diff --git a/DEPS b/DEPS
index 672b397..9df093a 100644
--- a/DEPS
+++ b/DEPS

@@ -36,11 +36,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '3ee255f259541eff1251c8007f9135e8d664346a',
+  'skia_revision': '982e7c502f4499044a4bff8420cdddddce0ce357',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '8b4e1a306667c2b70684c58dadb0f20b1c6faae4',
+  'v8_revision': '3e5d344f9cb90d626b251d5f9b3c4015bfd61f6b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -48,7 +48,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'd5da505da77f3ff31030b9f6fd02b4f00248dda4',
+  'angle_revision': 'ad10a4aa7f121c410d35ce5429a0ca83ec7ff752',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
@@ -60,7 +60,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'c65e11ee1bef647e87f2573848d5b49a6236ecf8',
+  'pdfium_revision': '21ce1a68bb9f80bfbd4f295fd3b7181e56502fdc',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -92,7 +92,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '578e20909005c3a030a55ce9948b74be5a6c4f1b',
+  'catapult_revision': 'aa7c58eb04599138bc97f93245c1acf3c5b81f85',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -219,7 +219,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '854d164fae9b0d4a2703d0bfb105bd4151b60ed3', # commit position 13978
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + 'e5dcf5c76c793e7355be2876cd9141e4289f8c9f', # commit position 13983
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),

diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index 1009072..d5ea693 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java

@@ -759,6 +759,13 @@
         mInitialFunctor = new AwGLFunctor(mNativeDrawGLFunctorFactory, mContainerView);
         mCurrentFunctor = mInitialFunctor;
         mContentsClient = contentsClient;
+        mContentsClient.getCallbackHelper().setCancelCallbackPoller(
+                new AwContentsClientCallbackHelper.CancelCallbackPoller() {
+                    @Override
+                    public boolean cancelAllCallbacks() {
+                        return AwContents.this.isDestroyed(NO_WARN);
+                    }
+                });
         mAwViewMethods = new AwViewMethodsImpl();
         mFullScreenTransitionsState = new FullScreenTransitionsState(
                 mContainerView, mInternalAccessAdapter, mAwViewMethods);
@@ -1218,12 +1225,7 @@
      * @return whether this instance of WebView is flagged as destroyed.
      */
     private boolean isDestroyed(int warnIfDestroyed) {
-        if (!mIsDestroyed) {
-            assert mContentViewCore != null;
-            assert mWebContents != null;
-            assert mNavigationController != null;
-            assert mNativeAwContents != 0;
-        } else if (warnIfDestroyed == WARN) {
+        if (mIsDestroyed && warnIfDestroyed == WARN) {
             Log.w(TAG, "Application attempted to call on a destroyed WebView", new Throwable());
         }
         boolean destroyRunnableHasRun =

diff --git a/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java b/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java
index 39fc42ef..2fb4a676 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContentsClientCallbackHelper.java

@@ -22,6 +22,12 @@
  */
 @VisibleForTesting
 public class AwContentsClientCallbackHelper {
+    /**
+     * Interface to tell CallbackHelper to cancel posted callbacks.
+     */
+    public static interface CancelCallbackPoller {
+        boolean cancelAllCallbacks();
+    }
 
     // TODO(boliu): Consider removing DownloadInfo and LoginRequestInfo by using native
     // MessageLoop to post directly to AwContents.
@@ -126,6 +132,8 @@
 
     private final Handler mHandler;
 
+    private CancelCallbackPoller mCancelCallbackPoller;
+
     private class MyHandler extends Handler {
         private MyHandler(Looper looper) {
             super(looper);
@@ -133,6 +141,11 @@
 
         @Override
         public void handleMessage(Message msg) {
+            if (mCancelCallbackPoller != null && mCancelCallbackPoller.cancelAllCallbacks()) {
+                removeCallbacksAndMessages(null);
+                return;
+            }
+
             switch(msg.what) {
                 case MSG_ON_LOAD_RESOURCE: {
                     final String url = (String) msg.obj;
@@ -227,6 +240,11 @@
         mContentsClient = contentsClient;
     }
 
+    // Public for tests.
+    public void setCancelCallbackPoller(CancelCallbackPoller poller) {
+        mCancelCallbackPoller = poller;
+    }
+
     public void postOnLoadResource(String url) {
         mHandler.sendMessage(mHandler.obtainMessage(MSG_ON_LOAD_RESOURCE, url));
     }

diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientCallbackHelperTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientCallbackHelperTest.java
index 5f46993..7dd5560 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientCallbackHelperTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsClientCallbackHelperTest.java

@@ -15,6 +15,7 @@
 import org.chromium.android_webview.test.TestAwContentsClient.OnReceivedLoginRequestHelper;
 import org.chromium.android_webview.test.TestAwContentsClient.PictureListenerHelper;
 import org.chromium.base.test.util.Feature;
+import org.chromium.base.test.util.parameter.ParameterizedTest;
 import org.chromium.content.browser.test.util.CallbackHelper;
 import org.chromium.content.browser.test.util.TestCallbackHelperContainer.OnPageStartedHelper;
 import org.chromium.content.browser.test.util.TestCallbackHelperContainer.OnReceivedErrorHelper;
@@ -24,6 +25,7 @@
 /**
  * Test suite for AwContentsClientCallbackHelper.
  */
+@ParameterizedTest.Set  // These are unit tests. No need to repeat for multiprocess.
 public class AwContentsClientCallbackHelperTest extends AwTestBase {
     /**
      * Callback helper for OnLoadedResource.
@@ -65,6 +67,26 @@
         }
     }
 
+    private static class TestCancelCallbackPoller
+            implements AwContentsClientCallbackHelper.CancelCallbackPoller {
+        private boolean mCancelled;
+        private final CallbackHelper mCallbackHelper = new CallbackHelper();
+
+        public void setCancelled() {
+            mCancelled = true;
+        }
+
+        public CallbackHelper getCallbackHelper() {
+            return mCallbackHelper;
+        }
+
+        @Override
+        public boolean cancelAllCallbacks() {
+            mCallbackHelper.notifyCalled();
+            return mCancelled;
+        }
+    }
+
     static final int PICTURE_TIMEOUT = 5000;
     static final String TEST_URL = "www.example.com";
     static final String REALM = "www.example.com";
@@ -82,6 +104,7 @@
 
     private TestAwContentsClient mContentsClient;
     private AwContentsClientCallbackHelper mClientHelper;
+    private TestCancelCallbackPoller mCancelCallbackPoller;
     private Looper mLooper;
 
     @Override
@@ -90,6 +113,8 @@
         mLooper = Looper.getMainLooper();
         mContentsClient = new TestAwContentsClient();
         mClientHelper = new AwContentsClientCallbackHelper(mLooper, mContentsClient);
+        mCancelCallbackPoller = new TestCancelCallbackPoller();
+        mClientHelper.setCancelCallbackPoller(mCancelCallbackPoller);
     }
 
     @Feature({"AndroidWebView"})
@@ -226,4 +251,31 @@
         assertEquals(OLD_SCALE, scaleChangedHelper.getOldScale());
         assertEquals(NEW_SCALE, scaleChangedHelper.getNewScale());
     }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testCancelCallbackPoller() throws Exception {
+        mCancelCallbackPoller.setCancelled();
+        CallbackHelper cancelCallbackPollerHelper = mCancelCallbackPoller.getCallbackHelper();
+        OnPageStartedHelper pageStartedHelper = mContentsClient.getOnPageStartedHelper();
+
+        int pollCount = pageStartedHelper.getCallCount();
+        int onPageStartedCount = pageStartedHelper.getCallCount();
+        // Post two callbacks.
+        mClientHelper.postOnPageStarted(TEST_URL);
+        mClientHelper.postOnPageStarted(TEST_URL);
+
+        // Wait for at least one poll.
+        cancelCallbackPollerHelper.waitForCallback(pollCount);
+
+        // Flush main queue.
+        getInstrumentation().runOnMainSync(new Runnable() {
+            @Override
+            public void run() {
+            }
+        });
+
+        // Neither callback should actually happen.
+        assertEquals(onPageStartedCount, pageStartedHelper.getCallCount());
+    }
 }

diff --git a/android_webview/native/aw_contents_client_bridge.cc b/android_webview/native/aw_contents_client_bridge.cc
index c428f24..d25dc84 100644
--- a/android_webview/native/aw_contents_client_bridge.cc
+++ b/android_webview/native/aw_contents_client_bridge.cc

@@ -239,7 +239,7 @@
 
   // Create an EVP_PKEY wrapper for the private key JNI reference.
   crypto::ScopedEVP_PKEY private_key(
-      net::android::GetOpenSSLPrivateKeyWrapper(private_key_ref.obj()));
+      net::android::GetOpenSSLPrivateKeyWrapper(private_key_ref));
   if (!private_key.get()) {
     LOG(ERROR) << "Could not create OpenSSL wrapper for private key";
     return;

diff --git a/base/bind_internal.h b/base/bind_internal.h
index 3d6ca09c..83e000d 100644
--- a/base/bind_internal.h
+++ b/base/bind_internal.h

@@ -244,8 +244,9 @@
   template <typename IgnoreResultType, typename... RunArgs>
   static void Invoke(IgnoreResultType&& ignore_result_helper,
                      RunArgs&&... args) {
-    FunctorTraits<T>::Invoke(ignore_result_helper.functor_,
-                             std::forward<RunArgs>(args)...);
+    FunctorTraits<T>::Invoke(
+        std::forward<IgnoreResultType>(ignore_result_helper).functor_,
+        std::forward<RunArgs>(args)...);
   }
 };
 
@@ -380,7 +381,7 @@
   template <typename ForwardFunctor, typename... ForwardBoundArgs>
   explicit BindState(ForwardFunctor&& functor, ForwardBoundArgs&&... bound_args)
       : BindStateBase(&Destroy),
-      functor_(std::forward<ForwardFunctor>(functor)),
+        functor_(std::forward<ForwardFunctor>(functor)),
         bound_args_(std::forward<ForwardBoundArgs>(bound_args)...) {
     DCHECK(!IsNull(functor_));
   }

diff --git a/base/message_loop/message_loop_test.cc b/base/message_loop/message_loop_test.cc
index 1ab946f9..4a690c0 100644
--- a/base/message_loop/message_loop_test.cc
+++ b/base/message_loop/message_loop_test.cc

@@ -98,17 +98,17 @@
   scoped_refptr<Foo> foo(new Foo());
   std::string a("a"), b("b"), c("c"), d("d");
   MessageLoop::current()->task_runner()->PostTask(FROM_HERE,
-                                                  Bind(&Foo::Test0, foo.get()));
+                                                  Bind(&Foo::Test0, foo));
   MessageLoop::current()->task_runner()->PostTask(
-      FROM_HERE, Bind(&Foo::Test1ConstRef, foo.get(), a));
+      FROM_HERE, Bind(&Foo::Test1ConstRef, foo, a));
   MessageLoop::current()->task_runner()->PostTask(
-      FROM_HERE, Bind(&Foo::Test1Ptr, foo.get(), &b));
+      FROM_HERE, Bind(&Foo::Test1Ptr, foo, &b));
   MessageLoop::current()->task_runner()->PostTask(
-      FROM_HERE, Bind(&Foo::Test1Int, foo.get(), 100));
+      FROM_HERE, Bind(&Foo::Test1Int, foo, 100));
   MessageLoop::current()->task_runner()->PostTask(
-      FROM_HERE, Bind(&Foo::Test2Ptr, foo.get(), &a, &c));
+      FROM_HERE, Bind(&Foo::Test2Ptr, foo, &a, &c));
   MessageLoop::current()->task_runner()->PostTask(
-      FROM_HERE, Bind(&Foo::Test2Mixed, foo.get(), a, &d));
+      FROM_HERE, Bind(&Foo::Test2Mixed, foo, a, &d));
   // After all tests, post a message that will shut down the message loop
   MessageLoop::current()->task_runner()->PostTask(
       FROM_HERE,
@@ -303,7 +303,7 @@
     *was_deleted_ = true;
     if (post_on_delete_.get())
       MessageLoop::current()->task_runner()->PostTask(
-          FROM_HERE, Bind(&RecordDeletionProbe::Run, post_on_delete_.get()));
+          FROM_HERE, Bind(&RecordDeletionProbe::Run, post_on_delete_));
   }
 
   scoped_refptr<RecordDeletionProbe> post_on_delete_;

diff --git a/base/message_loop/message_loop_unittest.cc b/base/message_loop/message_loop_unittest.cc
index bc69360..0d994f07 100644
--- a/base/message_loop/message_loop_unittest.cc
+++ b/base/message_loop/message_loop_unittest.cc

@@ -868,7 +868,7 @@
   scoped_refptr<Foo> foo(new Foo());
   std::string a("a");
   ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, Bind(
-      &Foo::Test1ConstRef, foo.get(), a));
+      &Foo::Test1ConstRef, foo, a));
 
   // Post quit task;
   MessageLoop::current()->task_runner()->PostTask(
@@ -997,7 +997,7 @@
 
   scoped_refptr<Foo> foo(new Foo());
   original_runner->PostTask(FROM_HERE,
-                            Bind(&Foo::Test1ConstRef, foo.get(), "a"));
+                            Bind(&Foo::Test1ConstRef, foo, "a"));
   RunLoop().RunUntilIdle();
   EXPECT_EQ(1, foo->test_count());
 }

diff --git a/base/message_loop/message_pump_glib_unittest.cc b/base/message_loop/message_pump_glib_unittest.cc
index 9259deb..607d3c93 100644
--- a/base/message_loop/message_pump_glib_unittest.cc
+++ b/base/message_loop/message_pump_glib_unittest.cc

@@ -357,15 +357,15 @@
   // Add 2 events to the queue to make sure it is always full (when we remove
   // the event before processing it).
   injector()->AddEventAsTask(
-      0, Bind(&ConcurrentHelper::FromEvent, helper.get()));
+      0, Bind(&ConcurrentHelper::FromEvent, helper));
   injector()->AddEventAsTask(
-      0, Bind(&ConcurrentHelper::FromEvent, helper.get()));
+      0, Bind(&ConcurrentHelper::FromEvent, helper));
 
   // Similarly post 2 tasks.
   loop()->task_runner()->PostTask(
-      FROM_HERE, Bind(&ConcurrentHelper::FromTask, helper.get()));
+      FROM_HERE, Bind(&ConcurrentHelper::FromTask, helper));
   loop()->task_runner()->PostTask(
-      FROM_HERE, Bind(&ConcurrentHelper::FromTask, helper.get()));
+      FROM_HERE, Bind(&ConcurrentHelper::FromTask, helper));
 
   RunLoop().Run();
   EXPECT_EQ(0, helper->event_count());
@@ -459,7 +459,7 @@
       FROM_HERE, Bind(&IncrementInt, &task_count),
       TimeDelta::FromMilliseconds(30));
   ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, Bind(&GLibLoopRunner::Quit, runner.get()),
+      FROM_HERE, Bind(&GLibLoopRunner::Quit, runner),
       TimeDelta::FromMilliseconds(40));
 
   // Run a nested, straight GLib message loop.
@@ -492,7 +492,7 @@
       FROM_HERE, Bind(&IncrementInt, &task_count),
       TimeDelta::FromMilliseconds(30));
   ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, Bind(&GLibLoopRunner::Quit, runner.get()),
+      FROM_HERE, Bind(&GLibLoopRunner::Quit, runner),
       TimeDelta::FromMilliseconds(40));
 
   // Run a nested, straight Gtk message loop.

diff --git a/blimp/BUILD.gn b/blimp/BUILD.gn
index 397ed58..fed5063 100644
--- a/blimp/BUILD.gn
+++ b/blimp/BUILD.gn

@@ -68,7 +68,6 @@
 test("blimp_unittests") {
   deps = [
     "//blimp/client:app_unit_tests",
-    "//blimp/client:feature_unit_tests",
     "//blimp/client/core:unit_tests",
     "//blimp/common:unit_tests",
     "//blimp/net:unit_tests",

diff --git a/blimp/client/BUILD.gn b/blimp/client/BUILD.gn
index b3323f8b..b14e565 100644
--- a/blimp/client/BUILD.gn
+++ b/blimp/client/BUILD.gn

@@ -16,17 +16,19 @@
   ]
 
   public_deps = [
-    ":feature",
+    "//blimp/client/core",
     "//blimp/client/core:switches",
+    "//blimp/common/proto",
     "//ui/events",
   ]
 
   deps = [
-    ":compositor",
     "//base",
     "//blimp/client/core/compositor",
     "//blimp/client/core/contents",
+    "//blimp/client/core/render_widget",
     "//blimp/client/core/session",
+    "//blimp/client/core/settings",
     "//blimp/common",
     "//blimp/common/proto",
     "//blimp/net",
@@ -96,127 +98,20 @@
   ]
 }
 
