 
 TEST(QuicWriteBlockedListTest, CryptoStream) {
   QuicWriteBlockedList write_blocked_list;
+  write_blocked_list.RegisterStream(kCryptoStreamId, kV3HighestPriority);
   write_blocked_list.AddStream(kCryptoStreamId, kV3HighestPriority);
 
   EXPECT_EQ(1u, write_blocked_list.NumBlockedStreams());
@@ -56,6 +63,7 @@
 
 TEST(QuicWriteBlockedListTest, HeadersStream) {
   QuicWriteBlockedList write_blocked_list;
+  write_blocked_list.RegisterStream(kHeadersStreamId, kV3HighestPriority);
   write_blocked_list.AddStream(kHeadersStreamId, kV3HighestPriority);
 
   EXPECT_EQ(1u, write_blocked_list.NumBlockedStreams());
@@ -67,6 +75,8 @@
 
 TEST(QuicWriteBlockedListTest, VerifyHeadersStream) {
   QuicWriteBlockedList write_blocked_list;
+  write_blocked_list.RegisterStream(5, kV3HighestPriority);
+  write_blocked_list.RegisterStream(kHeadersStreamId, kV3HighestPriority);
   write_blocked_list.AddStream(5, kV3HighestPriority);
   write_blocked_list.AddStream(kHeadersStreamId, kV3HighestPriority);
 
@@ -89,6 +99,7 @@
   // Try to add a stream to the write blocked list multiple times at the same
   // priority.
   const QuicStreamId kBlockedId = kClientDataStreamId1;
+  write_blocked_list.RegisterStream(kBlockedId, kV3HighestPriority);
   write_blocked_list.AddStream(kBlockedId, kV3HighestPriority);
   write_blocked_list.AddStream(kBlockedId, kV3HighestPriority);
   write_blocked_list.AddStream(kBlockedId, kV3HighestPriority);
@@ -109,6 +120,10 @@
 
   const QuicStreamId id1 = kClientDataStreamId1;
   const QuicStreamId id2 = kClientDataStreamId2;
+  const QuicStreamId id3 = kClientDataStreamId2 + 2;
+  write_blocked_list.RegisterStream(id1, kV3LowestPriority);
+  write_blocked_list.RegisterStream(id2, kV3LowestPriority);
+  write_blocked_list.RegisterStream(id3, kV3HighestPriority);
 
   write_blocked_list.AddStream(id1, kV3LowestPriority);
   write_blocked_list.AddStream(id2, kV3LowestPriority);
@@ -117,27 +132,23 @@
   // The first stream we push back should stay at the front until 16k is
   // written.
   EXPECT_EQ(id1, write_blocked_list.PopFront());
-  write_blocked_list.AddStream(id1, net::kV3HighestPriority);
   write_blocked_list.UpdateBytesForStream(id1, 15999);
   write_blocked_list.AddStream(id1, kV3LowestPriority);
   EXPECT_EQ(2u, write_blocked_list.NumBlockedStreams());
   EXPECT_EQ(id1, write_blocked_list.PopFront());
 
   // Once 16k is written the first stream will cede to the next.
-  write_blocked_list.AddStream(id1, net::kV3HighestPriority);
   write_blocked_list.UpdateBytesForStream(id1, 1);
   write_blocked_list.AddStream(id1, kV3LowestPriority);
   EXPECT_EQ(2u, write_blocked_list.NumBlockedStreams());
   EXPECT_EQ(id2, write_blocked_list.PopFront());
 
   // Set the new stream to have written all but one byte.
-  write_blocked_list.AddStream(id2, net::kV3HighestPriority);
   write_blocked_list.UpdateBytesForStream(id2, 15999);
   write_blocked_list.AddStream(id2, kV3LowestPriority);
   EXPECT_EQ(2u, write_blocked_list.NumBlockedStreams());
 
   // Ensure higher priority streams are popped first.
-  const QuicStreamId id3 = kClientDataStreamId2 + 2;
   write_blocked_list.AddStream(id3, kV3HighestPriority);
   EXPECT_EQ(id3, write_blocked_list.PopFront());
 

diff --git a/net/quic/reliable_quic_stream_test.cc b/net/quic/reliable_quic_stream_test.cc
index 90d5af2a..57baf71d 100644
--- a/net/quic/reliable_quic_stream_test.cc
+++ b/net/quic/reliable_quic_stream_test.cc

@@ -125,6 +125,7 @@
         .Times(AnyNumber());
     write_blocked_list_ =
         QuicSessionPeer::GetWriteBlockedStreams(session_.get());
+    write_blocked_list_->RegisterStream(kTestStreamId, kV3HighestPriority);
   }
 
   bool fin_sent() { return ReliableQuicStreamPeer::FinSent(stream_); }

diff --git a/net/quic/stream_sequencer_buffer.h b/net/quic/stream_sequencer_buffer.h
index 07df630..efb8bbbf 100644
--- a/net/quic/stream_sequencer_buffer.h
+++ b/net/quic/stream_sequencer_buffer.h

@@ -7,8 +7,8 @@
 
 // StreamSequencerBuffer implements QuicStreamSequencerBufferInterface.
 // It is a circular stream buffer with random write and
-// in-sequence read. It consists of an std::vector of pointers pointing
-// to memory blocks created as needed and a std::list of Gaps to indicate
+// in-sequence read. It consists of a vector of pointers pointing
+// to memory blocks created as needed and a list of Gaps to indicate
 // the missing data between the data already written into the buffer.
 // - Data are written in with offset indicating where it should be in the
 // stream, and the buffer grown as needed (up to the maximum buffer capacity),
@@ -183,9 +183,9 @@
   // Contains Gaps which represents currently missing data.
   std::list<Gap> gaps_;
 
-  // An ordered, variable-length std::list of blocks, with the length limited
+  // An ordered, variable-length list of blocks, with the length limited
   // such that the number of blocks never exceeds blocks_count_.
-  // Each std::list entry can hold up to kBlockSizeBytes bytes.
+  // Each list entry can hold up to kBlockSizeBytes bytes.
   std::vector<BufferBlock*> blocks_;
 
   // Number of bytes in buffer.

diff --git a/net/quic/test_tools/quic_test_utils.h b/net/quic/test_tools/quic_test_utils.h
index 8bb8da09..fe44402f 100644
--- a/net/quic/test_tools/quic_test_utils.h
+++ b/net/quic/test_tools/quic_test_utils.h

@@ -432,7 +432,8 @@
   // From QuicSession.
   MOCK_METHOD2(OnConnectionClosed, void(QuicErrorCode error, bool from_peer));
   MOCK_METHOD1(CreateIncomingDynamicStream, QuicSpdyStream*(QuicStreamId id));
-  MOCK_METHOD0(CreateOutgoingDynamicStream, QuicSpdyStream*());
+  MOCK_METHOD1(CreateOutgoingDynamicStream,
+               QuicSpdyStream*(SpdyPriority priority));
   MOCK_METHOD6(WritevData,
                QuicConsumedData(QuicStreamId id,
                                 QuicIOVector data,
@@ -487,7 +488,8 @@
   ~TestQuicSpdyServerSession() override;
 
   MOCK_METHOD1(CreateIncomingDynamicStream, QuicSpdyStream*(QuicStreamId id));
-  MOCK_METHOD0(CreateOutgoingDynamicStream, QuicSpdyStream*());
+  MOCK_METHOD1(CreateOutgoingDynamicStream,
+               QuicSpdyStream*(SpdyPriority priority));
 
   QuicCryptoServerStream* GetCryptoStream() override;
 
@@ -513,7 +515,8 @@
 
   // TestQuicSpdyClientSession
   MOCK_METHOD1(CreateIncomingDynamicStream, QuicSpdyStream*(QuicStreamId id));
-  MOCK_METHOD0(CreateOutgoingDynamicStream, QuicSpdyStream*());
+  MOCK_METHOD1(CreateOutgoingDynamicStream,
+               QuicSpdyStream*(SpdyPriority priority));
 
   QuicCryptoClientStream* GetCryptoStream() override;
 

diff --git a/net/spdy/spdy_network_transaction_unittest.cc b/net/spdy/spdy_network_transaction_unittest.cc
index 292074ab..dc2b96b8 100644
--- a/net/spdy/spdy_network_transaction_unittest.cc
+++ b/net/spdy/spdy_network_transaction_unittest.cc

@@ -5958,12 +5958,12 @@
       spdy_util_.ConstructSpdyGetSynReply(NULL, 0, 1));
   reads.push_back(CreateMockRead(*resp, writes.size() + reads.size()));
 
-  ScopedVector<SpdyFrame> body_frames;
+  std::vector<scoped_ptr<SpdyFrame>> body_frames;
   const std::string body_data(kChunkSize, 'x');
   for (size_t remaining = kTargetSize; remaining != 0;) {
     size_t frame_size = std::min(remaining, body_data.size());
-    body_frames.push_back(spdy_util_.ConstructSpdyBodyFrame(
-        1, body_data.data(), frame_size, false));
+    body_frames.push_back(make_scoped_ptr(spdy_util_.ConstructSpdyBodyFrame(
+        1, body_data.data(), frame_size, false)));
     reads.push_back(
         CreateMockRead(*body_frames.back(), writes.size() + reads.size()));
     remaining -= frame_size;

diff --git a/net/tools/quic/quic_client.cc b/net/tools/quic/quic_client.cc
index d9f93d9..2365c84 100644
--- a/net/tools/quic/quic_client.cc
+++ b/net/tools/quic/quic_client.cc

@@ -412,6 +412,7 @@
     latest_response_code_ = headers.parsed_response_code();
     headers.DumpHeadersToString(&latest_response_headers_);
     latest_response_body_ = client_stream->data();
+    latest_response_trailers_ = client_stream->trailers().DebugString();
   }
 }
 
@@ -430,6 +431,11 @@
   return latest_response_body_;
 }
 
+const string& QuicClient::latest_response_trailers() const {
+  LOG_IF(DFATAL, !store_response_) << "Response not stored!";
+  return latest_response_trailers_;
+}
+
 QuicEpollConnectionHelper* QuicClient::CreateQuicConnectionHelper() {
   return new QuicEpollConnectionHelper(epoll_server_);
 }

diff --git a/net/tools/quic/quic_client.h b/net/tools/quic/quic_client.h
index 9e7edb1..ff63e1c 100644
--- a/net/tools/quic/quic_client.h
+++ b/net/tools/quic/quic_client.h

@@ -166,6 +166,7 @@
   size_t latest_response_code() const;
   const std::string& latest_response_headers() const;
   const std::string& latest_response_body() const;
+  const std::string& latest_response_trailers() const;
 
  protected:
   virtual QuicEpollConnectionHelper* CreateQuicConnectionHelper();
@@ -254,10 +255,12 @@
   bool store_response_;
   // HTTP response code from most recent response.
   size_t latest_response_code_;
-  // HTTP headers from most recent response.
+  // HTTP/2 headers from most recent response.
   std::string latest_response_headers_;
   // Body of most recent response.
   std::string latest_response_body_;
+  // HTTP/2 trailers from most recent response.
+  std::string latest_response_trailers_;
 
   // Keeps track of any data sent before the handshake.
   std::vector<QuicDataToResend*> data_sent_before_handshake_;

diff --git a/net/tools/quic/quic_client_base.cc b/net/tools/quic/quic_client_base.cc
index 97885c6d..0364998 100644
--- a/net/tools/quic/quic_client_base.cc
+++ b/net/tools/quic/quic_client_base.cc

@@ -69,7 +69,7 @@
     return nullptr;
   }
 
-  return session_->CreateOutgoingDynamicStream();
+  return session_->CreateOutgoingDynamicStream(kDefaultPriority);
 }
 
 void QuicClientBase::WaitForStreamToClose(QuicStreamId id) {

diff --git a/net/tools/quic/quic_client_bin.cc b/net/tools/quic/quic_client_bin.cc
index a5b14d5..84ec757 100644
--- a/net/tools/quic/quic_client_bin.cc
+++ b/net/tools/quic/quic_client_bin.cc

@@ -305,15 +305,13 @@
   // Print request and response details.
   if (!FLAGS_quiet) {
     cout << "Request:" << endl;
-    cout << "headers:" << endl;
-    for (const auto& kv : header_block) {
-      cout << " " << kv.first << ": " << kv.second << endl;
-    }
+    cout << "headers:" << header_block.DebugString();
     cout << "body: " << FLAGS_body << endl;
     cout << endl;
     cout << "Response:" << endl;
     cout << "headers: " << client.latest_response_headers() << endl;
     cout << "body: " << client.latest_response_body() << endl;
+    cout << "trailers: " << client.latest_response_trailers() << endl;
   }
 
   size_t response_code = client.latest_response_code();

diff --git a/net/tools/quic/quic_client_session.cc b/net/tools/quic/quic_client_session.cc
index a990810..4387a3b 100644
--- a/net/tools/quic/quic_client_session.cc
+++ b/net/tools/quic/quic_client_session.cc

@@ -38,7 +38,8 @@
 void QuicClientSession::OnProofVerifyDetailsAvailable(
     const ProofVerifyDetails& /*verify_details*/) {}
 
-QuicSpdyClientStream* QuicClientSession::CreateOutgoingDynamicStream() {
+QuicSpdyClientStream* QuicClientSession::CreateOutgoingDynamicStream(
+    SpdyPriority priority) {
   if (!crypto_stream_->encryption_established()) {
     DVLOG(1) << "Encryption not active so no outgoing stream created.";
     return nullptr;
@@ -54,6 +55,7 @@
     return nullptr;
   }
   QuicSpdyClientStream* stream = CreateClientStream();
+  stream->SetPriority(priority);
   ActivateStream(stream);
   return stream;
 }

diff --git a/net/tools/quic/quic_client_session.h b/net/tools/quic/quic_client_session.h
index e04d1439..13f900d 100644
--- a/net/tools/quic/quic_client_session.h
+++ b/net/tools/quic/quic_client_session.h

@@ -34,7 +34,8 @@
   void Initialize() override;
 
   // QuicSession methods:
-  QuicSpdyClientStream* CreateOutgoingDynamicStream() override;
+  QuicSpdyClientStream* CreateOutgoingDynamicStream(
+      SpdyPriority priority) override;
   QuicCryptoClientStreamBase* GetCryptoStream() override;
 
   // QuicClientSessionBase methods:

diff --git a/net/tools/quic/quic_client_session_test.cc b/net/tools/quic/quic_client_session_test.cc
index 609408aa..6786357 100644
--- a/net/tools/quic/quic_client_session_test.cc
+++ b/net/tools/quic/quic_client_session_test.cc

@@ -99,7 +99,8 @@
   // established and will allow streams to be created.
   session_->CryptoConnect();
   EXPECT_TRUE(session_->IsEncryptionEstablished());
-  QuicSpdyClientStream* stream = session_->CreateOutgoingDynamicStream();
+  QuicSpdyClientStream* stream =
+      session_->CreateOutgoingDynamicStream(kDefaultPriority);
   DCHECK_NE(kCryptoStreamId, stream->id());
   EXPECT_TRUE(stream != nullptr);
 
@@ -115,7 +116,8 @@
             QuicPacketCreatorPeer::GetEncryptionLevel(
                 QuicConnectionPeer::GetPacketCreator(connection_)));
   // Verify that no new streams may be created.
-  EXPECT_TRUE(session_->CreateOutgoingDynamicStream() == nullptr);
+  EXPECT_TRUE(session_->CreateOutgoingDynamicStream(kDefaultPriority) ==
+              nullptr);
   // Verify that no data may be send on existing streams.
   char data[] = "hello world";
   struct iovec iov = {data, arraysize(data)};
@@ -134,16 +136,17 @@
   // Initialize crypto before the client session will create a stream.
   CompleteCryptoHandshake();
 
-  QuicSpdyClientStream* stream = session_->CreateOutgoingDynamicStream();
+  QuicSpdyClientStream* stream =
+      session_->CreateOutgoingDynamicStream(kDefaultPriority);
   ASSERT_TRUE(stream);
-  EXPECT_FALSE(session_->CreateOutgoingDynamicStream());
+  EXPECT_FALSE(session_->CreateOutgoingDynamicStream(kDefaultPriority));
 
   // Close the stream, but without having received a FIN or a RST_STREAM
   // and check that a new one can not be created.
   session_->CloseStream(stream->id());
   EXPECT_EQ(1u, session_->GetNumOpenOutgoingStreams());
 
-  stream = session_->CreateOutgoingDynamicStream();
+  stream = session_->CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_FALSE(stream);
 }
 
@@ -155,9 +158,10 @@
   // Initialize crypto before the client session will create a stream.
   CompleteCryptoHandshake();
 
-  QuicSpdyClientStream* stream = session_->CreateOutgoingDynamicStream();
+  QuicSpdyClientStream* stream =
+      session_->CreateOutgoingDynamicStream(kDefaultPriority);
   ASSERT_TRUE(stream);
-  EXPECT_FALSE(session_->CreateOutgoingDynamicStream());
+  EXPECT_FALSE(session_->CreateOutgoingDynamicStream(kDefaultPriority));
 
   // Close the stream and receive an RST frame to remove the unfinished stream
   session_->CloseStream(stream->id());
@@ -166,7 +170,7 @@
       0));
   // Check that a new one can be created.
   EXPECT_EQ(0u, session_->GetNumOpenOutgoingStreams());
-  stream = session_->CreateOutgoingDynamicStream();
+  stream = session_->CreateOutgoingDynamicStream(kDefaultPriority);
   EXPECT_TRUE(stream);
 }
 
@@ -177,7 +181,7 @@
   // streams.
   session_->connection()->OnGoAwayFrame(
       QuicGoAwayFrame(QUIC_PEER_GOING_AWAY, 1u, "Going away."));
-  EXPECT_EQ(nullptr, session_->CreateOutgoingDynamicStream());
+  EXPECT_EQ(nullptr, session_->CreateOutgoingDynamicStream(kDefaultPriority));
 }
 
 TEST_P(ToolsQuicClientSessionTest, SetFecProtectionFromConfig) {
@@ -195,7 +199,8 @@
   // optionally protected.
   EXPECT_EQ(FEC_PROTECT_ALWAYS, QuicSpdySessionPeer::GetHeadersStream(
                                     session_.get())->fec_policy());
-  QuicSpdyClientStream* stream = session_->CreateOutgoingDynamicStream();
+  QuicSpdyClientStream* stream =
+      session_->CreateOutgoingDynamicStream(kDefaultPriority);
   ASSERT_TRUE(stream);
   EXPECT_EQ(FEC_PROTECT_OPTIONAL, stream->fec_policy());
 }

diff --git a/net/tools/quic/quic_dispatcher_test.cc b/net/tools/quic/quic_dispatcher_test.cc
index ba110dd..b66db91 100644
--- a/net/tools/quic/quic_dispatcher_test.cc
+++ b/net/tools/quic/quic_dispatcher_test.cc

@@ -58,7 +58,8 @@
 
   MOCK_METHOD2(OnConnectionClosed, void(QuicErrorCode error, bool from_peer));
   MOCK_METHOD1(CreateIncomingDynamicStream, QuicSpdyStream*(QuicStreamId id));
-  MOCK_METHOD0(CreateOutgoingDynamicStream, QuicSpdyStream*());
+  MOCK_METHOD1(CreateOutgoingDynamicStream,
+               QuicSpdyStream*(SpdyPriority priority));
 
   void SetCryptoStream(QuicCryptoServerStream* crypto_stream) {
     crypto_stream_ = crypto_stream;

diff --git a/net/tools/quic/quic_server_session.cc b/net/tools/quic/quic_server_session.cc
index 84a3958..68e228d 100644
--- a/net/tools/quic/quic_server_session.cc
+++ b/net/tools/quic/quic_server_session.cc

@@ -222,13 +222,15 @@
   return true;
 }
 
-QuicSpdyStream* QuicServerSession::CreateOutgoingDynamicStream() {
+QuicSpdyStream* QuicServerSession::CreateOutgoingDynamicStream(
+    SpdyPriority priority) {
   if (!ShouldCreateOutgoingDynamicStream()) {
     return nullptr;
   }
 
   QuicSpdyStream* stream =
       new QuicSpdyServerStream(GetNextOutgoingStreamId(), this);
+  stream->SetPriority(priority);
   ActivateStream(stream);
   return stream;
 }

diff --git a/net/tools/quic/quic_server_session.h b/net/tools/quic/quic_server_session.h
index 8db5618..e6eb784 100644
--- a/net/tools/quic/quic_server_session.h
+++ b/net/tools/quic/quic_server_session.h

@@ -98,7 +98,7 @@
  protected:
   // QuicSession methods:
   QuicSpdyStream* CreateIncomingDynamicStream(QuicStreamId id) override;
-  QuicSpdyStream* CreateOutgoingDynamicStream() override;
+  QuicSpdyStream* CreateOutgoingDynamicStream(SpdyPriority priority) override;
   QuicCryptoServerStreamBase* GetCryptoStream() override;
 
   // If an outgoing stream can be created, return true.

diff --git a/net/tools/quic/quic_server_session_test.cc b/net/tools/quic/quic_server_session_test.cc
index 284c64a..625e51e0 100644
--- a/net/tools/quic/quic_server_session_test.cc
+++ b/net/tools/quic/quic_server_session_test.cc

@@ -67,8 +67,9 @@
     return s->bandwidth_resumption_enabled_;
   }
 
-  static QuicSpdyStream* CreateOutgoingDynamicStream(QuicServerSession* s) {
-    return s->CreateOutgoingDynamicStream();
+  static QuicSpdyStream* CreateOutgoingDynamicStream(QuicServerSession* s,
+                                                     SpdyPriority priority) {
+    return s->CreateOutgoingDynamicStream(priority);
   }
 };
 
@@ -501,9 +502,9 @@
   // Tests that outgoing stream creation fails when connection is not connected.
   size_t initial_num_open_stream = session_->GetNumOpenOutgoingStreams();
   QuicConnectionPeer::CloseConnection(connection_);
-  EXPECT_DFATAL(
-      QuicServerSessionPeer::CreateOutgoingDynamicStream(session_.get()),
-      "ShouldCreateOutgoingDynamicStream called when disconnected");
+  EXPECT_DFATAL(QuicServerSessionPeer::CreateOutgoingDynamicStream(
+                    session_.get(), kDefaultPriority),
+                "ShouldCreateOutgoingDynamicStream called when disconnected");
   EXPECT_EQ(initial_num_open_stream, session_->GetNumOpenOutgoingStreams());
 }
 
@@ -511,9 +512,9 @@
   // Tests that outgoing stream creation fails when encryption has not yet been
   // established.
   size_t initial_num_open_stream = session_->GetNumOpenOutgoingStreams();
-  EXPECT_DFATAL(
-      QuicServerSessionPeer::CreateOutgoingDynamicStream(session_.get()),
-      "Encryption not established so no outgoing stream created.");
+  EXPECT_DFATAL(QuicServerSessionPeer::CreateOutgoingDynamicStream(
+                    session_.get(), kDefaultPriority),
+                "Encryption not established so no outgoing stream created.");
   EXPECT_EQ(initial_num_open_stream, session_->GetNumOpenOutgoingStreams());
 }
 
@@ -538,14 +539,15 @@
   // Create push streams till reaching the upper limit of allowed open streams.
   for (size_t i = 0; i < kMaxStreamsForTest; ++i) {
     QuicSpdyStream* created_stream =
-        QuicServerSessionPeer::CreateOutgoingDynamicStream(session_.get());
+        QuicServerSessionPeer::CreateOutgoingDynamicStream(session_.get(),
+                                                           kDefaultPriority);
     EXPECT_EQ(2 * (i + 1), created_stream->id());
     EXPECT_EQ(i + 1, session_->GetNumOpenOutgoingStreams());
   }
 
   // Continuing creating push stream would fail.
-  EXPECT_EQ(nullptr,
-            QuicServerSessionPeer::CreateOutgoingDynamicStream(session_.get()));
+  EXPECT_EQ(nullptr, QuicServerSessionPeer::CreateOutgoingDynamicStream(
+                         session_.get(), kDefaultPriority));
   EXPECT_EQ(kMaxStreamsForTest, session_->GetNumOpenOutgoingStreams());
 
   // Create peer initiated stream should have no problem.

diff --git a/net/tools/quic/quic_simple_client_bin.cc b/net/tools/quic/quic_simple_client_bin.cc
index 5dbb26d9..742f0f6 100644
--- a/net/tools/quic/quic_simple_client_bin.cc
+++ b/net/tools/quic/quic_simple_client_bin.cc

@@ -308,10 +308,7 @@
   // Print request and response details.
   if (!FLAGS_quiet) {
     cout << "Request:" << endl;
-    cout << "headers:" << endl;
-    for (const auto& kv : header_block) {
-      cout << " " << kv.first << ": " << kv.second << endl;
-    }
+    cout << "headers:" << header_block.DebugString();
     cout << "body: " << FLAGS_body << endl;
     cout << endl;
     cout << "Response:" << endl;

diff --git a/net/tools/quic/quic_spdy_client_stream.h b/net/tools/quic/quic_spdy_client_stream.h
index 42c83a9..0391b5b 100644
--- a/net/tools/quic/quic_spdy_client_stream.h
+++ b/net/tools/quic/quic_spdy_client_stream.h

@@ -71,9 +71,9 @@
 
   int response_code() const { return response_code_; }
 
-  // While the server's set_priority shouldn't be called externally, the creator
+  // While the server's SetPriority shouldn't be called externally, the creator
   // of client-side streams should be able to set the priority.
-  using QuicSpdyStream::set_priority;
+  using QuicSpdyStream::SetPriority;
 
   void set_allow_bidirectional_data(bool value) {
     allow_bidirectional_data_ = value;

diff --git a/net/tools/quic/test_tools/quic_test_client.cc b/net/tools/quic/test_tools/quic_test_client.cc
index 16a81d6..b16714a 100644
--- a/net/tools/quic/test_tools/quic_test_client.cc
+++ b/net/tools/quic/test_tools/quic_test_client.cc

@@ -373,7 +373,7 @@
     }
     stream_->set_visitor(this);
     QuicSpdyClientStream* cs = reinterpret_cast<QuicSpdyClientStream*>(stream_);
-    cs->set_priority(priority_);
+    cs->SetPriority(priority_);
     cs->set_allow_bidirectional_data(allow_bidirectional_data_);
     // Set FEC policy on stream.
     ReliableQuicStreamPeer::SetFecPolicy(stream_, fec_policy_);

diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
index c369b3e..1998750 100644
--- a/net/url_request/url_request_context_builder.cc
+++ b/net/url_request/url_request_context_builder.cc

@@ -5,10 +5,12 @@
 #include "net/url_request/url_request_context_builder.h"
 
 #include <string>
+#include <vector>
 
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/thread_task_runner_handle.h"
@@ -244,8 +246,8 @@
 }
 
 void URLRequestContextBuilder::SetInterceptors(
-    ScopedVector<URLRequestInterceptor> url_request_interceptors) {
-  url_request_interceptors_ = url_request_interceptors.Pass();
+    std::vector<scoped_ptr<URLRequestInterceptor>> url_request_interceptors) {
+  url_request_interceptors_ = std::move(url_request_interceptors);
 }
 
 void URLRequestContextBuilder::SetCookieAndChannelIdStores(
@@ -456,18 +458,17 @@
   if (!url_request_interceptors_.empty()) {
     // Set up interceptors in the reverse order.
 
-    for (ScopedVector<net::URLRequestInterceptor>::reverse_iterator i =
-             url_request_interceptors_.rbegin();
+    for (auto i = url_request_interceptors_.rbegin();
          i != url_request_interceptors_.rend(); ++i) {
       top_job_factory.reset(new net::URLRequestInterceptingJobFactory(
-          top_job_factory.Pass(), make_scoped_ptr(*i)));
+          std::move(top_job_factory), std::move(*i)));
     }
-    url_request_interceptors_.weak_clear();
+    url_request_interceptors_.clear();
   }
-  storage->set_job_factory(top_job_factory.Pass());
+  storage->set_job_factory(std::move(top_job_factory));
   // TODO(willchan): Support sdch.
 