-source_set("feature") {
-  sources = [
-    "core/contents/tab_control_feature.cc",
-    "core/contents/tab_control_feature.h",
-    "feature/render_widget_feature.cc",
-    "feature/render_widget_feature.h",
-    "feature/settings_feature.cc",
-    "feature/settings_feature.h",
-  ]
-
-  deps = [
-    "//base:base",
-    "//blimp/common",
-    "//blimp/net",
-    "//cc",
-    "//cc/proto",
-    "//components/url_formatter",
-    "//net:net",
-    "//skia",
-    "//ui/gfx/geometry:geometry",
-  ]
-
-  public_deps = [
-    "//blimp/common/proto",
-  ]
-}
-
 source_set("test_support") {
   testonly = true
 
   sources = [
-    "feature/compositor/mock_compositor_dependencies.cc",
-    "feature/compositor/mock_compositor_dependencies.h",
-    "feature/mock_render_widget_feature_delegate.cc",
-    "feature/mock_render_widget_feature_delegate.h",
     "session/test_client_session.cc",
     "session/test_client_session.h",
   ]
 
   deps = [
     ":session",
-    "//blimp/client/support",
-    "//cc:test_support",
-    "//skia",
-    "//testing/gmock",
     "//url",
   ]
 }
 
-source_set("compositor") {
-  sources = [
-    "feature/compositor/blimp_compositor.cc",
-    "feature/compositor/blimp_compositor.h",
-    "feature/compositor/blimp_compositor_manager.cc",
-    "feature/compositor/blimp_compositor_manager.h",
-    "feature/compositor/blimp_input_handler_wrapper.cc",
-    "feature/compositor/blimp_input_handler_wrapper.h",
-    "feature/compositor/blimp_input_manager.cc",
-    "feature/compositor/blimp_input_manager.h",
-  ]
-
-  deps = [
-    "//blimp/client/core/compositor",
-    "//blimp/client/public:public_headers",
-    "//blimp/common",
-    "//blimp/net",
-    "//cc",
-    "//cc/proto",
-    "//cc/surfaces",
-    "//gpu/command_buffer/client",
-    "//net",
-    "//third_party/WebKit/public:blink_headers",
-    "//third_party/libwebp",
-    "//ui/events:gesture_detection",
-    "//ui/events/blink",
-    "//ui/events/gestures/blink",
-    "//ui/gfx/geometry:geometry",
-    "//ui/gl:gl",
-  ]
-
-  public_deps = [
-    ":feature",
-    "//blimp/common/proto",
-    "//skia",
-  ]
-}
-
-source_set("feature_unit_tests") {
-  testonly = true
-
-  sources = [
-    "core/contents/tab_control_feature_unittest.cc",
-    "feature/compositor/blimp_compositor_manager_unittest.cc",
-    "feature/compositor/blimp_compositor_unittest.cc",
-    "feature/render_widget_feature_unittest.cc",
-  ]
-
-  deps = [
-    ":compositor",
-    ":test_support",
-    "//base",
-    "//base/test:test_support",
-    "//blimp/client/core/compositor",
-    "//blimp/client/support",
-    "//blimp/common",
-    "//blimp/common/proto",
-    "//blimp/net",
-    "//blimp/net:test_support",
-    "//blimp/test:support",
-    "//cc/proto",
-    "//cc/surfaces:surfaces",
-    "//net",
-    "//net:test_support",
-    "//skia",
-    "//testing/gmock",
-    "//testing/gtest",
-    "//ui/events:gesture_detection",
-    "//ui/gfx/geometry",
-  ]
-}
-
 if (is_linux && !is_chromeos && use_x11) {
   executable("blimp_shell") {
     sources = [
@@ -229,9 +124,8 @@
 
     deps = [
       ":client",
-      ":compositor",
       "//base",
-      "//blimp/client:compositor",
+      "//blimp/client/core/compositor",
       "//blimp/client/core/session",
       "//blimp/net",
       "//net",
@@ -417,10 +311,11 @@
       ":client",
       ":jni_headers",
       "//base",
-      "//blimp/client:compositor",
       "//blimp/client/core",
+      "//blimp/client/core/compositor",
       "//blimp/client/core/contents",
       "//blimp/client/core/session:session",
+      "//blimp/client/core/settings",
       "//blimp/client/public:public_headers",
       "//blimp/common",
       "//blimp/common/proto",

diff --git a/blimp/client/app/android/blimp_client_session_android.cc b/blimp/client/app/android/blimp_client_session_android.cc
index 2a269ee..805ffc71 100644
--- a/blimp/client/app/android/blimp_client_session_android.cc
+++ b/blimp/client/app/android/blimp_client_session_android.cc

@@ -12,7 +12,7 @@
 #include "blimp/client/app/user_agent.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
 #include "blimp/client/core/session/assignment_source.h"
-#include "blimp/client/feature/settings_feature.h"
+#include "blimp/client/core/settings/settings_feature.h"
 #include "blimp/net/blimp_stats.h"
 #include "components/version_info/version_info.h"
 #include "jni/BlimpClientSession_jni.h"

diff --git a/blimp/client/app/android/blimp_view.cc b/blimp/client/app/android/blimp_view.cc
index b11f553..26755a33 100644
--- a/blimp/client/app/android/blimp_view.cc
+++ b/blimp/client/app/android/blimp_view.cc

@@ -10,7 +10,7 @@
 #include "blimp/client/app/android/blimp_client_session_android.h"
 #include "blimp/client/app/compositor/browser_compositor.h"
 #include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
-#include "blimp/client/feature/compositor/blimp_compositor_manager.h"
+#include "blimp/client/core/compositor/blimp_compositor_manager.h"
 #include "blimp/client/support/compositor/compositor_dependencies_impl.h"
 #include "jni/BlimpView_jni.h"
 #include "ui/events/android/motion_event_android.h"

diff --git a/blimp/client/app/android/blimp_view.h b/blimp/client/app/android/blimp_view.h
index 5ba48751..c40b2b4 100644
--- a/blimp/client/app/android/blimp_view.h
+++ b/blimp/client/app/android/blimp_view.h

@@ -9,7 +9,7 @@
 
 #include "base/android/jni_android.h"
 #include "base/macros.h"
-#include "blimp/client/feature/compositor/blimp_compositor_manager.h"
+#include "base/memory/weak_ptr.h"
 #include "ui/gfx/native_widget_types.h"
 
 namespace gfx {

diff --git a/blimp/client/app/linux/blimp_display_manager.cc b/blimp/client/app/linux/blimp_display_manager.cc
index de3a32b..c29fce26 100644
--- a/blimp/client/app/linux/blimp_display_manager.cc
+++ b/blimp/client/app/linux/blimp_display_manager.cc

@@ -6,9 +6,9 @@
 
 #include "blimp/client/app/compositor/browser_compositor.h"
 #include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
+#include "blimp/client/core/compositor/blimp_compositor_manager.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
-#include "blimp/client/feature/compositor/blimp_compositor_manager.h"
-#include "blimp/client/feature/render_widget_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/support/compositor/compositor_dependencies_impl.h"
 #include "ui/events/event.h"
 #include "ui/gfx/geometry/size.h"

diff --git a/blimp/client/core/BUILD.gn b/blimp/client/core/BUILD.gn
index 3a9696e4..2761312 100644
--- a/blimp/client/core/BUILD.gn
+++ b/blimp/client/core/BUILD.gn

@@ -38,7 +38,9 @@
     "//blimp/client/core/compositor",
     "//blimp/client/core/contents",
     "//blimp/client/core/geolocation",
+    "//blimp/client/core/render_widget",
     "//blimp/client/core/session",
+    "//blimp/client/core/settings",
   ]
 }
 
@@ -76,12 +78,13 @@
 
   deps = [
     ":context",
-    "//blimp/client:feature",
     "//blimp/client/core/compositor:unit_tests",
     "//blimp/client/core/contents:unit_tests",
     "//blimp/client/core/geolocation:unit_tests",
+    "//blimp/client/core/render_widget:unit_tests",
     "//blimp/client/core/session:unit_tests",
     "//blimp/client/public:public_headers",
+    "//blimp/client/support:test_support",
     "//blimp/client/test",
     "//testing/gmock",
     "//testing/gtest",
@@ -102,6 +105,11 @@
     "//url",
   ]
 
+  deps = [
+    ":switches",
+    "//blimp/client/core/settings",
+  ]
+
   if (is_android) {
     sources += [
       "android/blimp_client_context_impl_android.cc",
@@ -109,7 +117,7 @@
       "android/blimp_jni_registrar.cc",
     ]
 
-    deps = [
+    deps += [
       ":context_jni_headers",
       "//blimp/client/core/settings",
     ]

diff --git a/blimp/client/core/android/blimp_client_context_impl_android.cc b/blimp/client/core/android/blimp_client_context_impl_android.cc
index 23e078ec..6ef38658 100644
--- a/blimp/client/core/android/blimp_client_context_impl_android.cc
+++ b/blimp/client/core/android/blimp_client_context_impl_android.cc

@@ -10,6 +10,7 @@
 #include "blimp/client/core/contents/blimp_contents_impl.h"
 #include "blimp/client/core/settings/android/blimp_settings_android.h"
 #include "blimp/client/public/blimp_client_context.h"
+#include "blimp/client/public/compositor/compositor_dependencies.h"
 #include "jni/BlimpClientContextImpl_jni.h"
 
 namespace blimp {
@@ -42,8 +43,11 @@
 
 BlimpClientContextImplAndroid::BlimpClientContextImplAndroid(
     scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner)
-    : BlimpClientContextImpl(io_thread_task_runner, file_thread_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+    std::unique_ptr<CompositorDependencies> compositor_dependencies)
+    : BlimpClientContextImpl(io_thread_task_runner,
+                             file_thread_task_runner,
+                             std::move(compositor_dependencies)) {
   JNIEnv* env = base::android::AttachCurrentThread();
 
   java_obj_.Reset(env, Java_BlimpClientContextImpl_create(

diff --git a/blimp/client/core/android/blimp_client_context_impl_android.h b/blimp/client/core/android/blimp_client_context_impl_android.h
index 4e86576..b8c3e1e 100644
--- a/blimp/client/core/android/blimp_client_context_impl_android.h
+++ b/blimp/client/core/android/blimp_client_context_impl_android.h

@@ -12,6 +12,8 @@
 namespace blimp {
 namespace client {
 
+class CompositorDependencies;
+
 // JNI bridge between BlimpClientContextImpl in Java and C++.
 class BlimpClientContextImplAndroid : public BlimpClientContextImpl {
  public:
@@ -25,7 +27,8 @@
   // operations.
   explicit BlimpClientContextImplAndroid(
       scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+      std::unique_ptr<CompositorDependencies> compositor_dependencies);
   ~BlimpClientContextImplAndroid() override;
 
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject();

diff --git a/blimp/client/core/blimp_client_context_impl.cc b/blimp/client/core/blimp_client_context_impl.cc
index 009c1510..25e5360 100644
--- a/blimp/client/core/blimp_client_context_impl.cc
+++ b/blimp/client/core/blimp_client_context_impl.cc

@@ -5,16 +5,22 @@
 #include "blimp/client/core/blimp_client_context_impl.h"
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/threading/sequenced_task_runner_handle.h"
+#include "blimp/client/core/blimp_client_switches.h"
+#include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/contents/blimp_contents_impl.h"
 #include "blimp/client/core/contents/blimp_contents_manager.h"
 #include "blimp/client/core/contents/ime_feature.h"
 #include "blimp/client/core/contents/navigation_feature.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/core/session/cross_thread_network_event_observer.h"
+#include "blimp/client/core/settings/settings_feature.h"
 #include "blimp/client/public/blimp_client_context_delegate.h"
+#include "blimp/client/public/compositor/compositor_dependencies.h"
 
 #if defined(OS_ANDROID)
 #include "blimp/client/core/android/blimp_client_context_impl_android.h"
@@ -35,28 +41,39 @@
 // static
 BlimpClientContext* BlimpClientContext::Create(
     scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+    std::unique_ptr<CompositorDependencies> compositor_dependencies) {
 #if defined(OS_ANDROID)
   return new BlimpClientContextImplAndroid(io_thread_task_runner,
-                                           file_thread_task_runner);
+                                           file_thread_task_runner,
+                                           std::move(compositor_dependencies));
 #else
   return new BlimpClientContextImpl(io_thread_task_runner,
-                                    file_thread_task_runner);
+                                    file_thread_task_runner,
+                                    std::move(compositor_dependencies));
 #endif  // defined(OS_ANDROID)
 }
 
 BlimpClientContextImpl::BlimpClientContextImpl(
     scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner)
+    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+    std::unique_ptr<CompositorDependencies> compositor_dependencies)
     : BlimpClientContext(),
       io_thread_task_runner_(io_thread_task_runner),
       file_thread_task_runner_(file_thread_task_runner),
+      blimp_compositor_dependencies_(
+          base::MakeUnique<BlimpCompositorDependencies>(
+              std::move(compositor_dependencies))),
       ime_feature_(new ImeFeature),
       navigation_feature_(new NavigationFeature),
+      render_widget_feature_(new RenderWidgetFeature),
+      settings_feature_(new SettingsFeature),
       tab_control_feature_(new TabControlFeature),
       blimp_contents_manager_(
-          new BlimpContentsManager(ime_feature_.get(),
+          new BlimpContentsManager(blimp_compositor_dependencies_.get(),
+                                   ime_feature_.get(),
                                    navigation_feature_.get(),
+                                   render_widget_feature_.get(),
                                    tab_control_feature_.get())),
       weak_factory_(this) {
   net_components_.reset(new ClientNetworkComponents(
@@ -69,6 +86,7 @@
       io_thread_task_runner_, net_components_->GetBrowserConnectionHandler());
 
   RegisterFeatures();
+  InitializeSettings();
 
   // Initialize must only be posted after the calls features have been
   // registered.
@@ -160,11 +178,28 @@
   navigation_feature_->set_outgoing_message_processor(
       thread_pipe_manager_->RegisterFeature(BlimpMessage::kNavigation,
                                             navigation_feature_.get()));
+  render_widget_feature_->set_outgoing_input_message_processor(
+      thread_pipe_manager_->RegisterFeature(BlimpMessage::kInput,
+                                            render_widget_feature_.get()));
+  render_widget_feature_->set_outgoing_compositor_message_processor(
+      thread_pipe_manager_->RegisterFeature(BlimpMessage::kCompositor,
+                                            render_widget_feature_.get()));
+  thread_pipe_manager_->RegisterFeature(BlimpMessage::kRenderWidget,
+                                        render_widget_feature_.get());
+  settings_feature_->set_outgoing_message_processor(
+      thread_pipe_manager_->RegisterFeature(BlimpMessage::kSettings,
+                                            settings_feature_.get()));
   tab_control_feature_->set_outgoing_message_processor(
       thread_pipe_manager_->RegisterFeature(BlimpMessage::kTabControl,
                                             tab_control_feature_.get()));
 }
 
+void BlimpClientContextImpl::InitializeSettings() {
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDownloadWholeDocument))
+    settings_feature_->SetRecordWholeDocument(true);
+}
+
 void BlimpClientContextImpl::CreateIdentitySource() {
   identity_source_ = base::MakeUnique<IdentitySource>(
       delegate_, base::Bind(&BlimpClientContextImpl::ConnectToAssignmentSource,

diff --git a/blimp/client/core/blimp_client_context_impl.h b/blimp/client/core/blimp_client_context_impl.h
index 7c8d6e5..14c6677 100644
--- a/blimp/client/core/blimp_client_context_impl.h
+++ b/blimp/client/core/blimp_client_context_impl.h

@@ -24,9 +24,13 @@
 namespace blimp {
 namespace client {
 
+class BlimpCompositorDependencies;
 class BlimpContentsManager;
+class CompositorDependencies;
 class ImeFeature;
 class NavigationFeature;
+class RenderWidgetFeature;
+class SettingsFeature;
 class TabControlFeature;
 
 // BlimpClientContextImpl is the implementation of the main context-class for
@@ -40,7 +44,8 @@
   // operations.
   BlimpClientContextImpl(
       scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+      std::unique_ptr<CompositorDependencies> compositor_dependencies);
   ~BlimpClientContextImpl() override;
 
   IdentitySource* GetIdentitySource();
@@ -61,13 +66,6 @@
   // the AssignmentSource.
   virtual GURL GetAssignerURL();
 
-  // Create IdentitySource which provides user sign in states and OAuth2 token
-  // service.
-  void CreateIdentitySource();
-
-  // Provide OAuth2 token and propagate account sign in states change.
-  std::unique_ptr<IdentitySource> identity_source_;
-
  private:
   // Connect to assignment source with OAuth2 token to get an assignment.
   virtual void ConnectToAssignmentSource(const std::string& client_auth_token);
@@ -78,6 +76,11 @@
                                      const Assignment& assignment);
 
   void RegisterFeatures();
+  void InitializeSettings();
+
+  // Create IdentitySource which provides user sign in states and OAuth2 token
+  // service.
+  void CreateIdentitySource();
 
   // Provides functionality from the embedder.
   BlimpClientContextDelegate* delegate_ = nullptr;
@@ -92,9 +95,14 @@
   // Connect() to get a valid assignment and later connect to the engine.
   std::unique_ptr<AssignmentSource> assignment_source_;
 
+  // A set of dependencies required by all BlimpCompositor instances.
+  std::unique_ptr<BlimpCompositorDependencies> blimp_compositor_dependencies_;
+
   // Features to handle all incoming and outgoing protobuf messages.
   std::unique_ptr<ImeFeature> ime_feature_;
   std::unique_ptr<NavigationFeature> navigation_feature_;
+  std::unique_ptr<RenderWidgetFeature> render_widget_feature_;
+  std::unique_ptr<SettingsFeature> settings_feature_;
   std::unique_ptr<TabControlFeature> tab_control_feature_;
 
   std::unique_ptr<BlimpContentsManager> blimp_contents_manager_;
@@ -105,6 +113,9 @@
 
   std::unique_ptr<ThreadPipeManager> thread_pipe_manager_;
 
+  // Provide OAuth2 token and propagate account sign in states change.
+  std::unique_ptr<IdentitySource> identity_source_;
+
   base::WeakPtrFactory<BlimpClientContextImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(BlimpClientContextImpl);

diff --git a/blimp/client/core/blimp_client_context_impl_unittest.cc b/blimp/client/core/blimp_client_context_impl_unittest.cc
index 59f9490..ba896b2 100644
--- a/blimp/client/core/blimp_client_context_impl_unittest.cc
+++ b/blimp/client/core/blimp_client_context_impl_unittest.cc

@@ -5,6 +5,7 @@
 #include "blimp/client/core/blimp_client_context_impl.h"
 
 #include "base/macros.h"
+#include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/threading/thread.h"
@@ -12,6 +13,7 @@
 #include "blimp/client/core/contents/tab_control_feature.h"
 #include "blimp/client/public/blimp_client_context_delegate.h"
 #include "blimp/client/public/contents/blimp_contents.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "blimp/client/test/test_blimp_client_context_delegate.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -47,8 +49,9 @@
 
 TEST_F(BlimpClientContextImplTest,
        CreatedBlimpContentsGetsHelpersAttachedAndHasTabControlFeature) {
-  BlimpClientContextImpl blimp_client_context(io_thread_.task_runner(),
-                                              io_thread_.task_runner());
+  BlimpClientContextImpl blimp_client_context(
+      io_thread_.task_runner(), io_thread_.task_runner(),
+      base::MakeUnique<MockCompositorDependencies>());
   TestBlimpClientContextDelegate delegate;
   blimp_client_context.SetDelegate(&delegate);
 

diff --git a/blimp/client/core/compositor/BUILD.gn b/blimp/client/core/compositor/BUILD.gn
index b5edc42..5256a404 100644
--- a/blimp/client/core/compositor/BUILD.gn
+++ b/blimp/client/core/compositor/BUILD.gn

@@ -8,8 +8,12 @@
   sources = [
     "blimp_client_picture_cache.cc",
     "blimp_client_picture_cache.h",
+    "blimp_compositor.cc",
+    "blimp_compositor.h",
     "blimp_compositor_dependencies.cc",
     "blimp_compositor_dependencies.h",
+    "blimp_compositor_manager.cc",
+    "blimp_compositor_manager.h",
     "blimp_image_decoder.cc",
     "blimp_image_decoder.h",
     "blimp_output_surface.h",
@@ -24,12 +28,17 @@
   deps = [
     "//blimp/client/public:public_headers",
     "//blimp/net",
+    "//cc/proto",
+    "//cc/surfaces",
     "//gpu/command_buffer/client",
     "//third_party/libwebp",
+    "//ui/gl:gl",
   ]
 
   public_deps = [
     "//base",
+    "//blimp/client/core/input",
+    "//blimp/client/core/render_widget",
     "//blimp/common",
     "//blimp/common/proto",
     "//cc",
@@ -44,14 +53,25 @@
 
   sources = [
     "blimp_client_picture_cache_unittest.cc",
+    "blimp_compositor_manager_unittest.cc",
+    "blimp_compositor_unittest.cc",
     "delegated_output_surface_unittest.cc",
   ]
 
   deps = [
     ":compositor",
+    "//base",
+    "//blimp/client/core/render_widget",
+    "//blimp/client/core/render_widget:test_support",
+    "//blimp/client/support",
+    "//blimp/client/support:test_support",
     "//blimp/test:support",
+    "//cc",
     "//cc:test_support",
+    "//cc/proto",
+    "//cc/surfaces",
     "//skia",
     "//testing/gtest",
+    "//ui/events:gesture_detection",
   ]
 }

diff --git a/blimp/client/feature/compositor/blimp_compositor.cc b/blimp/client/core/compositor/blimp_compositor.cc
similarity index 98%
rename from blimp/client/feature/compositor/blimp_compositor.cc
rename to blimp/client/core/compositor/blimp_compositor.cc
index 8c16907..e778c8b 100644
--- a/blimp/client/feature/compositor/blimp_compositor.cc
+++ b/blimp/client/core/compositor/blimp_compositor.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_compositor.h"
+#include "blimp/client/core/compositor/blimp_compositor.h"
 
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ -129,8 +129,7 @@
 void BlimpCompositor::OnCompositorMessageReceived(
     std::unique_ptr<cc::proto::CompositorMessage> message) {
   DCHECK(message->has_to_impl());
-  const cc::proto::CompositorMessageToImpl& to_impl_proto =
-      message->to_impl();
+  const cc::proto::CompositorMessageToImpl& to_impl_proto = message->to_impl();
 
   DCHECK(to_impl_proto.has_message_type());
   switch (to_impl_proto.message_type()) {

diff --git a/blimp/client/feature/compositor/blimp_compositor.h b/blimp/client/core/compositor/blimp_compositor.h
similarity index 95%
rename from blimp/client/feature/compositor/blimp_compositor.h
rename to blimp/client/core/compositor/blimp_compositor.h
index ab5546c4..461cf59 100644
--- a/blimp/client/feature/compositor/blimp_compositor.h
+++ b/blimp/client/core/compositor/blimp_compositor.h

@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_H_
-#define BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_H_
+#ifndef BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_H_
+#define BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_H_
 
 #include <memory>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "blimp/client/core/compositor/blimp_output_surface.h"
-#include "blimp/client/feature/compositor/blimp_input_manager.h"
+#include "blimp/client/core/input/blimp_input_manager.h"
 #include "cc/surfaces/surface_factory_client.h"
 #include "cc/trees/layer_tree_host.h"
 #include "cc/trees/layer_tree_host_client.h"
@@ -165,8 +165,7 @@
 
   // Helper method to build the internal CC LayerTreeHost instance from
   // |message|.
-  void CreateLayerTreeHost(
-      const cc::proto::InitializeImpl& initialize_message);
+  void CreateLayerTreeHost(const cc::proto::InitializeImpl& initialize_message);
 
   // Helper method to destroy the internal CC LayerTreeHost instance and all its
   // associated state.
@@ -223,4 +222,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_H_
+#endif  // BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_H_

diff --git a/blimp/client/feature/compositor/blimp_compositor_manager.cc b/blimp/client/core/compositor/blimp_compositor_manager.cc
similarity index 89%
rename from blimp/client/feature/compositor/blimp_compositor_manager.cc
rename to blimp/client/core/compositor/blimp_compositor_manager.cc
index d65e07c..3085150 100644
--- a/blimp/client/feature/compositor/blimp_compositor_manager.cc
+++ b/blimp/client/core/compositor/blimp_compositor_manager.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_compositor_manager.h"
+#include "blimp/client/core/compositor/blimp_compositor_manager.h"
 
 #include "base/memory/ptr_util.h"
 #include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
@@ -106,17 +106,15 @@
 void BlimpCompositorManager::SendWebGestureEvent(
     int render_widget_id,
     const blink::WebGestureEvent& gesture_event) {
-  render_widget_feature_->SendWebGestureEvent(kDummyTabId,
-                                             render_widget_id,
-                                             gesture_event);
+  render_widget_feature_->SendWebGestureEvent(kDummyTabId, render_widget_id,
+                                              gesture_event);
 }
 
 void BlimpCompositorManager::SendCompositorMessage(
     int render_widget_id,
     const cc::proto::CompositorMessage& message) {
-  render_widget_feature_->SendCompositorMessage(kDummyTabId,
-                                               render_widget_id,
-                                               message);
+  render_widget_feature_->SendCompositorMessage(kDummyTabId, render_widget_id,
+                                                message);
 }
 
 BlimpCompositor* BlimpCompositorManager::GetCompositor(int render_widget_id) {

diff --git a/blimp/client/feature/compositor/blimp_compositor_manager.h b/blimp/client/core/compositor/blimp_compositor_manager.h
similarity index 91%
rename from blimp/client/feature/compositor/blimp_compositor_manager.h
rename to blimp/client/core/compositor/blimp_compositor_manager.h
index f4eaac0..dc1dfbd 100644
--- a/blimp/client/feature/compositor/blimp_compositor_manager.h
+++ b/blimp/client/core/compositor/blimp_compositor_manager.h

@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_
-#define BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_
+#ifndef BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_
+#define BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_
 
 #include <map>
 
 #include "base/macros.h"
+#include "blimp/client/core/compositor/blimp_compositor.h"
 #include "blimp/client/core/compositor/blob_image_serialization_processor.h"
-#include "blimp/client/feature/compositor/blimp_compositor.h"
-#include "blimp/client/feature/render_widget_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "cc/layers/layer.h"
 #include "cc/trees/layer_tree_settings.h"
 
@@ -94,4 +94,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_
+#endif  // BLIMP_CLIENT_CORE_COMPOSITOR_BLIMP_COMPOSITOR_MANAGER_H_

diff --git a/blimp/client/feature/compositor/blimp_compositor_manager_unittest.cc b/blimp/client/core/compositor/blimp_compositor_manager_unittest.cc
similarity index 86%
rename from blimp/client/feature/compositor/blimp_compositor_manager_unittest.cc
rename to blimp/client/core/compositor/blimp_compositor_manager_unittest.cc
index c5e8555..cd8b63f 100644
--- a/blimp/client/feature/compositor/blimp_compositor_manager_unittest.cc
+++ b/blimp/client/core/compositor/blimp_compositor_manager_unittest.cc

@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_compositor_manager.h"
+#include "blimp/client/core/compositor/blimp_compositor_manager.h"
 
 #include "base/memory/ptr_util.h"
 #include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/compositor/blob_image_serialization_processor.h"
-#include "blimp/client/feature/compositor/mock_compositor_dependencies.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "cc/proto/compositor_message.pb.h"
 #include "cc/surfaces/surface_manager.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -25,12 +25,9 @@
 class MockRenderWidgetFeature : public RenderWidgetFeature {
  public:
   MOCK_METHOD3(SendCompositorMessage,
-               void(const int,
-                    const int,
-                    const cc::proto::CompositorMessage&));
-  MOCK_METHOD3(SendInputEvent, void(const int,
-                                    const int,
-                                    const blink::WebInputEvent&));
+               void(const int, const int, const cc::proto::CompositorMessage&));
+  MOCK_METHOD3(SendInputEvent,
+               void(const int, const int, const blink::WebInputEvent&));
   MOCK_METHOD2(SetDelegate, void(int, RenderWidgetFeatureDelegate*));
   MOCK_METHOD1(RemoveDelegate, void(const int));
 };
@@ -97,10 +94,10 @@
     delegate()->OnRenderWidgetCreated(1);
     delegate()->OnRenderWidgetCreated(2);
 
-    mock_compositor1_ = static_cast<MockBlimpCompositor*>
-      (compositor_manager_->GetCompositor(1));
-    mock_compositor2_ = static_cast<MockBlimpCompositor*>
-      (compositor_manager_->GetCompositor(2));
+    mock_compositor1_ = static_cast<MockBlimpCompositor*>(
+        compositor_manager_->GetCompositor(1));
+    mock_compositor2_ = static_cast<MockBlimpCompositor*>(
+        compositor_manager_->GetCompositor(2));
 
     EXPECT_NE(mock_compositor1_, nullptr);
     EXPECT_NE(mock_compositor2_, nullptr);
@@ -111,8 +108,8 @@
 
   RenderWidgetFeature::RenderWidgetFeatureDelegate* delegate() const {
     DCHECK(compositor_manager_);
-    return static_cast<RenderWidgetFeature::RenderWidgetFeatureDelegate*>
-        (compositor_manager_.get());
+    return static_cast<RenderWidgetFeature::RenderWidgetFeatureDelegate*>(
+        compositor_manager_.get());
   }
 
   std::unique_ptr<BlimpCompositorDependencies> compositor_dependencies_;
@@ -128,12 +125,11 @@
 
   // Ensure that the compositor messages for a render widget are forwarded to
   // the correct compositor.
-  EXPECT_CALL(*mock_compositor1_,
-              MockableOnCompositorMessageReceived(_)).Times(2);
-  EXPECT_CALL(*mock_compositor2_,
-              MockableOnCompositorMessageReceived(_)).Times(1);
-  EXPECT_CALL(*mock_compositor1_,
-                SetVisible(false)).Times(1);
+  EXPECT_CALL(*mock_compositor1_, MockableOnCompositorMessageReceived(_))
+      .Times(2);
+  EXPECT_CALL(*mock_compositor2_, MockableOnCompositorMessageReceived(_))
+      .Times(1);
+  EXPECT_CALL(*mock_compositor1_, SetVisible(false)).Times(1);
 
   delegate()->OnCompositorMessageReceived(
       1, base::WrapUnique(new cc::proto::CompositorMessage));

diff --git a/blimp/client/feature/compositor/blimp_compositor_unittest.cc b/blimp/client/core/compositor/blimp_compositor_unittest.cc
similarity index 91%
rename from blimp/client/feature/compositor/blimp_compositor_unittest.cc
rename to blimp/client/core/compositor/blimp_compositor_unittest.cc
index 9edd6cf0..bf10f20 100644
--- a/blimp/client/feature/compositor/blimp_compositor_unittest.cc
+++ b/blimp/client/core/compositor/blimp_compositor_unittest.cc

@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_compositor.h"
+#include "blimp/client/core/compositor/blimp_compositor.h"
 
 #include "base/threading/thread_task_runner_handle.h"
 #include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/compositor/blob_image_serialization_processor.h"
-#include "blimp/client/feature/compositor/mock_compositor_dependencies.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "cc/layers/layer.h"
 #include "cc/proto/compositor_message.pb.h"
 #include "cc/surfaces/surface_manager.h"
@@ -83,8 +83,7 @@
   void SendInitializeMessage() {
     std::unique_ptr<cc::proto::CompositorMessage> message;
     message.reset(new cc::proto::CompositorMessage);
-    cc::proto::CompositorMessageToImpl* to_impl =
-        message->mutable_to_impl();
+    cc::proto::CompositorMessageToImpl* to_impl = message->mutable_to_impl();
     to_impl->set_message_type(
         cc::proto::CompositorMessageToImpl::INITIALIZE_IMPL);
     cc::proto::InitializeImpl* initialize_message =
@@ -97,8 +96,7 @@
   void SendShutdownMessage() {
     std::unique_ptr<cc::proto::CompositorMessage> message;
     message.reset(new cc::proto::CompositorMessage);
-    cc::proto::CompositorMessageToImpl* to_impl =
-        message->mutable_to_impl();
+    cc::proto::CompositorMessageToImpl* to_impl = message->mutable_to_impl();
     to_impl->set_message_type(cc::proto::CompositorMessageToImpl::CLOSE_IMPL);
     compositor_->OnCompositorMessageReceived(std::move(message));
   }
@@ -143,9 +141,11 @@
 