-  return context.Pass();
+  return std::move(context);
 }
 
 }  // namespace net

diff --git a/net/url_request/url_request_context_builder.h b/net/url_request/url_request_context_builder.h
index 3e7284d..735947dd 100644
--- a/net/url_request/url_request_context_builder.h
+++ b/net/url_request/url_request_context_builder.h

@@ -20,7 +20,6 @@
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "base/memory/scoped_vector.h"
 #include "build/build_config.h"
 #include "net/base/net_export.h"
 #include "net/base/network_delegate.h"
@@ -233,7 +232,7 @@
   void SetCertVerifier(scoped_ptr<CertVerifier> cert_verifier);
 
   void SetInterceptors(
-      ScopedVector<URLRequestInterceptor> url_request_interceptors);
+      std::vector<scoped_ptr<URLRequestInterceptor>> url_request_interceptors);
 
   // Override the default in-memory cookie store and channel id service.
   // |cookie_store| must not be NULL. |channel_id_service| may be NULL to
@@ -297,7 +296,7 @@
   scoped_ptr<FtpTransactionFactory> ftp_transaction_factory_;
   scoped_ptr<HttpAuthHandlerFactory> http_auth_handler_factory_;
   scoped_ptr<CertVerifier> cert_verifier_;
-  ScopedVector<URLRequestInterceptor> url_request_interceptors_;
+  std::vector<scoped_ptr<URLRequestInterceptor>> url_request_interceptors_;
   scoped_ptr<HttpServerProperties> http_server_properties_;
 
   DISALLOW_COPY_AND_ASSIGN(URLRequestContextBuilder);

diff --git a/ppapi/native_client/BUILD.gn b/ppapi/native_client/BUILD.gn
index 14138b3..374d970 100644
--- a/ppapi/native_client/BUILD.gn
+++ b/ppapi/native_client/BUILD.gn

@@ -10,10 +10,6 @@
     deps = [
       "//ppapi/native_client/src/untrusted/irt_stub:ppapi_stub_lib",
     ]
-    if (!is_nacl_glibc) {
-      # Glibc has its version of pthread library.
-      deps += [ "//native_client/src/untrusted/pthread" ]
-    }
   }
 
   executable("nacl_irt") {

diff --git a/sandbox/linux/bpf_dsl/bpf_dsl.cc b/sandbox/linux/bpf_dsl/bpf_dsl.cc
index 100cc8b8..b57c713 100644
--- a/sandbox/linux/bpf_dsl/bpf_dsl.cc
+++ b/sandbox/linux/bpf_dsl/bpf_dsl.cc

@@ -269,15 +269,23 @@
   return BoolExpr(new const ConstBoolExprImpl(value));
 }
 
-BoolExpr operator!(const BoolExpr& cond) {
+BoolExpr Not(const BoolExpr& cond) {
   return BoolExpr(new const NegateBoolExprImpl(cond));
 }
 
-BoolExpr operator&&(const BoolExpr& lhs, const BoolExpr& rhs) {
+BoolExpr AllOf() {
+  return BoolConst(true);
+}
+
+BoolExpr AllOf(const BoolExpr& lhs, const BoolExpr& rhs) {
   return BoolExpr(new const AndBoolExprImpl(lhs, rhs));
 }
 
-BoolExpr operator||(const BoolExpr& lhs, const BoolExpr& rhs) {
+BoolExpr AnyOf() {
+  return BoolConst(false);
+}
+
+BoolExpr AnyOf(const BoolExpr& lhs, const BoolExpr& rhs) {
   return BoolExpr(new const OrBoolExprImpl(lhs, rhs));
 }
 

diff --git a/sandbox/linux/bpf_dsl/bpf_dsl.h b/sandbox/linux/bpf_dsl/bpf_dsl.h
index 913ab9cb..2d3c9d44 100644
--- a/sandbox/linux/bpf_dsl/bpf_dsl.h
+++ b/sandbox/linux/bpf_dsl/bpf_dsl.h

@@ -39,9 +39,11 @@
 //            Arg<int> fd(0), cmd(1);
 //            Arg<unsigned long> flags(2);
 //            const uint64_t kGoodFlags = O_ACCMODE | O_NONBLOCK;
-//            return If(fd == 0 && cmd == F_SETFL && (flags & ~kGoodFlags) == 0,
+//            return If(AllOf(fd == 0,
+//                            cmd == F_SETFL,
+//                            (flags & ~kGoodFlags) == 0),
 //                      Allow())
-//                .ElseIf(cmd == F_DUPFD || cmd == F_DUPFD_CLOEXEC,
+//                .ElseIf(AnyOf(cmd == F_DUPFD, cmd == F_DUPFD_CLOEXEC),
 //                        Error(EMFILE))
 //                .Else(Trap(SetFlagHandler, NULL));
 //          } else {
@@ -59,7 +61,7 @@
 //          | Trap(trap_func, aux) | UnsafeTrap(trap_func, aux)
 //          | If(bool, result)[.ElseIf(bool, result)].Else(result)
 //          | Switch(arg)[.Case(val, result)].Default(result)
-//   bool   = BoolConst(boolean) | !bool | bool && bool | bool || bool
+//   bool   = BoolConst(boolean) | Not(bool) | AllOf(bool...) | AnyOf(bool...)
 //          | arg == val | arg != val
 //   arg    = Arg<T>(num) | arg & mask
 //
@@ -117,11 +119,22 @@
 // BoolConst converts a bool value into a BoolExpr.
 SANDBOX_EXPORT BoolExpr BoolConst(bool value);
 
-// Various ways to combine boolean expressions into more complex expressions.
-// They follow standard boolean algebra laws.
-SANDBOX_EXPORT BoolExpr operator!(const BoolExpr& cond);
-SANDBOX_EXPORT BoolExpr operator&&(const BoolExpr& lhs, const BoolExpr& rhs);
-SANDBOX_EXPORT BoolExpr operator||(const BoolExpr& lhs, const BoolExpr& rhs);
+// Not returns a BoolExpr representing the logical negation of |cond|.
+SANDBOX_EXPORT BoolExpr Not(const BoolExpr& cond);
+
+// AllOf returns a BoolExpr representing the logical conjunction ("and")
+// of zero or more BoolExprs.
+SANDBOX_EXPORT BoolExpr AllOf();
+SANDBOX_EXPORT BoolExpr AllOf(const BoolExpr& lhs, const BoolExpr& rhs);
+template <typename... Rest>
+SANDBOX_EXPORT BoolExpr AllOf(const BoolExpr& first, const Rest&... rest);
+
+// AnyOf returns a BoolExpr representing the logical disjunction ("or")
+// of zero or more BoolExprs.
+SANDBOX_EXPORT BoolExpr AnyOf();
+SANDBOX_EXPORT BoolExpr AnyOf(const BoolExpr& lhs, const BoolExpr& rhs);
+template <typename... Rest>
+SANDBOX_EXPORT BoolExpr AnyOf(const BoolExpr& first, const Rest&... rest);
 
 template <typename T>
 class SANDBOX_EXPORT Arg {
@@ -144,7 +157,7 @@
 
   // Returns a boolean expression comparing whether the system call argument
   // (after applying any bitmasks, if appropriate) does not equal |rhs|.
-  friend BoolExpr operator!=(const Arg& lhs, T rhs) { return !(lhs == rhs); }
+  friend BoolExpr operator!=(const Arg& lhs, T rhs) { return Not(lhs == rhs); }
 
  private:
   Arg(int num, uint64_t mask) : num_(num), mask_(mask) {}
@@ -199,15 +212,16 @@
   ~Caser() {}
 
   // Case adds a single-value "case" clause to the switch.
-  Caser<T> Case(T value, ResultExpr result) const;
+  Caser<T> Case(T value, const ResultExpr& result) const;
 
   // Cases adds a multiple-value "case" clause to the switch.
   // See also the SANDBOX_BPF_DSL_CASES macro below for a more idiomatic way
   // of using this function.
-  Caser<T> Cases(const std::vector<T>& values, ResultExpr result) const;
+  template <typename... Values>
+  Caser<T> CasesImpl(const ResultExpr& result, const Values&... values) const;
 
   // Terminate the switch with a "default" clause.
-  ResultExpr Default(ResultExpr result) const;
+  ResultExpr Default(const ResultExpr& result) const;
 
  private:
   Caser(const Arg<T>& arg, Elser elser) : arg_(arg), elser_(elser) {}
@@ -226,17 +240,10 @@
 // use like:
 //    Switch(arg).CASES((3, 5, 7), result)...;
 #define SANDBOX_BPF_DSL_CASES(values, result) \
-  Cases(SANDBOX_BPF_DSL_CASES_HELPER values, result)
+  CasesImpl(result, SANDBOX_BPF_DSL_CASES_HELPER values)
 
-// Helper macro to construct a std::vector from an initializer list.
-// TODO(mdempsky): Convert to use C++11 initializer lists instead.
-#define SANDBOX_BPF_DSL_CASES_HELPER(value, ...)                           \
-  ({                                                                       \
-    const __typeof__(value) bpf_dsl_cases_values[] = {value, __VA_ARGS__}; \
-    std::vector<__typeof__(value)>(                                        \
-        bpf_dsl_cases_values,                                              \
-        bpf_dsl_cases_values + arraysize(bpf_dsl_cases_values));           \
-  })
+// Helper macro to strip parentheses.
+#define SANDBOX_BPF_DSL_CASES_HELPER(...) __VA_ARGS__
 
 // =====================================================================
 // Official API ends here.
@@ -248,9 +255,9 @@
 // BoolExpr is defined in bpf_dsl, since it's merely a typedef for
 // scoped_refptr<const internal::BoolExplImpl>, argument-dependent lookup only
 // searches the "internal" nested namespace.
-using bpf_dsl::operator!;
-using bpf_dsl::operator||;
-using bpf_dsl::operator&&;
+using bpf_dsl::Not;
+using bpf_dsl::AllOf;
+using bpf_dsl::AnyOf;
 
 // Returns a boolean expression that represents whether system call
 // argument |num| of size |size| is equal to |val|, when masked
@@ -291,30 +298,36 @@
 }
 
 template <typename T>
-Caser<T> Caser<T>::Case(T value, ResultExpr result) const {
+Caser<T> Caser<T>::Case(T value, const ResultExpr& result) const {
   return SANDBOX_BPF_DSL_CASES((value), result);
 }
 
 template <typename T>
-Caser<T> Caser<T>::Cases(const std::vector<T>& values,
-                         ResultExpr result) const {
+template <typename... Values>
+Caser<T> Caser<T>::CasesImpl(const ResultExpr& result,
+                             const Values&... values) const {
   // Theoretically we could evaluate arg_ just once and emit a more efficient
   // dispatch table, but for now we simply translate into an equivalent
   // If/ElseIf/Else chain.
 
-  typedef typename std::vector<T>::const_iterator Iter;
-  BoolExpr test = BoolConst(false);
-  for (Iter i = values.begin(), end = values.end(); i != end; ++i) {
-    test = test || (arg_ == *i);
-  }
-  return Caser<T>(arg_, elser_.ElseIf(test, result));
+  return Caser<T>(arg_, elser_.ElseIf(AnyOf((arg_ == values)...), result));
 }
 
 template <typename T>
-ResultExpr Caser<T>::Default(ResultExpr result) const {
+ResultExpr Caser<T>::Default(const ResultExpr& result) const {
   return elser_.Else(result);
 }
 
+template <typename... Rest>
+BoolExpr AllOf(const BoolExpr& first, const Rest&... rest) {
+  return AllOf(first, AllOf(rest...));
+}
+
+template <typename... Rest>
+BoolExpr AnyOf(const BoolExpr& first, const Rest&... rest) {
+  return AnyOf(first, AnyOf(rest...));
+}
+
 }  // namespace bpf_dsl
 }  // namespace sandbox
 

diff --git a/sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc b/sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc
index dff21e5..6e0c29e 100644
--- a/sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc
+++ b/sandbox/linux/bpf_dsl/bpf_dsl_unittest.cc

@@ -151,10 +151,11 @@
   ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_socketpair) {
       const Arg<int> domain(0), type(1), protocol(2);
-      return If(domain == AF_UNIX &&
-                    (type == SOCK_STREAM || type == SOCK_DGRAM) &&
-                    protocol == 0,
-                Error(EPERM)).Else(Error(EINVAL));
+      return If(AllOf(domain == AF_UNIX,
+                      AnyOf(type == SOCK_STREAM, type == SOCK_DGRAM),
+                      protocol == 0),
+                Error(EPERM))
+          .Else(Error(EINVAL));
     }
     return Allow();
   }
@@ -196,8 +197,8 @@
   ResultExpr EvaluateSyscall(int sysno) const override {
     if (sysno == __NR_setresuid) {
       const Arg<uid_t> ruid(0), euid(1), suid(2);
-      return If(ruid == 0 || euid == 0 || suid == 0, Error(EPERM))
-          .ElseIf(ruid == 1 && euid == 1 && suid == 1, Error(EAGAIN))
+      return If(AnyOf(ruid == 0, euid == 0, suid == 0), Error(EPERM))
+          .ElseIf(AllOf(ruid == 1, euid == 1, suid == 1), Error(EAGAIN))
           .Else(Error(EINVAL));
     }
     return Allow();

diff --git a/sandbox/linux/integration_tests/bpf_dsl_seccomp_unittest.cc b/sandbox/linux/integration_tests/bpf_dsl_seccomp_unittest.cc
index 8e4844ff..a053773 100644
--- a/sandbox/linux/integration_tests/bpf_dsl_seccomp_unittest.cc
+++ b/sandbox/linux/integration_tests/bpf_dsl_seccomp_unittest.cc

@@ -57,6 +57,8 @@
 #define PR_CAPBSET_DROP 24
 #endif
 
+#define CASES SANDBOX_BPF_DSL_CASES
+
 namespace sandbox {
 namespace bpf_dsl {
 
@@ -775,8 +777,9 @@
       // Allow prctl(PR_SET_DUMPABLE) and prctl(PR_GET_DUMPABLE), but
       // disallow everything else.
       const Arg<int> option(0);
-      return If(option == PR_SET_DUMPABLE || option == PR_GET_DUMPABLE, Allow())
-          .Else(Error(ENOMEM));
+      return Switch(option)
+          .CASES((PR_SET_DUMPABLE, PR_GET_DUMPABLE), Allow())
+          .Default(Error(ENOMEM));
     }
     default:
       return Allow();
@@ -1725,10 +1728,11 @@
                                            CLONE_SIGHAND | CLONE_THREAD |
                                            CLONE_SYSVSEM;
     const Arg<unsigned long> flags(0);
-    return If(flags == kGlibcCloneMask ||
-                  flags == (kBaseAndroidCloneMask | CLONE_DETACHED) ||
-                  flags == kBaseAndroidCloneMask,
-              Allow()).Else(Trap(PthreadTrapHandler, "Unknown mask"));
+    return Switch(flags)
+        .CASES((kGlibcCloneMask, (kBaseAndroidCloneMask | CLONE_DETACHED),
+                kBaseAndroidCloneMask),
+               Allow())
+        .Default(Trap(PthreadTrapHandler, "Unknown mask"));
   }
 
   return Allow();
@@ -1786,15 +1790,15 @@
     const Arg<unsigned long> flags(0);
     return If(HasAnyBits(flags, ~kKnownFlags),
               Trap(PthreadTrapHandler, "Unexpected CLONE_XXX flag found"))
-        .ElseIf(!HasAllBits(flags, kMandatoryFlags),
+        .ElseIf(Not(HasAllBits(flags, kMandatoryFlags)),
                 Trap(PthreadTrapHandler,
                      "Missing mandatory CLONE_XXX flags "
                      "when creating new thread"))
-        .ElseIf(
-             !HasAllBits(flags, kFutexFlags) && HasAnyBits(flags, kFutexFlags),
-             Trap(PthreadTrapHandler,
-                  "Must set either all or none of the TLS and futex bits in "
-                  "call to clone()"))
+        .ElseIf(AllOf(Not(HasAllBits(flags, kFutexFlags)),
+                      HasAnyBits(flags, kFutexFlags)),
+                Trap(PthreadTrapHandler,
+                     "Must set either all or none of the TLS and futex bits in "
+                     "call to clone()"))
         .Else(Allow());
   }
 

diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 8bfb025b..6b42d9bb 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc

@@ -236,8 +236,8 @@
     // Used by Mojo EDK to catch a message pipe being sent over itself.
     const Arg<int> level(1);
     const Arg<int> optname(2);
-    return If(level == SOL_SOCKET && optname == SO_PEEK_OFF,
-              Allow()).Else(CrashSIGSYS());
+    return If(AllOf(level == SOL_SOCKET, optname == SO_PEEK_OFF), Allow())
+        .Else(CrashSIGSYS());
   }
 #endif
 

diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index 93115505..4b98366 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc

@@ -126,9 +126,9 @@
       CLONE_SYSVSEM | CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
   const BoolExpr glibc_test = flags == kGlibcPthreadFlags;
 
-  const BoolExpr android_test = flags == kAndroidCloneMask ||
-                                flags == kObsoleteAndroidCloneMask ||
-                                flags == kGlibcPthreadFlags;
+  const BoolExpr android_test =
+      AnyOf(flags == kAndroidCloneMask, flags == kObsoleteAndroidCloneMask,
+            flags == kGlibcPthreadFlags);
 
   return If(IsAndroid() ? android_test : glibc_test, Allow())
       .ElseIf((flags & (CLONE_VM | CLONE_THREAD)) == 0, Error(EPERM))
@@ -140,11 +140,13 @@
   // used by breakpad but not needed anymore.
   const Arg<int> option(0);
   return Switch(option)
-      .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE),
-             Allow())
+      .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE
 #if defined(OS_ANDROID)
-      .CASES((PR_SET_VMA, PR_SET_TIMERSLACK_PID), Allow())
+              ,
+              PR_SET_VMA, PR_SET_TIMERSLACK_PID
 #endif
+              ),
+             Allow())
       .Default(CrashSIGSYSPrctl());
 }
 
@@ -262,7 +264,7 @@
   const Arg<int> which(0);
   const Arg<int> who(1);
   return If(which == PRIO_PROCESS,
-            If(who == 0 || who == target_pid, Allow()).Else(Error(EPERM)))
+            Switch(who).CASES((0, target_pid), Allow()).Default(Error(EPERM)))
       .Else(CrashSIGSYS());
 }
 
@@ -278,8 +280,9 @@
     case __NR_sched_setparam:
     case __NR_sched_setscheduler: {
       const Arg<pid_t> pid(0);
-      return If(pid == 0 || pid == target_pid, Allow())
-          .Else(RewriteSchedSIGSYS());
+      return Switch(pid)
+          .CASES((0, target_pid), Allow())
+          .Default(RewriteSchedSIGSYS());
     }
     default:
       NOTREACHED();
@@ -289,7 +292,7 @@
 
 ResultExpr RestrictPrlimit64(pid_t target_pid) {
   const Arg<pid_t> pid(0);
-  return If(pid == 0 || pid == target_pid, Allow()).Else(CrashSIGSYS());
+  return Switch(pid).CASES((0, target_pid), Allow()).Default(CrashSIGSYS());
 }
 
 ResultExpr RestrictGetrusage() {
@@ -301,14 +304,11 @@
 ResultExpr RestrictClockID() {
   static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit");
   const Arg<clockid_t> clockid(0);
-  return If(
-                 clockid == CLOCK_MONOTONIC ||
-                 clockid == CLOCK_MONOTONIC_COARSE ||
-                 clockid == CLOCK_PROCESS_CPUTIME_ID ||
-                 clockid == CLOCK_REALTIME ||
-                 clockid == CLOCK_REALTIME_COARSE ||
-                 clockid == CLOCK_THREAD_CPUTIME_ID,
-             Allow()).Else(CrashSIGSYS());
+  return Switch(clockid)
+      .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID,
+              CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID),
+             Allow())
+      .Default(CrashSIGSYS());
 }
 
 }  // namespace sandbox.

diff --git a/sync/syncable/directory_unittest.cc b/sync/syncable/directory_unittest.cc
index c5eae7549..dc83e61 100644
--- a/sync/syncable/directory_unittest.cc
+++ b/sync/syncable/directory_unittest.cc

@@ -4,6 +4,9 @@
 
 #include "sync/syncable/directory_unittest.h"
 
+#include <cstdlib>
+
+#include "base/rand_util.h"
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
 #include "base/test/values_test_util.h"
@@ -1665,12 +1668,12 @@
     std::string path_name;
 
     for (int i = 0; i < 20; ++i) {
-      const int rand_action = rand() % 10;
+      const int rand_action = base::RandInt(0, 9);
       if (rand_action < 4 && !path_name.empty()) {
         ReadTransaction trans(FROM_HERE, dir_);
         EXPECT_EQ(1, CountEntriesWithName(&trans, trans.root_id(), path_name));
         base::PlatformThread::Sleep(
-            base::TimeDelta::FromMilliseconds(rand() % 10));
+            base::TimeDelta::FromMilliseconds(base::RandInt(0, 9)));
       } else {
         std::string unique_name =
             base::StringPrintf("%d.%d", thread_number_, entry_count++);
@@ -1679,9 +1682,9 @@
         MutableEntry e(&trans, CREATE, BOOKMARKS, trans.root_id(), path_name);
         EXPECT_TRUE(e.good());
         base::PlatformThread::Sleep(
-            base::TimeDelta::FromMilliseconds(rand() % 20));
+            base::TimeDelta::FromMilliseconds(base::RandInt(0, 19)));
         e.PutIsUnsynced(true);
-        if (e.PutId(TestIdFactory::FromNumber(rand())) &&
+        if (e.PutId(TestIdFactory::FromNumber(base::RandInt(0, RAND_MAX))) &&
             e.GetId().ServerKnows() && !e.GetId().IsRoot()) {
           e.PutBaseVersion(1);
         }

diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index 0b38d605..d0bc091 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl

@@ -317,7 +317,7 @@
     "type": "unknown",
   },
   "nacl_loader_unittests": {
-    "label": "//components/nacl/loader:nacl_loader_unittests",
+    "label": "//components/nacl:nacl_loader_unittests",
     "type": "raw",
     "args": [],
   },

diff --git a/testing/libfuzzer/fuzzers/BUILD.gn b/testing/libfuzzer/fuzzers/BUILD.gn
index 7e5acae..7cb98e1 100644
--- a/testing/libfuzzer/fuzzers/BUILD.gn
+++ b/testing/libfuzzer/fuzzers/BUILD.gn

@@ -7,6 +7,12 @@
 import("//build/config/features.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 
+fuzzer_test("empty_fuzzer") {
+  sources = [
+    "empty_fuzzer.cc",
+  ]
+}
+
 fuzzer_test("brotli_fuzzer") {
   sources = [
     "brotli_fuzzer.cc",

diff --git a/testing/libfuzzer/fuzzers/empty_fuzzer.cc b/testing/libfuzzer/fuzzers/empty_fuzzer.cc
new file mode 100644
index 0000000..a5cd30c
--- /dev/null
+++ b/testing/libfuzzer/fuzzers/empty_fuzzer.cc

@@ -0,0 +1,24 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Empty fuzzer that doesn't do anything. Used as test and documentation.
+
+#include <stddef.h>
+
+// Fuzzer entry point.
+extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) {
+  // Run your code on data.
+  return 0;
+}
+
+// Environment is optional.
+struct Environment {
+  Environment() {
+    // Initialize your environment.
+  }
+};
+
+Environment* env = new Environment();
+
+

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 2503c8f..6849909 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -1306,3 +1306,5 @@
 crbug.com/569514 inspector/sources/debugger-step/debugger-step-over-document-write.html [ NeedsManualRebaseline ]
 crbug.com/569514 inspector/sources/debugger-step/debugger-step-over-inlined-scripts.html [ NeedsManualRebaseline ]
 crbug.com/569514 inspector/sources/debugger/debugger-scripts.html [ NeedsManualRebaseline ]
+
+crbug.com/569811 inspector-protocol/debugger/updateCallFrameScopes.html [ Pass Failure ]

diff --git a/third_party/WebKit/LayoutTests/accessibility/name-calc-aria-owns.html b/third_party/WebKit/LayoutTests/accessibility/name-calc-aria-owns.html
new file mode 100644
index 0000000..7c358cba
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/accessibility/name-calc-aria-owns.html

@@ -0,0 +1,30 @@
+<!DOCTYPE HTML>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+
+<style>
+.hideAllContainers .container {
+    display: none;
+}
+</style>
+
+<div class="container">
+    <input id="input1" aria-labelledby="list1">
+    <ul id="list1" aria-owns="list1_item3">
+        <li>A
+        <li>B
+    </ul>
+    <div role="listitem" id="list1_item3">C</div>
+</div>
+
+<script>
+test(function(t) {
+    var axInput1 = accessibilityController.accessibleElementById("input1");
+    assert_equals(axInput1.name, "A B C");
+}, "Aria-owns is considered in a name computation");
+</script>
+
+<script>
+if (window.testRunner)
+    document.body.className = "hideAllContainers";
+</script>

diff --git a/third_party/WebKit/LayoutTests/accessibility/name-calc-presentational.html b/third_party/WebKit/LayoutTests/accessibility/name-calc-presentational.html
new file mode 100644
index 0000000..1fbcb9e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/accessibility/name-calc-presentational.html

@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+
+<style>
+.hideAllContainers .container {
+    display: none;
+}
+</style>
+
+<div class="container">
+  <div tabIndex=0 role="link" id="link1">
+    I
+    <img src="hidden.jpg" alt="do not" role="presentation" />
+    like ice cream.
+  </div>
+</div>
+
+<script>
+test(function(t) {
+    var axLink1 = accessibilityController.accessibleElementById("link1");
+    assert_equals(axLink1.name, "I like ice cream.");
+}, "Presentational element ignored in name calculation..");
+</script>
+
+<script>
+if (window.testRunner)
+    document.body.className = "hideAllContainers";
+</script>

diff --git a/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.png b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.png
new file mode 100644
index 0000000..f5d17c84
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.txt b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.txt
new file mode 100644
index 0000000..69a5f25e2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document-expected.txt

@@ -0,0 +1 @@
+This test passes if the entire background is green (including the region outside the html element).

diff --git a/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document.html b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document.html
new file mode 100644
index 0000000..0fbca7b2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/compositing/background-color/background-color-outside-document.html

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<script>
+
+if (window.internals) {
+    internals.settings.setViewportEnabled(true);
+    internals.settings.setViewportMetaEnabled(true);
+    addEventListener('load', function() {
+        internals.setPageScaleFactor(0.5);
+    });
+}
+if (window.testRunner) {
+    testRunner.dumpAsTextWithPixelResults();
+    testRunner.waitUntilDone();
+    addEventListener('load', function() {
+        testRunner.setCustomTextOutput(
+            "This test passes if the entire background is green " +
+            "(including the region outside the html element).");
+        testRunner.notifyDone();
+    });
+}
+
+</script>
+<meta name="viewport" content="width=device-width, minimum-scale=0.5, initial-scale=1, maximum-scale=1.25">
+<style>
+html {
+    background-color: #8f8;
+    height: 100%;
+    border: 1px solid black;
+}
+body {
+    background-color: #fcc;
+}
+#console {
+    display: none;
+}
+</style>

diff --git a/third_party/WebKit/LayoutTests/css-parser/d-parsing.html b/third_party/WebKit/LayoutTests/css-parser/d-parsing.html
new file mode 100644
index 0000000..241c48a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/css-parser/d-parsing.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<script src="resources/property-parsing-test.js"></script>
+<script>
+// Verifies that d property and its value are properly parsed
+
+assert_valid_value("d", "path('M 0 0 L 100 100 M 100 200 L 200 200 Z L 300 300 Z')");
+assert_invalid_value("d", "none");
+assert_invalid_value("d", "path('M 20 30 A 60 70 80')");
+</script>

diff --git a/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison-expected.txt b/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison-expected.txt
index e74f9c8..cb81c29 100644
--- a/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison-expected.txt
+++ b/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison-expected.txt

@@ -24,9 +24,6 @@
 PASS Two CSSValues "url(dummy://test.png)" for property "background-image" are equal. 
 PASS Two CSSValues "url(dummy://green.png)" for property "background-image" are equal. 
 PASS Two CSSValues "url(dummy://test.png)" and "url(dummy://green.png)" for property "background-image" are not equal. 
-PASS Two CSSValues "bold" for property "font-weight" are equal. 
-PASS Two CSSValues "inherit" for property "font-weight" are equal. 
-PASS Two CSSValues "bold" and "inherit" for property "font-weight" are not equal. 
 PASS Two CSSValues "counter(a)" for property "content" are equal. 
 PASS Two CSSValues "counters(a, '.')" for property "content" are equal. 
 PASS Two CSSValues "counter(a)" and "counters(a, '.')" for property "content" are not equal. 
@@ -61,9 +58,27 @@
 PASS Two CSSValues "url(resources/greenbox.png) 0 0, pointer" for property "cursor" are equal. 
 PASS Two CSSValues "url(resources/cursor.png) 1 1, wait" for property "cursor" are equal. 
 PASS Two CSSValues "url(resources/greenbox.png) 0 0, pointer" and "url(resources/cursor.png) 1 1, wait" for property "cursor" are not equal. 
-PASS Two CSSValues "italic bold 12px/30px arial" for property "font" are equal. 
-PASS Two CSSValues "italic bold 8px/16px helvetica" for property "font" are equal. 
-PASS Two CSSValues "italic bold 12px/30px arial" and "italic bold 8px/16px helvetica" for property "font" are not equal. 
+PASS Two CSSValues "italic" for property "font-style" are equal. 
+PASS Two CSSValues "oblique" for property "font-style" are equal. 
+PASS Two CSSValues "italic" and "oblique" for property "font-style" are not equal. 
+PASS Two CSSValues "small-caps" for property "font-variant" are equal. 
+PASS Two CSSValues "normal" for property "font-variant" are equal. 
+PASS Two CSSValues "small-caps" and "normal" for property "font-variant" are not equal. 
+PASS Two CSSValues "bold" for property "font-weight" are equal. 
+PASS Two CSSValues "bolder" for property "font-weight" are equal. 
+PASS Two CSSValues "bold" and "bolder" for property "font-weight" are not equal. 
+PASS Two CSSValues "semi-condensed" for property "font-stretch" are equal. 
+PASS Two CSSValues "expanded" for property "font-stretch" are equal. 
+PASS Two CSSValues "semi-condensed" and "expanded" for property "font-stretch" are not equal. 
+PASS Two CSSValues "12px" for property "font-size" are equal. 
+PASS Two CSSValues "8px" for property "font-size" are equal. 
+PASS Two CSSValues "12px" and "8px" for property "font-size" are not equal. 
+PASS Two CSSValues "30pz" for property "line-height" are equal. 
+PASS Two CSSValues "16px" for property "line-height" are equal. 
+PASS Two CSSValues "30pz" and "16px" for property "line-height" are not equal. 
+PASS Two CSSValues "arial" for property "font-family" are equal. 
+PASS Two CSSValues "helvetica" for property "font-family" are equal. 
+PASS Two CSSValues "arial" and "helvetica" for property "font-family" are not equal. 
 PASS Two CSSValues "-webkit-gradient(linear, left top, left bottom, from(#ccc), to(#000))" for property "background-image" are equal. 
 PASS Two CSSValues "-webkit-gradient(radial, 45 45, 0, 52 50, 0, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62))" for property "background-image" are equal. 
 PASS Two CSSValues "-webkit-gradient(linear, left top, left bottom, from(#ccc), to(#000))" and "-webkit-gradient(radial, 45 45, 0, 52 50, 0, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62))" for property "background-image" are not equal. 

diff --git a/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison.html b/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison.html
index 9835d44..e1516b25 100644
--- a/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison.html
+++ b/third_party/WebKit/LayoutTests/cssom/cssvalue-comparison.html