 TEST_F(BlimpCompositorTest, MessagesHaveCorrectId) {
   EXPECT_CALL(compositor_client_,
-              MockableSendCompositorMessage(render_widget_id_)).Times(1);
+              MockableSendCompositorMessage(render_widget_id_))
+      .Times(1);
   EXPECT_CALL(compositor_client_,
-              MockableSendWebGestureEvent(render_widget_id_)).Times(1);
+              MockableSendWebGestureEvent(render_widget_id_))
+      .Times(1);
 
   compositor_->SendProto(cc::proto::CompositorMessage());
   compositor_->SendGestureEvent(blink::WebGestureEvent());

diff --git a/blimp/client/core/compositor/blob_image_serialization_processor.cc b/blimp/client/core/compositor/blob_image_serialization_processor.cc
index d10e5c4..b5f041991 100644
--- a/blimp/client/core/compositor/blob_image_serialization_processor.cc
+++ b/blimp/client/core/compositor/blob_image_serialization_processor.cc

@@ -19,6 +19,7 @@
 #include "blimp/common/blob_cache/id_util.h"
 #include "blimp/common/proto/blob_cache.pb.h"
 #include "blimp/net/blob_channel/blob_channel_receiver.h"
+#include "third_party/skia/include/core/SkPicture.h"
 
 namespace blimp {
 namespace client {

diff --git a/blimp/client/core/compositor/blob_image_serialization_processor.h b/blimp/client/core/compositor/blob_image_serialization_processor.h
index 155910d..f244a75 100644
--- a/blimp/client/core/compositor/blob_image_serialization_processor.h
+++ b/blimp/client/core/compositor/blob_image_serialization_processor.h

@@ -10,9 +10,8 @@
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "cc/blimp/image_serialization_processor.h"
-#include "third_party/skia/include/core/SkPicture.h"
 
-class SkPixelSerializer;
+class SkBitmap;
 
 namespace blimp {
 

diff --git a/blimp/client/core/contents/BUILD.gn b/blimp/client/core/contents/BUILD.gn
index 328faf35..4e153d8 100644
--- a/blimp/client/core/contents/BUILD.gn
+++ b/blimp/client/core/contents/BUILD.gn

@@ -23,11 +23,13 @@
     "ime_feature.h",
     "navigation_feature.cc",
     "navigation_feature.h",
+    "tab_control_feature.cc",
+    "tab_control_feature.h",
   ]
 
   public_deps = [
     "//base",
-    "//blimp/client:feature",
+    "//blimp/client/core/compositor",
     "//blimp/client/public:public_headers",
     "//blimp/net",
     "//net:net",
@@ -37,6 +39,7 @@
   ]
 
   deps = [
+    "//blimp/client/core/render_widget",
     "//blimp/common",
     "//components/url_formatter",
     "//skia",
@@ -88,7 +91,7 @@
   ]
 
   public_deps = [
-    "//blimp/client/core/contents",
+    ":contents",
     "//testing/gmock",
   ]
 }
@@ -104,16 +107,18 @@
     "blimp_contents_observer_unittest.cc",
     "blimp_navigation_controller_impl_unittest.cc",
     "navigation_feature_unittest.cc",
+    "tab_control_feature_unittest.cc",
   ]
 
   deps = [
     ":contents",
     ":test_support",
     "//base",
-    "//blimp/client:feature",
     "//blimp/client/public:public_headers",
+    "//blimp/client/support:test_support",
     "//blimp/common",
     "//blimp/net:test_support",
+    "//net",
     "//net:test_support",
     "//testing/gtest",
     "//ui/gfx:test_support",

diff --git a/blimp/client/core/contents/android/blimp_contents_impl_android.cc b/blimp/client/core/contents/android/blimp_contents_impl_android.cc
index 172dba21..e0053921 100644
--- a/blimp/client/core/contents/android/blimp_contents_impl_android.cc
+++ b/blimp/client/core/contents/android/blimp_contents_impl_android.cc

@@ -49,6 +49,14 @@
   delete blimp_contents_impl_;
 }
 
+void BlimpContentsImplAndroid::Show(JNIEnv* env, jobject jobj) {
+  blimp_contents_impl_->Show();
+}
+
+void BlimpContentsImplAndroid::Hide(JNIEnv* env, jobject jobj) {
+  blimp_contents_impl_->Hide();
+}
+
 BlimpContentsImplAndroid::~BlimpContentsImplAndroid() {
   Java_BlimpContentsImpl_clearNativePtr(base::android::AttachCurrentThread(),
                                         java_obj_);

diff --git a/blimp/client/core/contents/android/blimp_contents_impl_android.h b/blimp/client/core/contents/android/blimp_contents_impl_android.h
index 46d4d0d..03b969f64 100644
--- a/blimp/client/core/contents/android/blimp_contents_impl_android.h
+++ b/blimp/client/core/contents/android/blimp_contents_impl_android.h

@@ -26,6 +26,8 @@
   BlimpContentsImpl* blimp_contents_impl() { return blimp_contents_impl_; }
 
   void Destroy(JNIEnv* env, jobject jobj);
+  void Show(JNIEnv* env, jobject jobj);
+  void Hide(JNIEnv* env, jobject jobj);
 
  private:
   BlimpContentsImpl* blimp_contents_impl_;

diff --git a/blimp/client/core/contents/android/java/src/org/chromium/blimp/core/contents/BlimpContentsImpl.java b/blimp/client/core/contents/android/java/src/org/chromium/blimp/core/contents/BlimpContentsImpl.java
index f068069..849a3c9e 100644
--- a/blimp/client/core/contents/android/java/src/org/chromium/blimp/core/contents/BlimpContentsImpl.java
+++ b/blimp/client/core/contents/android/java/src/org/chromium/blimp/core/contents/BlimpContentsImpl.java

@@ -79,5 +79,19 @@
         nativeDestroy(mNativeBlimpContentsImplAndroid);
     }
 
+    @Override
+    public void show() {
+        if (mNativeBlimpContentsImplAndroid == 0) return;
+        nativeShow(mNativeBlimpContentsImplAndroid);
+    }
+
+    @Override
+    public void hide() {
+        if (mNativeBlimpContentsImplAndroid == 0) return;
+        nativeHide(mNativeBlimpContentsImplAndroid);
+    }
+
     private native void nativeDestroy(long nativeBlimpContentsImplAndroid);
+    private native void nativeShow(long nativeBlimpContentsImplAndroid);
+    private native void nativeHide(long nativeBlimpContentsImplAndroid);
 }

diff --git a/blimp/client/core/contents/blimp_contents_impl.cc b/blimp/client/core/contents/blimp_contents_impl.cc
index 76e486f..2790c6a5 100644
--- a/blimp/client/core/contents/blimp_contents_impl.cc
+++ b/blimp/client/core/contents/blimp_contents_impl.cc

@@ -24,14 +24,19 @@
 #endif  // OS_ANDROID
 }
 
-BlimpContentsImpl::BlimpContentsImpl(int id,
-                                     ImeFeature* ime_feature,
-                                     NavigationFeature* navigation_feature,
-                                     TabControlFeature* tab_control_feature)
+BlimpContentsImpl::BlimpContentsImpl(
+    int id,
+    BlimpCompositorDependencies* compositor_deps,
+    ImeFeature* ime_feature,
+    NavigationFeature* navigation_feature,
+    RenderWidgetFeature* render_widget_feature,
+    TabControlFeature* tab_control_feature)
     : navigation_controller_(this, navigation_feature),
+      compositor_manager_(render_widget_feature, compositor_deps),
       id_(id),
       tab_control_feature_(tab_control_feature) {
-  blimp_contents_view_ = BlimpContentsView::Create(this);
+  blimp_contents_view_ =
+      BlimpContentsView::Create(this, compositor_manager_.layer());
 }
 
 BlimpContentsImpl::~BlimpContentsImpl() {
@@ -73,6 +78,14 @@
   return blimp_contents_view_->GetNativeView();
 }
 
+void BlimpContentsImpl::Show() {
+  compositor_manager_.SetVisible(true);
+}
+
+void BlimpContentsImpl::Hide() {
+  compositor_manager_.SetVisible(false);
+}
+
 bool BlimpContentsImpl::HasObserver(BlimpContentsObserver* observer) {
   return observers_.HasObserver(observer);
 }

diff --git a/blimp/client/core/contents/blimp_contents_impl.h b/blimp/client/core/contents/blimp_contents_impl.h
index ac1a2b6..76b96dea 100644
--- a/blimp/client/core/contents/blimp_contents_impl.h
+++ b/blimp/client/core/contents/blimp_contents_impl.h

@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "base/observer_list.h"
+#include "blimp/client/core/compositor/blimp_compositor_manager.h"
 #include "blimp/client/core/contents/blimp_navigation_controller_delegate.h"
 #include "blimp/client/core/contents/blimp_navigation_controller_impl.h"
 #include "blimp/client/public/contents/blimp_contents.h"
@@ -24,11 +25,13 @@
 class BlimpContentsImplAndroid;
 #endif  // defined(OS_ANDROID)
 
+class BlimpCompositorDependencies;
 class BlimpContentsObserver;
 class BlimpContentsView;
 class BlimpNavigationController;
 class ImeFeature;
 class NavigationFeature;
+class RenderWidgetFeature;
 class TabControlFeature;
 
 class BlimpContentsImpl : public BlimpContents,
@@ -36,8 +39,10 @@
  public:
   // Ownership of the features remains with the caller.
   explicit BlimpContentsImpl(int id,
+                             BlimpCompositorDependencies* compositor_deps,
                              ImeFeature* ime_feature,
                              NavigationFeature* navigation_feature,
+                             RenderWidgetFeature* render_widget_feature,
                              TabControlFeature* tab_control_feature);
   ~BlimpContentsImpl() override;
 
@@ -51,6 +56,8 @@
   void AddObserver(BlimpContentsObserver* observer) override;
   void RemoveObserver(BlimpContentsObserver* observer) override;
   gfx::NativeView GetNativeView() override;
+  void Show() override;
+  void Hide() override;
 
   // Check if some observer is in the observer list.
   bool HasObserver(BlimpContentsObserver* observer);
@@ -68,6 +75,11 @@
   // Handles the back/forward list and loading URLs.
   BlimpNavigationControllerImpl navigation_controller_;
 
+  // Holds onto all active BlimpCompositor instances for this BlimpContents.
+  // This properly exposes the right rendered page content for the correct
+  // BlimpCompositor based on the engine state.
+  BlimpCompositorManager compositor_manager_;
+
   // A list of all the observers of this BlimpContentsImpl.
   base::ObserverList<BlimpContentsObserver> observers_;
 

diff --git a/blimp/client/core/contents/blimp_contents_impl_unittest.cc b/blimp/client/core/contents/blimp_contents_impl_unittest.cc
index 72b48aa..6be333bb 100644
--- a/blimp/client/core/contents/blimp_contents_impl_unittest.cc
+++ b/blimp/client/core/contents/blimp_contents_impl_unittest.cc

@@ -6,9 +6,12 @@
 
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/contents/fake_navigation_feature.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/public/contents/blimp_contents_observer.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -44,8 +47,13 @@
 
 TEST(BlimpContentsImplTest, LoadURLAndNotifyObservers) {
   base::MessageLoop loop;
-  FakeNavigationFeature feature;
-  BlimpContentsImpl blimp_contents(kDummyTabId, nullptr, &feature, nullptr);
+  FakeNavigationFeature navigation_feature;
+  RenderWidgetFeature render_widget_feature;
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsImpl blimp_contents(kDummyTabId, &compositor_deps, nullptr,
+                                   &navigation_feature, &render_widget_feature,
+                                   nullptr);
 
   BlimpNavigationControllerImpl& navigation_controller =
       blimp_contents.GetNavigationController();
@@ -75,9 +83,13 @@
   int height = 15;
   float dp_to_px = 1.23f;
 
+  RenderWidgetFeature render_widget_feature;
   MockTabControlFeature tab_control_feature;
   base::MessageLoop loop;
-  BlimpContentsImpl blimp_contents(kDummyTabId, nullptr, nullptr,
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsImpl blimp_contents(kDummyTabId, &compositor_deps, nullptr,
+                                   nullptr, &render_widget_feature,
                                    &tab_control_feature);
 
   EXPECT_CALL(tab_control_feature,

diff --git a/blimp/client/core/contents/blimp_contents_manager.cc b/blimp/client/core/contents/blimp_contents_manager.cc
index 80023c6..6778bb1 100644
--- a/blimp/client/core/contents/blimp_contents_manager.cc
+++ b/blimp/client/core/contents/blimp_contents_manager.cc

@@ -7,7 +7,11 @@
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
+#include "blimp/client/core/contents/blimp_contents_impl.h"
+#include "blimp/client/core/contents/navigation_feature.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/public/contents/blimp_contents_observer.h"
 
 namespace {
@@ -45,11 +49,15 @@
 }
 
 BlimpContentsManager::BlimpContentsManager(
+    BlimpCompositorDependencies* blimp_compositor_dependencies,
     ImeFeature* ime_feature,
     NavigationFeature* nav_feature,
+    RenderWidgetFeature* render_widget_feature,
     TabControlFeature* tab_control_feature)
-    : ime_feature_(ime_feature),
+    : blimp_compositor_dependencies_(blimp_compositor_dependencies),
+      ime_feature_(ime_feature),
       navigation_feature_(nav_feature),
+      render_widget_feature_(render_widget_feature),
       tab_control_feature_(tab_control_feature),
       weak_ptr_factory_(this) {}
 
@@ -62,8 +70,9 @@
   int id = CreateBlimpContentsId();
 
   std::unique_ptr<BlimpContentsImpl> new_contents =
-      base::MakeUnique<BlimpContentsImpl>(id, ime_feature_, navigation_feature_,
-                                          tab_control_feature_);
+      base::MakeUnique<BlimpContentsImpl>(
+          id, blimp_compositor_dependencies_, ime_feature_, navigation_feature_,
+          render_widget_feature_, tab_control_feature_);
 
   // Create an observer entry for the contents.
   std::unique_ptr<BlimpContentsDeletionObserver> observer =

diff --git a/blimp/client/core/contents/blimp_contents_manager.h b/blimp/client/core/contents/blimp_contents_manager.h
index a19e6efd..fcbadc5 100644
--- a/blimp/client/core/contents/blimp_contents_manager.h
+++ b/blimp/client/core/contents/blimp_contents_manager.h

@@ -5,11 +5,19 @@
 #ifndef BLIMP_CLIENT_CORE_CONTENTS_BLIMP_CONTENTS_MANAGER_H_
 #define BLIMP_CLIENT_CORE_CONTENTS_BLIMP_CONTENTS_MANAGER_H_
 
-#include "blimp/client/core/contents/blimp_contents_impl.h"
+#include <map>
+
+#include "base/memory/weak_ptr.h"
 
 namespace blimp {
 namespace client {
 
+class BlimpCompositorDependencies;
+class BlimpContents;
+class BlimpContentsImpl;
+class ImeFeature;
+class NavigationFeature;
+class RenderWidgetFeature;
 class TabControlFeature;
 
 // BlimpContentsManager does the real work of creating BlimpContentsImpl, and
@@ -17,9 +25,12 @@
 // monitor the life time of the contents it creates.
 class BlimpContentsManager {
  public:
-  explicit BlimpContentsManager(ImeFeature* ime_feature,
-                                NavigationFeature* nav_feature,
-                                TabControlFeature* tab_control_feature);
+  explicit BlimpContentsManager(
+      BlimpCompositorDependencies* blimp_compositor_dependencies,
+      ImeFeature* ime_feature,
+      NavigationFeature* nav_feature,
+      RenderWidgetFeature* render_widget_feature,
+      TabControlFeature* tab_control_feature);
   ~BlimpContentsManager();
 
   // Builds a BlimpContentsImpl and notifies the engine.
@@ -53,8 +64,10 @@
   // lifetime of the observers.
   std::map<int, std::unique_ptr<BlimpContentsDeletionObserver>> observer_map_;
 
+  BlimpCompositorDependencies* blimp_compositor_dependencies_;
   ImeFeature* ime_feature_;
   NavigationFeature* navigation_feature_;
+  RenderWidgetFeature* render_widget_feature_;
   TabControlFeature* tab_control_feature_;
 
   // TODO(mlliu): Currently we want to have a single BlimpContents. Remove this

diff --git a/blimp/client/core/contents/blimp_contents_manager_unittest.cc b/blimp/client/core/contents/blimp_contents_manager_unittest.cc
index 89da6c8f..0037055 100644
--- a/blimp/client/core/contents/blimp_contents_manager_unittest.cc
+++ b/blimp/client/core/contents/blimp_contents_manager_unittest.cc

@@ -6,8 +6,11 @@
 
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
+#include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/contents/blimp_contents_impl.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -35,9 +38,13 @@
 
 TEST(BlimpContentsManagerUnittest, GetExistingBlimpContents) {
   base::MessageLoop loop;
+  RenderWidgetFeature render_widget_feature;
   MockTabControlFeature tab_control_feature;
 
-  BlimpContentsManager blimp_contents_manager(nullptr, nullptr,
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsManager blimp_contents_manager(&compositor_deps, nullptr,
+                                              nullptr, &render_widget_feature,
                                               &tab_control_feature);
 
   EXPECT_CALL(tab_control_feature, CreateTab(_)).Times(1);
@@ -50,9 +57,13 @@
 }
 
 TEST(BlimpContentsManagerUnittest, GetNonExistingBlimpContents) {
+  RenderWidgetFeature render_widget_feature;
   MockTabControlFeature tab_control_feature;
 
-  BlimpContentsManager blimp_contents_manager(nullptr, nullptr,
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsManager blimp_contents_manager(&compositor_deps, nullptr,
+                                              nullptr, &render_widget_feature,
                                               &tab_control_feature);
 
   BlimpContentsImpl* existing_contents =
@@ -62,8 +73,12 @@
 
 TEST(BlimpContentsManagerUnittest, GetDestroyedBlimpContents) {
   base::MessageLoop loop;
+  RenderWidgetFeature render_widget_feature;
   MockTabControlFeature tab_control_feature;
-  BlimpContentsManager blimp_contents_manager(nullptr, nullptr,
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsManager blimp_contents_manager(&compositor_deps, nullptr,
+                                              nullptr, &render_widget_feature,
                                               &tab_control_feature);
   int id;
 
@@ -85,8 +100,12 @@
 // TODO(mlliu): remove this test case (http://crbug.com/642558)
 TEST(BlimpContentsManagerUnittest, CreateTwoBlimpContentsDestroyAndCreate) {
   base::MessageLoop loop;
+  RenderWidgetFeature render_widget_feature;
   MockTabControlFeature tab_control_feature;
-  BlimpContentsManager blimp_contents_manager(nullptr, nullptr,
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsManager blimp_contents_manager(&compositor_deps, nullptr,
+                                              nullptr, &render_widget_feature,
                                               &tab_control_feature);
 
   EXPECT_CALL(tab_control_feature, CreateTab(_)).Times(2);

diff --git a/blimp/client/core/contents/blimp_contents_observer_unittest.cc b/blimp/client/core/contents/blimp_contents_observer_unittest.cc
index 1b688ea..cea0d026 100644
--- a/blimp/client/core/contents/blimp_contents_observer_unittest.cc
+++ b/blimp/client/core/contents/blimp_contents_observer_unittest.cc

@@ -5,7 +5,10 @@
 #include "blimp/client/public/contents/blimp_contents_observer.h"
 
 #include "base/memory/ptr_util.h"
+#include "blimp/client/core/compositor/blimp_compositor_dependencies.h"
 #include "blimp/client/core/contents/blimp_contents_impl.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -30,7 +33,11 @@
 };
 
 TEST(BlimpContentsObserverUnittests, ObserverDies) {
-  BlimpContentsImpl contents(kDummyTabId, nullptr, nullptr, nullptr);
+  RenderWidgetFeature render_widget_feature;
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
+  BlimpContentsImpl contents(kDummyTabId, &compositor_deps, nullptr, nullptr,
+                             &render_widget_feature, nullptr);
 
   std::unique_ptr<BlimpContentsObserver> observer =
       base::MakeUnique<BlimpContentsObserverTest>(&contents);
@@ -43,10 +50,13 @@
 
 TEST(BlimpContentsObserverUnittests, ContentsDies) {
   std::unique_ptr<BlimpContentsObserverTest> observer;
-
+  RenderWidgetFeature render_widget_feature;
+  BlimpCompositorDependencies compositor_deps(
+      base::MakeUnique<MockCompositorDependencies>());
   std::unique_ptr<BlimpContentsImpl> contents =
-      base::MakeUnique<BlimpContentsImpl>(kDummyTabId, nullptr, nullptr,
-                                          nullptr);
+      base::MakeUnique<BlimpContentsImpl>(kDummyTabId, &compositor_deps,
+                                          nullptr, nullptr,
+                                          &render_widget_feature, nullptr);
   observer.reset(new BlimpContentsObserverTest(contents.get()));
   EXPECT_CALL(*observer, OnContentsDestroyed()).Times(1);
   EXPECT_EQ(observer->blimp_contents(), contents.get());

diff --git a/blimp/client/core/contents/blimp_contents_view.h b/blimp/client/core/contents/blimp_contents_view.h
index b94359f..a9017a4 100644
--- a/blimp/client/core/contents/blimp_contents_view.h
+++ b/blimp/client/core/contents/blimp_contents_view.h

@@ -8,8 +8,13 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "base/memory/ref_counted.h"
 #include "ui/gfx/native_widget_types.h"
 
+namespace cc {
+class Layer;
+}  // namespace cc
+
 namespace blimp {
 namespace client {
 class BlimpContentsImpl;
@@ -17,7 +22,8 @@
 class BlimpContentsView {
  public:
   static std::unique_ptr<BlimpContentsView> Create(
-      BlimpContentsImpl* blimp_contents);
+      BlimpContentsImpl* blimp_contents,
+      scoped_refptr<cc::Layer> contents_layer);
 
   virtual ~BlimpContentsView() {}
 

diff --git a/blimp/client/core/contents/blimp_contents_view_android.cc b/blimp/client/core/contents/blimp_contents_view_android.cc
index ce32fc53..2ade9c3 100644
--- a/blimp/client/core/contents/blimp_contents_view_android.cc
+++ b/blimp/client/core/contents/blimp_contents_view_android.cc

@@ -13,19 +13,19 @@
 
 // static
 std::unique_ptr<BlimpContentsView> BlimpContentsView::Create(
-    BlimpContentsImpl* blimp_contents) {
+    BlimpContentsImpl* blimp_contents,
+    scoped_refptr<cc::Layer> contents_layer) {
   return base::MakeUnique<BlimpContentsViewAndroid>(
-      blimp_contents->GetBlimpContentsImplAndroid());
+      blimp_contents->GetBlimpContentsImplAndroid(), contents_layer);
 }
 
 BlimpContentsViewAndroid::BlimpContentsViewAndroid(
-    BlimpContentsImplAndroid* blimp_contents) {
+    BlimpContentsImplAndroid* blimp_contents,
+    scoped_refptr<cc::Layer> contents_layer) {
   // TODO(khushalsagar): Get the ViewAndroidDelegate from java after it has a
   // BlimpView. Also get the WindowAndroid so this view can add itself as a
   // child to it.
-  // TODO(dtrainor): Use the layer from the compositor manager here instead when
-  // it goes in the BlimpContents.
-  view_.SetLayer(cc::Layer::Create());
+  view_.SetLayer(contents_layer);
 }
 
 gfx::NativeView BlimpContentsViewAndroid::GetNativeView() {

diff --git a/blimp/client/core/contents/blimp_contents_view_android.h b/blimp/client/core/contents/blimp_contents_view_android.h
index 4feaad5..9f087249 100644
--- a/blimp/client/core/contents/blimp_contents_view_android.h
+++ b/blimp/client/core/contents/blimp_contents_view_android.h

@@ -15,7 +15,8 @@
 
 class BlimpContentsViewAndroid : public BlimpContentsView {
  public:
-  explicit BlimpContentsViewAndroid(BlimpContentsImplAndroid* blimp_contents);
+  explicit BlimpContentsViewAndroid(BlimpContentsImplAndroid* blimp_contents,
+                                    scoped_refptr<cc::Layer> contents_layer);
 
   // BlimpContentsView implementation.
   gfx::NativeView GetNativeView() override;

diff --git a/blimp/client/core/contents/blimp_contents_view_aura.cc b/blimp/client/core/contents/blimp_contents_view_aura.cc
index e9e8008..f4112149 100644
--- a/blimp/client/core/contents/blimp_contents_view_aura.cc
+++ b/blimp/client/core/contents/blimp_contents_view_aura.cc

@@ -5,13 +5,15 @@
 #include "blimp/client/core/contents/blimp_contents_view_aura.h"
 
 #include "base/memory/ptr_util.h"
+#include "cc/layers/layer.h"
 
 namespace blimp {
 namespace client {
 
 // static
 std::unique_ptr<BlimpContentsView> BlimpContentsView::Create(
-    BlimpContentsImpl* blimp_contents) {
+    BlimpContentsImpl* blimp_contents,
+    scoped_refptr<cc::Layer> contents_layer) {
   return base::MakeUnique<BlimpContentsViewAura>();
 }
 

diff --git a/blimp/client/core/dummy_blimp_client_context.cc b/blimp/client/core/dummy_blimp_client_context.cc
index 09d89247..97e5ada 100644
--- a/blimp/client/core/dummy_blimp_client_context.cc
+++ b/blimp/client/core/dummy_blimp_client_context.cc

@@ -7,6 +7,7 @@
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/single_thread_task_runner.h"
+#include "blimp/client/public/compositor/compositor_dependencies.h"
 
 #if defined(OS_ANDROID)
 #include "blimp/client/core/android/dummy_blimp_client_context_android.h"
@@ -22,7 +23,8 @@
 // static
 BlimpClientContext* BlimpClientContext::Create(
     scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+    std::unique_ptr<CompositorDependencies> compositor_dependencies) {
 #if defined(OS_ANDROID)
   return new DummyBlimpClientContextAndroid();
 #else

diff --git a/blimp/client/core/input/BUILD.gn b/blimp/client/core/input/BUILD.gn
new file mode 100644
index 0000000..7862c80
--- /dev/null
+++ b/blimp/client/core/input/BUILD.gn

@@ -0,0 +1,26 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("input") {
+  visibility = [ "//blimp/client/*" ]
+
+  sources = [
+    "blimp_input_handler_wrapper.cc",
+    "blimp_input_handler_wrapper.h",
+    "blimp_input_manager.cc",
+    "blimp_input_manager.h",
+  ]
+
+  deps = [
+    "//cc/",
+    "//ui/events/gestures/blink",
+  ]
+
+  public_deps = [
+    "//base",
+    "//third_party/WebKit/public:blink_headers",
+    "//ui/events:gesture_detection",
+    "//ui/events/blink",
+  ]
+}

diff --git a/blimp/client/feature/compositor/blimp_input_handler_wrapper.cc b/blimp/client/core/input/blimp_input_handler_wrapper.cc
similarity index 82%
rename from blimp/client/feature/compositor/blimp_input_handler_wrapper.cc
rename to blimp/client/core/input/blimp_input_handler_wrapper.cc
index 9f24ec8..2fe48e76 100644
--- a/blimp/client/feature/compositor/blimp_input_handler_wrapper.cc
+++ b/blimp/client/core/input/blimp_input_handler_wrapper.cc

@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_input_handler_wrapper.h"
+#include "blimp/client/core/input/blimp_input_handler_wrapper.h"
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
-#include "blimp/client/feature/compositor/blimp_input_manager.h"
+#include "blimp/client/core/input/blimp_input_manager.h"
 #include "ui/events/gestures/blink/web_gesture_curve_impl.h"
 
 namespace blimp {
@@ -21,8 +21,7 @@
       input_manager_weak_ptr_(input_manager_weak_ptr) {
   DCHECK(compositor_thread_checker_.CalledOnValidThread());
   DCHECK(input_handler);
-  input_handler_proxy_.reset(
-      new ui::InputHandlerProxy(input_handler, this));
+  input_handler_proxy_.reset(new ui::InputHandlerProxy(input_handler, this));
 }
 
 BlimpInputHandlerWrapper::~BlimpInputHandlerWrapper() {
@@ -72,21 +71,21 @@
     const blink::WebActiveWheelFlingParameters& params) {
   DCHECK(compositor_thread_checker_.CalledOnValidThread());
 
-  NOTIMPLEMENTED() <<
-      "Transferring Fling Animations to the engine is not supported";
+  NOTIMPLEMENTED()
+      << "Transferring Fling Animations to the engine is not supported";
 }
 
 blink::WebGestureCurve* BlimpInputHandlerWrapper::CreateFlingAnimationCurve(
-      blink::WebGestureDevice device_source,
-      const blink::WebFloatPoint& velocity,
-      const blink::WebSize& cumulative_scroll) {
+    blink::WebGestureDevice device_source,
+    const blink::WebFloatPoint& velocity,
+    const blink::WebSize& cumulative_scroll) {
   DCHECK(compositor_thread_checker_.CalledOnValidThread());
 
   return ui::WebGestureCurveImpl::CreateFromDefaultPlatformCurve(
-               gfx::Vector2dF(velocity.x, velocity.y),
-               gfx::Vector2dF(cumulative_scroll.width,
-                              cumulative_scroll.height),
-               false /* on_main_thread */).release();
+             gfx::Vector2dF(velocity.x, velocity.y),
+             gfx::Vector2dF(cumulative_scroll.width, cumulative_scroll.height),
+             false /* on_main_thread */)
+      .release();
 }
 
 void BlimpInputHandlerWrapper::DidOverscroll(

diff --git a/blimp/client/feature/compositor/blimp_input_handler_wrapper.h b/blimp/client/core/input/blimp_input_handler_wrapper.h
similarity index 91%
rename from blimp/client/feature/compositor/blimp_input_handler_wrapper.h
rename to blimp/client/core/input/blimp_input_handler_wrapper.h
index 5f734b4..0e3552c9 100644
--- a/blimp/client/feature/compositor/blimp_input_handler_wrapper.h
+++ b/blimp/client/core/input/blimp_input_handler_wrapper.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_HANDLER_WRAPPER_H_
-#define BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_HANDLER_WRAPPER_H_
+#ifndef BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_HANDLER_WRAPPER_H_
+#define BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_HANDLER_WRAPPER_H_
 
 #include "base/macros.h"
 #include "base/single_thread_task_runner.h"
@@ -11,6 +11,10 @@
 #include "ui/events/blink/input_handler_proxy.h"
 #include "ui/events/blink/input_handler_proxy_client.h"
 
+namespace cc {
+class InputHandler;
+}  // namespace cc
+
 namespace blimp {
 namespace client {
 
@@ -68,4 +72,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_HANDLER_WRAPPER_H_
+#endif  // BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_HANDLER_WRAPPER_H_

diff --git a/blimp/client/feature/compositor/blimp_input_manager.cc b/blimp/client/core/input/blimp_input_manager.cc
similarity index 86%
rename from blimp/client/feature/compositor/blimp_input_manager.cc
rename to blimp/client/core/input/blimp_input_manager.cc
index f1d106f..87f77e1d 100644
--- a/blimp/client/feature/compositor/blimp_input_manager.cc
+++ b/blimp/client/core/input/blimp_input_manager.cc

@@ -2,12 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/blimp_input_manager.h"
+#include "blimp/client/core/input/blimp_input_manager.h"
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
+#include "blimp/client/core/input/blimp_input_handler_wrapper.h"
 #include "ui/events/blink/blink_event_util.h"
 #include "ui/events/gesture_detection/gesture_provider_config_helper.h"
 
@@ -30,7 +31,8 @@
     const base::WeakPtr<cc::InputHandler>& input_handler)
     : client_(client),
       gesture_provider_(ui::GetGestureProviderConfig(
-                ui::GestureProviderConfigType::CURRENT_PLATFORM), this),
+                            ui::GestureProviderConfigType::CURRENT_PLATFORM),
+                        this),
       main_task_runner_(main_task_runner),
       compositor_task_runner_(compositor_task_runner),
       main_thread_blocked_(false),
@@ -40,8 +42,7 @@
       FROM_HERE,
       base::Bind(
           &BlimpInputManager::CreateInputHandlerWrapperOnCompositorThread,
-          base::Unretained(this), weak_factory_.GetWeakPtr(),
-          input_handler));
+          base::Unretained(this), weak_factory_.GetWeakPtr(), input_handler));
 }
 
 BlimpInputManager::~BlimpInputManager() {
@@ -51,13 +52,11 @@
       base::WaitableEvent::ResetPolicy::AUTOMATIC,
       base::WaitableEvent::InitialState::NOT_SIGNALED);
   {
-    base::AutoReset<bool> auto_reset_main_thread_blocked(
-        &main_thread_blocked_, true);
+    base::AutoReset<bool> auto_reset_main_thread_blocked(&main_thread_blocked_,
+                                                         true);
     compositor_task_runner_->PostTask(
-        FROM_HERE,
-        base::Bind(
-            &BlimpInputManager::ShutdownOnCompositorThread,
-            base::Unretained(this), &shutdown_event));
+        FROM_HERE, base::Bind(&BlimpInputManager::ShutdownOnCompositorThread,
+                              base::Unretained(this), &shutdown_event));
     shutdown_event.Wait();
   }
 }
@@ -70,9 +69,8 @@
   if (!result.succeeded)
     return false;
 