@@ -36,7 +36,6 @@
    var tests = [ {"width" : ["20%", "2em", "2rem", "20px", "2cm", "20mm", "4in", "20pt", "10pc", "6vw", "6vh", "4vmin", "10vmax", "-webkit-calc(-100px + 100%)"]}, // lengths, calc
                   {"-webkit-transform" : ["rotate(15deg)", "rotate(1.55rad)", "rotate(200grad)", "rotate(0.5turn)"]}, // angle
                   {"background-image" : ["url(dummy://test.png)", "url(dummy://green.png)"]}, // uri
-                  {"font-weight" : ["bold", "inherit"]}, // ident
                   {"content" : ["counter(a)", "counters(a, '.')"]}, // counter
                   {"content" : ["attr(a)", "attr(p)"]}, // attr
                   {"clip" : ["rect(40px, 0, 45px, -5px)", "rect(10px, 5px, 15px, -10px)"]}, // rect
@@ -48,7 +47,13 @@
                   {"border-image-source" : ["url(resources/greenbox.png)", "url(resources/redbox.png)"]}, // image
                   {"border-image-slice" : ["1 2 3 4", "2 3 4 5"]}, // border image slice
                   {"cursor" : ["url(resources/greenbox.png) 0 0, pointer", "url(resources/cursor.png) 1 1, wait"]}, // cursor
-                  {"font" : ["italic bold 12px/30px arial", "italic bold 8px/16px helvetica"]}, // font
+                  {"font-style" : ["italic", "oblique"]}, // font
+                  {"font-variant" : ["small-caps", "normal"]}, // font
+                  {"font-weight" : ["bold", "bolder"]}, // font
+                  {"font-stretch" : ["semi-condensed", "expanded"]}, // font
+                  {"font-size" : ["12px", "8px"]}, // font
+                  {"line-height" : ["30pz", "16px"]}, // font
+                  {"font-family" : ["arial", "helvetica"]}, // font
                   {"background-image" : ["-webkit-gradient(linear, left top, left bottom, from(#ccc), to(#000))", "-webkit-gradient(radial, 45 45, 0, 52 50, 0, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62))"]}, // gradients
                   {"background-image" : ["radial-gradient(circle, #ccc, #000)"]}, // gradients
                   {"background-image" : ["linear-gradient(#000, #234)", "linear-gradient(to top, #000, #234)"]}, // gradients

diff --git a/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3-expected.txt b/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3-expected.txt
new file mode 100644
index 0000000..45dbf034
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3-expected.txt

@@ -0,0 +1 @@
+crbug.com/568744: Ensure an element's floats are cleared when it becomes inline. This test shouldn't crash.

diff --git a/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3.html b/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3.html
new file mode 100644
index 0000000..d98ea1e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/clear-intruding-floats-when-moving-to-inline-parent-3.html

@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<style>
+#container {
+    float: right;
+}
+canvas{
+    display: block;
+}
+</style>
+<li></li>
+crbug.com/568744: Ensure an element's floats are cleared when it becomes inline. This test shouldn't crash.
+<div id="container">
+    <canvas></canvas>
+</div>
+<pre id="pre"></pre>
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    document.body.offsetTop;
+    var pre = document.getElementById("pre")
+
+    // Make the pre element have block children.
+    pre.appendChild(document.createElement("canvas"));
+    // Change the pre element so that it is now out-of-flow and folds into an adjacent anonymous block.
+    pre.style.position = 'absolute';
+    // Destroy the float that should no longer be in the pre's float lists.
+    document.getElementById("container").style.display = "none";
+    // Re-compute style, but don't layout. (Layout would rebuild float lists and avoid a crash.)
+    getComputedStyle(pre).color;
+    // Prompt the canvas to access the float destroyed above if it hasn't been removed from pre's float lists.
+    document.body.style.zoom=0.50
+</script>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context-expected.txt b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context-expected.txt
new file mode 100644
index 0000000..7ef22e9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context-expected.txt

@@ -0,0 +1 @@
+PASS

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context.html
new file mode 100644
index 0000000..128a79b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-as-formatting-context.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<style>
+div {
+    height: 100px;
+    width: 100%;
+}
+.container {
+    contain: paint;
+    border: 1px solid black;
+}
+.overhangingContainer {
+    height: 10px;
+}
+.overhangingFloat {
+    float: left;
+}
+</style>
+<body>
+<div class="overhangingContainer"><div class="overhangingFloat"></div></div>
+<div class="container" data-offset-y=108></div>
+<script src="../../../resources/check-layout.js"></script>
+<script>
+checkLayout(".container");
+</script>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position-expected.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position-expected.html
new file mode 100644
index 0000000..b880446
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position-expected.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+}
+</style>
+<body>
+<div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position.html
new file mode 100644
index 0000000..bac8d56
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-absolute-position.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 50px;
+}
+.container {
+    contain: paint;
+    background-color: green;
+}
+.absolute {
+    position: absolute;
+    top: 0px;
+    left: 100px;
+    background-color: red;
+}
+.inline {
+    display: inline-block;
+}
+</style>
+<body>
+<div class="container"><div class="absolute"></div></div>
+<div class="container inline"><div class="absolute"></div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow-expected.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow-expected.html
new file mode 100644
index 0000000..b880446
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow-expected.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+}
+</style>
+<body>
+<div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow.html
new file mode 100644
index 0000000..ffa0f31
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-box-shadow.html

@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+}
+#container {
+    contain: paint;
+}
+#child {
+    background-color: green;
+    -webkit-box-shadow: 0 0 100px 100px red;
+}
+</style>
+<body>
+<div id="container"><div id="child"></div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position-expected.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position-expected.html
new file mode 100644
index 0000000..b880446
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position-expected.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+}
+</style>
+<body>
+<div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position.html
new file mode 100644
index 0000000..f028d8c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-fixed-position.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 50px;
+}
+.container {
+    contain: paint;
+    background-color: green;
+}
+.fixed {
+    position: fixed;
+    top: 0px;
+    left: 100px;
+    background-color: red;
+}
+.inline {
+    display: inline-block;
+}
+</style>
+<body>
+<div class="container"><div class="fixed"></div></div>
+<div class="container inline"><div class="fixed"></div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant-expected.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant-expected.html
new file mode 100644
index 0000000..b880446
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant-expected.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+}
+</style>
+<body>
+<div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant.html b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant.html
new file mode 100644
index 0000000..d11d1821
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/paint-containment-with-transformed-descendant.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<style>
+div {
+    width: 100px;
+    height: 50px;
+}
+.container {
+    contain: paint;
+    background-color: green;
+}
+.transform {
+    background-color: red;
+    top: 100px;
+    transform: translateZ(0) scaleY(2) translateX(100px);
+}
+.inline {
+    display: inline-block;
+}
+</style>
+<body>
+<div class="container"><div class="transform"></div></div>
+<div class="container inline"><div class="transform"></div></div>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands-expected.txt b/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands-expected.txt
index 231aec08..5a5f293 100644
--- a/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands-expected.txt

@@ -7,38 +7,27 @@
 PASS computedStyle.font is 'normal normal normal normal 20px / normal foobar'
 PASS computedStyle.fontSize is '20px'
 PASS checkFontStyleValue() is true
-PASS style.font is '20px sans-serif'
+PASS style.font is ''
 PASS computedStyle.font is 'normal normal normal normal 20px / normal sans-serif'
 PASS computedStyle.fontFamily is 'sans-serif'
-PASS checkFontStyleValue() is true
-PASS style.font is 'italic 20px sans-serif'
+PASS style.font is ''
 PASS computedStyle.font is 'italic normal normal normal 20px / normal sans-serif'
 PASS computedStyle.fontStyle is 'italic'
-PASS checkFontStyleValue() is true
-PASS style.font is 'italic small-caps 20px sans-serif'
+PASS style.font is ''
 PASS computedStyle.font is 'italic small-caps normal normal 20px / normal sans-serif'
 PASS computedStyle.fontVariant is 'small-caps'
-PASS checkFontStyleValue() is true
-PASS style.font is 'italic small-caps bold 20px sans-serif'
+PASS style.font is ''
 PASS computedStyle.font is 'italic small-caps bold normal 20px / normal sans-serif'
 PASS computedStyle.fontWeight is 'bold'
-PASS checkFontStyleValue() is true
-PASS style.font is 'italic small-caps bold 20px/40px sans-serif'
+PASS style.font is ''
 PASS computedStyle.font is 'italic small-caps bold normal 20px / 40px sans-serif'
 PASS computedStyle.lineHeight is '40px'
+PASS style.font is 'italic small-caps bold ultra-expanded 20px/40px sans-serif'
+PASS computedStyle.font is 'italic small-caps bold ultra-expanded 20px / 40px sans-serif'
 PASS checkFontStyleValue() is true
 PASS style.font is ''
 PASS computedStyle.font is 'normal normal normal normal 16px / normal foobar'
 PASS checkFontStyleValue() is true
-PASS style.font is ''
-PASS computedStyle.font is 'normal normal bold normal 16px / normal foobar'
-PASS computedStyle.fontWeight is 'bold'
-PASS checkFontStyleValue() is true
-PASS style.font is 'bold 40px sans-serif'
-PASS computedStyle.font is 'normal normal bold normal 40px / normal sans-serif'
-PASS computedStyle.fontSize is '40px'
-PASS computedStyle.fontFamily is 'sans-serif'
-PASS checkFontStyleValue() is true
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands.html b/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands.html
index 36373c2..92c584d 100644
--- a/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands.html
+++ b/third_party/WebKit/LayoutTests/fast/css/font-shorthand-from-longhands.html

@@ -34,7 +34,7 @@
 }
 
 style.fontSize = "20px";
-// We need at least the font-family to build the shorthand.
+// We need all font longhands to build the shorthand.
 shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'normal normal normal normal 20px / normal foobar'");
 shouldBe("computedStyle.fontSize", "'20px'");
@@ -42,33 +42,34 @@
 
 style.fontSize = "20px";
 style.fontFamily = "sans-serif";
-shouldBe("style.font", "'20px sans-serif'");
+shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'normal normal normal normal 20px / normal sans-serif'");
 shouldBe("computedStyle.fontFamily", "'sans-serif'");
-shouldBe("checkFontStyleValue()", "true");
 
 style.fontStyle = "italic";
-shouldBe("style.font", "'italic 20px sans-serif'");
+shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'italic normal normal normal 20px / normal sans-serif'");
 shouldBe("computedStyle.fontStyle", "'italic'");
-shouldBe("checkFontStyleValue()", "true");
 
 style.fontVariant = "small-caps";
-shouldBe("style.font", "'italic small-caps 20px sans-serif'");
+shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'italic small-caps normal normal 20px / normal sans-serif'");
 shouldBe("computedStyle.fontVariant", "'small-caps'");
-shouldBe("checkFontStyleValue()", "true");
 
 style.fontWeight = "bold";
-shouldBe("style.font", "'italic small-caps bold 20px sans-serif'");
+shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'italic small-caps bold normal 20px / normal sans-serif'");
 shouldBe("computedStyle.fontWeight", "'bold'");
-shouldBe("checkFontStyleValue()", "true");
 
 style.lineHeight = "40px";
-shouldBe("style.font", "'italic small-caps bold 20px/40px sans-serif'");
+shouldBe("style.font", "''");
 shouldBe("computedStyle.font", "'italic small-caps bold normal 20px / 40px sans-serif'");
 shouldBe("computedStyle.lineHeight", "'40px'");
+
+style.fontStretch = "ultra-expanded";
+// All font longhands are set, therefore shorthand is built
+shouldBe("style.font", "'italic small-caps bold ultra-expanded 20px/40px sans-serif'");
+shouldBe("computedStyle.font", "'italic small-caps bold ultra-expanded 20px / 40px sans-serif'");
 shouldBe("checkFontStyleValue()", "true");
 
 style.font = "";
@@ -76,22 +77,6 @@
 shouldBe("computedStyle.font", "'normal normal normal normal 16px / normal foobar'");
 shouldBe("checkFontStyleValue()", "true");
 
-style.fontWeight = "bold";
-// It is normal to return null as the font-size is mandatory to build the shorthand.
-shouldBe("style.font", "''");
-shouldBe("computedStyle.font", "'normal normal bold normal 16px / normal foobar'");
-shouldBe("computedStyle.fontWeight", "'bold'");
-shouldBe("checkFontStyleValue()", "true");
-
-style.fontSize = "40px";
-style.fontFamily = "sans-serif";
-style.fontWeight = "bold";
-shouldBe("style.font", "'bold 40px sans-serif'");
-shouldBe("computedStyle.font", "'normal normal bold normal 40px / normal sans-serif'");
-shouldBe("computedStyle.fontSize", "'40px'");
-shouldBe("computedStyle.fontFamily", "'sans-serif'");
-shouldBe("checkFontStyleValue()", "true");
-
 document.body.removeChild(testContainer);
 </script>
 </body>

diff --git a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-listing-expected.txt b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-listing-expected.txt
index a0e8340..7a3e38b 100644
--- a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-listing-expected.txt

@@ -138,6 +138,7 @@
 cursor: auto
 cx: 0px
 cy: 0px
+d: path('')
 direction: ltr
 display: block
 dominant-baseline: auto

diff --git a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-without-renderer-listing-expected.txt b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-without-renderer-listing-expected.txt
index 87fa4e0..9b78b80 100644
--- a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-without-renderer-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/computed-style-without-renderer-listing-expected.txt

@@ -138,6 +138,7 @@
 cursor: auto
 cx: 0px
 cy: 0px
+d: path('')
 direction: ltr
 display: none
 dominant-baseline: auto

diff --git a/third_party/WebKit/LayoutTests/fast/dom/elementsFromPoint/elementsFromPoint-inline.html b/third_party/WebKit/LayoutTests/fast/dom/elementsFromPoint/elementsFromPoint-inline.html
new file mode 100644
index 0000000..88771453
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dom/elementsFromPoint/elementsFromPoint-inline.html

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<div id="container">
+<span id="innerSpan1">This is in a inline element</span>
+<span id="innerSpan2"><span id="innerSpan3"><span id="innerSpan4">This is in culled inline elements</span></span></span>
+</div>
+<div id="log"></div>
+<script>
+test(function(t)
+{
+    var span = document.getElementById("innerSpan1");
+    var x = span.offsetLeft + span.offsetWidth / 2;
+    var y = span.offsetTop + span.offsetHeight / 2;
+
+    var elements = document.elementsFromPoint(x, y);
+    assert_equals(elements.length, 4);
+    assert_equals(elements[0].id, 'innerSpan1');
+    assert_equals(elements[1].id, 'container');
+    assert_equals(elements[2].nodeName, 'BODY');
+    assert_equals(elements[3].nodeName, 'HTML');
+
+    var span = document.getElementById("innerSpan4");
+    var x = span.offsetLeft + span.offsetWidth / 2;
+    var y = span.offsetTop + span.offsetHeight / 2;
+
+    var elements = document.elementsFromPoint(x, y);
+    assert_equals(elements.length, 6);
+    assert_equals(elements[0].id, 'innerSpan4');
+    assert_equals(elements[1].id, 'innerSpan3');
+    assert_equals(elements[2].id, 'innerSpan2');
+    assert_equals(elements[3].id, 'container');
+    assert_equals(elements[4].nodeName, 'BODY');
+    assert_equals(elements[5].nodeName, 'HTML');
+}, "elementsFromPoint should return all elements under a point");
+</script>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-align.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-align.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-align.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-align.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-legend-padding-unclipped-fieldset-border.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-legend-padding-unclipped-fieldset-border.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-pseudo-valid-style-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-pseudo-valid-style-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-pseudo-valid-style-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-pseudo-valid-style-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-pseudo-valid-style.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-pseudo-valid-style.html
similarity index 98%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-pseudo-valid-style.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-pseudo-valid-style.html
index 8929f603..e9b11f9e 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/fieldset-pseudo-valid-style.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-pseudo-valid-style.html

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
+<script src="../../../resources/js-test.js"></script>
 <style>
 :invalid { background: rgb(255, 0, 0); }
 :valid { background: rgb(0, 255, 0); }

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-width-nostretch-ifspecified-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-width-nostretch-ifspecified-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-width-nostretch-ifspecified-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-width-nostretch-ifspecified-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-width-nostretch-ifspecified.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-width-nostretch-ifspecified.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-width-nostretch-ifspecified.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-width-nostretch-ifspecified.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset-with-float.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-with-float.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/fieldset-with-float.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-with-float.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/float-before-fieldset.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/float-before-fieldset.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/float-before-fieldset.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/float-before-fieldset.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/inline-ignored-on-legend-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/inline-ignored-on-legend-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/inline-ignored-on-legend-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/inline-ignored-on-legend-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/inline-ignored-on-legend.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/inline-ignored-on-legend.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/inline-ignored-on-legend.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/inline-ignored-on-legend.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-absolute-position-auto-width-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-absolute-position-auto-width-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-absolute-position-auto-width-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-absolute-position-auto-width-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-absolute-position-auto-width.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-absolute-position-auto-width.html
similarity index 91%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-absolute-position-auto-width.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-absolute-position-auto-width.html
index 1686aa1..04388d2b7 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/legend-absolute-position-auto-width.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-absolute-position-auto-width.html

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
+<script src="../../../resources/js-test.js"></script>
 <style>
 fieldset {
     position: relative;

diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-access-key-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-access-key-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-access-key-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-access-key-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-access-key.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-access-key.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-access-key.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-access-key.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-horizontal-writing-mode-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-horizontal-writing-mode-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-horizontal-writing-mode-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-horizontal-writing-mode-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-horizontal-writing-mode.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-horizontal-writing-mode.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-horizontal-writing-mode.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-horizontal-writing-mode.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-vertical-writing-mode-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-vertical-writing-mode-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-vertical-writing-mode-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-vertical-writing-mode-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-vertical-writing-mode.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-vertical-writing-mode.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-vertical-writing-mode.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-vertical-writing-mode.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-with-before-border-horizontal-mode-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-with-before-border-horizontal-mode-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-with-before-border-horizontal-mode-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-with-before-border-horizontal-mode-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-with-before-border-horizontal-mode.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-with-before-border-horizontal-mode.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-after-margin-with-before-border-horizontal-mode.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-after-margin-with-before-border-horizontal-mode.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-display-none-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-display-none-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-display-none-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-display-none-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-display-none.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-display-none.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-display-none.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-display-none.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend/legend-focus.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-focus.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend/legend-focus.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-focus.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend/legend-form-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-form-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend/legend-form-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-form-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend/legend-form.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-form.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend/legend-form.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-form.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-small-after-margin-before-border-horizontal-mode-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-small-after-margin-before-border-horizontal-mode-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-small-after-margin-before-border-horizontal-mode-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-small-after-margin-before-border-horizontal-mode-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/legend-small-after-margin-before-border-horizontal-mode.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-small-after-margin-before-border-horizontal-mode.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/legend-small-after-margin-before-border-horizontal-mode.html
rename to third_party/WebKit/LayoutTests/fast/forms/fieldset/legend-small-after-margin-before-border-horizontal-mode.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/disabled-search-input-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/disabled-search-input-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/disabled-search-input-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/disabled-search-input-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/disabled-search-input.html b/third_party/WebKit/LayoutTests/fast/forms/search/disabled-search-input.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/disabled-search-input.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/disabled-search-input.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/input-search-press-escape-key-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/input-search-press-escape-key-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/input-search-press-escape-key-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/input-search-press-escape-key-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/input-search-press-escape-key.html b/third_party/WebKit/LayoutTests/fast/forms/search/input-search-press-escape-key.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/forms/input-search-press-escape-key.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/input-search-press-escape-key.html
index bcd5899..8833692 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/input-search-press-escape-key.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/input-search-press-escape-key.html

@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
-<script src="resources/common.js"></script>
+<script src="../../../resources/js-test.js"></script>
+<script src="../resources/common.js"></script>
 </head>
 <body>
 <input id="search" type="search" onsearch="searchEventDispatched()" />

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-abs-pos-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-abs-pos-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-abs-pos-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-abs-pos-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-abs-pos-cancel-button.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-abs-pos-cancel-button.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/forms/search-abs-pos-cancel-button.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-abs-pos-cancel-button.html
index ee85997..b1977640 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-abs-pos-cancel-button.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-abs-pos-cancel-button.html

@@ -1,7 +1,7 @@
 <html>
 <head>
     <title>Search Field with Transform</title>
-    <script src="resources/common.js"></script>
+    <script src="../resources/common.js"></script>
     <script type="text/javascript" charset="utf-8">
       if (window.testRunner)
         testRunner.dumpAsText();

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-events-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-events-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-events-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-events-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-events.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-events.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-events.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-events.html
index 6c4e5966..4f36dff35 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-events.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-events.html

@@ -1,7 +1,7 @@
 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
+<script src="../../../resources/js-test.js"></script>
 </head>
 <body>
 <p id="description"></p>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-mouseup-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-mouseup-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-mouseup-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-mouseup-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-mouseup.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-mouseup.html
similarity index 97%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-mouseup.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-mouseup.html
index 97c7aabc..21a3ef6 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-mouseup.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-mouseup.html

@@ -1,7 +1,7 @@
 <html>
 <head>
     <title></title>
-    <script src="resources/common.js"></script>
+    <script src="../resources/common.js"></script>
     <script>
         function test()
         {

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-style-sharing.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-style-sharing.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-button-style-sharing.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-button-style-sharing.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-in-invisible-elements-expected.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-in-invisible-elements-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-in-invisible-elements-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-in-invisible-elements-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-cancel-in-invisible-elements.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-in-invisible-elements.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-cancel-in-invisible-elements.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-cancel-in-invisible-elements.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-click-in-placeholder-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-click-in-placeholder-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-click-in-placeholder-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-click-in-placeholder-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-click-in-placeholder.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-click-in-placeholder.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-click-in-placeholder.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-click-in-placeholder.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-delete-while-cancel-button-clicked-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-delete-while-cancel-button-clicked-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-delete-while-cancel-button-clicked-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-delete-while-cancel-button-clicked-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-delete-while-cancel-button-clicked.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-delete-while-cancel-button-clicked.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-delete-while-cancel-button-clicked.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-delete-while-cancel-button-clicked.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-disabled-readonly-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-disabled-readonly-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-disabled-readonly-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-disabled-readonly-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-disabled-readonly.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-disabled-readonly.html
similarity index 97%
rename from third_party/WebKit/LayoutTests/fast/forms/search-disabled-readonly.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-disabled-readonly.html
index 955b3cf44..3992f4b 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-disabled-readonly.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-disabled-readonly.html

@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
-<script src="resources/common.js"></script>
+<script src="../../../resources/js-test.js"></script>
+<script src="../resources/common.js"></script>
 </head>
 <body>
 <input id="search_input" type="search" />

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-display-none-cancel-button.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-display-none-cancel-button.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-display-none-cancel-button.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-display-none-cancel-button.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-hidden-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-hidden-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-hidden-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-hidden-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-hidden-cancel-button.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-hidden-cancel-button.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-hidden-cancel-button.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-hidden-cancel-button.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-hide-cancel-on-cancel-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-hide-cancel-on-cancel-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-hide-cancel-on-cancel-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-hide-cancel-on-cancel-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-hide-cancel-on-cancel.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-hide-cancel-on-cancel.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/forms/search-hide-cancel-on-cancel.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-hide-cancel-on-cancel.html
index 63af9ee..6a406f7 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-hide-cancel-on-cancel.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-hide-cancel-on-cancel.html

@@ -1,7 +1,7 @@
 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 <html>
 <head>
-<script src="../../resources/js-test.js"></script>
+<script src="../../../resources/js-test.js"></script>
 </head>
 <body>
 <p id="description"></p>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-placeholder-value-changed-expected.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-placeholder-value-changed-expected.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-placeholder-value-changed-expected.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-placeholder-value-changed-expected.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-placeholder-value-changed.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-placeholder-value-changed.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-placeholder-value-changed.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-placeholder-value-changed.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-popup-crasher-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-popup-crasher-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-popup-crasher-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-popup-crasher-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-popup-crasher.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-popup-crasher.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-popup-crasher.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-popup-crasher.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-rtl.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-rtl.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/fast/forms/search-rtl.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-rtl.html
index 5b2b19d..5225b8d 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-rtl.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-rtl.html

@@ -1,7 +1,7 @@
 <html>
 <head>
     <meta http-equiv="content-type" content="text/html; charset=UTF-8">
-    <script src="resources/common.js"></script>
+    <script src="../resources/common.js"></script>
     <title></title>
 </head>
 <body>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-transformed-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-transformed-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-transformed-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-transformed-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-transformed.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-transformed.html
similarity index 96%
rename from third_party/WebKit/LayoutTests/fast/forms/search-transformed.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-transformed.html
index 9d9b855..7c0a8f7 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-transformed.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-transformed.html

@@ -2,7 +2,7 @@
 <head>
     <meta http-equiv="content-type" content="text/html; charset=UTF-8">
     <title>Search Field with Transform</title>
-    <script src="resources/common.js"></script>
+    <script src="../resources/common.js"></script>
 </head>
 <body>
     <p>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-vertical-alignment.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-vertical-alignment.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-vertical-alignment.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-vertical-alignment.html


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-zoomed-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/search/search-zoomed-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/search-zoomed-expected.txt
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-zoomed-expected.txt


diff --git a/third_party/WebKit/LayoutTests/fast/forms/search-zoomed.html b/third_party/WebKit/LayoutTests/fast/forms/search/search-zoomed.html
similarity index 96%
rename from third_party/WebKit/LayoutTests/fast/forms/search-zoomed.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/search-zoomed.html
index 40d6245..226b2e3 100644
--- a/third_party/WebKit/LayoutTests/fast/forms/search-zoomed.html
+++ b/third_party/WebKit/LayoutTests/fast/forms/search/search-zoomed.html

@@ -7,7 +7,7 @@
         zoom: 120%;
       }
     </style>
-    <script src="resources/common.js"></script>
+    <script src="../resources/common.js"></script>
 </head>
 <body>
     <p>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/searchfield-heights.html b/third_party/WebKit/LayoutTests/fast/forms/search/searchfield-heights.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/forms/searchfield-heights.html
rename to third_party/WebKit/LayoutTests/fast/forms/search/searchfield-heights.html


diff --git a/third_party/WebKit/LayoutTests/fast/frames/frame-set-rotation-hit-expected.png b/third_party/WebKit/LayoutTests/fast/frames/frame-set-rotation-hit-expected.png
index 78c480d..947f436 100644
--- a/third_party/WebKit/LayoutTests/fast/frames/frame-set-rotation-hit-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/frames/frame-set-rotation-hit-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/fast/frames/frame-set-scaling-hit-expected.png b/third_party/WebKit/LayoutTests/fast/frames/frame-set-scaling-hit-expected.png
new file mode 100644
index 0000000..e5429cf5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/frames/frame-set-scaling-hit-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest-expected.txt b/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest-expected.txt
new file mode 100644
index 0000000..7282117
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest-expected.txt

@@ -0,0 +1,12 @@
+Hit testing should respect clips established by contain: paint.
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS document.elementFromPoint(centerX, centerY).id is 'containTransform'
+PASS document.elementFromPoint(centerX, centerY).id is 'containAbsolute'
+PASS document.elementFromPoint(centerX, centerY).id is 'containFixed'
+PASS document.elementFromPoint(centerX, centerY).id is 'body'
+PASS document.elementFromPoint(centerX, centerY).id is 'body'
+PASS document.elementFromPoint(centerX, centerY).id is 'body'
+

diff --git a/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest.html b/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest.html
new file mode 100644
index 0000000..24f7bd19
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/hittesting/paint-containment-hittest.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<script src="../resources/js-test.js"></script>
+<script>
+var centerX;
+var centerY;
+function hitTestCenterOfElement(elementID, expectedID)
+{
+    var element = document.getElementById(elementID);
+    var rect = element.getBoundingClientRect();
+    centerX = rect.left + (rect.width / 2);
+    centerY = rect.top + (rect.height / 2);
+    shouldBe("document.elementFromPoint(centerX, centerY).id", "'" + expectedID + "'");
+}
+
+function test() {
+    hitTestCenterOfElement("containTransform", "containTransform");
+    hitTestCenterOfElement("containAbsolute", "containAbsolute");
+    hitTestCenterOfElement("containFixed", "containFixed");
+
+    hitTestCenterOfElement("transform", "body");
+    hitTestCenterOfElement("absolute", "body");
+    hitTestCenterOfElement("fixed", "body");
+}
+</script>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+}
+div > div {
+    background-color: red;
+}
+.paintContainment {
+    contain: paint;
+    margin: 10px;
+}
+#transform {
+    transform: translateZ(0) translateX(100px);
+}
+#absolute {
+    position: absolute;
+    top: 0px;
+    left: 100px;
+}
+#fixed {
+    position: fixed;
+    top: 0px;
+    left: 100px;
+}
+</style>
+<body onload="test()" id="body">
+    <p>Hit testing should respect clips established by contain: paint.</p>
+<div id="containTransform" class="paintContainment">
+    <div id="transform"></div>
+</div>
+<div id="containAbsolute" class="paintContainment">
+    <div id="absolute"></div>
+</div>
+<div id="containFixed" class="paintContainment">
+    <div id="fixed"></div>
+</div>
+<pre id="console"></pre>

diff --git a/third_party/WebKit/LayoutTests/media/encrypted-media/encrypted-media-syntax.html b/third_party/WebKit/LayoutTests/media/encrypted-media/encrypted-media-syntax.html
index 2fe6324..76b53684 100644
--- a/third_party/WebKit/LayoutTests/media/encrypted-media/encrypted-media-syntax.html
+++ b/third_party/WebKit/LayoutTests/media/encrypted-media/encrypted-media-syntax.html

@@ -206,6 +206,27 @@
                 }
             ];
 
+            // This function checks that calling createSession() with an
+            // unsupported session type doesn't create a MediaKeySession object.
+            // Since requestMediaKeySystemAccess() is called without specifying
+            // persistent sessions, only temporary sessions will be allowed.
+            function test_unsupported_sessionType(mediaKeys)
+            {
+                var mediaKeySession = 'test';
+
+                try {
+                    mediaKeySession = mediaKeys.createSession('persistent-license');
+                    assert_unreached('Session should not be created.');
+                } catch (error) {
+                    assert_equals(error.name, 'NotSupportedError');
+                    assert_not_equals(error.message, "");
+
+                    // Since createSession() failed, |mediaKeySession| is not
+                    // touched.
+                    assert_equals(mediaKeySession, 'test');
+                }
+            }
+
             async_test(function(test)
             {
                 navigator.requestMediaKeySystemAccess('org.w3.clearkey', [{}]).then(function(access) {
@@ -214,6 +235,7 @@
                     var sessionPromises = kCreateSessionExceptionsTestCases.map(function(testCase) {
                         return test_exception(testCase, mediaKeys);
                     });
+                    sessionPromises = sessionPromises.concat(test_unsupported_sessionType(mediaKeys));
 
                     assert_not_equals(sessionPromises.length, 0);
                     return Promise.all(sessionPromises);