-  blink::WebTouchEvent touch =
-      ui::CreateWebTouchEventFromMotionEvent(motion_event,
-                                             result.moved_beyond_slop_region);
+  blink::WebTouchEvent touch = ui::CreateWebTouchEventFromMotionEvent(
+      motion_event, result.moved_beyond_slop_region);
 
   // Touch events are queued in the Gesture Provider until acknowledged to
   // allow them to be consumed by the touch event handlers in blink which can

diff --git a/blimp/client/feature/compositor/blimp_input_manager.h b/blimp/client/core/input/blimp_input_manager.h
similarity index 93%
rename from blimp/client/feature/compositor/blimp_input_manager.h
rename to blimp/client/core/input/blimp_input_manager.h
index 120988a1..6ece953 100644
--- a/blimp/client/feature/compositor/blimp_input_manager.h
+++ b/blimp/client/core/input/blimp_input_manager.h

@@ -2,21 +2,26 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_MANAGER_H_
-#define BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_MANAGER_H_
+#ifndef BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_MANAGER_H_
+#define BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_MANAGER_H_
 
 #include <memory>
 
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/waitable_event.h"
-#include "blimp/client/feature/compositor/blimp_input_handler_wrapper.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "ui/events/gesture_detection/filtered_gesture_provider.h"
 #include "ui/events/gesture_detection/motion_event.h"
 
+namespace cc {
+class InputHandler;
+}  // namespace cc
+
 namespace blimp {
 namespace client {
+class BlimpInputHandlerWrapper;
 
 class BlimpInputManagerClient {
  public:
@@ -106,4 +111,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_COMPOSITOR_BLIMP_INPUT_MANAGER_H_
+#endif  // BLIMP_CLIENT_CORE_INPUT_BLIMP_INPUT_MANAGER_H_

diff --git a/blimp/client/core/render_widget/BUILD.gn b/blimp/client/core/render_widget/BUILD.gn
new file mode 100644
index 0000000..34ec7207
--- /dev/null
+++ b/blimp/client/core/render_widget/BUILD.gn

@@ -0,0 +1,59 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("render_widget") {
+  visibility = [ "//blimp/client/*" ]
+
+  sources = [
+    "render_widget_feature.cc",
+    "render_widget_feature.h",
+  ]
+
+  deps = [
+    "//blimp/common",
+    "//cc/proto",
+    "//net",
+  ]
+
+  public_deps = [
+    "//base",
+    "//blimp/net",
+  ]
+}
+
+source_set("test_support") {
+  testonly = true
+
+  sources = [
+    "mock_render_widget_feature_delegate.cc",
+    "mock_render_widget_feature_delegate.h",
+  ]
+
+  public_deps = [
+    ":render_widget",
+    "//testing/gmock",
+  ]
+}
+
+source_set("unit_tests") {
+  visibility = [ "//blimp/client/core:unit_tests" ]
+
+  testonly = true
+
+  sources = [
+    "render_widget_feature_unittest.cc",
+  ]
+
+  deps = [
+    ":render_widget",
+    ":test_support",
+    "//base",
+    "//blimp/common",
+    "//blimp/net:test_support",
+    "//cc/proto",
+    "//net",
+    "//net:test_support",
+    "//testing/gtest",
+  ]
+}

diff --git a/blimp/client/feature/mock_render_widget_feature_delegate.cc b/blimp/client/core/render_widget/mock_render_widget_feature_delegate.cc
similarity index 88%
rename from blimp/client/feature/mock_render_widget_feature_delegate.cc
rename to blimp/client/core/render_widget/mock_render_widget_feature_delegate.cc
index 0d9703d..2273bb64 100644
--- a/blimp/client/feature/mock_render_widget_feature_delegate.cc
+++ b/blimp/client/core/render_widget/mock_render_widget_feature_delegate.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/mock_render_widget_feature_delegate.h"
+#include "blimp/client/core/render_widget/mock_render_widget_feature_delegate.h"
 
 namespace blimp {
 namespace client {

diff --git a/blimp/client/feature/mock_render_widget_feature_delegate.h b/blimp/client/core/render_widget/mock_render_widget_feature_delegate.h
similarity index 76%
rename from blimp/client/feature/mock_render_widget_feature_delegate.h
rename to blimp/client/core/render_widget/mock_render_widget_feature_delegate.h
index 5f519a0..3c29671 100644
--- a/blimp/client/feature/mock_render_widget_feature_delegate.h
+++ b/blimp/client/core/render_widget/mock_render_widget_feature_delegate.h

@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_
-#define BLIMP_CLIENT_FEATURE_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_
+#ifndef BLIMP_CLIENT_CORE_RENDER_WIDGET_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_
+#define BLIMP_CLIENT_CORE_RENDER_WIDGET_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_
 
 #include <string>
 
-#include "blimp/client/feature/render_widget_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace blimp {
@@ -34,4 +34,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_
+#endif  // BLIMP_CLIENT_CORE_RENDER_WIDGET_MOCK_RENDER_WIDGET_FEATURE_DELEGATE_H_

diff --git a/blimp/client/feature/render_widget_feature.cc b/blimp/client/core/render_widget/render_widget_feature.cc
similarity index 95%
rename from blimp/client/feature/render_widget_feature.cc
rename to blimp/client/core/render_widget/render_widget_feature.cc
index 79748cd2..e34706a 100644
--- a/blimp/client/feature/render_widget_feature.cc
+++ b/blimp/client/core/render_widget/render_widget_feature.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/render_widget_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 
 #include "base/numerics/safe_conversions.h"
 #include "blimp/common/create_blimp_message.h"
@@ -89,7 +89,7 @@
   int target_tab_id = message->target_tab_id();
   RenderWidgetFeatureDelegate* delegate = FindDelegate(target_tab_id);
   DCHECK(delegate) << "RenderWidgetFeatureDelegate not found for "
-      << target_tab_id;
+                   << target_tab_id;
 
   switch (message->feature_case()) {
     case BlimpMessage::kRenderWidget:
@@ -135,8 +135,7 @@
   std::unique_ptr<cc::proto::CompositorMessage> payload(
       new cc::proto::CompositorMessage);
   if (payload->ParseFromString(message.payload())) {
-    delegate->OnCompositorMessageReceived(render_widget_id,
-                                          std::move(payload));
+    delegate->OnCompositorMessageReceived(render_widget_id, std::move(payload));
   }
 }
 

diff --git a/blimp/client/feature/render_widget_feature.h b/blimp/client/core/render_widget/render_widget_feature.h
similarity index 92%
rename from blimp/client/feature/render_widget_feature.h
rename to blimp/client/core/render_widget/render_widget_feature.h
index b18ec9f..3fafce5 100644
--- a/blimp/client/feature/render_widget_feature.h
+++ b/blimp/client/core/render_widget/render_widget_feature.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_RENDER_WIDGET_FEATURE_H_
-#define BLIMP_CLIENT_FEATURE_RENDER_WIDGET_FEATURE_H_
+#ifndef BLIMP_CLIENT_CORE_RENDER_WIDGET_RENDER_WIDGET_FEATURE_H_
+#define BLIMP_CLIENT_CORE_RENDER_WIDGET_RENDER_WIDGET_FEATURE_H_
 
 #include <stdint.h>
 
@@ -94,9 +94,8 @@
                       const net::CompletionCallback& callback) override;
 
  private:
-  void ProcessRenderWidgetMessage(
-      RenderWidgetFeatureDelegate* delegate,
-      const RenderWidgetMessage& message);
+  void ProcessRenderWidgetMessage(RenderWidgetFeatureDelegate* delegate,
+                                  const RenderWidgetMessage& message);
 
   void ProcessCompositorMessage(RenderWidgetFeatureDelegate* delegate,
                                 const CompositorMessage& message);
@@ -123,4 +122,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_RENDER_WIDGET_FEATURE_H_
+#endif  // BLIMP_CLIENT_CORE_RENDER_WIDGET_RENDER_WIDGET_FEATURE_H_

diff --git a/blimp/client/feature/render_widget_feature_unittest.cc b/blimp/client/core/render_widget/render_widget_feature_unittest.cc
similarity index 96%
rename from blimp/client/feature/render_widget_feature_unittest.cc
rename to blimp/client/core/render_widget/render_widget_feature_unittest.cc
index 0bfbcf73..e9e6e7d9 100644
--- a/blimp/client/feature/render_widget_feature_unittest.cc
+++ b/blimp/client/core/render_widget/render_widget_feature_unittest.cc

@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/render_widget_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 
 #include <memory>
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
-#include "blimp/client/feature/mock_render_widget_feature_delegate.h"
+#include "blimp/client/core/render_widget/mock_render_widget_feature_delegate.h"
 #include "blimp/common/create_blimp_message.h"
 #include "blimp/common/proto/blimp_message.pb.h"
 #include "blimp/common/proto/compositor.pb.h"

diff --git a/blimp/client/core/settings/BUILD.gn b/blimp/client/core/settings/BUILD.gn
index 54eb871..8e1b53a4 100644
--- a/blimp/client/core/settings/BUILD.gn
+++ b/blimp/client/core/settings/BUILD.gn

@@ -5,22 +5,41 @@
 if (is_android) {
   import("//build/config/android/config.gni")
   import("//build/config/android/rules.gni")
+}
 
-  source_set("settings") {
-    visibility = [ "//blimp/client/*" ]
+source_set("settings") {
+  visibility = [ "//blimp/client/*" ]
 
-    sources = [
+  sources = [
+    "settings_feature.cc",
+    "settings_feature.h",
+  ]
+
+  deps = [
+    "//blimp/common",
+    "//net",
+  ]
+
+  public_deps = [
+    "//base",
+    "//blimp/net",
+  ]
+
+  if (is_android) {
+    sources += [
       "android/blimp_settings_android.cc",
       "android/blimp_settings_android.h",
     ]
 
-    deps = [
+    deps += [
       ":settings_jni_headers",
       "//blimp/client/core/session",
       "//blimp/common",
     ]
   }
+}
 
+if (is_android) {
   android_library("settings_java") {
     visibility = [ "//blimp/client/*" ]
 

diff --git a/blimp/client/feature/settings_feature.cc b/blimp/client/core/settings/settings_feature.cc
similarity index 96%
rename from blimp/client/feature/settings_feature.cc
rename to blimp/client/core/settings/settings_feature.cc
index f613cda6..d2e9d1d 100644
--- a/blimp/client/feature/settings_feature.cc
+++ b/blimp/client/core/settings/settings_feature.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/settings_feature.h"
+#include "blimp/client/core/settings/settings_feature.h"
 
 #include "blimp/common/create_blimp_message.h"
 #include "blimp/common/proto/blimp_message.pb.h"

diff --git a/blimp/client/feature/settings_feature.h b/blimp/client/core/settings/settings_feature.h
similarity index 88%
rename from blimp/client/feature/settings_feature.h
rename to blimp/client/core/settings/settings_feature.h
index 58c50f5..1868282 100644
--- a/blimp/client/feature/settings_feature.h
+++ b/blimp/client/core/settings/settings_feature.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_SETTINGS_FEATURE_H_
-#define BLIMP_CLIENT_FEATURE_SETTINGS_FEATURE_H_
+#ifndef BLIMP_CLIENT_CORE_SETTINGS_SETTINGS_FEATURE_H_
+#define BLIMP_CLIENT_CORE_SETTINGS_SETTINGS_FEATURE_H_
 
 #include "base/macros.h"
 #include "blimp/net/blimp_message_processor.h"
@@ -42,4 +42,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_SETTINGS_FEATURE_H_
+#endif  // BLIMP_CLIENT_CORE_SETTINGS_SETTINGS_FEATURE_H_

diff --git a/blimp/client/public/android/java/src/org/chromium/blimp_public/contents/BlimpContents.java b/blimp/client/public/android/java/src/org/chromium/blimp_public/contents/BlimpContents.java
index 4cea10f..9ef1358 100644
--- a/blimp/client/public/android/java/src/org/chromium/blimp_public/contents/BlimpContents.java
+++ b/blimp/client/public/android/java/src/org/chromium/blimp_public/contents/BlimpContents.java

@@ -13,7 +13,7 @@
  */
 public interface BlimpContents {
     /**
-     * Retrives the {@link BlimpNavigationController} that controls all navigation related
+     * Retrieves the {@link BlimpNavigationController} that controls all navigation related
      * to this BlimpContents.
      */
     BlimpNavigationController getNavigationController();
@@ -33,4 +33,14 @@
      * garbage collected.
      */
     void destroy();
+
+    /**
+     * Shows this BlimpContents.
+     */
+    void show();
+
+    /**
+     * Hide this BlimpContents.
+     */
+    void hide();
 }

diff --git a/blimp/client/public/blimp_client_context.h b/blimp/client/public/blimp_client_context.h
index 98999dd7..908aaca6 100644
--- a/blimp/client/public/blimp_client_context.h
+++ b/blimp/client/public/blimp_client_context.h

@@ -25,6 +25,8 @@
 namespace blimp {
 namespace client {
 
+class CompositorDependencies;
+
 // BlimpClientContext is the core class for the Blimp client. It provides hooks
 // for creating BlimpContents and other features that are per
 // BrowserContext/Profile.
@@ -44,9 +46,12 @@
   // operations.
   // The |file_thread_task_runner| must be the task runner to use for file
   // operations.
+  // |compositor_dependencies| is a support object that provides all embedder
+  // dependencies required by internal compositors.
   static BlimpClientContext* Create(
       scoped_refptr<base::SingleThreadTaskRunner> io_thread_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
+      std::unique_ptr<CompositorDependencies> compositor_dependencies);
 
   // The delegate provides all the required functionality from the embedder.
   virtual void SetDelegate(BlimpClientContextDelegate* delegate) = 0;

diff --git a/blimp/client/public/contents/blimp_contents.h b/blimp/client/public/contents/blimp_contents.h
index 0b41f566..9d949d3 100644
--- a/blimp/client/public/contents/blimp_contents.h
+++ b/blimp/client/public/contents/blimp_contents.h

@@ -39,6 +39,11 @@
   // Returns the native view that holds the contents of this tab.
   virtual gfx::NativeView GetNativeView() = 0;
 
+  // Will cause this BlimpContents and the remote contents to show and start or
+  // stop rendering content respectively.
+  virtual void Show() = 0;
+  virtual void Hide() = 0;
+
 #if defined(OS_ANDROID)
   // Returns a Java object of the type BlimpContents for the given
   // BlimpContents.

diff --git a/blimp/client/session/blimp_client_session.cc b/blimp/client/session/blimp_client_session.cc
index 35593bf..04ba1b7 100644
--- a/blimp/client/session/blimp_client_session.cc
+++ b/blimp/client/session/blimp_client_session.cc

@@ -20,10 +20,10 @@
 #include "blimp/client/core/contents/ime_feature.h"
 #include "blimp/client/core/contents/navigation_feature.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/core/session/client_network_components.h"
 #include "blimp/client/core/session/cross_thread_network_event_observer.h"
-#include "blimp/client/feature/render_widget_feature.h"
-#include "blimp/client/feature/settings_feature.h"
+#include "blimp/client/core/settings/settings_feature.h"
 #include "blimp/common/blob_cache/in_memory_blob_cache.h"
 #include "blimp/net/blimp_message_thread_pipe.h"
 #include "blimp/net/blimp_stats.h"

diff --git a/blimp/client/support/BUILD.gn b/blimp/client/support/BUILD.gn
index 1977805..3ddaa16a 100644
--- a/blimp/client/support/BUILD.gn
+++ b/blimp/client/support/BUILD.gn

@@ -2,10 +2,16 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-source_set("support") {
-  visibility = [ "//blimp/client/*" ]
-
+group("support") {
   public_deps = [
     "//blimp/client/support/compositor",
   ]
 }
+
+group("test_support") {
+  testonly = true
+
+  public_deps = [
+    "//blimp/client/support/compositor:test_support",
+  ]
+}

diff --git a/blimp/client/support/compositor/BUILD.gn b/blimp/client/support/compositor/BUILD.gn
index 65441c5b..829cd60 100644
--- a/blimp/client/support/compositor/BUILD.gn
+++ b/blimp/client/support/compositor/BUILD.gn

@@ -8,8 +8,6 @@
 }
 
 source_set("compositor") {
-  visibility = [ "//blimp/client/support" ]
-
   sources = [
     "blimp_context_provider.cc",
     "blimp_context_provider.h",
@@ -39,3 +37,20 @@
     "//ui/gfx:memory_buffer",
   ]
 }
+
+source_set("test_support") {
+  testonly = true
+
+  sources = [
+    "mock_compositor_dependencies.cc",
+    "mock_compositor_dependencies.h",
+  ]
+
+  deps = [
+    "//cc:test_support",
+  ]
+
+  public_deps = [
+    ":compositor",
+  ]
+}

diff --git a/blimp/client/feature/compositor/mock_compositor_dependencies.cc b/blimp/client/support/compositor/mock_compositor_dependencies.cc
similarity index 89%
rename from blimp/client/feature/compositor/mock_compositor_dependencies.cc
rename to blimp/client/support/compositor/mock_compositor_dependencies.cc
index c6f1ff4..85e7efa8 100644
--- a/blimp/client/feature/compositor/mock_compositor_dependencies.cc
+++ b/blimp/client/support/compositor/mock_compositor_dependencies.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "blimp/client/feature/compositor/mock_compositor_dependencies.h"
+#include "blimp/client/support/compositor/mock_compositor_dependencies.h"
 
 #include "cc/test/test_in_process_context_provider.h"
 

diff --git a/blimp/client/feature/compositor/mock_compositor_dependencies.h b/blimp/client/support/compositor/mock_compositor_dependencies.h
similarity index 77%
rename from blimp/client/feature/compositor/mock_compositor_dependencies.h
rename to blimp/client/support/compositor/mock_compositor_dependencies.h
index 02f83dae..c4a298a 100644
--- a/blimp/client/feature/compositor/mock_compositor_dependencies.h
+++ b/blimp/client/support/compositor/mock_compositor_dependencies.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BLIMP_CLIENT_FEATURE_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_
-#define BLIMP_CLIENT_FEATURE_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_
+#ifndef BLIMP_CLIENT_SUPPORT_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_
+#define BLIMP_CLIENT_SUPPORT_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_
 
 #include "blimp/client/support/compositor/compositor_dependencies_impl.h"
 
@@ -22,4 +22,4 @@
 }  // namespace client
 }  // namespace blimp
 
-#endif  // BLIMP_CLIENT_FEATURE_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_
+#endif  // BLIMP_CLIENT_SUPPORT_COMPOSITOR_MOCK_COMPOSITOR_DEPENDENCIES_H_

diff --git a/blimp/engine/BUILD.gn b/blimp/engine/BUILD.gn
index 832042db..14761012 100644
--- a/blimp/engine/BUILD.gn
+++ b/blimp/engine/BUILD.gn

@@ -678,12 +678,13 @@
 
   deps = [
     "//base",
-    "//blimp/client:feature",
     "//blimp/client:session",
     "//blimp/client:test_support",
     "//blimp/client/core:switches",
     "//blimp/client/core/contents:test_support",
+    "//blimp/client/core/render_widget:test_support",
     "//blimp/client/core/session",
+    "//blimp/client/support:test_support",
     "//blimp/common",
     "//blimp/engine:app",
     "//blimp/engine:app_config",

diff --git a/blimp/engine/browser_tests/engine_browsertest.cc b/blimp/engine/browser_tests/engine_browsertest.cc
index 77a9217..436cf0a 100644
--- a/blimp/engine/browser_tests/engine_browsertest.cc
+++ b/blimp/engine/browser_tests/engine_browsertest.cc

@@ -8,9 +8,9 @@
 #include "blimp/client/core/contents/mock_navigation_feature_delegate.h"
 #include "blimp/client/core/contents/navigation_feature.h"
 #include "blimp/client/core/contents/tab_control_feature.h"
+#include "blimp/client/core/render_widget/mock_render_widget_feature_delegate.h"
+#include "blimp/client/core/render_widget/render_widget_feature.h"
 #include "blimp/client/core/session/assignment_source.h"
-#include "blimp/client/feature/mock_render_widget_feature_delegate.h"
-#include "blimp/client/feature/render_widget_feature.h"
 #include "blimp/client/public/session/assignment.h"
 #include "blimp/client/session/test_client_session.h"
 #include "blimp/engine/browser_tests/blimp_browser_test.h"

diff --git a/build/android/adb_gdb b/build/android/adb_gdb
index 00c4f89..13ce78c1 100755
--- a/build/android/adb_gdb
+++ b/build/android/adb_gdb

@@ -25,6 +25,7 @@
 GDBSERVER_PIDFILE=
 TARGET_GDBSERVER=
 COMMAND_PREFIX=
+COMMAND_SUFFIX=
 
 clean_exit () {
   if [ "$TMPDIR" ]; then
@@ -35,7 +36,7 @@
     fi
     if [ "$TARGET_GDBSERVER" ]; then
       log "Removing target gdbserver binary: $TARGET_GDBSERVER."
-      "$ADB" shell "$COMMAND_PREFIX" rm "$TARGET_GDBSERVER" >/dev/null 2>&1
+      "$ADB" shell "$COMMAND_PREFIX" rm "$TARGET_GDBSERVER" "$COMMAND_SUFFIX" >/dev/null 2>&1
     fi
     log "Cleaning up: $TMPDIR"
     rm -rf "$TMPDIR"
@@ -920,7 +921,7 @@
 # Push gdbserver to the device
 log "Pushing gdbserver $GDBSERVER to $TARGET_GDBSERVER"
 adb push $GDBSERVER $TMP_TARGET_GDBSERVER &>/dev/null
-adb shell $COMMAND_PREFIX cp $TMP_TARGET_GDBSERVER $TARGET_GDBSERVER
+adb shell $COMMAND_PREFIX cp $TMP_TARGET_GDBSERVER $TARGET_GDBSERVER $COMMAND_SUFFIX
 adb shell rm $TMP_TARGET_GDBSERVER
 fail_panic "Could not copy gdbserver to the device!"
 

diff --git a/build/android/lint/suppressions.xml b/build/android/lint/suppressions.xml
index 36b9e24..473dbfb 100644
--- a/build/android/lint/suppressions.xml
+++ b/build/android/lint/suppressions.xml

@@ -262,16 +262,12 @@
         AndroidManifest.xml after rolling to SDK 24.
     -->
     <ignore regexp="chrome/android/java/res/xml/network_security_config.xml" />
-    <ignore regexp="chrome/android/java/res/values/dimens.xml" />
-    <ignore regexp="chrome/android/java/res/values/ids.xml" />
-    <ignore regexp="chrome/android/webapk/shell_apk/res/layout/main.xml" />
     <ignore regexp="chromecast/browser/android/apk/res/values/strings.xml" />
     <ignore regexp="chromecast/internal" />
     <ignore regexp="clank" />
     <ignore regexp="gen/android_webview/locale_paks.resources.zip/values/locale-paks.xml" />
     <ignore regexp="gen/android_webview/strings_grd.resources.zip/values/android_webview_strings.xml" />
     <ignore regexp="gen/blimp/client/blimp_strings_grd.resources.zip/values/android_blimp_strings.xml" />
-    <ignore regexp="gen/chrome/android/chrome_strings_grd.resources.zip/values/android_chrome_strings.xml" />
     <ignore regexp="gen/components/strings/components_strings_grd.resources.zip/values.*/components_strings.xml" />
     <ignore regexp="gen/remoting/resources/strings_java.resources.zip/values/remoting_strings.xml" />
     <ignore regexp="remoting/android/java/res/layout/navigation_list_item.xml" />

diff --git a/build/android/test_runner.pydeps b/build/android/test_runner.pydeps
index 624e72d..0cccc89 100644
--- a/build/android/test_runner.pydeps
+++ b/build/android/test_runner.pydeps

@@ -1,8 +1,7 @@
 # Generated by running:
-#   build/print_python_deps.py --root build/android --output build/android/test_runner.pydeps build/android/test_runner.py
-../../third_party/catapult/catapult_base/catapult_base/__init__.py
-../../third_party/catapult/catapult_base/catapult_base/cloud_storage.py
-../../third_party/catapult/catapult_base/catapult_base/util.py
+#   build/print_python_deps.py --root 'build/android' --output 'build/android/test_runner.pydeps' 'build/android/test_runner.py'
+../../third_party/catapult/common/py_utils/py_utils/__init__.py
+../../third_party/catapult/common/py_utils/py_utils/cloud_storage.py
 ../../third_party/catapult/dependency_manager/dependency_manager/__init__.py
 ../../third_party/catapult/dependency_manager/dependency_manager/archive_info.py
 ../../third_party/catapult/dependency_manager/dependency_manager/base_config.py

diff --git a/build/toolchain/gcc_toolchain.gni b/build/toolchain/gcc_toolchain.gni
index efc79b3..7ee2b6a 100644
--- a/build/toolchain/gcc_toolchain.gni
+++ b/build/toolchain/gcc_toolchain.gni

@@ -221,10 +221,6 @@
     object_subdir = "{{target_out_dir}}/{{label_name}}"
 
     tool("cc") {
-      whitelist_flag = " "
-      if (enable_resource_whitelist_generation) {
-        whitelist_flag = " --resource-whitelist=\"{{output}}.whitelist\""
-      }
       depfile = "{{output}}.d"
       command = "$cc -MMD -MF $depfile ${rebuild_string}{{defines}} {{include_dirs}} {{cflags}} {{cflags_c}}${extra_cppflags}${extra_cflags} -c {{source}} -o {{output}}"
       depsformat = "gcc"
@@ -234,16 +230,15 @@
         # currently support multiple outputs for tool("cc").
         "$object_subdir/{{source_name_part}}.o",
       ]
-      compile_wrapper = rebase_path("//build/toolchain/gcc_compile_wrapper.py",
-                                    root_build_dir)
-      command = "$python_path \"$compile_wrapper\"$whitelist_flag $command"
+      if (enable_resource_whitelist_generation) {
+        compile_wrapper =
+            rebase_path("//build/toolchain/gcc_compile_wrapper.py",
+                        root_build_dir)
+        command = "$python_path \"$compile_wrapper\" --resource-whitelist=\"{{output}}.whitelist\" $command"
+      }
     }
 
     tool("cxx") {
-      whitelist_flag = " "
-      if (enable_resource_whitelist_generation) {
-        whitelist_flag = " --resource-whitelist=\"{{output}}.whitelist\""
-      }
       depfile = "{{output}}.d"
       command = "$cxx -MMD -MF $depfile ${rebuild_string}{{defines}} {{include_dirs}} {{cflags}} {{cflags_cc}}${extra_cppflags}${extra_cxxflags} -c {{source}} -o {{output}}"
       depsformat = "gcc"
@@ -253,9 +248,12 @@
         # currently support multiple outputs for tool("cxx").
         "$object_subdir/{{source_name_part}}.o",
       ]
-      compile_wrapper = rebase_path("//build/toolchain/gcc_compile_wrapper.py",
-                                    root_build_dir)
-      command = "$python_path \"$compile_wrapper\"$whitelist_flag $command"
+      if (enable_resource_whitelist_generation) {
+        compile_wrapper =
+            rebase_path("//build/toolchain/gcc_compile_wrapper.py",
+                        root_build_dir)
+        command = "$python_path \"$compile_wrapper\" --resource-whitelist=\"{{output}}.whitelist\" $command"
+      }
     }
 
     tool("asm") {

diff --git a/cc/blimp/image_serialization_processor.h b/cc/blimp/image_serialization_processor.h
index 697317b..80ca852 100644
--- a/cc/blimp/image_serialization_processor.h
+++ b/cc/blimp/image_serialization_processor.h

@@ -6,14 +6,12 @@
 #define CC_BLIMP_IMAGE_SERIALIZATION_PROCESSOR_H_
 
 #include "base/memory/ptr_util.h"
-#include "cc/blimp/client_picture_cache.h"
-#include "cc/blimp/engine_picture_cache.h"
-#include "third_party/skia/include/core/SkPicture.h"
-
-class SkPixelSerializer;
 
 namespace cc {
 
+class ClientPictureCache;
+class EnginePictureCache;
+
 // ImageSerializationProcessor provides functionality to serialize,
 // deserialize and cache Skia images.
 class ImageSerializationProcessor {

diff --git a/cc/layers/picture_layer.cc b/cc/layers/picture_layer.cc
index 5c85ff7..c83d5e0 100644
--- a/cc/layers/picture_layer.cc
+++ b/cc/layers/picture_layer.cc

@@ -6,6 +6,8 @@
 
 #include "base/auto_reset.h"
 #include "base/trace_event/trace_event.h"
+#include "cc/blimp/client_picture_cache.h"
+#include "cc/blimp/engine_picture_cache.h"
 #include "cc/layers/content_layer_client.h"
 #include "cc/layers/picture_layer_impl.h"
 #include "cc/playback/recording_source.h"

diff --git a/cc/trees/layer_tree_host.cc b/cc/trees/layer_tree_host.cc
index 1b4401d..ba84bab 100644
--- a/cc/trees/layer_tree_host.cc
+++ b/cc/trees/layer_tree_host.cc

@@ -29,6 +29,8 @@
 #include "cc/animation/animation_events.h"
 #include "cc/animation/animation_host.h"
 #include "cc/base/math_util.h"
+#include "cc/blimp/client_picture_cache.h"
+#include "cc/blimp/engine_picture_cache.h"
 #include "cc/blimp/image_serialization_processor.h"
 #include "cc/blimp/picture_data.h"
 #include "cc/blimp/picture_data_conversions.h"

diff --git a/cc/trees/layer_tree_host.h b/cc/trees/layer_tree_host.h
index 8b8802d..91425f4 100644
--- a/cc/trees/layer_tree_host.h
+++ b/cc/trees/layer_tree_host.h

@@ -22,8 +22,6 @@
 #include "base/time/time.h"
 #include "cc/animation/target_property.h"
 #include "cc/base/cc_export.h"
-#include "cc/blimp/client_picture_cache.h"
-#include "cc/blimp/engine_picture_cache.h"
 #include "cc/debug/micro_benchmark.h"
 #include "cc/debug/micro_benchmark_controller.h"
 #include "cc/input/event_listener_properties.h"
@@ -56,6 +54,8 @@
 class AnimationEvents;
 class AnimationHost;
 class BeginFrameSource;
+class ClientPictureCache;
+class EnginePictureCache;
 class HeadsUpDisplayLayer;
 class ImageSerializationProcessor;
 class Layer;

diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index b77df2e..38a4b175 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml

@@ -231,9 +231,6 @@
     <dimen name="tablet_toolbar_start_padding_no_buttons">6dp</dimen>
     <dimen name="tablet_toolbar_end_padding">6dp</dimen>
     <dimen name="location_bar_status_separator_width">1dp</dimen>
-    <!-- Offset applied to the toolbar menu button in document mode to align with the menu
-         positioned inside the omnibox. -->
-    <dimen name="document_toolbar_menu_offset">5dp</dimen>
 
     <!-- Omnibox suggestions -->
     <dimen name="omnibox_suggestion_height">60dp</dimen>

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/CardViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/CardViewHolder.java
index ad835a0..5dc61ec 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/CardViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/CardViewHolder.java

@@ -4,12 +4,7 @@
 
 package org.chromium.chrome.browser.ntp.cards;
 
-import android.animation.Animator;
-import android.animation.AnimatorListenerAdapter;
-import android.animation.AnimatorSet;
-import android.animation.ObjectAnimator;
 import android.support.annotation.DrawableRes;
-import android.support.v4.view.animation.FastOutLinearInInterpolator;
 import android.support.v4.view.animation.FastOutSlowInInterpolator;
 import android.support.v7.widget.RecyclerView;
 import android.view.ContextMenu;
@@ -44,9 +39,7 @@
  * parent implementation to reset the private state when a card is recycled.
  */
 public class CardViewHolder extends NewTabPageViewHolder {
-    private static final Interpolator FADE_INTERPOLATOR = new FastOutLinearInInterpolator();
     private static final Interpolator TRANSITION_INTERPOLATOR = new FastOutSlowInInterpolator();
-    private static final int DISMISS_ANIMATION_TIME_MS = 300;
 
     /** Value used for max peeking card height and padding. */
     private final int mMaxPeekPadding;
@@ -192,15 +185,6 @@
         return mPeekingPercentage > 0f;
     }
 
-    @Override
-    public void updateViewStateForDismiss(float dX) {
-        // Any changes in the animation here should be reflected also in |dismiss|
-        // and reset in onBindViewHolder.
-        float input = Math.abs(dX) / itemView.getMeasuredWidth();
-        float alpha = 1 - FADE_INTERPOLATOR.getInterpolation(input);
-        itemView.setAlpha(alpha);
-    }
-
     /**
      * Override this to react when the card is tapped. This method will not be called if the card is
      * currently peeking.
@@ -248,40 +232,6 @@
         return LayoutInflater.from(parent.getContext()).inflate(resourceId, parent, false);
     }
 