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-align-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-align-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-align-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-with-float-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-with-float-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-with-float-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset-with-float-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/fieldset-with-float-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/float-before-fieldset-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/float-before-fieldset-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/float-before-fieldset-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/float-before-fieldset-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/fieldset/float-before-fieldset-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-cancel-button-style-sharing-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-cancel-button-style-sharing-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-cancel-button-style-sharing-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-cancel-button-style-sharing-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-display-none-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-display-none-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-display-none-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-display-none-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-rtl-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-rtl-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-rtl-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-vertical-alignment-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-vertical-alignment-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/search-vertical-alignment-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/search-vertical-alignment-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/forms/searchfield-heights-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/searchfield-heights-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/linux/fast/forms/searchfield-heights-expected.txt
rename to third_party/WebKit/LayoutTests/platform/linux/fast/forms/search/searchfield-heights-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-lion/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset-align-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset/fieldset-align-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset-align-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/fieldset/fieldset-align-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-cancel-button-style-sharing-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-cancel-button-style-sharing-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-cancel-button-style-sharing-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-cancel-button-style-sharing-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-display-none-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-display-none-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-display-none-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-display-none-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-rtl-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-rtl-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-rtl-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-vertical-alignment-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-vertical-alignment-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search-vertical-alignment-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/search-vertical-alignment-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/searchfield-heights-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/searchfield-heights-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/searchfield-heights-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/search/searchfield-heights-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-align-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-align-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-align-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-with-float-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-with-float-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-with-float-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset-with-float-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/fieldset-with-float-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/float-before-fieldset-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/float-before-fieldset-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/float-before-fieldset-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/float-before-fieldset-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/fieldset/float-before-fieldset-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-cancel-button-style-sharing-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-cancel-button-style-sharing-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-display-none-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-display-none-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-rtl-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-rtl-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-rtl-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-vertical-alignment-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/search-vertical-alignment-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/searchfield-heights-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/searchfield-heights-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/forms/searchfield-heights-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/fast/forms/search/searchfield-heights-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/frames/frame-set-scaling-hit-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/frames/frame-set-scaling-hit-expected.png
deleted file mode 100644
index e06308b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/frames/frame-set-scaling-hit-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-align-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-align-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-align-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-align-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-with-float-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-with-float-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-with-float-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-with-float-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-with-float-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-with-float-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset-with-float-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/fieldset-with-float-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/float-before-fieldset-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/float-before-fieldset-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/float-before-fieldset-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/float-before-fieldset-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/float-before-fieldset-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/float-before-fieldset-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/float-before-fieldset-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/fieldset/float-before-fieldset-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-cancel-button-style-sharing-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-cancel-button-style-sharing-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-cancel-button-style-sharing-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-cancel-button-style-sharing-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-display-none-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-display-none-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-display-none-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-display-none-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-rtl-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-rtl-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-rtl-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-vertical-alignment-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-vertical-alignment-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search-vertical-alignment-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/search-vertical-alignment-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/searchfield-heights-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/searchfield-heights-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/searchfield-heights-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/fast/forms/search/searchfield-heights-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-align-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-align-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-align-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-align-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-align-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-legend-padding-unclipped-fieldset-border-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-with-float-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-with-float-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-with-float-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset-with-float-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/fieldset-with-float-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/float-before-fieldset-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/float-before-fieldset-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/float-before-fieldset-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/float-before-fieldset-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/fieldset/float-before-fieldset-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-cancel-button-style-sharing-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-cancel-button-style-sharing-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-cancel-button-style-sharing-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-cancel-button-style-sharing-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-cancel-button-style-sharing-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-cancel-button-style-sharing-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-cancel-button-style-sharing-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-cancel-button-style-sharing-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-display-none-cancel-button-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-display-none-cancel-button-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-display-none-cancel-button-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-display-none-cancel-button-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-display-none-cancel-button-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-display-none-cancel-button-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-display-none-cancel-button-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-display-none-cancel-button-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-rtl-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-rtl-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-rtl-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-rtl-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-rtl-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-rtl-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-vertical-alignment-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-vertical-alignment-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-vertical-alignment-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-vertical-alignment-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/search-vertical-alignment-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-vertical-alignment-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/search-vertical-alignment-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/search-vertical-alignment-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/searchfield-heights-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/searchfield-heights-expected.png
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/searchfield-heights-expected.png
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/searchfield-heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/searchfield-heights-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/search/searchfield-heights-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/forms/searchfield-heights-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win/fast/forms/search/searchfield-heights-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/frames/frame-set-scaling-hit-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/frames/frame-set-scaling-hit-expected.png
deleted file mode 100644
index f1e5b154..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/fast/frames/frame-set-scaling-hit-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/svg/css/css-d-expected.svg b/third_party/WebKit/LayoutTests/svg/css/css-d-expected.svg
new file mode 100644
index 0000000..acc0cf6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/css/css-d-expected.svg

@@ -0,0 +1,8 @@
+<svg width="800" height="600" xmlns="http://www.w3.org/2000/svg">
+    <style>
+        #t {
+            fill: blue;
+        }
+    </style>
+    <path id="t" d="M 100 100 H 700 V 500 Z"/>
+</svg>

diff --git a/third_party/WebKit/LayoutTests/svg/css/css-d.svg b/third_party/WebKit/LayoutTests/svg/css/css-d.svg
new file mode 100644
index 0000000..491e18f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/css/css-d.svg

@@ -0,0 +1,9 @@
+<svg width="800" height="600" xmlns="http://www.w3.org/2000/svg">
+    <style>
+        #t {
+            fill: blue;
+            d: path("M 100 100 H 700 V 500 Z");
+        }
+    </style>
+    <path id="t" d="M 300 200 H 500 V 400 H 300 Z"/>
+</svg>

diff --git a/third_party/WebKit/LayoutTests/svg/css/getComputedStyle-listing-expected.txt b/third_party/WebKit/LayoutTests/svg/css/getComputedStyle-listing-expected.txt
index b86e045..23b13a53 100644
--- a/third_party/WebKit/LayoutTests/svg/css/getComputedStyle-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/css/getComputedStyle-listing-expected.txt

@@ -138,6 +138,7 @@
 cursor: auto
 cx: 0px
 cy: 0px
+d: path('')
 direction: ltr
 display: inline
 dominant-baseline: auto

diff --git a/third_party/WebKit/LayoutTests/svg/css/inherit-d-expected.svg b/third_party/WebKit/LayoutTests/svg/css/inherit-d-expected.svg
new file mode 100644
index 0000000..80a124e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/css/inherit-d-expected.svg

@@ -0,0 +1,5 @@
+<svg width="800" height="600" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <g>
+      <path fill="green" d="M 100 100 H 300 V 300 H 100 V 100" />
+    </g>
+</svg>

diff --git a/third_party/WebKit/LayoutTests/svg/css/inherit-d.svg b/third_party/WebKit/LayoutTests/svg/css/inherit-d.svg
new file mode 100644
index 0000000..afa5a983
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/css/inherit-d.svg

@@ -0,0 +1,29 @@
+<svg width="800" height="600" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <style>
+        #d0 {
+            fill: red;
+            d: path('M 200 100 A 100 100 0 1 1 200 100');
+        }
+
+        #p0 {
+            d: inherit;
+        }
+
+        #g0 {
+            fill: green;
+            d: path('M 100 100 H 300 V 300 H 100 V 100');
+        }
+
+        #u0 {
+            d: inherit;
+        }
+    </style>
+
+    <defs id="d0">
+      <path id="p0" />
+    </defs>
+
+    <g id="g0">
+      <use id="u0" xlink:href="#p0" />
+    </g>
+</svg>

diff --git a/third_party/WebKit/LayoutTests/svg/css/path-element.html b/third_party/WebKit/LayoutTests/svg/css/path-element.html
new file mode 100644
index 0000000..ba6b8b2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/css/path-element.html

@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<style>
+#test { d: path('M 0 0 H 30 V 40'); }
+</style>
+<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
+    <path id="test" d="M 10 190 H 190" />
+</svg>
+<script>
+'use strict';
+test(function() {
+    var test = document.getElementById("test");
+    assert_equals(test.getTotalLength(), 70);
+}, "Test for getTotalLength using computed style");
+test(function() {
+    var test = document.getElementById("test");
+    assert_equals(test.getPointAtLength(70).x, 30);
+    assert_equals(test.getPointAtLength(70).y, 40);
+}, "Test for getTotalLength using computed style");
+test(function() {
+    var test = document.getElementById("test");
+    assert_equals(test.getPathSegAtLength(50), 2);
+}, "Test for getPathSegAtLength using computed style");
+</script>

diff --git a/third_party/WebKit/LayoutTests/webexposed/css-properties-as-js-properties-expected.txt b/third_party/WebKit/LayoutTests/webexposed/css-properties-as-js-properties-expected.txt
index 335c6f3..524fb4fa32 100644
--- a/third_party/WebKit/LayoutTests/webexposed/css-properties-as-js-properties-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/css-properties-as-js-properties-expected.txt

@@ -87,6 +87,7 @@
 cursor
 cx
 cy
+d
 direction
 display
 dominantBaseline

diff --git a/third_party/WebKit/Source/core/animation/PathSVGInterpolation.cpp b/third_party/WebKit/Source/core/animation/PathSVGInterpolation.cpp
index dce4bd13..33d87a4 100644
--- a/third_party/WebKit/Source/core/animation/PathSVGInterpolation.cpp
+++ b/third_party/WebKit/Source/core/animation/PathSVGInterpolation.cpp

@@ -392,11 +392,8 @@
 
 PassRefPtr<PathSVGInterpolation> PathSVGInterpolation::maybeCreate(SVGPropertyBase* start, SVGPropertyBase* end, PassRefPtrWillBeRawPtr<SVGAnimatedPropertyBase> attribute)
 {
-    ASSERT(start->type() == SVGPath::classType());
-    ASSERT(end->type() == SVGPath::classType());
-
-    const SVGPathByteStream& startPath = static_cast<SVGPath*>(start)->byteStream();
-    const SVGPathByteStream& endPath = static_cast<SVGPath*>(end)->byteStream();
+    const SVGPathByteStream& startPath = toSVGPath(start)->pathValue()->byteStream();
+    const SVGPathByteStream& endPath = toSVGPath(end)->pathValue()->byteStream();
 
     if (startPath.size() != endPath.size())
         return nullptr;
@@ -438,7 +435,7 @@
     SVGPathByteStreamBuilder builder(*pathByteStream);
     SVGPathParser parser(&source, &builder);
     parser.parsePathDataFromSource(UnalteredParsing, false);
-    return SVGPath::create(pathByteStream.release());
+    return SVGPath::create(CSSPathValue::create(pathByteStream.release()));
 }
 
 PassRefPtrWillBeRawPtr<SVGPropertyBase> PathSVGInterpolation::interpolatedValue(SVGElement&) const

diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index a9098c02..f623675e 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi

@@ -3930,6 +3930,7 @@
             'layout/MultiColumnFragmentainerGroupTest.cpp',
             'layout/OverflowModelTest.cpp',
             'layout/PaginationTest.cpp',
+            'layout/PaintContainmentTest.cpp',
             'layout/compositing/CompositedLayerMappingTest.cpp',
             'layout/shapes/BoxShapeTest.cpp',
             'loader/FrameFetchContextTest.cpp',

diff --git a/third_party/WebKit/Source/core/css/CSSComputedStyleDeclaration.cpp b/third_party/WebKit/Source/core/css/CSSComputedStyleDeclaration.cpp
index da497fdda..d4cca18 100644
--- a/third_party/WebKit/Source/core/css/CSSComputedStyleDeclaration.cpp
+++ b/third_party/WebKit/Source/core/css/CSSComputedStyleDeclaration.cpp

@@ -327,6 +327,7 @@
     CSSPropertyWritingMode,
     CSSPropertyVectorEffect,
     CSSPropertyPaintOrder,
+    CSSPropertyD,
     CSSPropertyCx,
     CSSPropertyCy,
     CSSPropertyX,

diff --git a/third_party/WebKit/Source/core/css/CSSPathValue.cpp b/third_party/WebKit/Source/core/css/CSSPathValue.cpp
index 22b8689..c995671 100644
--- a/third_party/WebKit/Source/core/css/CSSPathValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSPathValue.cpp

@@ -5,22 +5,39 @@
 #include "config.h"
 #include "core/css/CSSPathValue.h"
 
+#include "core/svg/SVGPathUtilities.h"
+
 namespace blink {
 
-CSSPathValue::CSSPathValue(const String& pathString)
-    : CSSValue(PathClass)
-    , m_pathString(pathString)
+PassRefPtrWillBeRawPtr<CSSPathValue> CSSPathValue::create(const String& pathString)
 {
+    OwnPtr<SVGPathByteStream> byteStream = SVGPathByteStream::create();
+    buildByteStreamFromString(pathString, *byteStream);
+    return CSSPathValue::create(byteStream.release());
+}
+
+CSSPathValue::CSSPathValue(PassOwnPtr<SVGPathByteStream> pathByteStream)
+    : CSSValue(PathClass)
+    , m_pathByteStream(pathByteStream)
+{
+    ASSERT(m_pathByteStream);
+    buildPathFromByteStream(*m_pathByteStream, m_path);
+}
+
+CSSPathValue* CSSPathValue::emptyPathValue()
+{
+    DEFINE_STATIC_LOCAL(RefPtrWillBePersistent<CSSPathValue>, empty, (CSSPathValue::create(SVGPathByteStream::create())));
+    return empty.get();
 }
 
 String CSSPathValue::customCSSText() const
 {
-    return "path('" + m_pathString + "')";
+    return "path('" + pathString() + "')";
 }
 
 bool CSSPathValue::equals(const CSSPathValue& other) const
 {
-    return m_pathString == other.m_pathString;
+    return *m_pathByteStream == *other.m_pathByteStream;
 }
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSPathValue)
@@ -28,4 +45,9 @@
     CSSValue::traceAfterDispatch(visitor);
 }
 
+String CSSPathValue::pathString() const
+{
+    return buildStringFromByteStream(*m_pathByteStream);
+}
+
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/css/CSSPathValue.h b/third_party/WebKit/Source/core/css/CSSPathValue.h
index 7121ebb..21d6a36 100644
--- a/third_party/WebKit/Source/core/css/CSSPathValue.h
+++ b/third_party/WebKit/Source/core/css/CSSPathValue.h

@@ -6,6 +6,8 @@
 #define CSSPathValue_h
 
 #include "core/css/CSSValue.h"
+#include "core/svg/SVGPathByteStream.h"
+#include "platform/graphics/Path.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefPtr.h"
 
@@ -13,23 +15,30 @@
 
 class CSSPathValue : public CSSValue {
 public:
-    static PassRefPtrWillBeRawPtr<CSSPathValue> create(const String& pathString)
+    static PassRefPtrWillBeRawPtr<CSSPathValue> create(PassOwnPtr<SVGPathByteStream> pathByteStream)
     {
-        return adoptRefWillBeNoop(new CSSPathValue(pathString));
+        return adoptRefWillBeNoop(new CSSPathValue(pathByteStream));
     }
 
+    static PassRefPtrWillBeRawPtr<CSSPathValue> create(const String&);
+
+    static CSSPathValue* emptyPathValue();
+
     String customCSSText() const;
 
     bool equals(const CSSPathValue&) const;
 
     DECLARE_TRACE_AFTER_DISPATCH();
 
-    const String& pathString() const { return m_pathString; }
+    const SVGPathByteStream& byteStream() const { return *m_pathByteStream; }
+    String pathString() const;
+    const Path& path() const { return m_path; }
 
 private:
-    CSSPathValue(const String& pathString);
+    CSSPathValue(PassOwnPtr<SVGPathByteStream>);
 
-    String m_pathString;
+    OwnPtr<SVGPathByteStream> m_pathByteStream;
+    Path m_path;
 };
 
 DEFINE_CSS_VALUE_TYPE_CASTS(CSSPathValue, isPathValue());

diff --git a/third_party/WebKit/Source/core/css/CSSProperties.in b/third_party/WebKit/Source/core/css/CSSProperties.in
index fd18ed9..a0a6f8d 100644
--- a/third_party/WebKit/Source/core/css/CSSProperties.in
+++ b/third_party/WebKit/Source/core/css/CSSProperties.in

@@ -170,6 +170,7 @@
 cursor inherited, custom_all
 cx interpolable, svg, converter=convertLength
 cy interpolable, svg, converter=convertLength
+d runtime_flag=CSSPropertyD, svg, converter=convertPath
 display
 dominant-baseline inherited, svg
 empty-cells inherited, type_name=EEmptyCell

diff --git a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
index 827e58b5..4f41f9a 100644
--- a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
+++ b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp

@@ -57,6 +57,7 @@
 #include "core/style/PathStyleMotionPath.h"
 #include "core/style/QuotesData.h"
 #include "core/style/ShadowList.h"
+#include "core/svg/SVGPathUtilities.h"
 #include "platform/LengthFunctions.h"
 
 namespace blink {
@@ -2623,6 +2624,8 @@
     case CSSPropertyMarker:
         // the above properties are not yet implemented in the engine
         return nullptr;
+    case CSSPropertyD:
+        return svgStyle.d();
     case CSSPropertyCx:
         return zoomAdjustedPixelValueForLength(svgStyle.cx(), style);
     case CSSPropertyCy:
@@ -2708,7 +2711,7 @@
             list->append(cssValuePool().createIdentifierValue(CSSValueStyle));
         if (style.contain() & ContainsLayout)
             list->append(cssValuePool().createIdentifierValue(CSSValueLayout));
-        if (style.contain() & ContainsPaint)
+        if (style.containsPaint())
             list->append(cssValuePool().createIdentifierValue(CSSValuePaint));
         ASSERT(list->length());
         return list.release();

diff --git a/third_party/WebKit/Source/core/css/PropertySetCSSStyleDeclaration.cpp b/third_party/WebKit/Source/core/css/PropertySetCSSStyleDeclaration.cpp
index 21995497..60dfabca 100644
--- a/third_party/WebKit/Source/core/css/PropertySetCSSStyleDeclaration.cpp
+++ b/third_party/WebKit/Source/core/css/PropertySetCSSStyleDeclaration.cpp

@@ -292,7 +292,7 @@
         return;
 
     Element* parent = parentElement();
-    if (parent && parent->inActiveDocument() && parent->document().styleResolver())
+    if (parent)
         parent->document().styleEngine().attributeChangedForElement(HTMLNames::styleAttr, *parent);
     mutationScope.enqueueMutationRecord();
 }

diff --git a/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp b/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp
index 4f3f20d..a38e538 100644
--- a/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp
+++ b/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp

@@ -509,8 +509,7 @@
 void StylePropertySerializer::appendFontLonghandValueIfNotNormal(CSSPropertyID propertyID, StringBuilder& result, String& commonValue) const
 {
     int foundPropertyIndex = m_propertySet.findPropertyIndex(propertyID);
-    if (foundPropertyIndex == -1)
-        return;
+    ASSERT(foundPropertyIndex != -1);
 
     const CSSValue* val = m_propertySet.propertyAt(foundPropertyIndex).value();
     if (val->isPrimitiveValue() && toCSSPrimitiveValue(val)->getValueID() == CSSValueNormal) {
@@ -545,10 +544,12 @@
 
 String StylePropertySerializer::fontValue() const
 {
+    if (!isPropertyShorthandAvailable(fontShorthand()) && !shorthandHasOnlyInitialOrInheritedValue(fontShorthand()))
+        return emptyString();
+
     int fontSizePropertyIndex = m_propertySet.findPropertyIndex(CSSPropertyFontSize);
     int fontFamilyPropertyIndex = m_propertySet.findPropertyIndex(CSSPropertyFontFamily);
-    if (fontSizePropertyIndex == -1 || fontFamilyPropertyIndex == -1)
-        return emptyString();
+    ASSERT(fontSizePropertyIndex != -1 && fontFamilyPropertyIndex != -1);
 
     PropertyValueForSerializer fontSizeProperty = m_propertySet.propertyAt(fontSizePropertyIndex);
     PropertyValueForSerializer fontFamilyProperty = m_propertySet.propertyAt(fontFamilyPropertyIndex);

diff --git a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
index db5fa17..6cd632a 100644
--- a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
+++ b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp

@@ -62,13 +62,16 @@
             requiresDescendantInvalidation = true;
     }
 
-    if (invalidationLists.siblings.isEmpty() && !requiresDescendantInvalidation)
+    if (!requiresDescendantInvalidation && (invalidationLists.siblings.isEmpty() || !element.nextSibling()))
         return;
 
     element.setNeedsStyleInvalidation();
+
     PendingInvalidations& pendingInvalidations = ensurePendingInvalidations(element);
-    for (auto& invalidationSet : invalidationLists.siblings)
-        pendingInvalidations.siblings().append(invalidationSet);
+    if (element.nextSibling()) {
+        for (auto& invalidationSet : invalidationLists.siblings)
+            pendingInvalidations.siblings().append(invalidationSet);
+    }
 
     if (!requiresDescendantInvalidation)
         return;

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 6432b84..058d7a9 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

@@ -832,7 +832,7 @@
     return nullptr;
 }
 
-static bool consumeTransformOrigin(CSSParserTokenRange& range, CSSParserMode cssParserMode, UnitlessQuirk unitless, RefPtrWillBeRawPtr<CSSValue>& resultX, RefPtrWillBeRawPtr<CSSValue>& resultY)
+static bool consumeOneOrTwoValuedPosition(CSSParserTokenRange& range, CSSParserMode cssParserMode, UnitlessQuirk unitless, RefPtrWillBeRawPtr<CSSValue>& resultX, RefPtrWillBeRawPtr<CSSValue>& resultY)
 {
     RefPtrWillBeRawPtr<CSSPrimitiveValue> value1 = consumePositionComponent(range, cssParserMode, unitless);
     if (!value1)
@@ -849,7 +849,7 @@
 {
     RefPtrWillBeRawPtr<CSSValue> resultX = nullptr;
     RefPtrWillBeRawPtr<CSSValue> resultY = nullptr;
-    if (consumeTransformOrigin(range, cssParserMode, unitless, resultX, resultY)) {
+    if (consumeOneOrTwoValuedPosition(range, cssParserMode, unitless, resultX, resultY)) {
         RefPtrWillBeRawPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
         list->append(resultX.release());
         list->append(resultY.release());
@@ -1926,11 +1926,8 @@
     return list.release();
 }
 
-static PassRefPtrWillBeRawPtr<CSSValue> consumeMotionPath(CSSParserTokenRange& range)
+static PassRefPtrWillBeRawPtr<CSSValue> consumePath(CSSParserTokenRange& range)
 {
-    CSSValueID id = range.peek().id();
-    if (id == CSSValueNone)
-        return consumeIdent(range);
     // FIXME: Add support for <url>, <basic-shape>, <geometry-box>.
     if (range.peek().functionId() != CSSValuePath)
         return nullptr;
@@ -1942,12 +1939,22 @@
     if (functionArgs.peek().type() != StringToken)
         return nullptr;
     String pathString = functionArgs.consumeIncludingWhitespace().value();
-    Path path;
-    if (!buildPathFromString(pathString, path) || !functionArgs.atEnd())
+
+    OwnPtr<SVGPathByteStream> byteStream = SVGPathByteStream::create();
+    if (!buildByteStreamFromString(pathString, *byteStream) || !functionArgs.atEnd())
         return nullptr;
 
     range = functionRange;
-    return CSSPathValue::create(pathString);
+    return CSSPathValue::create(byteStream.release());
+}
+
+static PassRefPtrWillBeRawPtr<CSSValue> consumePathOrNone(CSSParserTokenRange& range)
+{
+    CSSValueID id = range.peek().id();
+    if (id == CSSValueNone)
+        return consumeIdent(range);
+
+    return consumePath(range);
 }
 
 static PassRefPtrWillBeRawPtr<CSSValue> consumeMotionRotation(CSSParserTokenRange& range, CSSParserMode cssParserMode)
@@ -2406,6 +2413,122 @@
     return list.release();
 }
 
+// This should go away once we drop support for -webkit-gradient
+static PassRefPtrWillBeRawPtr<CSSPrimitiveValue> consumeDeprecatedGradientPoint(CSSParserTokenRange& args, bool horizontal)
+{
+    if (args.peek().type() == IdentToken) {
+        if ((horizontal && consumeIdent<CSSValueLeft>(args)) || (!horizontal && consumeIdent<CSSValueTop>(args)))
+            return cssValuePool().createValue(0., CSSPrimitiveValue::UnitType::Percentage);
+        if ((horizontal && consumeIdent<CSSValueRight>(args)) || (!horizontal && consumeIdent<CSSValueBottom>(args)))
+            return cssValuePool().createValue(100., CSSPrimitiveValue::UnitType::Percentage);
+        if (consumeIdent<CSSValueCenter>(args))
+            return cssValuePool().createValue(50., CSSPrimitiveValue::UnitType::Percentage);
+        return nullptr;
+    }
+    RefPtrWillBeRawPtr<CSSPrimitiveValue> result = consumePercent(args, ValueRangeAll);
+    if (!result)
+        result = consumeNumber(args, ValueRangeAll);
+    return result;
+}
+
+// Used to parse colors for -webkit-gradient(...).
+static PassRefPtrWillBeRawPtr<CSSValue> consumeDeprecatedGradientStopColor(CSSParserTokenRange& args, CSSParserMode cssParserMode)
+{
+    if (args.peek().id() == CSSValueCurrentcolor)
+        return nullptr;
+    return consumeColor(args, cssParserMode);
+}
+
+static bool consumeDeprecatedGradientColorStop(CSSParserTokenRange& range, CSSGradientColorStop& stop, CSSParserMode cssParserMode)
+{
+    CSSValueID id = range.peek().functionId();
+    if (id != CSSValueFrom && id != CSSValueTo && id != CSSValueColorStop)
+        return false;
+
+    CSSParserTokenRange args = consumeFunction(range);
+    double position;
+    if (id == CSSValueFrom || id == CSSValueTo) {
+        position = (id == CSSValueFrom) ? 0 : 1;
+    } else {
+        ASSERT(id == CSSValueColorStop);
+        const CSSParserToken& arg = args.consumeIncludingWhitespace();
+        if (arg.type() == PercentageToken)
+            position = arg.numericValue() / 100.0;
+        else if (arg.type() == NumberToken)
+            position = arg.numericValue();
+        else
+            return false;
+
+        if (!consumeCommaIncludingWhitespace(args))
+            return false;
+    }
+
+    stop.m_position = cssValuePool().createValue(position, CSSPrimitiveValue::UnitType::Number);
+    stop.m_color = consumeDeprecatedGradientStopColor(args, cssParserMode);
+    return stop.m_color && args.atEnd();
+}
+
+static PassRefPtrWillBeRawPtr<CSSValue> consumeDeprecatedGradient(CSSParserTokenRange& args, CSSParserMode cssParserMode)
+{
+    RefPtrWillBeRawPtr<CSSGradientValue> result = nullptr;
+    CSSValueID id = args.consumeIncludingWhitespace().id();
+    bool isDeprecatedRadialGradient = (id == CSSValueRadial);
+    if (isDeprecatedRadialGradient)
+        result = CSSRadialGradientValue::create(NonRepeating, CSSDeprecatedRadialGradient);
+    else if (id == CSSValueLinear)
+        result = CSSLinearGradientValue::create(NonRepeating, CSSDeprecatedLinearGradient);
+    if (!result || !consumeCommaIncludingWhitespace(args))
+        return nullptr;
+
+    RefPtrWillBeRawPtr<CSSPrimitiveValue> point = consumeDeprecatedGradientPoint(args, true);
+    if (!point)
+        return nullptr;
+    result->setFirstX(point.release());
+    point = consumeDeprecatedGradientPoint(args, false);
+    if (!point)
+        return nullptr;
+    result->setFirstY(point.release());
+
+    if (!consumeCommaIncludingWhitespace(args))
+        return nullptr;
+
+    // For radial gradients only, we now expect a numeric radius.
+    if (isDeprecatedRadialGradient) {
+        RefPtrWillBeRawPtr<CSSPrimitiveValue> radius = consumeNumber(args, ValueRangeAll);
+        if (!radius || !consumeCommaIncludingWhitespace(args))
+            return nullptr;
+        toCSSRadialGradientValue(result.get())->setFirstRadius(radius.release());
+    }
+
+    point = consumeDeprecatedGradientPoint(args, true);
+    if (!point)
+        return nullptr;
+    result->setSecondX(point.release());
+    point = consumeDeprecatedGradientPoint(args, false);
+    if (!point)
+        return nullptr;
+    result->setSecondY(point.release());
+
+    // For radial gradients only, we now expect the second radius.
+    if (isDeprecatedRadialGradient) {
+        if (!consumeCommaIncludingWhitespace(args))
+            return nullptr;
+        RefPtrWillBeRawPtr<CSSPrimitiveValue> radius = consumeNumber(args, ValueRangeAll);
+        if (!radius)
+            return nullptr;
+        toCSSRadialGradientValue(result.get())->setSecondRadius(radius.release());
+    }
+
+    CSSGradientColorStop stop;
+    while (consumeCommaIncludingWhitespace(args)) {
+        if (!consumeDeprecatedGradientColorStop(args, stop, cssParserMode))
+            return nullptr;
+        result->addStop(stop);
+    }
+
+    return result.release();
+}
+
 static bool consumeGradientColorStops(CSSParserTokenRange& range, CSSParserMode cssParserMode, CSSGradientValue* gradient)
 {
     bool supportsColorHints = gradient->gradientType() == CSSLinearGradient || gradient->gradientType() == CSSRadialGradient;
@@ -2433,6 +2556,48 @@
     return gradient->stopCount() >= 2;
 }
 
+static PassRefPtrWillBeRawPtr<CSSValue> consumeDeprecatedRadialGradient(CSSParserTokenRange& args, CSSParserMode cssParserMode, CSSGradientRepeat repeating)
+{
+    RefPtrWillBeRawPtr<CSSRadialGradientValue> result = CSSRadialGradientValue::create(repeating, CSSPrefixedRadialGradient);
+    RefPtrWillBeRawPtr<CSSValue> centerX = nullptr;
+    RefPtrWillBeRawPtr<CSSValue> centerY = nullptr;
+    consumeOneOrTwoValuedPosition(args, cssParserMode, UnitlessQuirk::Forbid, centerX, centerY);
+    if ((centerX || centerY) && !consumeCommaIncludingWhitespace(args))
+        return nullptr;
+
+    result->setFirstX(toCSSPrimitiveValue(centerX.get()));
+    result->setSecondX(toCSSPrimitiveValue(centerX.get()));
+    result->setFirstY(toCSSPrimitiveValue(centerY.get()));
+    result->setSecondY(toCSSPrimitiveValue(centerY.get()));
+
+    RefPtrWillBeRawPtr<CSSPrimitiveValue> shape = consumeIdent<CSSValueCircle, CSSValueEllipse>(args);
+    RefPtrWillBeRawPtr<CSSPrimitiveValue> sizeKeyword = consumeIdent<CSSValueClosestSide, CSSValueClosestCorner, CSSValueFarthestSide, CSSValueFarthestCorner, CSSValueContain, CSSValueCover>(args);
+    if (!shape)
+        shape = consumeIdent<CSSValueCircle, CSSValueEllipse>(args);
+    result->setShape(shape);
+    result->setSizingBehavior(sizeKeyword);
+
+    // Or, two lengths or percentages
+    if (!shape && !sizeKeyword) {
+        RefPtrWillBeRawPtr<CSSPrimitiveValue> horizontalSize = nullptr;
+        RefPtrWillBeRawPtr<CSSPrimitiveValue> verticalSize = nullptr;
+        if ((horizontalSize = consumeLengthOrPercent(args, cssParserMode, ValueRangeAll))) {
+            verticalSize = consumeLengthOrPercent(args, cssParserMode, ValueRangeAll);
+            if (!verticalSize)
+                return nullptr;
+            consumeCommaIncludingWhitespace(args);
+            result->setEndHorizontalSize(horizontalSize);
+            result->setEndVerticalSize(verticalSize);
+        }
+    } else {
+        consumeCommaIncludingWhitespace(args);
+    }
+    if (!consumeGradientColorStops(args, cssParserMode, result.get()))
+        return nullptr;
+
+    return result.release();
+}
+
 static PassRefPtrWillBeRawPtr<CSSValue> consumeRadialGradient(CSSParserTokenRange& args, CSSParserMode cssParserMode, CSSGradientRepeat repeating)
 {
     RefPtrWillBeRawPtr<CSSRadialGradientValue> result = CSSRadialGradientValue::create(repeating, CSSRadialGradient);
@@ -2590,6 +2755,20 @@
         result = consumeLinearGradient(args, context.mode(), Repeating, CSSPrefixedLinearGradient);
     } else if (id == CSSValueLinearGradient) {
         result = consumeLinearGradient(args, context.mode(), NonRepeating, CSSLinearGradient);
+    } else if (id == CSSValueWebkitGradient) {
+        // FIXME: This should send a deprecation message.
+        if (context.useCounter())
+            context.useCounter()->count(UseCounter::DeprecatedWebKitGradient);
+        result = consumeDeprecatedGradient(args, context.mode());
+    } else if (id == CSSValueWebkitRadialGradient) {
+        // FIXME: This should send a deprecation message.
+        if (context.useCounter())
+            context.useCounter()->count(UseCounter::DeprecatedWebKitRadialGradient);
+        result = consumeDeprecatedRadialGradient(args, context.mode(), NonRepeating);
+    } else if (id == CSSValueWebkitRepeatingRadialGradient) {
+        if (context.useCounter())
+            context.useCounter()->count(UseCounter::DeprecatedWebKitRepeatingRadialGradient);
+        result = consumeDeprecatedRadialGradient(args, context.mode(), Repeating);
     } else if (id == CSSValueWebkitCrossFade) {
         result = consumeCrossFade(args, context);
     }
@@ -2786,8 +2965,10 @@
     case CSSPropertyWebkitTextDecorationsInEffect:
     case CSSPropertyTextDecorationLine:
         return consumeTextDecorationLine(m_range);
+    case CSSPropertyD:
+        return consumePath(m_range);
     case CSSPropertyMotionPath:
-        return consumeMotionPath(m_range);
+        return consumePathOrNone(m_range);
     case CSSPropertyMotionOffset:
         return consumeLengthOrPercent(m_range, m_context.mode(), ValueRangeAll);
     case CSSPropertyMotionRotation:

diff --git a/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp
index 4603de7..00977c0d 100644
--- a/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp

@@ -876,6 +876,7 @@
     case CSSPropertyFlexShrink:
     case CSSPropertyFlexFlow:
     case CSSPropertyStrokeDasharray:
+    case CSSPropertyD:
     case CSSPropertyWebkitColumnRule:
     case CSSPropertyWebkitColumnRuleColor:
     case CSSPropertyWebkitColumnRuleWidth:

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleAdjuster.cpp b/third_party/WebKit/Source/core/css/resolver/StyleAdjuster.cpp
index 9d584a4..e129549 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleAdjuster.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleAdjuster.cpp

@@ -203,7 +203,8 @@
         || style.hasIsolation()
         || style.position() == FixedPosition
         || isInTopLayer(element, style)
-        || hasWillChangeThatCreatesStackingContext(style)))
+        || hasWillChangeThatCreatesStackingContext(style)
+        || style.containsPaint()))
         style.setZIndex(0);
 
     if (doesNotInheritTextDecoration(style, element))

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
index 4ed7a7c8..6403a8d 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp

@@ -953,4 +953,9 @@
     return primitiveValue.getValueID() == CSSValueFromImage ? RespectImageOrientation : DoNotRespectImageOrientation;
 }
 
+CSSPathValue* StyleBuilderConverter::convertPath(StyleResolverState&, CSSValue& value)
+{
+    return toCSSPathValue(&value);
+}
+
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h
index dcc5c6a7..9b3027b7 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h

@@ -104,6 +104,7 @@
     static PassRefPtr<RotateTransformOperation> convertRotate(StyleResolverState&, const CSSValue&);
     static PassRefPtr<ScaleTransformOperation> convertScale(StyleResolverState&, const CSSValue&);
     static RespectImageOrientationEnum convertImageOrientation(StyleResolverState&, const CSSValue&);
+    static CSSPathValue* convertPath(StyleResolverState&, CSSValue&);
 };
 
 template <typename T>

diff --git a/third_party/WebKit/Source/core/css/themeWin.css b/third_party/WebKit/Source/core/css/themeWin.css
index be245b38..43cf9e1 100644
--- a/third_party/WebKit/Source/core/css/themeWin.css
+++ b/third_party/WebKit/Source/core/css/themeWin.css

@@ -92,14 +92,6 @@
     margin: auto 3px auto 2px;
 }
 
-input[type="search" i]::-webkit-search-results-button {
-    margin: auto 3px auto 2px;
-}
-
-input::-webkit-outer-spin-button {
-    margin: 0;
-}
-
 input[type="button" i], input[type="submit" i], input[type="reset" i], input[type="file" i]::-webkit-file-upload-button, button {
     padding: 1px 6px;
 }

diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 22a345e..dac35587 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp

@@ -1201,15 +1201,12 @@
 
     document().incDOMTreeVersion();
 
-    StyleResolver* styleResolver = document().styleResolver();
-
     if (name == HTMLNames::idAttr) {
         AtomicString oldId = elementData()->idForStyleResolution();
         AtomicString newId = makeIdForStyleResolution(newValue, document().inQuirksMode());
         if (newId != oldId) {
             elementData()->setIdForStyleResolution(newId);
-            if (inActiveDocument() && styleResolver)
-                document().styleEngine().idChangedForElement(oldId, newId, *this);
+            document().styleEngine().idChangedForElement(oldId, newId, *this);
         }
     } else if (name == classAttr) {
         classAttributeChanged(newValue);
@@ -1226,10 +1223,6 @@
 
     invalidateNodeListCachesInAncestors(&name, this);
 
-    // If there is currently no StyleResolver, we can't be sure that this attribute change won't affect style.
-    if (!styleResolver)
-        setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::fromAttribute(name));
-
     if (inDocument()) {
         if (AXObjectCache* cache = document().existingAXObjectCache())
             cache->handleAttributeChanged(name, this);
@@ -1287,9 +1280,6 @@
 
 void Element::classAttributeChanged(const AtomicString& newClassString)
 {
-    StyleResolver* styleResolver = document().styleResolver();
-    bool testShouldInvalidateStyle = inActiveDocument() && styleResolver;
-
     ASSERT(elementData());
     ClassStringContent classStringContentType = classStringHasClassName(newClassString);
     const bool shouldFoldCase = document().inQuirksMode();
@@ -1297,12 +1287,10 @@
         const SpaceSplitString oldClasses = elementData()->classNames();
         elementData()->setClass(newClassString, shouldFoldCase);
         const SpaceSplitString& newClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            document().styleEngine().classChangedForElement(oldClasses, newClasses, *this);
+        document().styleEngine().classChangedForElement(oldClasses, newClasses, *this);
     } else {
         const SpaceSplitString& oldClasses = elementData()->classNames();
-        if (testShouldInvalidateStyle)
-            document().styleEngine().classChangedForElement(oldClasses, *this);
+        document().styleEngine().classChangedForElement(oldClasses, *this);
         if (classStringContentType == ClassStringContent::WhiteSpaceOnly)
             elementData()->setClass(newClassString, shouldFoldCase);
         else
@@ -1876,9 +1864,7 @@
     // like HTMLSelectElement.
     if (document().inStyleRecalc())
         return;
-    StyleResolver* styleResolver = document().styleResolver();
-    if (inActiveDocument() && styleResolver)
-        document().styleEngine().pseudoStateChangedForElement(pseudo, *this);
+    document().styleEngine().pseudoStateChangedForElement(pseudo, *this);
 }
 
 void Element::setAnimationStyleChange(bool animationStyleChange)
@@ -3126,9 +3112,7 @@
     }
 
     if (oldValue != newValue) {
-        if (inActiveDocument() && document().styleResolver())
-            document().styleEngine().attributeChangedForElement(name, *this);
-
+        document().styleEngine().attributeChangedForElement(name, *this);
         if (isUpgradedCustomElement())
             CustomElement::attributeDidChange(this, name.localName(), oldValue, newValue);
     }

diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.cpp b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
index d5d9941d1c..0f96af7 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.cpp

@@ -627,9 +627,21 @@
     document().setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::create(StyleChangeReason::PlatformColorChange));
 }
 
+bool StyleEngine::shouldSkipInvalidationFor(const Element& element) const
+{
+    if (!resolver())
+        return true;
+    if (!element.inActiveDocument())
+        return true;
+    if (!element.parentNode())
+        return true;
+    return element.parentNode()->styleChangeType() >= SubtreeStyleChange;
+}
+
 void StyleEngine::classChangedForElement(const SpaceSplitString& changedClasses, Element& element)
 {
-    ASSERT(isMaster());
+    if (shouldSkipInvalidationFor(element))
+        return;
     InvalidationLists invalidationLists;
     unsigned changedSize = changedClasses.size();
     RuleFeatureSet& ruleFeatureSet = ensureResolver().ensureUpdatedRuleFeatureSet();
@@ -640,7 +652,9 @@
 
 void StyleEngine::classChangedForElement(const SpaceSplitString& oldClasses, const SpaceSplitString& newClasses, Element& element)
 {
-    ASSERT(isMaster());
+    if (shouldSkipInvalidationFor(element))
+        return;
+
     if (!oldClasses.size()) {
         classChangedForElement(newClasses, element);
         return;
@@ -681,7 +695,9 @@
 
 void StyleEngine::attributeChangedForElement(const QualifiedName& attributeName, Element& element)
 {
-    ASSERT(isMaster());
+    if (shouldSkipInvalidationFor(element))
+        return;
+
     InvalidationLists invalidationLists;
     ensureResolver().ensureUpdatedRuleFeatureSet().collectInvalidationSetsForAttribute(invalidationLists, element, attributeName);
     m_styleInvalidator.scheduleInvalidationSetsForElement(invalidationLists, element);
@@ -689,7 +705,9 @@
 
 void StyleEngine::idChangedForElement(const AtomicString& oldId, const AtomicString& newId, Element& element)
 {
-    ASSERT(isMaster());
+    if (shouldSkipInvalidationFor(element))
+        return;
+
     InvalidationLists invalidationLists;
     RuleFeatureSet& ruleFeatureSet = ensureResolver().ensureUpdatedRuleFeatureSet();
     if (!oldId.isEmpty())
@@ -701,7 +719,9 @@
 
 void StyleEngine::pseudoStateChangedForElement(CSSSelector::PseudoType pseudoType, Element& element)
 {
-    ASSERT(isMaster());
+    if (shouldSkipInvalidationFor(element))
+        return;
+
     InvalidationLists invalidationLists;
     ensureResolver().ensureUpdatedRuleFeatureSet().collectInvalidationSetsForPseudoClass(invalidationLists, element, pseudoType);
     m_styleInvalidator.scheduleInvalidationSetsForElement(invalidationLists, element);

diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.h b/third_party/WebKit/Source/core/dom/StyleEngine.h
index 931a72ca..8c01e98 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.h
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.h

@@ -218,6 +218,8 @@
 
     void updateActiveStyleSheetsInShadow(StyleResolverUpdateMode, TreeScope*, UnorderedTreeScopeSet& treeScopesRemoved);
 
+    bool shouldSkipInvalidationFor(const Element&) const;
+
     RawPtrWillBeMember<Document> m_document;
     bool m_isMaster;
 

diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 481ab6e5..0dc1740 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp

@@ -2290,29 +2290,12 @@
 
 Color FrameView::documentBackgroundColor() const
 {
-    // <https://bugs.webkit.org/show_bug.cgi?id=59540> We blend the background color of
-    // the document and the body against the base background color of the frame view.
-    // Background images are unfortunately impractical to include.
-
+    // The LayoutView's background color is set in Document::inheritHtmlAndBodyElementStyles.
+    // Blend this with the base background color of the FrameView. This should match the color
+    // drawn by ViewPainter::paintBoxDecorationBackground.
     Color result = baseBackgroundColor();
-    if (!frame().document())
-        return result;
-
-    Element* htmlElement = frame().document()->documentElement();
-    Element* bodyElement = frame().document()->body();
-
-    // We take the aggregate of the base background color
-    // the <html> background color, and the <body>
-    // background color to find the document color. The
-    // addition of the base background color is not
-    // technically part of the document background, but it
-    // otherwise poses problems when the aggregate is not
-    // fully opaque.
-    if (htmlElement && htmlElement->layoutObject())
-        result = result.blend(htmlElement->layoutObject()->resolveColor(CSSPropertyBackgroundColor));
-    if (bodyElement && bodyElement->layoutObject())
-        result = result.blend(bodyElement->layoutObject()->resolveColor(CSSPropertyBackgroundColor));
-
+    if (LayoutObject* documentLayoutObject = layoutView())
+        result = result.blend(documentLayoutObject->resolveColor(CSSPropertyBackgroundColor));
     return result;
 }
 

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.cpp b/third_party/WebKit/Source/core/frame/UseCounter.cpp
index e303d571..6397d00f 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.cpp
+++ b/third_party/WebKit/Source/core/frame/UseCounter.cpp

@@ -550,6 +550,7 @@
     case CSSPropertyVariable: return 515;
     case CSSPropertyFontDisplay: return 516;
     case CSSPropertyContain: return 517;
+    case CSSPropertyD: return 518;
 
     // 1. Add new features above this line (don't change the assigned numbers of the existing
     // items).
@@ -566,7 +567,7 @@
     return 0;
 }
 
-static int maximumCSSSampleId() { return 517; }
+static int maximumCSSSampleId() { return 518; }
 
 void UseCounter::muteForInspector()
 {

diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 3e18330..ecc2c5f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp

@@ -1007,7 +1007,7 @@
 {
     return isInlineBlockOrInlineTable() || isFloatingOrOutOfFlowPositioned() || hasOverflowClip() || isFlexItemIncludingDeprecated()
         || style()->specifiesColumns() || isLayoutFlowThread() || isTableCell() || isTableCaption() || isFieldset() || isWritingModeRoot()
-        || isDocumentElement() || isColumnSpanAll() || isGridItem();
+        || isDocumentElement() || isColumnSpanAll() || isGridItem() || style()->containsPaint();
 }
 
 void LayoutBlock::updateBlockChildDirtyBitsBeforeLayout(bool relayoutChildren, LayoutBox& child)

diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 31f903a..f8986d14 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp

@@ -4058,7 +4058,7 @@
 
 bool LayoutBox::avoidsFloats() const
 {
-    return isAtomicInlineLevel() || shouldBeConsideredAsReplaced(node()) || hasOverflowClip() || isHR() || isLegend() || isWritingModeRoot() || isFlexItemIncludingDeprecated();
+    return isAtomicInlineLevel() || shouldBeConsideredAsReplaced(node()) || hasOverflowClip() || isHR() || isLegend() || isWritingModeRoot() || isFlexItemIncludingDeprecated() || style()->containsPaint();
 }
 
 bool LayoutBox::hasNonCompositedScrollbars() const

diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index 5d5ecdd3..411183e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp

@@ -1015,7 +1015,7 @@
     // the child can no longer do so. This can happen if a block becomes floating or out-of-flow and is moved
     // to an anonymous block. Remove all floats from their float-lists immediately as markAllDescendantsWithFloatsForLayout
     // won't attempt to remove floats from parents that have inline-flow if we try later.
-    if (child->isLayoutBlockFlow() && toBoxModelObject->childrenInline() && !child->childrenInline() && !childrenInline()) {
+    if (child->isLayoutBlockFlow() && toBoxModelObject->childrenInline() && !childrenInline()) {
         toLayoutBlockFlow(child)->removeFloatingObjectsFromDescendants();
         ASSERT(!toLayoutBlockFlow(child)->containsFloats());
     }

diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index 92a2792f..38409e2 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp

@@ -805,7 +805,9 @@
         // We can not use addNodeToListBasedTestResult to determine if we fully enclose the hit-test area
         // because it can only handle rectangular targets.
         result.addNodeToListBasedTestResult(node(), locationInContainer);
-        return regionResult.contains(tmpLocation.boundingBox());
+        // We check if using list-based hit-test to continue hit testing.
+        if (!result.hitTestRequest().penetratingList())
+            return regionResult.contains(tmpLocation.boundingBox());
     }
     return false;
 }
@@ -1140,6 +1142,12 @@
     return offset;
 }
 
+PaintLayerType LayoutInline::layerTypeRequired() const
+{
+    return isInFlowPositioned() || createsGroup() || hasClipPath() || style()->shouldCompositeForCurrentAnimations()
+        ||  style()->hasCompositorProxy() || style()->containsPaint() ? NormalPaintLayer : NoPaintLayer;
+}
+
 void LayoutInline::mapLocalToContainer(const LayoutBoxModelObject* paintInvalidationContainer, TransformState& transformState, MapCoordinatesFlags mode, bool* wasFixed, const PaintInvalidationState* paintInvalidationState) const
 {
     if (paintInvalidationContainer == this)

diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.h b/third_party/WebKit/Source/core/layout/LayoutInline.h
index 2987d26..354505c 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.h
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.h

@@ -228,7 +228,7 @@
 
     bool nodeAtPoint(HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction) final;
 
-    PaintLayerType layerTypeRequired() const override { return isInFlowPositioned() || createsGroup() || hasClipPath() || style()->shouldCompositeForCurrentAnimations() || style()->hasCompositorProxy() ? NormalPaintLayer : NoPaintLayer; }
+    PaintLayerType layerTypeRequired() const override;
 
     LayoutUnit offsetLeft() const final;
     LayoutUnit offsetTop() const final;

diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index a45e243..9dc0b509 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h

@@ -698,7 +698,7 @@
 
     bool hasClip() const { return isOutOfFlowPositioned() && !style()->hasAutoClip(); }
     bool hasOverflowClip() const { return m_bitfields.hasOverflowClip(); }
-    bool hasClipOrOverflowClip() const { return hasClip() || hasOverflowClip(); }
+    bool hasClipRelatedProperty() const { return hasClip() || hasOverflowClip() || style()->containsPaint(); }
 
     bool hasTransformRelatedProperty() const { return m_bitfields.hasTransformRelatedProperty(); }
     bool hasMask() const { return style() && style()->hasMask(); }
@@ -930,7 +930,7 @@
 
     bool canContainFixedPositionObjects() const
     {
-        return isLayoutView() || (hasTransformRelatedProperty() && isLayoutBlock()) || isSVGForeignObject();
+        return isLayoutView() || (hasTransformRelatedProperty() && isLayoutBlock()) || isSVGForeignObject() || style()->containsPaint();
     }
 
     // Convert the given local point to absolute coordinates

diff --git a/third_party/WebKit/Source/core/layout/PaintContainmentTest.cpp b/third_party/WebKit/Source/core/layout/PaintContainmentTest.cpp
new file mode 100644
index 0000000..36547ba
--- /dev/null
+++ b/third_party/WebKit/Source/core/layout/PaintContainmentTest.cpp

@@ -0,0 +1,55 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+
+#include "core/layout/LayoutBlock.h"
+#include "core/layout/LayoutInline.h"
+#include "core/layout/LayoutTestHelper.h"
+#include "core/paint/PaintLayer.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+
+class PaintContainmentTest : public RenderingTest {
+};
+
+static void checkIsClippingStackingContextAndContainer(LayoutBoxModelObject& obj)
+{
+    EXPECT_TRUE(obj.canContainFixedPositionObjects());
+    EXPECT_TRUE(obj.hasClipRelatedProperty());
+    EXPECT_TRUE(obj.style()->containsPaint());
+
+    // TODO(leviw): Ideally, we wouldn't require a paint layer to handle the clipping
+    // and stacking performed by paint containment.
+    ASSERT(obj.layer());
+    PaintLayer* layer = obj.layer();
+    EXPECT_TRUE(layer->stackingNode() && layer->stackingNode()->isStackingContext());
+}
+
+TEST_F(PaintContainmentTest, BlockPaintContainment)
+{
+    setBodyInnerHTML("<div id='div' style='contain: paint'></div>");
+    Element* div = document().getElementById(AtomicString("div"));
+    ASSERT(div);
+    LayoutObject* obj = div->layoutObject();
+    ASSERT(obj && obj->isLayoutBlock());
+    LayoutBlock& block = toLayoutBlock(*obj);
+    EXPECT_TRUE(block.createsNewFormattingContext());
+    EXPECT_FALSE(block.canBeScrolledAndHasScrollableArea());
+    checkIsClippingStackingContextAndContainer(block);
+}
+
+TEST_F(PaintContainmentTest, InlinePaintContainment)
+{
+    setBodyInnerHTML("<div><span id='test' style='contain: paint'>Foo</span></div>");
+    Element* span = document().getElementById(AtomicString("test"));
+    ASSERT(span);
+    LayoutObject* obj = span->layoutObject();
+    ASSERT(obj && obj->isInline());
+    LayoutInline& layoutInline = toLayoutInline(*obj);
+    checkIsClippingStackingContextAndContainer(layoutInline);
+}
+
+}

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
index 485f65d7..5467894 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

@@ -568,7 +568,7 @@
 static IntRect clipBox(LayoutBox* layoutObject)
 {
     LayoutRect result = LayoutRect(LayoutRect::infiniteIntRect());
-    if (layoutObject->hasOverflowClip())
+    if (layoutObject->hasOverflowClip() || layoutObject->style()->containsPaint())
         result = layoutObject->overflowClipRect(LayoutPoint());
 
     if (layoutObject->hasClip())

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp
index 851df37..3ce313b 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp

@@ -37,7 +37,7 @@
             for (current = current->parent(); current && !current->canContainFixedPositionObjects(); current = current->parent()) {
                 // All types of clips apply to fixed-position descendants of other fixed-position elements.
                 // Note: it's unclear whether this is what the spec says. Firefox does not clip, but Chrome does.
-                if (current->style()->position() == FixedPosition && current->hasClipOrOverflowClip()) {
+                if (current->style()->position() == FixedPosition && current->hasClipRelatedProperty()) {
                     ASSERT(current->hasLayer());
                     return static_cast<const LayoutBoxModelObject*>(current)->layer();
                 }
@@ -56,7 +56,7 @@
         if (current->hasLayer())
             return static_cast<const LayoutBoxModelObject*>(current)->layer();
         // Having clip or overflow clip forces the LayoutObject to become a layer.
-        ASSERT(!current->hasClipOrOverflowClip());
+        ASSERT(!current->hasClipRelatedProperty());
     }
     ASSERT_NOT_REACHED();
     return nullptr;
@@ -82,7 +82,7 @@
         if (current == clippingLayer)
             return foundInterveningClip;
 
-        if (current->layoutObject()->hasClipOrOverflowClip() && !clippingLayoutObject->isDescendantOf(current->layoutObject()))
+        if (current->layoutObject()->hasClipRelatedProperty() && !clippingLayoutObject->isDescendantOf(current->layoutObject()))
             foundInterveningClip = true;
 
         if (const LayoutObject* container = current->clippingContainer()) {
@@ -130,10 +130,10 @@
             bool layerIsFixedPosition = layer->layoutObject()->style()->position() == FixedPosition;
             properties.nearestFixedPositionLayer = layerIsFixedPosition ? layer : parent->nearestFixedPositionLayer();
 
-            if (info.hasAncestorWithClipOrOverflowClip) {
+            if (info.hasAncestorWithClipRelatedProperty) {
                 const PaintLayer* parentLayerOnClippingContainerChain = findParentLayerOnClippingContainerChain(layer);
-                const bool parentHasClipOrOverflowClip = parentLayerOnClippingContainerChain->layoutObject()->hasClipOrOverflowClip();
-                properties.clippingContainer = parentHasClipOrOverflowClip ? parentLayerOnClippingContainerChain->layoutObject() : parentLayerOnClippingContainerChain->clippingContainer();
+                const bool parentHasClipRelatedProperty = parentLayerOnClippingContainerChain->layoutObject()->hasClipRelatedProperty();
+                properties.clippingContainer = parentHasClipRelatedProperty ? parentLayerOnClippingContainerChain->layoutObject() : parentLayerOnClippingContainerChain->clippingContainer();
             }
 
             if (info.lastScrollingAncestor) {
@@ -167,8 +167,8 @@
     if (layer->scrollsOverflow())
         info.lastScrollingAncestor = layer;
 
-    if (layer->layoutObject()->hasClipOrOverflowClip())
-        info.hasAncestorWithClipOrOverflowClip = true;
+    if (layer->layoutObject()->hasClipRelatedProperty())
+        info.hasAncestorWithClipRelatedProperty = true;
 
     if (layer->layoutObject()->hasClipPath())
         info.hasAncestorWithClipPath = true;

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.h b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.h
index 0c646a4..d182c926 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.h
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.h

@@ -35,7 +35,7 @@
             : ancestorStackingContext(nullptr)
             , enclosingCompositedLayer(nullptr)
             , lastScrollingAncestor(nullptr)
-            , hasAncestorWithClipOrOverflowClip(false)
+            , hasAncestorWithClipRelatedProperty(false)
             , hasAncestorWithClipPath(false)
         {
         }
@@ -48,7 +48,7 @@
         // actually controls the scrolling of this layer, which we find on the
         // containing block chain.
         PaintLayer* lastScrollingAncestor;
-        bool hasAncestorWithClipOrOverflowClip;
+        bool hasAncestorWithClipRelatedProperty;
         bool hasAncestorWithClipPath;
     };
 

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp
index a58e642..69d03b01 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp

@@ -166,7 +166,7 @@
 
         // FIXME: This should move into CompositingReasonFinder::potentialCompositingReasonsFromStyle, but
         // theres a poor interaction with LayoutTextControlSingleLine, which sets this hasOverflowClip directly.
-        if (layer->layoutObject()->hasClipOrOverflowClip())
+        if (layer->layoutObject()->hasClipRelatedProperty())
             subtreeReasons |= CompositingReasonClipsCompositingDescendants;
 
         if (layer->layoutObject()->style()->position() == FixedPosition)

diff --git a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
index 969d1ef6..4146ce84 100644
--- a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp

@@ -777,7 +777,7 @@
 // into the hierarchy between this layer and its children in the z-order hierarchy.
 bool PaintLayerCompositor::clipsCompositingDescendants(const PaintLayer* layer) const
 {
-    return layer->hasCompositingDescendant() && layer->layoutObject()->hasClipOrOverflowClip();
+    return layer->hasCompositingDescendant() && layer->layoutObject()->hasClipRelatedProperty();
 }
 
 // If an element has composited negative z-index children, those children paint in front of the

diff --git a/third_party/WebKit/Source/core/loader/ImageLoader.cpp b/third_party/WebKit/Source/core/loader/ImageLoader.cpp
index d4bc457..d8ccf60 100644
--- a/third_party/WebKit/Source/core/loader/ImageLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/ImageLoader.cpp

@@ -487,8 +487,10 @@
 
     updateLayoutObject();
 
-    if (m_image && m_image->image() && m_image->image()->isSVGImage())
+    if (m_image && m_image->image() && m_image->image()->isSVGImage()) {
+        toSVGImage(m_image->image())->assertSubresourcesLoaded();
         toSVGImage(m_image->image())->updateUseCounters(element()->document());
+    }
 
     if (!m_hasPendingLoadEvent)
         return;

diff --git a/third_party/WebKit/Source/core/paint/BoxClipper.cpp b/third_party/WebKit/Source/core/paint/BoxClipper.cpp
index ac13973..09f10cf 100644
--- a/third_party/WebKit/Source/core/paint/BoxClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/BoxClipper.cpp

@@ -24,9 +24,10 @@
         return;
 
     bool isControlClip = m_box.hasControlClip();
-    bool isOverflowClip = m_box.hasOverflowClip() && !m_box.layer()->isSelfPaintingLayer();
+    bool isOverflowOrContainmentClip = (m_box.hasOverflowClip() && !m_box.layer()->isSelfPaintingLayer())
+        || m_box.style()->containsPaint();
 
-    if (!isControlClip && !isOverflowClip)
+    if (!isControlClip && !isOverflowOrContainmentClip)
         return;
 
     LayoutRect clipRect = isControlClip ? m_box.controlClipRect(accumulatedOffset) : m_box.overflowClipRect(accumulatedOffset);
@@ -64,7 +65,7 @@
     if (m_clipType == DisplayItem::UninitializedType)
         return;
 
-    ASSERT(m_box.hasControlClip() || (m_box.hasOverflowClip() && !m_box.layer()->isSelfPaintingLayer()));
+    ASSERT(m_box.hasControlClip() || (m_box.hasOverflowClip() && !m_box.layer()->isSelfPaintingLayer()) || m_box.style()->containsPaint());
     m_paintInfo.context.paintController().endItem<EndClipDisplayItem>(m_box, DisplayItem::clipTypeToEndClipType(m_clipType));
 }
 

diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index a764e09..e28864f 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp

@@ -752,15 +752,15 @@
     }
 
     // Subtract our parent's scroll offset.
-    if (PaintLayer* positionedParent = layoutObject()->isOutOfFlowPositioned() ? enclosingPositionedAncestor() : nullptr) {
+    if (PaintLayer* containingLayer = layoutObject()->isOutOfFlowPositioned() ? containingLayerForOutOfFlowPositioned() : nullptr) {
         // For positioned layers, we subtract out the enclosing positioned layer's scroll offset.
-        if (positionedParent->layoutObject()->hasOverflowClip()) {
-            IntSize offset = positionedParent->layoutBox()->scrolledContentOffset();
+        if (containingLayer->layoutObject()->hasOverflowClip()) {
+            IntSize offset = containingLayer->layoutBox()->scrolledContentOffset();
             localPoint -= offset;
         }
 
-        if (positionedParent->layoutObject()->isInFlowPositioned() && positionedParent->layoutObject()->isLayoutInline()) {
-            LayoutSize offset = toLayoutInline(positionedParent->layoutObject())->offsetForInFlowPositionedInline(*toLayoutBox(layoutObject()));
+        if (containingLayer->layoutObject()->isInFlowPositioned() && containingLayer->layoutObject()->isLayoutInline()) {
+            LayoutSize offset = toLayoutInline(containingLayer->layoutObject())->offsetForInFlowPositionedInline(*toLayoutBox(layoutObject()));
             localPoint += offset;
         }
     } else if (parent() && parent()->layoutObject()->hasOverflowClip()) {
@@ -818,19 +818,28 @@
     return FloatPoint(floatValueForLength(style.perspectiveOriginX(), borderBox.width().toFloat()), floatValueForLength(style.perspectiveOriginY(), borderBox.height().toFloat()));
 }
 
-static inline bool isFixedPositionedContainer(PaintLayer* layer)
+static inline bool isContainerForFixedPositioned(PaintLayer* layer)
 {
     return layer->isRootLayer() || layer->hasTransformRelatedProperty();
 }
 
-PaintLayer* PaintLayer::enclosingPositionedAncestor(const PaintLayer* ancestor, bool* skippedAncestor) const
+static inline bool isContainerForPositioned(PaintLayer* layer)
+{
+    // FIXME: This is not in sync with containingBlock.
+    // LayoutObject::canContainFixedPositionObjects() should probably be used
+    // instead.
+    LayoutBoxModelObject* layerlayoutObject = layer->layoutObject();
+    return layer->isRootLayer() || layerlayoutObject->isPositioned() || layer->hasTransformRelatedProperty() || layerlayoutObject->style()->containsPaint();
+}
+
+PaintLayer* PaintLayer::containingLayerForOutOfFlowPositioned(const PaintLayer* ancestor, bool* skippedAncestor) const
 {
     ASSERT(!ancestor || skippedAncestor); // If we have specified an ancestor, surely the caller needs to know whether we skipped it.
     if (skippedAncestor)
         *skippedAncestor = false;
     if (layoutObject()->style()->position() == FixedPosition) {
         PaintLayer* curr = parent();
-        while (curr && !isFixedPositionedContainer(curr)) {
+        while (curr && !isContainerForFixedPositioned(curr)) {
             if (skippedAncestor && curr == ancestor)
                 *skippedAncestor = true;
             curr = curr->parent();
@@ -840,7 +849,7 @@
     }
 
     PaintLayer* curr = parent();
-    while (curr && !curr->isPositionedContainer()) {
+    while (curr && !isContainerForPositioned(curr)) {
         if (skippedAncestor && curr == ancestor)
             *skippedAncestor = true;
         curr = curr->parent();
@@ -1277,7 +1286,7 @@
     PaintLayer* parentLayer;
     if (position == AbsolutePosition || position == FixedPosition) {
         bool foundAncestorFirst;
-        parentLayer = layer->enclosingPositionedAncestor(ancestorLayer, &foundAncestorFirst);
+        parentLayer = layer->containingLayerForOutOfFlowPositioned(ancestorLayer, &foundAncestorFirst);
 
         if (foundAncestorFirst) {
             // Found ancestorLayer before the container of the out-of-flow object, so compute offset
@@ -2371,7 +2380,7 @@
 
     // We can't consult child layers if we clip, since they might cover
     // parts of the rect that are clipped out.
-    if (layoutObject()->hasOverflowClip())
+    if (layoutObject()->hasOverflowClip() || layoutObject()->style()->containsPaint())
         return false;
 
     return childBackgroundIsKnownToBeOpaqueInRect(localRect);

diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.h b/third_party/WebKit/Source/core/paint/PaintLayer.h
index e02293d3..17a1633 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.h

@@ -261,14 +261,13 @@
     bool hasVisibleNonLayerContent() const { return m_hasVisibleNonLayerContent; }
     bool hasNonCompositedChild() const { ASSERT(isAllowedToQueryCompositingState()); return m_hasNonCompositedChild; }
 
-    // Gets the ancestor layer that serves as the containing block of this layer. It is assumed
-    // that this layer is established by an out-of-flow positioned layout object (i.e. either
-    // absolutely or fixed positioned).
+    // Gets the ancestor layer that serves as the containing block of this layer. This is either
+    // another out of flow positioned layer, or one that contains paint.
     // If |ancestor| is specified, |*skippedAncestor| will be set to true if |ancestor| is found in
     // the ancestry chain between this layer and the containing block layer; if not found, it will
     // be set to false. Either both |ancestor| and |skippedAncestor| should be nullptr, or none of
     // them should.
-    PaintLayer* enclosingPositionedAncestor(const PaintLayer* ancestor = nullptr, bool* skippedAncestor = nullptr) const;
+    PaintLayer* containingLayerForOutOfFlowPositioned(const PaintLayer* ancestor = nullptr, bool* skippedAncestor = nullptr) const;
 
     bool isPaintInvalidationContainer() const;
 
@@ -459,15 +458,6 @@
     PaintLayerClipper& clipper() { return m_clipper; }
     const PaintLayerClipper& clipper() const { return m_clipper; }
 
-    inline bool isPositionedContainer() const
-    {
-        // FIXME: This is not in sync with containingBlock.
-        // LayoutObject::canContainFixedPositionObjects() should probably be used
-        // instead.
-        LayoutBoxModelObject* layerlayoutObject = layoutObject();
-        return isRootLayer() || layerlayoutObject->isPositioned() || hasTransformRelatedProperty();
-    }
-
     bool scrollsOverflow() const;
 
     CompositingReasons potentialCompositingReasonsFromStyle() const { return m_potentialCompositingReasonsFromStyle; }

diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
index 0ff40ac..3b11423 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp

@@ -69,12 +69,12 @@
 
 static void applyClipRects(const ClipRectsContext& context, const LayoutObject& layoutObject, LayoutPoint offset, ClipRects& clipRects)
 {
-    ASSERT(layoutObject.hasOverflowClip() || layoutObject.hasClip());
+    ASSERT(layoutObject.hasOverflowClip() || layoutObject.hasClip() || layoutObject.style()->containsPaint());
     LayoutView* view = layoutObject.view();
     ASSERT(view);
     if (clipRects.fixed() && context.rootLayer->layoutObject() == view)
         offset -= toIntSize(view->frameView()->scrollPosition());
-    if (layoutObject.hasOverflowClip()) {
+    if (layoutObject.hasOverflowClip() || layoutObject.style()->containsPaint()) {
         ClipRect newOverflowClip = toLayoutBox(layoutObject).overflowClipRect(offset, context.scrollbarRelevancy);
         newOverflowClip.setHasRadius(layoutObject.style()->hasBorderRadius());
         clipRects.setOverflowClipRect(intersection(newOverflowClip, clipRects.overflowClipRect()));
@@ -82,6 +82,10 @@
             clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
         if (layoutObject.isLayoutView())
             clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
+        if (layoutObject.style()->containsPaint()) {
+            clipRects.setPosClipRect(intersection(newOverflowClip, clipRects.posClipRect()));
+            clipRects.setFixedClipRect(intersection(newOverflowClip, clipRects.fixedClipRect()));
+        }
     }
     if (layoutObject.hasClip()) {
         LayoutRect newClip = toLayoutBox(layoutObject).clipRect(offset);
@@ -213,7 +217,7 @@
     layerBounds = LayoutRect(offset, LayoutSize(m_layoutObject.layer()->size()));
 
     // Update the clip rects that will be passed to child layers.
-    if (m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context)) {
+    if ((m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context)) || m_layoutObject.style()->containsPaint()) {
         foregroundRect.intersect(toLayoutBox(m_layoutObject).overflowClipRect(offset, context.scrollbarRelevancy));
         if (m_layoutObject.style()->hasBorderRadius())
             foregroundRect.setHasRadius(true);
@@ -267,7 +271,7 @@
 
     adjustClipRectsForChildren(m_layoutObject, clipRects);
 
-    if ((m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context)) || m_layoutObject.hasClip()) {
+    if ((m_layoutObject.hasOverflowClip() && shouldRespectOverflowClip(context)) || m_layoutObject.hasClip() || m_layoutObject.style()->containsPaint()) {
         // This offset cannot use convertToLayerCoords, because sometimes our rootLayer may be across
         // some transformed layer boundary, for example, in the PaintLayerCompositor overlapMap, where
         // clipRects are needed in view space.

diff --git a/third_party/WebKit/Source/core/style/ComputedStyle.h b/third_party/WebKit/Source/core/style/ComputedStyle.h
index 4c288f2..2e1b0ea 100644
--- a/third_party/WebKit/Source/core/style/ComputedStyle.h
+++ b/third_party/WebKit/Source/core/style/ComputedStyle.h

@@ -826,6 +826,7 @@
     bool hasVisualOverflowingEffect() const { return boxShadow() || hasBorderImageOutsets() || hasOutline(); }
 
     Containment contain() const { return static_cast<Containment>(rareNonInheritedData->m_contain); }
+    bool containsPaint() const { return rareNonInheritedData->m_contain & ContainsPaint; }
 
     EBoxSizing boxSizing() const { return m_box->boxSizing(); }
     EUserModify userModify() const { return static_cast<EUserModify>(rareInheritedData->userModify); }
@@ -1497,6 +1498,7 @@
     float strokeMiterLimit() const { return svgStyle().strokeMiterLimit(); }
     void setStrokeMiterLimit(float f) { accessSVGStyle().setStrokeMiterLimit(f); }
 
+    void setD(PassRefPtrWillBeRawPtr<CSSPathValue> d) { accessSVGStyle().setD(d); }
     void setCx(const Length& cx) { accessSVGStyle().setCx(cx); }
     void setCy(const Length& cy) { accessSVGStyle().setCy(cy); }
     void setX(const Length& x) { accessSVGStyle().setX(x); }

diff --git a/third_party/WebKit/Source/core/style/SVGComputedStyle.cpp b/third_party/WebKit/Source/core/style/SVGComputedStyle.cpp
index 85e19fd3..fa79bd0 100644
--- a/third_party/WebKit/Source/core/style/SVGComputedStyle.cpp
+++ b/third_party/WebKit/Source/core/style/SVGComputedStyle.cpp

@@ -187,7 +187,7 @@
             return true;
     }
 
-    // The x, y, rx and ry properties require a re-layout.
+    // The StyleLayoutData properties require a re-layout.
     if (layout.get() != other->layout.get()) {
         if (layout->x != other->layout->x
             || layout->y != other->layout->y
@@ -195,7 +195,8 @@
             || layout->rx != other->layout->rx
             || layout->ry != other->layout->ry
             || layout->cx != other->layout->cx
-            || layout->cy != other->layout->cy)
+            || layout->cy != other->layout->cy
+            || !layout->d->equals(*other->layout->d))
             return true;
     }
 

diff --git a/third_party/WebKit/Source/core/style/SVGComputedStyle.h b/third_party/WebKit/Source/core/style/SVGComputedStyle.h
index f8925f1..e6e8436f 100644
--- a/third_party/WebKit/Source/core/style/SVGComputedStyle.h
+++ b/third_party/WebKit/Source/core/style/SVGComputedStyle.h

@@ -90,6 +90,7 @@
     static const AtomicString& initialMarkerEndResource() { return nullAtom; }
     static EMaskType initialMaskType() { return MT_LUMINANCE; }
     static EPaintOrder initialPaintOrder() { return PaintOrderNormal; }
+    static CSSPathValue* initialD() { return CSSPathValue::emptyPathValue(); }
     static Length initialCx() { return Length(Fixed); }
     static Length initialCy() { return Length(Fixed); }
     static Length initialX() { return Length(Fixed); }
@@ -115,6 +116,11 @@
     void setTextAnchor(ETextAnchor val) { svg_inherited_flags.textAnchor = val; }
     void setMaskType(EMaskType val) { svg_noninherited_flags.f.maskType = val; }
     void setPaintOrder(EPaintOrder val) { svg_inherited_flags.paintOrder = (int)val; }
+    void setD(PassRefPtrWillBeRawPtr<CSSPathValue> d)
+    {
+        if (!(layout->d == d))
+            layout.access()->d = d;
+    }
     void setCx(const Length& obj)
     {
         if (!(layout->cx == obj))
@@ -333,6 +339,7 @@
     const Color& floodColor() const { return misc->floodColor; }
     const Color& lightingColor() const { return misc->lightingColor; }
     const Length& baselineShiftValue() const { return misc->baselineShiftValue; }
+    CSSPathValue* d() const { return layout->d.get(); }
     const Length& cx() const { return layout->cx; }
     const Length& cy() const { return layout->cy; }
     const Length& x() const { return layout->x; }

diff --git a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.cpp b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.cpp
index 756a211..d1fb9350 100644
--- a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.cpp
+++ b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.cpp

@@ -201,7 +201,8 @@
 }
 
 StyleLayoutData::StyleLayoutData()
-    : cx(SVGComputedStyle::initialCx())
+    : d(CSSPathValue::emptyPathValue())
+    , cx(SVGComputedStyle::initialCx())
     , cy(SVGComputedStyle::initialCy())
     , x(SVGComputedStyle::initialX())
     , y(SVGComputedStyle::initialY())
@@ -213,6 +214,7 @@
 
 inline StyleLayoutData::StyleLayoutData(const StyleLayoutData& other)
     : RefCounted<StyleLayoutData>()
+    , d(other.d)
     , cx(other.cx)
     , cy(other.cy)
     , x(other.x)
@@ -236,7 +238,8 @@
         && rx == other.rx
         && ry == other.ry
         && cx == other.cx
-        && cy == other.cy;
+        && cy == other.cy
+        && d->equals(*other.d);
 }
 
 }

diff --git a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h
index ae3e3a9a..88d38aa 100644
--- a/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h
+++ b/third_party/WebKit/Source/core/style/SVGComputedStyleDefs.h

@@ -29,6 +29,7 @@
 #define SVGComputedStyleDefs_h
 
 #include "core/CoreExport.h"
+#include "core/css/CSSPathValue.h"
 #include "platform/Length.h"
 #include "platform/graphics/Color.h"
 #include "wtf/Allocator.h"
@@ -289,6 +290,7 @@
         {
             return !(*this == other);
         }
+        RefPtrWillBePersistent<CSSPathValue> d;
         Length cx;
         Length cy;
         Length x;

diff --git a/third_party/WebKit/Source/core/svg/SVGPath.cpp b/third_party/WebKit/Source/core/svg/SVGPath.cpp
index 51637639..0bcde6a 100644
--- a/third_party/WebKit/Source/core/svg/SVGPath.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGPath.cpp

@@ -48,30 +48,35 @@
     return resultStream.release();
 }
 
-PassOwnPtr<SVGPathByteStream> addPathByteStreams(PassOwnPtr<SVGPathByteStream> fromStream, const SVGPathByteStream& byStream, unsigned repeatCount = 1)
+PassOwnPtr<SVGPathByteStream> addPathByteStreams(const SVGPathByteStream& fromStream, const SVGPathByteStream& byStream, unsigned repeatCount = 1)
 {
-    if (fromStream->isEmpty() || byStream.isEmpty())
-        return fromStream;
-    OwnPtr<SVGPathByteStream> tempFromStream = fromStream;
     OwnPtr<SVGPathByteStream> resultStream = SVGPathByteStream::create();
     SVGPathByteStreamBuilder builder(*resultStream);
-    SVGPathByteStreamSource fromSource(*tempFromStream);
+    SVGPathByteStreamSource fromSource(fromStream);
     SVGPathByteStreamSource bySource(byStream);
     SVGPathBlender blender(&fromSource, &bySource, &builder);
     blender.addAnimatedPath(repeatCount);
     return resultStream.release();
 }
 
+PassOwnPtr<SVGPathByteStream> conditionallyAddPathByteStreams(PassOwnPtr<SVGPathByteStream> fromStream, const SVGPathByteStream& byStream, unsigned repeatCount = 1)
+{
+    if (fromStream->isEmpty() || byStream.isEmpty())
+        return fromStream;
+    return addPathByteStreams(*fromStream, byStream, repeatCount);
+}
+
 }
 
 SVGPath::SVGPath()
     : SVGPropertyBase(classType())
+    , m_pathValue(CSSPathValue::emptyPathValue())
 {
 }
 
-SVGPath::SVGPath(PassOwnPtr<SVGPathByteStream> byteStream)
+SVGPath::SVGPath(PassRefPtrWillBeRawPtr<CSSPathValue> pathValue)
     : SVGPropertyBase(classType())
-    , m_byteStream(byteStream)
+    , m_pathValue(pathValue)
 {
 }
 
@@ -79,71 +84,40 @@
 {
 }
 
-const Path& SVGPath::path() const
+String SVGPath::valueAsString() const
 {
-    if (!m_cachedPath) {
-        m_cachedPath = adoptPtr(new Path);
-        buildPathFromByteStream(byteStream(), *m_cachedPath);
-    }
-
-    return *m_cachedPath;
+    return m_pathValue->pathString();
 }
 
+
 PassRefPtrWillBeRawPtr<SVGPath> SVGPath::clone() const
 {
-    return SVGPath::create(byteStream().copy());
+    return SVGPath::create(m_pathValue);
+}
+
+
+void SVGPath::setValueAsString(const String& string, ExceptionState& exceptionState)
+{
+    OwnPtr<SVGPathByteStream> byteStream = SVGPathByteStream::create();
+    if (!buildByteStreamFromString(string, *byteStream))
+        exceptionState.throwDOMException(SyntaxError, "Problem parsing path \"" + string + "\"");
+    m_pathValue = CSSPathValue::create(byteStream.release());
 }
 
 PassRefPtrWillBeRawPtr<SVGPropertyBase> SVGPath::cloneForAnimation(const String& value) const
 {
-    RefPtrWillBeRawPtr<SVGPath> svgPath = SVGPath::create();
-    svgPath->setValueAsString(value, IGNORE_EXCEPTION);
-    return svgPath;
-}
-
-SVGPathByteStream& SVGPath::ensureByteStream()
-{
-    if (!m_byteStream)
-        m_byteStream = SVGPathByteStream::create();
-
-    return *m_byteStream.get();
-}
-
-void SVGPath::byteStreamChanged()
-{
-    m_cachedPath.clear();
-}
-
-const SVGPathByteStream& SVGPath::byteStream() const
-{
-    return const_cast<SVGPath*>(this)->ensureByteStream();
-}
-
-String SVGPath::valueAsString() const
-{
-    return buildStringFromByteStream(byteStream());
-}
-
-void SVGPath::setValueAsString(const String& string, ExceptionState& exceptionState)
-{
-    if (!buildByteStreamFromString(string, ensureByteStream()))
-        exceptionState.throwDOMException(SyntaxError, "Problem parsing path \"" + string + "\"");
-    byteStreamChanged();
-}
-
-void SVGPath::setValueAsByteStream(PassOwnPtr<SVGPathByteStream> byteStream)
-{
-    m_byteStream = byteStream;
-    byteStreamChanged();
+    return SVGPath::create(CSSPathValue::create(value));
 }
 
 void SVGPath::add(PassRefPtrWillBeRawPtr<SVGPropertyBase> other, SVGElement*)
 {
     const SVGPathByteStream& otherPathByteStream = toSVGPath(other)->byteStream();
-    if (byteStream().size() != otherPathByteStream.size())
+    if (byteStream().size() != otherPathByteStream.size()
+        || byteStream().isEmpty()
+        || otherPathByteStream.isEmpty())
         return;
 
-    setValueAsByteStream(addPathByteStreams(m_byteStream.release(), otherPathByteStream));
+    m_pathValue = CSSPathValue::create(addPathByteStreams(byteStream(), otherPathByteStream));
 }
 
 void SVGPath::calculateAnimatedValue(SVGAnimationElement* animationElement, float percentage, unsigned repeatCount, PassRefPtrWillBeRawPtr<SVGPropertyBase> fromValue, PassRefPtrWillBeRawPtr<SVGPropertyBase> toValue, PassRefPtrWillBeRawPtr<SVGPropertyBase> toAtEndOfDurationValue, SVGElement*)
@@ -171,27 +145,26 @@
     if (fromStream->size() != toStream.size() && fromStream->size()) {
         if (percentage < 0.5) {
             if (!isToAnimation) {
-                setValueAsByteStream(fromStream->copy());
+                m_pathValue = from->pathValue();
                 return;
             }
         } else {
-            setValueAsByteStream(toStream.copy());
+            m_pathValue = to->pathValue();
             return;
         }
     }
 
-    OwnPtr<SVGPathByteStream> lastAnimatedStream = m_byteStream.release();
     OwnPtr<SVGPathByteStream> newStream = blendPathByteStreams(*fromStream, toStream, percentage);
 
     // Handle additive='sum'.
-    if (!fromStream->size() || (animationElement->isAdditive() && !isToAnimation))
-        newStream = addPathByteStreams(newStream.release(), *lastAnimatedStream);
+    if (animationElement->isAdditive() && !isToAnimation)
+        newStream = conditionallyAddPathByteStreams(newStream.release(), byteStream());
 
     // Handle accumulate='sum'.
     if (animationElement->isAccumulated() && repeatCount)
-        newStream = addPathByteStreams(newStream.release(), toSVGPath(toAtEndOfDurationValue)->byteStream(), repeatCount);
+        newStream = conditionallyAddPathByteStreams(newStream.release(), toSVGPath(toAtEndOfDurationValue)->byteStream(), repeatCount);
 
-    setValueAsByteStream(newStream.release());
+    m_pathValue = CSSPathValue::create(newStream.release());
 }
 
 float SVGPath::calculateDistance(PassRefPtrWillBeRawPtr<SVGPropertyBase> to, SVGElement*)
@@ -200,4 +173,10 @@
     return -1;
 }
 
+DEFINE_TRACE(SVGPath)
+{
+    visitor->trace(m_pathValue);
+    SVGPropertyBase::trace(visitor);
+}
+
 }

diff --git a/third_party/WebKit/Source/core/svg/SVGPath.h b/third_party/WebKit/Source/core/svg/SVGPath.h
index 546afc6c..a498add 100644
--- a/third_party/WebKit/Source/core/svg/SVGPath.h
+++ b/third_party/WebKit/Source/core/svg/SVGPath.h

@@ -31,6 +31,7 @@
 #ifndef SVGPath_h
 #define SVGPath_h
 
+#include "core/css/CSSPathValue.h"
 #include "core/svg/SVGPathByteStream.h"
 #include "core/svg/properties/SVGProperty.h"
 
@@ -47,16 +48,15 @@
     {
         return adoptRefWillBeNoop(new SVGPath());
     }
-    static PassRefPtrWillBeRawPtr<SVGPath> create(PassOwnPtr<SVGPathByteStream> pathByteStream)
+    static PassRefPtrWillBeRawPtr<SVGPath> create(PassRefPtrWillBeRawPtr<CSSPathValue> pathValue)
     {
-        return adoptRefWillBeNoop(new SVGPath(pathByteStream));
+        return adoptRefWillBeNoop(new SVGPath(pathValue));
     }
 
     ~SVGPath() override;
 
-    const Path& path() const;
-
-    const SVGPathByteStream& byteStream() const;
+    const SVGPathByteStream& byteStream() const { return m_pathValue->byteStream(); }
+    CSSPathValue* pathValue() const { return m_pathValue.get(); }
 
     // SVGPropertyBase:
     PassRefPtrWillBeRawPtr<SVGPath> clone() const;
@@ -70,16 +70,13 @@
 
     static AnimatedPropertyType classType() { return AnimatedPath; }
 
+    DECLARE_VIRTUAL_TRACE();
+
 private:
     SVGPath();
-    explicit SVGPath(PassOwnPtr<SVGPathByteStream>);
+    explicit SVGPath(PassRefPtrWillBeRawPtr<CSSPathValue>);
 
-    SVGPathByteStream& ensureByteStream();
-    void byteStreamChanged();
-    void setValueAsByteStream(PassOwnPtr<SVGPathByteStream>);
-
-    OwnPtr<SVGPathByteStream> m_byteStream;
-    mutable OwnPtr<Path> m_cachedPath;
+    RefPtrWillBeMember<CSSPathValue> m_pathValue;
 };
 
 DEFINE_SVG_PROPERTY_TYPE_CASTS(SVGPath);

diff --git a/third_party/WebKit/Source/core/svg/SVGPathByteStream.h b/third_party/WebKit/Source/core/svg/SVGPathByteStream.h
index 42b4dce..70430c8 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathByteStream.h
+++ b/third_party/WebKit/Source/core/svg/SVGPathByteStream.h

@@ -58,6 +58,8 @@
     bool isEmpty() const { return m_data.isEmpty(); }
     unsigned size() const { return m_data.size(); }
 
+    bool operator==(const SVGPathByteStream& other) const { return m_data == other.m_data; }
+
 private:
     SVGPathByteStream() { }
     SVGPathByteStream(const Data& data)

diff --git a/third_party/WebKit/Source/core/svg/SVGPathElement.cpp b/third_party/WebKit/Source/core/svg/SVGPathElement.cpp
index dc0b4b4..5a53beae 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGPathElement.cpp

@@ -25,6 +25,7 @@
 #include "core/svg/SVGDocumentExtensions.h"
 #include "core/svg/SVGMPathElement.h"
 #include "core/svg/SVGPathQuery.h"
+#include "core/svg/SVGPathUtilities.h"
 #include "core/svg/SVGPointTearOff.h"
 
 namespace blink {
@@ -72,52 +73,94 @@
 
 Path SVGPathElement::asPath() const
 {
-    // If this is a <use> instance, return the referenced path to maximize geometry sharing.
-    if (const SVGElement* element = correspondingElement())
-        return toSVGPathElement(element)->asPath();
+    if (layoutObject()) {
+        const SVGComputedStyle& svgStyle = layoutObject()->styleRef().svgStyle();
+        return svgStyle.d()->path();
+    }
 
-    return m_path->currentValue()->path();
+    return m_path->currentValue()->pathValue()->path();
+}
+
+const SVGPathByteStream& SVGPathElement::pathByteStream() const
+{
+    if (layoutObject()) {
+        const SVGComputedStyle& svgStyle = layoutObject()->styleRef().svgStyle();
+        return svgStyle.d()->byteStream();
+    }
+
+    return m_path->currentValue()->byteStream();
 }
 
 float SVGPathElement::getTotalLength()
 {
-    return SVGPathQuery(m_path->currentValue()->byteStream()).getTotalLength();
+    document().updateLayoutIgnorePendingStylesheets();
+    return SVGPathQuery(pathByteStream()).getTotalLength();
 }
 
 PassRefPtrWillBeRawPtr<SVGPointTearOff> SVGPathElement::getPointAtLength(float length)
 {
-    FloatPoint point = SVGPathQuery(m_path->currentValue()->byteStream()).getPointAtLength(length);
+    document().updateLayoutIgnorePendingStylesheets();
+    FloatPoint point = SVGPathQuery(pathByteStream()).getPointAtLength(length);
     return SVGPointTearOff::create(SVGPoint::create(point), 0, PropertyIsNotAnimVal);
 }
 
 unsigned SVGPathElement::getPathSegAtLength(float length)
 {
-    return SVGPathQuery(m_path->currentValue()->byteStream()).getPathSegIndexAtLength(length);
+    document().updateLayoutIgnorePendingStylesheets();
+    return SVGPathQuery(pathByteStream()).getPathSegIndexAtLength(length);
+}
+
+bool SVGPathElement::isPresentationAttribute(const QualifiedName& attrName) const
+{
+    if (attrName == SVGNames::dAttr)
+        return true;
+    return SVGGeometryElement::isPresentationAttribute(attrName);
+}
+
+bool SVGPathElement::isPresentationAttributeWithSVGDOM(const QualifiedName& attrName) const
+{
+    if (attrName == SVGNames::dAttr)
+        return true;
+    return SVGGeometryElement::isPresentationAttributeWithSVGDOM(attrName);
 }
 
 void SVGPathElement::svgAttributeChanged(const QualifiedName& attrName)
 {
-    if (attrName == SVGNames::dAttr || attrName == SVGNames::pathLengthAttr) {
+    if (attrName == SVGNames::dAttr) {
         SVGElement::InvalidationGuard invalidationGuard(this);
+        invalidateSVGPresentationAttributeStyle();
+        setNeedsStyleRecalc(LocalStyleChange,
+            StyleChangeReasonForTracing::fromAttribute(attrName));
 
-        LayoutSVGShape* layoutObject = toLayoutSVGShape(this->layoutObject());
+        if (LayoutSVGShape* layoutPath = toLayoutSVGShape(this->layoutObject()))
+            layoutPath->setNeedsShapeUpdate();
 
-        if (attrName == SVGNames::dAttr) {
-            if (layoutObject)
-                layoutObject->setNeedsShapeUpdate();
-
-            invalidateMPathDependencies();
-        }
-
-        if (layoutObject)
-            markForLayoutAndParentResourceInvalidation(layoutObject);
+        invalidateMPathDependencies();
+        if (layoutObject())
+            markForLayoutAndParentResourceInvalidation(layoutObject());
 
         return;
     }
 
+    if (attrName == SVGNames::pathLengthAttr) {
+        SVGElement::InvalidationGuard invalidationGuard(this);
+        if (layoutObject())
+            markForLayoutAndParentResourceInvalidation(layoutObject());
+        return;
+    }
+
     SVGGeometryElement::svgAttributeChanged(attrName);
 }
 
+void SVGPathElement::collectStyleForPresentationAttribute(const QualifiedName& name, const AtomicString& value, MutableStylePropertySet* style)
+{
+    RefPtrWillBeRawPtr<SVGAnimatedPropertyBase> property = propertyFromAttribute(name);
+    if (property == m_path)
+        addPropertyToPresentationAttributeStyle(style, CSSPropertyD, m_path->currentValue()->pathValue());
+    else
+        SVGGeometryElement::collectStyleForPresentationAttribute(name, value, style);
+}
+
 void SVGPathElement::invalidateMPathDependencies()
 {
     // <mpath> can only reference <path> but this dependency is not handled in

diff --git a/third_party/WebKit/Source/core/svg/SVGPathElement.h b/third_party/WebKit/Source/core/svg/SVGPathElement.h
index c50a3e5..56744aca 100644
--- a/third_party/WebKit/Source/core/svg/SVGPathElement.h
+++ b/third_party/WebKit/Source/core/svg/SVGPathElement.h

@@ -43,6 +43,11 @@
     SVGAnimatedPath* path() { return m_path.get(); }
     SVGAnimatedNumber* pathLength() { return m_pathLength.get(); }
 
+    const SVGPathByteStream& pathByteStream() const;
+
+    bool isPresentationAttribute(const QualifiedName&) const override;
+    bool isPresentationAttributeWithSVGDOM(const QualifiedName&) const override;
+
     DECLARE_VIRTUAL_TRACE();
 
 private:
@@ -50,6 +55,8 @@
 
     void svgAttributeChanged(const QualifiedName&) override;
 
+    void collectStyleForPresentationAttribute(const QualifiedName&, const AtomicString&, MutableStylePropertySet*) override;
+
     Node::InsertionNotificationRequest insertedInto(ContainerNode*) override;
     void removedFrom(ContainerNode*) override;
 

diff --git a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
index a58ec2a..7d3eae6 100644
--- a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
+++ b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp

@@ -32,15 +32,16 @@
 #include "core/animation/AnimationTimeline.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/shadow/ComposedTreeTraversal.h"
+#include "core/fetch/ResourceFetcher.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
-#include "core/style/ComputedStyle.h"
 #include "core/layout/svg/LayoutSVGRoot.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/paint/CompositingRecorder.h"
 #include "core/paint/FloatClipRecorder.h"
 #include "core/paint/TransformRecorder.h"
+#include "core/style/ComputedStyle.h"
 #include "core/svg/SVGDocumentExtensions.h"
 #include "core/svg/SVGFEImageElement.h"
 #include "core/svg/SVGImageElement.h"
@@ -98,14 +99,20 @@
     return page->chromeClient().isSVGImageChromeClient();
 }
 
+void SVGImage::assertSubresourcesLoaded() const
+{
+    RELEASE_ASSERT(m_page);
+    LocalFrame* frame = toLocalFrame(m_page->mainFrame());
+    RELEASE_ASSERT(frame->document()->fetcher()->requestCount() == 0);
+}
+
 bool SVGImage::currentFrameHasSingleSecurityOrigin() const
 {
     if (!m_page)
         return true;
 
     LocalFrame* frame = toLocalFrame(m_page->mainFrame());
-
-    RELEASE_ASSERT(frame->document()->loadEventFinished());
+    assertSubresourcesLoaded();
 
     SVGSVGElement* rootElement = frame->document()->accessSVGExtensions().rootElement();
     if (!rootElement)

diff --git a/third_party/WebKit/Source/core/svg/graphics/SVGImage.h b/third_party/WebKit/Source/core/svg/graphics/SVGImage.h
index cd54d2ce..0421351 100644
--- a/third_party/WebKit/Source/core/svg/graphics/SVGImage.h
+++ b/third_party/WebKit/Source/core/svg/graphics/SVGImage.h

@@ -57,6 +57,7 @@
     bool isTextureBacked() override { return false; }
     IntSize size() const override { return m_intrinsicSize; }
 
+    void assertSubresourcesLoaded() const;
     bool currentFrameHasSingleSecurityOrigin() const override;
 
     void startAnimation(CatchUpAnimation = CatchUp) override;

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
index 1d34cf2f..a7d0159 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js

@@ -1334,19 +1334,19 @@
     /** @type Map<string, WebInspector.TimelineTreeView> */
     this._rangeDetailViews = new Map();
     if (!Runtime.experiments.isEnabled("multipleTimelineViews")) {
-        if (Runtime.experiments.isEnabled("timelineEventsTreeView")) {
-            var eventsView = new WebInspector.EventsTimelineTreeView(timelineModel, delegate);
-            this.appendTab(tabIds.Events, WebInspector.UIString("Events"), eventsView);
-            this._rangeDetailViews.set(tabIds.Events, eventsView);
-        }
+        var bottomUpView = new WebInspector.BottomUpTimelineTreeView(timelineModel);
+        this.appendTab(tabIds.BottomUp, WebInspector.UIString("Bottom-Up"), bottomUpView);
+        this._rangeDetailViews.set(tabIds.BottomUp, bottomUpView);
 
         var callTreeView = new WebInspector.CallTreeTimelineTreeView(timelineModel);
         this.appendTab(tabIds.CallTree, WebInspector.UIString("Call Tree"), callTreeView);
         this._rangeDetailViews.set(tabIds.CallTree, callTreeView);
 
-        var bottomUpView = new WebInspector.BottomUpTimelineTreeView(timelineModel);
-        this.appendTab(tabIds.BottomUp, WebInspector.UIString("Bottom-Up"), bottomUpView);
-        this._rangeDetailViews.set(tabIds.BottomUp, bottomUpView);
+        if (Runtime.experiments.isEnabled("timelineEventsTreeView")) {
+            var eventsView = new WebInspector.EventsTimelineTreeView(timelineModel, delegate);
+            this.appendTab(tabIds.Events, WebInspector.UIString("Event Log"), eventsView);
+            this._rangeDetailViews.set(tabIds.Events, eventsView);
+        }
     }
 
     this.addEventListener(WebInspector.TabbedPane.EventTypes.TabSelected, this._tabSelected, this);

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
index c608c9f..429d262 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js

@@ -36,7 +36,7 @@
     this._splitWidget.setMainWidget(mainView);
 
     this._detailsView = new WebInspector.VBox();
-    this._detailsView.element.classList.add("timeline-tree-view-details", "timeline-details-view-body");
+    this._detailsView.element.classList.add("timeline-details-view", "timeline-details-view-body");
     this._splitWidget.setSidebarWidget(this._detailsView);
     this._dataGrid.addEventListener(WebInspector.DataGrid.Events.SelectedNode, this._updateDetailsForSelection, this);
 
@@ -84,6 +84,7 @@
     {
         this._startTime = startTime;
         this._endTime = endTime;
+        this._lastSelectedNode = null;
         this._refreshTree();
     },
 
@@ -116,20 +117,21 @@
 
     /**
      * @param {!WebInspector.TimelineTreeView.ProfileTreeNode} treeNode
+     * @param {boolean} suppressSelectedEvent
      */
-    revealProfileNode: function(treeNode)
+    selectProfileNode: function(treeNode, suppressSelectedEvent)
     {
         var pathToRoot = [];
         for (var node = treeNode; node; node = node.parent)
             pathToRoot.push(node);
         for (var i = pathToRoot.length - 1; i > 0; --i) {
-            var gridNode = pathToRoot[i][WebInspector.TimelineTreeView.TreeGridNode._gridNodeSymbol];
+            var gridNode = this._dataGridNodeForTreeNode(pathToRoot[i]);
             if (gridNode)
                 gridNode.expand();
         }
-        var gridNode = treeNode[WebInspector.TimelineTreeView.TreeGridNode._gridNodeSymbol];
+        var gridNode = this._dataGridNodeForTreeNode(treeNode);
         gridNode.reveal();
-        gridNode.select(true);
+        gridNode.select(suppressSelectedEvent);
     },
 
     _refreshTree: function()
@@ -343,6 +345,15 @@
         this._onHover(profileNode);
     },
 
+    /**
+     * @param {!WebInspector.TimelineTreeView.ProfileTreeNode} treeNode
+     * @return {?WebInspector.TimelineTreeView.GridNode}
+     */
+    _dataGridNodeForTreeNode: function(treeNode)
+    {
+        return treeNode[WebInspector.TimelineTreeView.TreeGridNode._gridNodeSymbol] || null;
+    },
+
     __proto__: WebInspector.VBox.prototype
 }
 
@@ -667,7 +678,7 @@
     {
         var treeNode = this._stackView.selectedTreeNode();
         if (treeNode)
-            this.revealProfileNode(treeNode);
+            this.selectProfileNode(treeNode, true);
     },
 
     /**
@@ -973,8 +984,10 @@
     updateContents: function(selection)
     {
         WebInspector.TimelineTreeView.prototype.updateContents.call(this, selection);
-        if (selection.type() === WebInspector.TimelineSelection.Type.TraceEvent)
-            this._revealEvent(/** @type {!WebInspector.TracingModel.Event} */ (selection.object()));
+        if (selection.type() === WebInspector.TimelineSelection.Type.TraceEvent) {
+            var event = /** @type {!WebInspector.TracingModel.Event} */ (selection.object());
+            this._selectEvent(event, true);
+        }
     },
 
     /**
@@ -992,7 +1005,7 @@
         var selectedEvent = this._lastSelectedNode && this._lastSelectedNode.event;
         this._refreshTree();
         if (selectedEvent)
-            this._revealEvent(selectedEvent);
+            this._selectEvent(selectedEvent, false);
     },
 
     /**
@@ -1020,13 +1033,16 @@
 
     /**
      * @param {!WebInspector.TracingModel.Event} event
+     * @param {boolean=} expand
      */
-    _revealEvent: function(event)
+    _selectEvent: function(event, expand)
     {
         var node = this._findNodeWithEvent(event);
         if (!node)
             return;
-        this.revealProfileNode(node);
+        this.selectProfileNode(node, true);
+        if (expand)
+            this._dataGridNodeForTreeNode(node).expand();
     },
 
     /**
@@ -1035,7 +1051,7 @@
      */
     _populateColumns: function(columns)
     {
-        columns.push({id: "startTime", title: WebInspector.UIString("Start Time"), width: "80px", sortable: true});
+        columns.push({id: "startTime", title: WebInspector.UIString("Start Time"), width: "110px", sortable: true});
         WebInspector.TimelineTreeView.prototype._populateColumns.call(this, columns);
     },
 
@@ -1096,7 +1112,7 @@
     header.textContent = WebInspector.UIString("Heaviest stack");
     this._treeView = treeView;
     var columns = [
-        {id: "total", title: WebInspector.UIString("Total Time"), width: "110px"},
+        {id: "total", title: WebInspector.UIString("Total Time"), width: "80px"},
         {id: "activity", title: WebInspector.UIString("Activity")}
     ];
     this._dataGrid = new WebInspector.ViewportDataGrid(columns);

diff --git a/third_party/WebKit/Source/devtools/front_end/ui/FilterBar.js b/third_party/WebKit/Source/devtools/front_end/ui/FilterBar.js
index 80af80d6..a818f66 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/FilterBar.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/FilterBar.js

@@ -90,7 +90,8 @@
 
     forceShowFilterBar: function()
     {
-        this._updateFilterBar(true);
+        this._alwaysShowFilters = true;
+        this._updateFilterBar();
     },
 
     /**
@@ -124,12 +125,9 @@
         return WebInspector.FilterBar.FilterBarState.Inactive;
     },
 
-    /**
-     * @param {boolean=} forceShow
-     */
-    _updateFilterBar: function(forceShow)
+    _updateFilterBar: function()
     {
-        var visible = forceShow || (this._filtersShown && this._enabled);
+        var visible = this._alwaysShowFilters || (this._filtersShown && this._enabled);
         this.element.classList.toggle("hidden", !visible);
         if (visible) {
             for (var i = 0; i < this._filters.length; ++i) {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp b/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp
index 270b05b..46f79e6 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXARIAGrid.cpp

@@ -94,7 +94,7 @@
         return;
 
     HeapVector<Member<AXObject>> children;
-    for (AXObject* child = rawFirstChild(); child; child = child->rawFirstSibling())
+    for (AXObject* child = rawFirstChild(); child; child = child->rawNextSibling())
         children.append(child);
     computeAriaOwnsChildren(children);
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h
index 775ca341..4b7c29e 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h

@@ -47,8 +47,6 @@
     void init() override;
     void detach() override;
 
-    void setInlineTextBox(AbstractInlineTextBox* inlineTextBox) { m_inlineTextBox = inlineTextBox; }
-
     AccessibilityRole roleValue() const override { return InlineTextBoxRole; }
     String name(AXNameFrom&, AXObject::AXObjectVector* nameObjects) const override;
     void textCharacterOffsets(Vector<int>&) const override;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index 3ff8061..dddc1d8 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

@@ -216,12 +216,6 @@
     return m_cachedElementRect;
 }
 
-void AXLayoutObject::setLayoutObject(LayoutObject* layoutObject)
-{
-    m_layoutObject = layoutObject;
-    setNode(layoutObject->node());
-}
-
 LayoutBoxModelObject* AXLayoutObject::layoutBoxModelObject() const
 {
     if (!m_layoutObject || !m_layoutObject->isBoxModelObject())
@@ -229,13 +223,6 @@
     return toLayoutBoxModelObject(m_layoutObject);
 }
 
-Document* AXLayoutObject::topDocument() const
-{
-    if (!document())
-        return 0;
-    return &document()->topDocument();
-}
-
 bool AXLayoutObject::shouldNotifyActiveDescendant() const
 {
     // We want to notify that the combo box has changed its active descendant,
@@ -1441,7 +1428,7 @@
 
     // Marks children recursively, if this element changed.
     m_cachedElementRectDirty = true;
-    for (AXObject* child = rawFirstChild(); child; child = child->rawFirstSibling())
+    for (AXObject* child = rawFirstChild(); child; child = child->rawNextSibling())
         child->markCachedElementRectDirty();
 }
 
@@ -1593,7 +1580,7 @@
     return axObjectCache().getOrCreate(firstChild);
 }
 
-AXObject* AXLayoutObject::rawFirstSibling() const
+AXObject* AXLayoutObject::rawNextSibling() const
 {
     if (!m_layoutObject)
         return 0;
@@ -1652,7 +1639,7 @@
     HeapVector<Member<AXObject>> ownedChildren;
     computeAriaOwnsChildren(ownedChildren);
 
-    for (AXObject* obj = rawFirstChild(); obj; obj = obj->rawFirstSibling()) {
+    for (AXObject* obj = rawFirstChild(); obj; obj = obj->rawNextSibling()) {
         if (!axObjectCache().isAriaOwned(obj))
             addChild(obj);
     }
@@ -2208,18 +2195,6 @@
     return 0;
 }
 
-bool AXLayoutObject::nodeIsTextControl(const Node* node) const
-{
-    if (!node)
-        return false;
-
-    const AXObject* axObjectForNode = axObjectCache().getOrCreate(const_cast<Node*>(node));
-    if (!axObjectForNode)
-        return false;
-
-    return axObjectForNode->isTextControl();
-}
-
 bool AXLayoutObject::isTabItemSelected() const
 {
     if (!isTabItem() || !m_layoutObject)

diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
index 6abaa4b..d207fe17 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h

@@ -56,10 +56,7 @@
     // Public, overridden from AXObject.
     LayoutObject* layoutObject() const final { return m_layoutObject; }
     LayoutRect elementRect() const override;
-
-    void setLayoutObject(LayoutObject*);
     LayoutBoxModelObject* layoutBoxModelObject() const;
-    Document* topDocument() const;
     bool shouldNotifyActiveDescendant() const;
     ScrollableArea* getScrollableAreaIfScrollable() const final;
     AccessibilityRole determineAccessibilityRole() override;
@@ -168,7 +165,7 @@
 
     // Low-level accessibility tree exploration, only for use within the accessibility module.
     AXObject* rawFirstChild() const override;
-    AXObject* rawFirstSibling() const override;
+    AXObject* rawNextSibling() const override;
     void addChildren() override;
     bool canHaveChildren() const override;
     void updateChildrenIfNecessary() override;
@@ -200,7 +197,6 @@
 
 private:
     AXObject* treeAncestorDisallowingChild() const;
-    bool nodeIsTextControl(const Node*) const;
     bool isTabItemSelected() const;
     bool isValidSelectionBound(const AXObject*) const;
     AXObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
index c8e5e8ac..ddec707 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h

@@ -62,12 +62,9 @@
 
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
-    AXObject* listBoxOptionAXObject(HTMLElement*) const;
     bool isParentPresentationalRole() const;
 };
 
-DEFINE_AX_OBJECT_TYPE_CASTS(AXListBoxOption, isAXListBoxOption());
-
 } // namespace blink
 
 #endif // AXListBoxOption_h

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h
index 589d4a9..4a57760 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h

@@ -63,7 +63,6 @@
 
     String description(AXNameFrom, AXDescriptionFrom&, AXObjectVector* descriptionObjects) const override;
     String valueDescription() const override;
-    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
 private:
     AccessibilityMediaTimeline(LayoutObject*, AXObjectCacheImpl&);
@@ -83,7 +82,6 @@
 
 private:
     AXMediaControlsContainer(LayoutObject*, AXObjectCacheImpl&);
-    bool controllingVideoElement() const;
     bool computeAccessibilityIsIgnored(IgnoredReasons* = nullptr) const override;
 };
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index 96bdd25..3cdf159 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

@@ -1472,16 +1472,6 @@
     return b1 && b2 && b1 == b2;
 }
 
-AXObject* AXNodeObject::findChildWithTagName(const HTMLQualifiedName& tagName) const
-{
-    for (AXObject* child = rawFirstChild(); child; child = child->rawFirstSibling()) {
-        Node* childNode = child->node();
-        if (childNode && childNode->hasTagName(tagName))
-            return child;
-    }
-    return 0;
-}
-
 bool AXNodeObject::isNativeCheckboxInMixedState() const
 {
     if (!isHTMLInputElement(m_node))
@@ -1543,7 +1533,7 @@
         else if (isHTMLBRElement(node))
             textAlternative = String("\n");
         else
-            textAlternative = textFromDescendants(visited);
+            textAlternative = textFromDescendants(visited, false);
 
         if (!textAlternative.isEmpty()) {
             if (nameSources) {
@@ -1589,11 +1579,26 @@
     return String();
 }
 
-String AXNodeObject::textFromDescendants(AXObjectSet& visited) const
+String AXNodeObject::textFromDescendants(AXObjectSet& visited, bool recursive) const
 {
+    if (!canHaveChildren() && recursive)
+        return String();
+
     StringBuilder accumulatedText;
     AXObject* previous = nullptr;
-    for (AXObject* child = rawFirstChild(); child; child = child->rawFirstSibling()) {
+
+    AXObjectVector children;
+
+    HeapVector<Member<AXObject>> ownedChildren;
+    computeAriaOwnsChildren(ownedChildren);
+    for (AXObject* obj = rawFirstChild(); obj; obj = obj->rawNextSibling()) {
+        if (!axObjectCache().isAriaOwned(obj))
+            children.append(obj);
+    }
+    for (const auto& ownedChild : ownedChildren)
+        children.append(ownedChild);
+
+    for (AXObject* child : children) {
         // Skip hidden children
         if (child->isInertOrAriaHidden())
             continue;
@@ -1608,7 +1613,11 @@
                 accumulatedText.append(' ');
         }
 
-        String result = recursiveTextAlternative(*child, false, visited);
+        String result;
+        if (child->isPresentational())
+            result = child->textFromDescendants(visited, true);
+        else
+            result = recursiveTextAlternative(*child, false, visited);
         accumulatedText.append(result);
         previous = child;
     }
@@ -1745,7 +1754,7 @@
     return axObjectCache().getOrCreate(firstChild);
 }
 
-AXObject* AXNodeObject::rawFirstSibling() const
+AXObject* AXNodeObject::rawNextSibling() const
 {
     if (!node())
         return 0;
@@ -2081,7 +2090,7 @@
         childrenChanged();
 }
 
-void AXNodeObject::computeAriaOwnsChildren(HeapVector<Member<AXObject>>& ownedChildren)
+void AXNodeObject::computeAriaOwnsChildren(HeapVector<Member<AXObject>>& ownedChildren) const
 {
     if (!hasAttribute(aria_ownsAttr))
         return;
@@ -2606,7 +2615,7 @@
         }
 
         AXObjectSet visited;
-        description = textFromDescendants(visited);
+        description = textFromDescendants(visited, false);
 
         if (!description.isEmpty()) {
             if (descriptionSources) {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
index 77a593a..2444eba 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h

@@ -171,7 +171,7 @@
 
     // Low-level accessibility tree exploration.
     AXObject* rawFirstChild() const override;
-    AXObject* rawFirstSibling() const override;
+    AXObject* rawNextSibling() const override;
     void addChildren() override;
     bool canHaveChildren() const override;
     void addChild(AXObject*);
@@ -199,21 +199,18 @@
     int setSize() const override;
 
     // Aria-owns.
-    void computeAriaOwnsChildren(HeapVector<Member<AXObject>>& ownedChildren);
+    void computeAriaOwnsChildren(HeapVector<Member<AXObject>>& ownedChildren) const;
 
 private:
     RawPtrWillBeMember<Node> m_node;
 
     bool isNativeCheckboxInMixedState() const;
-    String textFromDescendants(AXObjectSet& visited) const;
+    String textFromDescendants(AXObjectSet& visited, bool recursive) const override;
     String nativeTextAlternative(AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*, bool* foundTextAlternative) const;
     float stepValueForRange() const;
-    AXObject* findChildWithTagName(const HTMLQualifiedName&) const;
     bool isDescendantOfElementType(const HTMLQualifiedName& tagName) const;
 };
 
-DEFINE_AX_OBJECT_TYPE_CASTS(AXNodeObject, isAXNodeObject());
-
 } // namespace blink
 
 #endif // AXNodeObject_h

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
index 7c972cfd..c3c5714 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp

@@ -1037,18 +1037,6 @@
     return 0;
 }
 
-void AXObject::ariaTreeRows(AXObjectVector& result)
-{
-    for (const auto& child : children()) {
-        // Add tree items as the rows.
-        if (child->roleValue() == TreeItemRole)
-            result.append(child);
-
-        // Now see if this item also has rows hiding inside of it.
-        child->ariaTreeRows(result);
-    }
-}
-
 bool AXObject::isLiveRegion() const
 {
     const AtomicString& liveRegion = liveRegionStatus();

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.h b/third_party/WebKit/Source/modules/accessibility/AXObject.h
index 94ad5bf..a88e925c 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.h

@@ -215,19 +215,6 @@
 
 class AccessibilityText final : public GarbageCollectedFinalized<AccessibilityText> {
 public:
-    static AccessibilityText* create(const String& text, const AccessibilityTextSource& source)
-    {
-        return new AccessibilityText(text, source, nullptr);
-    }
-    static AccessibilityText* create(const String& text, const AccessibilityTextSource& source, AXObject* element)
-    {
-        return new AccessibilityText(text, source, element);
-    }
-
-    String text() const { return m_text; }
-    AccessibilityTextSource textSource() const { return m_textSource; }
-    AXObject* textElement() const { return m_textElement; }
-
     DEFINE_INLINE_TRACE()
     {
         visitor->trace(m_textElement);
@@ -236,12 +223,10 @@
 private:
     AccessibilityText(const String& text, const AccessibilityTextSource& source, AXObject* element)
     : m_text(text)
-    , m_textSource(source)
     , m_textElement(element)
     { }
 
     String m_text;
-    AccessibilityTextSource m_textSource;
     Member<AXObject> m_textElement;
 };
 
@@ -590,7 +575,6 @@
     bool isLandmarkRelated() const;
     virtual bool isLink() const { return false; }
     virtual bool isList() const { return false; }
-    bool isListItem() const { return roleValue() == ListItemRole; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuList() const { return false; }
@@ -619,7 +603,6 @@
     virtual bool isTextControl() const { return false; }
     virtual bool isTableCol() const { return false; }
     bool isTree() const { return roleValue() == TreeRole; }
-    bool isTreeItem() const { return roleValue() == TreeItemRole; }
     bool isWebArea() const { return roleValue() == WebAreaRole; }
 
     // Check object state.
@@ -694,9 +677,10 @@
     // exposed by one of the two functions above.
     virtual String placeholder(AXNameFrom, AXDescriptionFrom) const { return String(); }
 
-    // Internal function used by name and description, above.
+    // Internal functions used by name and description, above.
     typedef HeapHashSet<Member<const AXObject>> AXObjectSet;
     virtual String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const { return String(); }
+    virtual String textFromDescendants(AXObjectSet& visited, bool recursive) const { return String(); }
 
     // Returns result of Accessible Name Calculation algorithm.
     // This is a simpler high-level interface to |name| used by Inspector.
@@ -791,10 +775,6 @@
     virtual int setSize() const { return 0; }
     bool supportsSetSizeAndPosInSet() const;
 
-    // ARIA trees.
-    // Used by an ARIA tree to get all its rows.
-    void ariaTreeRows(AXObjectVector&);
-
     // ARIA live-region features.
     bool isLiveRegion() const;
     const AXObject* liveRegionRoot() const;
@@ -831,8 +811,7 @@
 
     // Low-level accessibility tree exploration, only for use within the accessibility module.
     virtual AXObject* rawFirstChild() const { return 0; }
-    virtual AXObject* rawFirstSibling() const { return 0; }
-    AXObject* firstAccessibleObjectFromNode(const Node*);
+    virtual AXObject* rawNextSibling() const { return 0; }
     virtual void addChildren() { }
     virtual bool canHaveChildren() const { return true; }
     bool hasChildren() const { return m_haveChildren; }
@@ -892,7 +871,6 @@
     void scrollToGlobalPoint(const IntPoint&) const;
     virtual void setFocused(bool) { }
     virtual void setSelected(bool) { }
-    void setSelectedText(const String&) { }
     virtual void setValue(const String&) { }
     virtual void setValue(float) { }
 
@@ -946,10 +924,6 @@
 
     AccessibilityRole buttonRoleType() const;
 
-    unsigned getLengthForTextRange() const { return text().length(); }
-
-    bool m_detached;
-
     mutable Member<AXObject> m_parent;
 
     // The following cached attribute values (the ones starting with m_cached*)

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index 9e66b41..e997fc4 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp

@@ -1074,12 +1074,6 @@
     textChanged(toHTMLLabelElement(element)->control());
 }
 
-void AXObjectCacheImpl::recomputeIsIgnored(LayoutObject* layoutObject)
-{
-    if (AXObject* obj = get(layoutObject))
-        obj->notifyIfIgnoredValueChanged();
-}
-
 void AXObjectCacheImpl::inlineTextBoxesUpdated(LayoutObject* layoutObject)
 {
     if (!inlineTextBoxAccessibilityEnabled())

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
index 1441792..73ad0f3 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h

@@ -139,13 +139,10 @@
     void handleAriaExpandedChange(Node*);
     void handleAriaSelectedChanged(Node*);
 
-    void recomputeIsIgnored(LayoutObject*);
-
     bool accessibilityEnabled();
     bool inlineTextBoxAccessibilityEnabled();
 
     void removeAXID(AXObject*);
-    bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
 
     AXID platformGenerateAXID() const;
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSVGRoot.h b/third_party/WebKit/Source/modules/accessibility/AXSVGRoot.h
index c57b7df..c3a2133 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSVGRoot.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXSVGRoot.h

@@ -51,8 +51,6 @@
     bool isAXSVGRoot() const override { return true; }
 };
 
-DEFINE_AX_OBJECT_TYPE_CASTS(AXSVGRoot, isAXSVGRoot());
-
 } // namespace blink
 
 #endif // AXSVGRoot_h

diff --git a/third_party/WebKit/Source/modules/accessibility/AXScrollView.h b/third_party/WebKit/Source/modules/accessibility/AXScrollView.h
index 74872d99..3d9f3abd07 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXScrollView.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXScrollView.h

@@ -39,7 +39,6 @@
 public:
     static AXScrollView* create(FrameView*, AXObjectCacheImpl&);
     AccessibilityRole roleValue() const override { return ScrollAreaRole; }
-    FrameView* scrollView() const { return m_scrollView; }
 
     ~AXScrollView() override;
     DECLARE_VIRTUAL_TRACE();
@@ -82,8 +81,6 @@
     bool m_childrenDirty;
 };
 
-DEFINE_AX_OBJECT_TYPE_CASTS(AXScrollView, isAXScrollView());
-
 } // namespace blink
 
 #endif // AXScrollView_h

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp b/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp
index 4adcc94..1904af12 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp

@@ -105,11 +105,6 @@
         m_children.append(thumb);
 }
 
-const AtomicString& AXSlider::getAttribute(const QualifiedName& attribute) const
-{
-    return element()->getAttribute(attribute);
-}
-
 AXObject* AXSlider::elementAccessibilityHitTest(const IntPoint& point) const
 {
     if (m_children.size()) {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSlider.h b/third_party/WebKit/Source/modules/accessibility/AXSlider.h
index 40013819..a055b30 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSlider.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXSlider.h

@@ -57,7 +57,6 @@
     void addChildren() final;
 
     bool canSetValueAttribute() const final { return true; }
-    const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
     void setValue(const String&) final;
     AccessibilityOrientation orientation() const final;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h
index a2e7d42..04185cf 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h

@@ -61,8 +61,6 @@
 public:
     static AXSpinButtonPart* create(AXObjectCacheImpl&);
     ~AXSpinButtonPart() override { }
-
-    bool isIncrementor() const { return m_isIncrementor; }
     void setIsIncrementor(bool value) { m_isIncrementor = value; }
 
 private:

diff --git a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
index 0ee5f480..bad2a3a 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp

@@ -486,19 +486,6 @@
         toAXTableRow(m_rows[r].get())->headerObjectsForRow(headers);
 }
 
-void AXTable::cells(AXObject::AXObjectVector& cells)
-{
-    if (!m_layoutObject)
-        return;
-
-    updateChildrenIfNecessary();
-
-    int numRows = m_rows.size();
-    for (int row = 0; row < numRows; ++row) {
-        cells.appendVector(m_rows[row]->children());
-    }
-}
-
 unsigned AXTable::columnCount()
 {
     updateChildrenIfNecessary();

diff --git a/third_party/WebKit/Source/modules/accessibility/AXTable.h b/third_party/WebKit/Source/modules/accessibility/AXTable.h
index 36f536f..5f357d5 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTable.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXTable.h

@@ -67,9 +67,6 @@
 
     unsigned columnCount();
     unsigned rowCount();
-
-    // all the cells in the table
-    void cells(AXObjectVector&);
     AXTableCell* cellForColumnAndRow(unsigned column, unsigned row);
 
     void columnHeaders(AXObjectVector&);

diff --git a/third_party/WebKit/Source/modules/accessibility/AXTableCell.h b/third_party/WebKit/Source/modules/accessibility/AXTableCell.h
index c3fbcbb6..7d1a3ec 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTableCell.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXTableCell.h

@@ -56,7 +56,6 @@
 
 protected:
     virtual AXObject* parentTable() const;
-    int m_rowIndex;
     AccessibilityRole determineAccessibilityRole() final;
 
 private:

diff --git a/third_party/WebKit/Source/modules/accessibility/AXTableRow.h b/third_party/WebKit/Source/modules/accessibility/AXTableRow.h
index ff1797f..743a729 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTableRow.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXTableRow.h

@@ -55,10 +55,6 @@
     void setRowIndex(int rowIndex) { m_rowIndex = rowIndex; }
     int rowIndex() const { return m_rowIndex; }
 
-    // allows the table to add other children that may not originate
-    // in the row, but their col/row spans overlap into it
-    void appendChild(AXObject*);
-
 protected:
     AccessibilityRole determineAccessibilityRole() final;
 

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp
index ff7e083..705870a 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp

@@ -107,7 +107,7 @@
 
 MediaKeySession* MediaKeys::createSession(ScriptState* scriptState, const String& sessionTypeString, ExceptionState& exceptionState)
 {
-    WTF_LOG(Media, "MediaKeys(%p)::createSession", this);
+    WTF_LOG(Media, "MediaKeys(%p)::createSession %s", this, sessionTypeString.utf8().data());
 
     // From http://w3c.github.io/encrypted-media/#createSession
 
@@ -121,8 +121,10 @@
     //    implementation value does not support sessionType, throw a new
     //    DOMException whose name is NotSupportedError.
     WebEncryptedMediaSessionType sessionType = EncryptedMediaUtils::convertToSessionType(sessionTypeString);
-    if (!sessionTypeSupported(sessionType))
+    if (!sessionTypeSupported(sessionType)) {
         exceptionState.throwDOMException(NotSupportedError, "Unsupported session type.");
+        return nullptr;
+    }
 
     // 3. Let session be a new MediaKeySession object, and initialize it as
     //    follows:

diff --git a/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp b/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp
index 67242fe..a11b2049 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp

@@ -7,6 +7,7 @@
 
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/fetch/CrossOriginAccessControl.h"
+#include "core/fetch/FetchUtils.h"
 #include "modules/fetch/BodyStreamBuffer.h"
 #include "modules/fetch/DataConsumerHandleUtil.h"
 #include "modules/fetch/DataConsumerTee.h"
@@ -76,7 +77,7 @@
     response->m_url = m_url;
     for (size_t i = 0; i < m_headerList->size(); ++i) {
         const FetchHeaderList::Header* header = m_headerList->list()[i].get();
-        if (header->first == "set-cookie" || header->first == "set-cookie2")
+        if (FetchUtils::isForbiddenResponseHeaderName(header->first))
             continue;
         response->m_headerList->append(header->first, header->second);
     }
@@ -103,9 +104,9 @@
         parseAccessControlExposeHeadersAllowList(accessControlExposeHeaders, accessControlExposeHeaderSet);
     for (size_t i = 0; i < m_headerList->size(); ++i) {
         const FetchHeaderList::Header* header = m_headerList->list()[i].get();
-        if (!isOnAccessControlResponseHeaderWhitelist(header->first) && !accessControlExposeHeaderSet.contains(header->first))
-            continue;
-        response->m_headerList->append(header->first, header->second);
+        const String& name = header->first;
+        if (isOnAccessControlResponseHeaderWhitelist(name) || (accessControlExposeHeaderSet.contains(name) && !FetchUtils::isForbiddenResponseHeaderName(name)))
+            response->m_headerList->append(name, header->second);
     }
     response->m_buffer = m_buffer;
     response->m_mimeType = m_mimeType;

diff --git a/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp b/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp
index 9f8ab77..8c866e05 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp

@@ -34,6 +34,26 @@
     }
 };
 
+TEST_F(FetchResponseDataTest, HeaderList)
+{
+    FetchResponseData* responseData = createInternalResponse();
+
+    Vector<String> setCookieValues;
+    responseData->headerList()->getAll("set-cookie", setCookieValues);
+    ASSERT_EQ(1U, setCookieValues.size());
+    EXPECT_EQ("foo", setCookieValues[0]);
+
+    Vector<String> barValues;
+    responseData->headerList()->getAll("bar", barValues);
+    ASSERT_EQ(1U, barValues.size());
+    EXPECT_EQ("bar", barValues[0]);
+
+    Vector<String> cacheControlValues;
+    responseData->headerList()->getAll("cache-control", cacheControlValues);
+    ASSERT_EQ(1U, cacheControlValues.size());
+    EXPECT_EQ("no-cache", cacheControlValues[0]);
+}
+
 TEST_F(FetchResponseDataTest, ToWebServiceWorkerDefaultType)
 {
     WebServiceWorkerResponse webResponse;
@@ -44,6 +64,24 @@
     CheckHeaders(webResponse);
 }
 
+TEST_F(FetchResponseDataTest, BasicFilter)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    FetchResponseData* basicResponseData = internalResponse->createBasicFilteredResponse();
+
+    EXPECT_FALSE(basicResponseData->headerList()->has("set-cookie"));
+
+    Vector<String> barValues;
+    basicResponseData->headerList()->getAll("bar", barValues);
+    ASSERT_EQ(1U, barValues.size());
+    EXPECT_EQ("bar", barValues[0]);
+
+    Vector<String> cacheControlValues;
+    basicResponseData->headerList()->getAll("cache-control", cacheControlValues);
+    ASSERT_EQ(1U, cacheControlValues.size());
+    EXPECT_EQ("no-cache", cacheControlValues[0]);
+}
+
 TEST_F(FetchResponseDataTest, ToWebServiceWorkerBasicType)
 {
     WebServiceWorkerResponse webResponse;
@@ -55,6 +93,36 @@
     CheckHeaders(webResponse);
 }
 
+TEST_F(FetchResponseDataTest, CORSFilter)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    FetchResponseData* corsResponseData = internalResponse->createCORSFilteredResponse();
+
+    EXPECT_FALSE(corsResponseData->headerList()->has("set-cookie"));
+
+    EXPECT_FALSE(corsResponseData->headerList()->has("bar"));
+
+    Vector<String> cacheControlValues;
+    corsResponseData->headerList()->getAll("cache-control", cacheControlValues);
+    ASSERT_EQ(1U, cacheControlValues.size());
+    EXPECT_EQ("no-cache", cacheControlValues[0]);
+}
+
+TEST_F(FetchResponseDataTest, CORSFilterOnResponseWithAccessControlExposeHeaders)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    internalResponse->headerList()->append("access-control-expose-headers", "set-cookie, bar");
+
+    FetchResponseData* corsResponseData = internalResponse->createCORSFilteredResponse();
+
+    EXPECT_FALSE(corsResponseData->headerList()->has("set-cookie"));
+
+    Vector<String> barValues;
+    corsResponseData->headerList()->getAll("bar", barValues);
+    ASSERT_EQ(1U, barValues.size());
+    EXPECT_EQ("bar", barValues[0]);
+}
+
 TEST_F(FetchResponseDataTest, ToWebServiceWorkerCORSType)
 {
     WebServiceWorkerResponse webResponse;
@@ -66,6 +134,28 @@
     CheckHeaders(webResponse);
 }
 
+TEST_F(FetchResponseDataTest, OpaqueFilter)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    FetchResponseData* opaqueResponseData = internalResponse->createOpaqueFilteredResponse();
+
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("set-cookie"));
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("bar"));
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("cache-control"));
+}
+
+TEST_F(FetchResponseDataTest, OpaqueFilterOnResponseWithAccessControlExposeHeaders)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    internalResponse->headerList()->append("access-control-expose-headers", "set-cookie, bar");
+
+    FetchResponseData* opaqueResponseData = internalResponse->createOpaqueFilteredResponse();
+
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("set-cookie"));
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("bar"));
+    EXPECT_FALSE(opaqueResponseData->headerList()->has("cache-control"));
+}
+
 TEST_F(FetchResponseDataTest, ToWebServiceWorkerOpaqueType)
 {
     WebServiceWorkerResponse webResponse;

diff --git a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp
index 792a4d1..aa794b7 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp
+++ b/third_party/WebKit/Source/modules/mediarecorder/MediaRecorder.cpp

@@ -8,8 +8,6 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "core/dom/DOMError.h"
 #include "core/fileapi/Blob.h"
-#include "core/frame/ConsoleTypes.h"
-#include "core/inspector/ConsoleMessage.h"
 #include "modules/EventModules.h"
 #include "modules/EventTargetModules.h"
 #include "modules/mediarecorder/BlobEvent.h"
@@ -67,11 +65,6 @@
 {
     ASSERT(m_stream->getTracks().size());
 
-    // Recording remote Audio streams is not supported: http://crbug.com/121673.
-    if (!stream->getAudioTracks().isEmpty() && stream->getAudioTracks()[0]->remote()) {
-        context->addConsoleMessage(ConsoleMessage::create(JSMessageSource, WarningMessageLevel, "Recording remote audio tracks is not supported, ignoring them."));
-    }
-
     m_recorderHandler = adoptPtr(Platform::current()->createMediaRecorderHandler());
     ASSERT(m_recorderHandler);
 

diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index b48c61d..3b4149a 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

@@ -23,6 +23,7 @@
 #include "modules/webgl/WebGLTransformFeedback.h"
 #include "modules/webgl/WebGLUniformLocation.h"
 #include "modules/webgl/WebGLVertexArrayObject.h"
+#include "platform/CheckedInt.h"
 #include "platform/NotImplemented.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
@@ -905,14 +906,14 @@
     }
 
     // Before checking if it is in the range, check if overflow happens first.
-    Checked<GLint, RecordOverflow> maxX = xoffset, maxY = yoffset, maxZ = zoffset;
+    CheckedInt<GLint> maxX = xoffset, maxY = yoffset, maxZ = zoffset;
     maxX += width;
     maxY += height;
     maxZ += depth;
-    if (maxX.hasOverflowed() || maxY.hasOverflowed() || maxZ.hasOverflowed()
-        || maxX.unsafeGet() > tex->getWidth(target, level)
-        || maxY.unsafeGet() > tex->getHeight(target, level)
-        || maxZ.unsafeGet() > tex->getDepth(target, level)) {
+    if (!maxX.isValid() || !maxY.isValid() || !maxZ.isValid()
+        || maxX.value() > tex->getWidth(target, level)
+        || maxY.value() > tex->getHeight(target, level)
+        || maxZ.value() > tex->getDepth(target, level)) {
         synthesizeGLError(GL_INVALID_VALUE, functionName, "dimensions out of range");
         return false;
     }

diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 15ef8b5..12429eec 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

@@ -5872,15 +5872,15 @@
     if (!validateSize(functionName, xoffset, yoffset, zoffset) || !validateSize(functionName, width, height))
         return false;
     // Before checking if it is in the range, check if overflow happens first.
-    Checked<GLint, RecordOverflow> maxX = xoffset;
+    CheckedInt<GLint> maxX = xoffset;
     maxX += width;
-    Checked<GLint, RecordOverflow> maxY = yoffset;
+    CheckedInt<GLint> maxY = yoffset;
     maxY += height;
-    if (maxX.hasOverflowed() || maxY.hasOverflowed()) {
+    if (!maxX.isValid() || !maxY.isValid()) {
         synthesizeGLError(GL_INVALID_VALUE, functionName, "bad dimensions");
         return false;
     }
-    if (maxX.unsafeGet() > tex->getWidth(target, level) || maxY.unsafeGet() > tex->getHeight(target, level) || zoffset >= tex->getDepth(target, level)) {
+    if (maxX.value() > tex->getWidth(target, level) || maxY.value() > tex->getHeight(target, level) || zoffset >= tex->getDepth(target, level)) {
         synthesizeGLError(GL_INVALID_VALUE, functionName, "rectangle out of range");
         return false;
     }
@@ -6157,14 +6157,14 @@
             synthesizeGLError(GL_INVALID_OPERATION, functionName, "xoffset or yoffset not multiple of 4");
             return false;
         }
-        Checked<GLint, RecordOverflow> maxX = xoffset, maxY = yoffset;
+        CheckedInt<GLint> maxX = xoffset, maxY = yoffset;
         maxX += width;
         maxY += height;
-        if (maxX.hasOverflowed() || ((width % kBlockWidth) && maxX.unsafeGet() != tex->getWidth(target, level))) {
+        if (!maxX.isValid() || ((width % kBlockWidth) && maxX.value() != tex->getWidth(target, level))) {
             synthesizeGLError(GL_INVALID_OPERATION, functionName, "width not multiple of 4 and width + xoffset not equal to width of the texture level for ETC2/EAC format texture");
             return false;
         }
-        if (maxY.hasOverflowed() || ((height % kBlockHeight) && maxY.unsafeGet() != tex->getHeight(target, level))) {
+        if (!maxY.isValid() || ((height % kBlockHeight) && maxY.value() != tex->getHeight(target, level))) {
             synthesizeGLError(GL_INVALID_OPERATION, functionName, "height not multiple of 4 and height + yoffset not equal to height of the texture level for ETC2/EAC format texture");
             return false;
         }
@@ -6181,11 +6181,11 @@
             return false;
         }
         // Before checking if it is in the range, check if overflow happens first.
-        Checked<GLint, RecordOverflow> maxX = xoffset, maxY = yoffset;
+        CheckedInt<GLint> maxX = xoffset, maxY = yoffset;
         maxX += width;
         maxY += height;
-        if (maxX.hasOverflowed() || maxY.hasOverflowed() || maxX.unsafeGet() > tex->getWidth(target, level)
-            || maxY.unsafeGet() > tex->getHeight(target, level)) {
+        if (!maxX.isValid() || !maxY.isValid() || maxX.value() > tex->getWidth(target, level)
+            || maxY.value() > tex->getHeight(target, level)) {
             synthesizeGLError(GL_INVALID_VALUE, functionName, "dimensions out of range");
             return false;
         }

diff --git a/third_party/WebKit/Source/modules/webusb/USBError.cpp b/third_party/WebKit/Source/modules/webusb/USBError.cpp
index cea84dfc..6bd48cb 100644
--- a/third_party/WebKit/Source/modules/webusb/USBError.cpp
+++ b/third_party/WebKit/Source/modules/webusb/USBError.cpp

@@ -14,12 +14,12 @@
 DOMException* USBError::take(ScriptPromiseResolver*, const WebUSBError& webError)
 {
     switch (webError.error) {
-    case WebUSBError::Error::Device:
+    case WebUSBError::Error::Network:
+        return DOMException::create(NetworkError, webError.message);
+    case WebUSBError::Error::NotFound:
+        return DOMException::create(NotFoundError, webError.message);
     case WebUSBError::Error::Security:
-    case WebUSBError::Error::Service:
-    case WebUSBError::Error::Transfer:
-        // TODO(rockot): Differentiate between different error types.
-        return DOMException::create(AbortError, webError.message);
+        return DOMException::create(SecurityError, webError.message);
     }
     ASSERT_NOT_REACHED();
     return DOMException::create(UnknownError);

diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 187ec20..baf6256 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in

@@ -49,6 +49,7 @@
 CSSIndependentTransformProperties status=experimental
 CSSMaskSourceType status=experimental
 CSSOMSmoothScroll status=experimental
+CSSPropertyD status=experimental
 CSSStickyPosition
 CSSTouchActionPanDirections status=experimental
 CSSTypedOM status=experimental

diff --git a/third_party/WebKit/public/platform/modules/webusb/WebUSBError.h b/third_party/WebKit/public/platform/modules/webusb/WebUSBError.h
index 6bc06bbe..e48a1d7d 100644
--- a/third_party/WebKit/public/platform/modules/webusb/WebUSBError.h
+++ b/third_party/WebKit/public/platform/modules/webusb/WebUSBError.h

@@ -13,10 +13,9 @@
 // satisfied.
 struct WebUSBError {
     enum class Error {
-        Device,
+        Network,
+        NotFound,
         Security,
-        Service,
-        Transfer,
     };
 
     WebUSBError(Error error, const WebString& message)

diff --git a/third_party/liblouis/BUILD.gn b/third_party/liblouis/BUILD.gn
index 634ec1a..75018ce 100644
--- a/third_party/liblouis/BUILD.gn
+++ b/third_party/liblouis/BUILD.gn

@@ -193,7 +193,6 @@
     ]
     deps = [
       ":liblouis_nacl",
-      "//native_client/src/untrusted/nacl",
       "//native_client_sdk/src/libraries/nacl_io",
       "//ppapi:ppapi_cpp_lib",
       "//ppapi/native_client:ppapi_lib",

diff --git a/third_party/mojo/src/mojo/edk/system/data_pipe.cc b/third_party/mojo/src/mojo/edk/system/data_pipe.cc
index 81c7b6c..a49e677 100644
--- a/third_party/mojo/src/mojo/edk/system/data_pipe.cc
+++ b/third_party/mojo/src/mojo/edk/system/data_pipe.cc

@@ -368,7 +368,7 @@
 
 MojoResult DataPipe::ProducerAddAwakable(Awakable* awakable,
                                          MojoHandleSignals signals,
-                                         uint32_t context,
+                                         uintptr_t context,
                                          HandleSignalsState* signals_state) {
   base::AutoLock locker(lock_);
   DCHECK(has_local_producer_no_lock());
@@ -577,7 +577,7 @@
 
 MojoResult DataPipe::ConsumerAddAwakable(Awakable* awakable,
                                          MojoHandleSignals signals,
-                                         uint32_t context,
+                                         uintptr_t context,
                                          HandleSignalsState* signals_state) {
   base::AutoLock locker(lock_);
   DCHECK(has_local_consumer_no_lock());

diff --git a/third_party/mojo/src/mojo/edk/system/data_pipe.h b/third_party/mojo/src/mojo/edk/system/data_pipe.h
index b49ab40..de340c9 100644
--- a/third_party/mojo/src/mojo/edk/system/data_pipe.h
+++ b/third_party/mojo/src/mojo/edk/system/data_pipe.h

@@ -111,7 +111,7 @@
   HandleSignalsState ProducerGetHandleSignalsState();
   MojoResult ProducerAddAwakable(Awakable* awakable,
                                  MojoHandleSignals signals,
-                                 uint32_t context,
+                                 uintptr_t context,
                                  HandleSignalsState* signals_state);
   void ProducerRemoveAwakable(Awakable* awakable,
                               HandleSignalsState* signals_state);
@@ -143,7 +143,7 @@
   HandleSignalsState ConsumerGetHandleSignalsState();
   MojoResult ConsumerAddAwakable(Awakable* awakable,
                                  MojoHandleSignals signals,
-                                 uint32_t context,
+                                 uintptr_t context,
                                  HandleSignalsState* signals_state);
   void ConsumerRemoveAwakable(Awakable* awakable,
                               HandleSignalsState* signals_state);

diff --git a/tools/cygprofile/profile_android_startup.py b/tools/cygprofile/profile_android_startup.py
index 6dbf0ea5..e08eec3 100644
--- a/tools/cygprofile/profile_android_startup.py
+++ b/tools/cygprofile/profile_android_startup.py

@@ -18,12 +18,12 @@
 import time
 
 sys.path.append(os.path.join(sys.path[0], '..', '..', 'build', 'android'))
+from devil.android import device_errors
+from devil.android import device_utils
+from devil.android import forwarder
+from devil.android.sdk import intent
 from pylib import constants
 from pylib import flag_changer
-from pylib import forwarder
-from pylib.device import device_errors
-from pylib.device import device_utils
-from pylib.device import intent
 
 sys.path.append(os.path.join(sys.path[0], '..', '..', 'tools', 'telemetry'))
 from telemetry.internal.util import webpagereplay

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index e7b935b..25122c4d 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -68882,7 +68882,7 @@
   <int value="9" label="font-variant"/>
   <int value="10" label="font-weight"/>
   <int value="11" label="text-rendering"/>
-  <int value="12" label="webkit-font-feature-settings"/>
+  <int value="12" label="alias-webkit-font-feature-settings"/>
   <int value="13" label="font-kerning"/>
   <int value="14" label="webkit-font-smoothing"/>
   <int value="15" label="font-variant-ligatures"/>
@@ -69374,6 +69374,21 @@
   <int value="501" label="scroll-snap-points-y"/>
   <int value="502" label="scroll-snap-coordinate"/>
   <int value="503" label="scroll-snap-destination"/>
+  <int value="504" label="translate"/>
+  <int value="505" label="rotate"/>
+  <int value="506" label="scale"/>
+  <int value="507" label="image-orientation"/>
+  <int value="508" label="backdrop-filter"/>
+  <int value="509" label="text-combine-upright"/>
+  <int value="510" label="text-orientation"/>
+  <int value="511" label="grid-column-gap"/>
+  <int value="512" label="grid-row-gap"/>
+  <int value="513" label="grid-gap"/>
+  <int value="514" label="font-feature-settings"/>
+  <int value="515" label="variable"/>
+  <int value="516" label="font-display"/>
+  <int value="517" label="contain"/>
+  <int value="518" label="d"/>
 </enum>
 
 <enum name="MappedEditingCommands" type="int">

diff --git a/tools/valgrind/gtest_exclude/content_browsertests.gtest-drmemory.txt b/tools/valgrind/gtest_exclude/content_browsertests.gtest-drmemory.txt
index 757d6b9..1fbfa5c6 100644
--- a/tools/valgrind/gtest_exclude/content_browsertests.gtest-drmemory.txt
+++ b/tools/valgrind/gtest_exclude/content_browsertests.gtest-drmemory.txt

@@ -58,11 +58,11 @@
 WebRtcGetUserMediaBrowserTest.TwoGetUserMediaAndCheckCallbackAfterFailure
 WebRtcGetUserMediaBrowserTest.TwoGetUserMediaWithEqualConstraints
 
-# https://crbug.com/507012
-ServiceWorkerVersionBrowserTest.ReadResourceFailure_WaitingWorker
-
 # https://crbug.com/376668
 TouchActionBrowserTest.DefaultAuto
 
 # https://crbug.com/536881
 IndexedDBBrowserTest.DiskFullOnCommit
+
+# https://crbug.com/569752
+SitePerProcessBrowserTest.*

diff --git a/ui/base/ime/chromeos/ime_keyboard.h b/ui/base/ime/chromeos/ime_keyboard.h
index 2885a2ae..44f7d35 100644
--- a/ui/base/ime/chromeos/ime_keyboard.h
+++ b/ui/base/ime/chromeos/ime_keyboard.h

@@ -28,8 +28,9 @@
   kVoidKey,
   kCapsLockKey,
   kEscapeKey,
-  // IMPORTANT: You should update kCustomizableKeys[] in .cc file, if you
-  // add a customizable key.
+  kBackspaceKey,
+  // IMPORTANT: Add new key to the end, because the keys may have been stored
+  // in user preferences.
   kNumModifierKeys,
 };
 

diff --git a/ui/file_manager/audio_player/elements/track_list.css b/ui/file_manager/audio_player/elements/track_list.css
index e39398a..efd5339 100644
--- a/ui/file_manager/audio_player/elements/track_list.css
+++ b/ui/file_manager/audio_player/elements/track_list.css

@@ -23,6 +23,7 @@
   flex-direction: row;
   height: 48px;
   justify-content: flex-start;
+  position: relative;
   width: 100%;
 }
 
@@ -87,3 +88,12 @@
   color: rgb(100, 100, 100);
   font-size: 12px;
 }
+
+paper-ripple {
+  bottom: 0;
+  color: rgb(51, 51, 51);
+  left: 0;
+  position: absolute;
+  right: 0;
+  top: 0;
+}

diff --git a/ui/file_manager/audio_player/elements/track_list.html b/ui/file_manager/audio_player/elements/track_list.html
index 23f91bc..ed847fa 100644
--- a/ui/file_manager/audio_player/elements/track_list.html
+++ b/ui/file_manager/audio_player/elements/track_list.html

@@ -6,6 +6,7 @@
 
 <link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/font-roboto/roboto.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/paper-ripple/paper-ripple.html">
 
 <dom-module id="track-list">
   <link rel="import" type="css" href="track_list.css">
@@ -17,6 +18,7 @@
           <div class="data-title">[[item.title]]</div>
           <div class="data-artist">[[item.artist]]</div>
         </div>
+        <paper-ripple initial-opacity="0.08"></paper-ripple>
       </div>
     </template>
   </template>

diff --git a/ui/file_manager/file_manager/foreground/css/common.css b/ui/file_manager/file_manager/foreground/css/common.css
index 6a1b0bd..4443843b 100644
--- a/ui/file_manager/file_manager/foreground/css/common.css
+++ b/ui/file_manager/file_manager/foreground/css/common.css

@@ -381,17 +381,12 @@
 }
 
 .shown > .cr-dialog-frame {
-  -webkit-transform: perspective(500px) scale(1)
-                     translateY(0) rotateX(0);
   opacity: 1;
 }
 
 .cr-dialog-frame {
-  -webkit-transform: perspective(500px) scale(0.99)
-                     translateY(-20px) rotateX(5deg);
   opacity: 0;
-  transition: all 180ms;
-  transition-duration: 250ms;
+  transition: opacity 250ms;
 }
 
 .cr-dialog-shield {

diff --git a/ui/message_center/message_center_style.h b/ui/message_center/message_center_style.h
index 864c2894..ab73a80 100644
--- a/ui/message_center/message_center_style.h
+++ b/ui/message_center/message_center_style.h

@@ -118,8 +118,8 @@
 const int kProgressBarThickness = 5;
 const int kProgressBarTopPadding = 16;
 const int kProgressBarCornerRadius = 3;
-const SkColor kProgressBarBackgroundColor = SkColorSetRGB(216, 216, 216);
-const SkColor kProgressBarSliceColor = SkColorSetRGB(120, 120, 120);
+const SkColor kProgressBarBackgroundColor = SkColorSetARGB(26, 0, 0, 0);
+const SkColor kProgressBarSliceColor = SkColorSetRGB(26, 194, 34);
 
 // Line limits.
 const int kMaxTitleLines = 2;

diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
index 5219f7f..2882894 100644
--- a/ui/views/win/hwnd_message_handler.cc
+++ b/ui/views/win/hwnd_message_handler.cc

@@ -2271,6 +2271,9 @@
   // messages are only received for the client area. We need to ignore the
   // synthesized mouse messages for all points in the client area and places
   // which return HTNOWHERE.
+  // TODO(ananta)
+  // Windows does not reliably set the touch flag on mouse messages. Look into
+  // a better way of identifying mouse messages originating from touch.
   if (ui::IsMouseEventFromTouch(message)) {
     LPARAM l_param_ht = l_param;
     // For mouse events (except wheel events), location is in window coordinates
@@ -2285,28 +2288,6 @@
       return 0;
   }
 
-  // Windows does not reliably set the touch flag on mouse moves nc mouse
-  // moves/mouse wheel messages etc. We also ignore mouse leaves as they are
-  // artificially generated messages in response to the TrackMouseEvents API.
-  // The code below is primarily for validation that we don't receive
-  // other mouse messages while we are in a touch sequence.
-  switch (message) {
-    case WM_MOUSEMOVE:
-    case WM_NCMOUSEMOVE:
-    case WM_MOUSELEAVE:
-    case WM_NCMOUSELEAVE:
-    case WM_MOUSEWHEEL:
-    case WM_MOUSEHWHEEL:
-      break;
-
-    default:
-      // Remove this CHECK once we validate that our hypothesis about the above
-      // mouse events being the only ones on which the touch flag is not set
-      // is correct.
-      CHECK(touch_ids_.empty());
-      break;
-  }
-
   // Certain logitech drivers send the WM_MOUSEHWHEEL message to the parent
   // followed by WM_MOUSEWHEEL messages to the child window causing a vertical
   // scroll. We treat these WM_MOUSEWHEEL messages as WM_MOUSEHWHEEL