-    /**
-     * Animates the card being swiped to the right as if the user had dismissed it. You must check
-     * {@link #isDismissable()} before calling.
-     */
-    protected void dismiss() {
-        assert isDismissable();
-
-        // In case the user pressed dismiss on the context menu after swiping to dismiss.
-        if (getAdapterPosition() == RecyclerView.NO_POSITION) return;
-
-        // Any changes in the animation here should be reflected also in |updateViewStateForDismiss|
-        // and reset in onBindViewHolder.
-        AnimatorSet animation = new AnimatorSet();
-        animation.playTogether(
-                ObjectAnimator.ofFloat(itemView, View.ALPHA, 0f),
-                ObjectAnimator.ofFloat(itemView, View.TRANSLATION_X, (float) itemView.getWidth()));
-
-        animation.setDuration(DISMISS_ANIMATION_TIME_MS);
-        animation.setInterpolator(FADE_INTERPOLATOR);
-        animation.addListener(new AnimatorListenerAdapter() {
-            @Override
-            public void onAnimationStart(Animator animation) {
-                mRecyclerView.onItemDismissStarted(itemView);
-            }
-
-            @Override
-            public void onAnimationEnd(Animator animation) {
-                ((NewTabPageAdapter) mRecyclerView.getAdapter()).dismissItem(CardViewHolder.this);
-                mRecyclerView.onItemDismissFinished(itemView);
-            }
-        });
-        animation.start();
-    }
-
     private static boolean isCard(@NewTabPageItem.ViewType int type) {
         switch (type) {
             case NewTabPageItem.VIEW_TYPE_SNIPPET:
@@ -307,4 +257,8 @@
         if (hasCardAbove && !hasCardBelow) return R.drawable.ntp_card_bottom;
         return R.drawable.ntp_card_single;
     }
+
+    protected NewTabPageRecyclerView getRecyclerView() {
+        return mRecyclerView;
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageAdapter.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageAdapter.java
index 8b9abcb..8ad02b2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageAdapter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageAdapter.java

@@ -69,8 +69,7 @@
         @Override
         public void onSwiped(ViewHolder viewHolder, int direction) {
             mRecyclerView.onItemDismissStarted(viewHolder.itemView);
-
-            NewTabPageAdapter.this.dismissItem(viewHolder);
+            NewTabPageAdapter.this.dismissItem(viewHolder.getAdapterPosition());
         }
 
         @Override
@@ -108,7 +107,7 @@
                 float dX, float dY, int actionState, boolean isCurrentlyActive) {
             assert viewHolder instanceof NewTabPageViewHolder;
 
-            ((NewTabPageViewHolder) viewHolder).updateViewStateForDismiss(dX);
+            mRecyclerView.updateViewStateForDismiss(dX, viewHolder);
 
             // The super implementation performs animation and elevation, but only the animation is
             // needed.
@@ -311,6 +310,18 @@
         return getGroupPositionOffset(mBottomSpacer);
     }
 
+    public int getSuggestionPosition(String suggestionId) {
+        List<NewTabPageItem> items = getItems();
+        for (int i = 0; i < items.size(); i++) {
+            NewTabPageItem item = items.get(i);
+            if (item instanceof SnippetArticle
+                    && ((SnippetArticle) item).mId.equals(suggestionId)) {
+                return i;
+            }
+        }
+        return RecyclerView.NO_POSITION;
+    }
+
     /** Start a request for new snippets. */
     public void reloadSnippets() {
         SnippetsBridge.fetchSnippets(/*forceRequest=*/true);
@@ -360,10 +371,8 @@
         mRecyclerView = (NewTabPageRecyclerView) recyclerView;
     }
 
-    public void dismissItem(ViewHolder itemViewHolder) {
-        int position = itemViewHolder.getAdapterPosition();
+    public void dismissItem(int position) {
         SnippetArticle suggestion = (SnippetArticle) getItems().get(position);
-
         mSuggestionsSource.getSuggestionVisited(suggestion, new Callback<Boolean>() {
             @Override
             public void onResult(Boolean result) {
@@ -373,9 +382,8 @@
             }
         });
 
-        itemViewHolder.itemView.announceForAccessibility(
-                itemViewHolder.itemView.getResources().getString(
-                        R.string.ntp_accessibility_item_removed, suggestion.mTitle));
+        mRecyclerView.announceForAccessibility(mRecyclerView.getResources().getString(
+                R.string.ntp_accessibility_item_removed, suggestion.mTitle));
 
         mSuggestionsSource.dismissSuggestion(suggestion);
         SuggestionsSection section = (SuggestionsSection) getGroup(position);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageRecyclerView.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageRecyclerView.java
index 66e6da3..62dc150b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageRecyclerView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageRecyclerView.java

@@ -4,15 +4,21 @@
 
 package org.chromium.chrome.browser.ntp.cards;
 
+import android.animation.Animator;
+import android.animation.AnimatorListenerAdapter;
+import android.animation.AnimatorSet;
+import android.animation.ObjectAnimator;
 import android.content.Context;
 import android.content.res.Resources;
 import android.graphics.Region;
+import android.support.v4.view.animation.FastOutLinearInInterpolator;
 import android.support.v7.widget.LinearLayoutManager;
 import android.support.v7.widget.RecyclerView;
 import android.util.AttributeSet;
 import android.view.GestureDetector;
 import android.view.MotionEvent;
 import android.view.View;
+import android.view.animation.Interpolator;
 import android.view.inputmethod.EditorInfo;
 import android.view.inputmethod.InputConnection;
 
@@ -20,6 +26,7 @@
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ntp.NewTabPageLayout;
 import org.chromium.chrome.browser.ntp.snippets.SectionHeaderViewHolder;
+import org.chromium.chrome.browser.ntp.snippets.SnippetArticle;
 import org.chromium.chrome.browser.util.ViewUtils;
 
 /**
@@ -28,6 +35,8 @@
  */
 public class NewTabPageRecyclerView extends RecyclerView {
     private static final String TAG = "NtpCards";
+    private static final Interpolator DISMISS_INTERPOLATOR = new FastOutLinearInInterpolator();
+    private static final int DISMISS_ANIMATION_TIME_MS = 300;
 
     private final GestureDetector mGestureDetector;
     private final LinearLayoutManager mLayoutManager;
@@ -394,4 +403,68 @@
         ViewUtils.gatherTransparentRegionsForOpaqueView(this, region);
         return true;
     }
+
+    /**
+     * Animates the card being swiped to the right as if the user had dismissed it. Any changes to
+     * the animation here should be reflected also in
+     * {@link #updateViewStateForDismiss(float, ViewHolder)} and reset in
+     * {@link CardViewHolder#onBindViewHolder(NewTabPageItem)}.
+     * @param article The item to be dismissed.
+     */
+    public void dismissItemWithAnimation(SnippetArticle suggestion) {
+        // We need to recompute the position, as it might have changed.
+        final int position = getNewTabPageAdapter().getSuggestionPosition(suggestion.mId);
+        if (position == RecyclerView.NO_POSITION) {
+            // The item does not exist anymore, so ignore.
+            return;
+        }
+
+        final View itemView = mLayoutManager.findViewByPosition(position);
+        if (itemView == null) {
+            // The view is not visible anymore, skip the animation.
+            getNewTabPageAdapter().dismissItem(position);
+            return;
+        }
+
+        final ViewHolder viewHolder = getChildViewHolder(itemView);
+        if (!((NewTabPageViewHolder) viewHolder).isDismissable()) {
+            // The item is not dismissable (anymore), so ignore.
+            return;
+        }
+
+        AnimatorSet animation = new AnimatorSet();
+        animation.playTogether(ObjectAnimator.ofFloat(itemView, View.ALPHA, 0f),
+                ObjectAnimator.ofFloat(itemView, View.TRANSLATION_X, (float) itemView.getWidth()));
+
+        animation.setDuration(DISMISS_ANIMATION_TIME_MS);
+        animation.setInterpolator(DISMISS_INTERPOLATOR);
+        animation.addListener(new AnimatorListenerAdapter() {
+            @Override
+            public void onAnimationStart(Animator animation) {
+                NewTabPageRecyclerView.this.onItemDismissStarted(itemView);
+            }
+
+            @Override
+            public void onAnimationEnd(Animator animation) {
+                getNewTabPageAdapter().dismissItem(position);
+                NewTabPageRecyclerView.this.onItemDismissFinished(itemView);
+            }
+        });
+        animation.start();
+    }
+
+    /**
+     * Update the view's state as it is being swiped away. Any changes to the animation here should
+     * be reflected also in {@link #dismissItemWithAnimation(SnippetArticle)} and reset in
+     * {@link CardViewHolder#onBindViewHolder(NewTabPageItem)}.
+     * @param dX The amount of horizontal displacement caused by user's action.
+     * @param viewHolder The view holder containing the view to be updated.
+     */
+    public void updateViewStateForDismiss(float dX, ViewHolder viewHolder) {
+        if (!((NewTabPageViewHolder) viewHolder).isDismissable()) return;
+
+        float input = Math.abs(dX) / viewHolder.itemView.getMeasuredWidth();
+        float alpha = 1 - DISMISS_INTERPOLATOR.getInterpolation(input);
+        viewHolder.itemView.setAlpha(alpha);
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageViewHolder.java
index 2b6b8ceb3..b18aca3f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/NewTabPageViewHolder.java

@@ -40,12 +40,6 @@
     }
 
     /**
-     * Update the wrapped view's state as it is being swiped away.
-     * @param dX The amount of horizontal displacement caused by user's action
-     */
-    public void updateViewStateForDismiss(float dX) {}
-
-    /**
      * Update the layout params for the view holder.
      */
     public void updateLayoutParams() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java
index 5221a8f..40636629 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/snippets/SnippetArticleViewHolder.java

@@ -18,6 +18,7 @@
 import android.view.ContextMenu;
 import android.view.Menu;
 import android.view.MenuItem;
+import android.view.MenuItem.OnMenuItemClickListener;
 import android.view.View;
 import android.view.View.MeasureSpec;
 import android.widget.ImageView;
@@ -26,6 +27,7 @@
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.Callback;
+import org.chromium.base.annotations.SuppressFBWarnings;
 import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.favicon.FaviconHelper.FaviconImageCallback;
@@ -51,8 +53,7 @@
 /**
  * A class that represents the view for a single card snippet.
  */
-public class SnippetArticleViewHolder extends CardViewHolder
-        implements MenuItem.OnMenuItemClickListener, ImpressionTracker.Listener {
+public class SnippetArticleViewHolder extends CardViewHolder implements ImpressionTracker.Listener {
     private static final String PUBLISHER_FORMAT_STRING = "%s - %s";
     private static final int FADE_IN_ANIMATION_TIME_MS = 300;
     private static final int[] FAVICON_SERVICE_SUPPORTED_SIZES = {16, 24, 32, 48, 64};
@@ -84,6 +85,7 @@
     private final boolean mUseFaviconService;
     private final UiConfig mUiConfig;
 
+    @SuppressFBWarnings("URF_UNREAD_FIELD")
     private ImpressionTracker mImpressionTracker;
 
     /**
@@ -94,6 +96,61 @@
         void onCreateContextMenu();
     }
 
+    private static class ContextMenuItemClickListener implements OnMenuItemClickListener {
+        private final SnippetArticle mArticle;
+        private final NewTabPageManager mManager;
+        private final NewTabPageRecyclerView mRecyclerView;
+
+        public ContextMenuItemClickListener(SnippetArticle article,
+                NewTabPageManager newTabPageManager,
+                NewTabPageRecyclerView newTabPageRecyclerView) {
+            mArticle = article;
+            mManager = newTabPageManager;
+            mRecyclerView = newTabPageRecyclerView;
+        }
+
+        @Override
+        public boolean onMenuItemClick(MenuItem item) {
+            // If the user clicks a snippet then immediately long presses they will create a context
+            // menu while the snippet's URL loads in the background. This means that when they press
+            // an item on context menu the NTP will not actually be open. We add this check here to
+            // prevent taking any action if the user has already left the NTP.
+            // https://crbug.com/640468.
+            // TODO(peconn): Instead, close the context menu when a snippet is clicked.
+            if (!ViewCompat.isAttachedToWindow(mRecyclerView)) return true;
+
+            // The UMA is used to compare how the user views the article linked from a snippet.
+            switch (item.getItemId()) {
+                case ID_OPEN_IN_NEW_WINDOW:
+                    NewTabPageUma.recordOpenSnippetMethod(
+                            NewTabPageUma.OPEN_SNIPPET_METHODS_NEW_WINDOW);
+                    mManager.openSnippet(WindowOpenDisposition.NEW_WINDOW, mArticle);
+                    return true;
+                case ID_OPEN_IN_NEW_TAB:
+                    NewTabPageUma.recordOpenSnippetMethod(
+                            NewTabPageUma.OPEN_SNIPPET_METHODS_NEW_TAB);
+                    mManager.openSnippet(WindowOpenDisposition.NEW_FOREGROUND_TAB, mArticle);
+                    return true;
+                case ID_OPEN_IN_INCOGNITO_TAB:
+                    NewTabPageUma.recordOpenSnippetMethod(
+                            NewTabPageUma.OPEN_SNIPPET_METHODS_INCOGNITO);
+                    mManager.openSnippet(WindowOpenDisposition.OFF_THE_RECORD, mArticle);
+                    return true;
+                case ID_SAVE_FOR_OFFLINE:
+                    NewTabPageUma.recordOpenSnippetMethod(
+                            NewTabPageUma.OPEN_SNIPPET_METHODS_SAVE_FOR_OFFLINE);
+                    mManager.openSnippet(WindowOpenDisposition.SAVE_TO_DISK, mArticle);
+                    return true;
+                case ID_REMOVE:
+                    // UMA is recorded during dismissal.
+                    mRecyclerView.dismissItemWithAnimation(mArticle);
+                    return true;
+                default:
+                    return false;
+            }
+        }
+    }
+
     /**
      * Constructs a SnippetCardItemView item used to display snippets
      *
@@ -147,27 +204,31 @@
                 "NewTabPage.Snippets.CardLongPressed", mArticle.mPosition);
         mArticle.recordAgeAndScore("NewTabPage.Snippets.CardLongPressed");
 
+        OnMenuItemClickListener listener =
+                new ContextMenuItemClickListener(mArticle, mNewTabPageManager, getRecyclerView());
+
         // Create a context menu akin to the one shown for MostVisitedItems.
         if (mNewTabPageManager.isOpenInNewWindowEnabled()) {
-            addContextMenuItem(
-                    menu, ID_OPEN_IN_NEW_WINDOW, R.string.contextmenu_open_in_other_window);
+            addContextMenuItem(menu, ID_OPEN_IN_NEW_WINDOW,
+                    R.string.contextmenu_open_in_other_window, listener);
         }
 
-        addContextMenuItem(menu, ID_OPEN_IN_NEW_TAB, R.string.contextmenu_open_in_new_tab);
+        addContextMenuItem(
+                menu, ID_OPEN_IN_NEW_TAB, R.string.contextmenu_open_in_new_tab, listener);
 
         if (mNewTabPageManager.isOpenInIncognitoEnabled()) {
             addContextMenuItem(menu, ID_OPEN_IN_INCOGNITO_TAB,
-                    R.string.contextmenu_open_in_incognito_tab);
+                    R.string.contextmenu_open_in_incognito_tab, listener);
         }
 
         // TODO(peconn): Only show 'Save for Offline' for appropriate snippet types.
         if (SnippetsConfig.isSaveToOfflineEnabled()
                 && OfflinePageBridge.canSavePage(mArticle.mUrl)) {
-            addContextMenuItem(menu, ID_SAVE_FOR_OFFLINE,
-                    R.string.contextmenu_save_offline);
+            addContextMenuItem(
+                    menu, ID_SAVE_FOR_OFFLINE, R.string.contextmenu_save_offline, listener);
         }
 
-        addContextMenuItem(menu, ID_REMOVE, R.string.remove);
+        addContextMenuItem(menu, ID_REMOVE, R.string.remove, listener);
 
         // Disable touch events on the RecyclerView while the context menu is open. This is to
         // prevent the user long pressing to get the context menu then on the same press scrolling
@@ -187,49 +248,9 @@
     /**
      * Convenience method to reduce multi-line function call to single line.
      */
-    private void addContextMenuItem(ContextMenu menu, int id, int resourceId) {
-        menu.add(Menu.NONE, id, Menu.NONE, resourceId).setOnMenuItemClickListener(this);
-    }
-
-    @Override
-    public boolean onMenuItemClick(MenuItem item) {
-        // If the user clicks a snippet then immediately long presses they will create a context
-        // menu while the snippet's URL loads in the background. This means that when they press
-        // an item on context menu the NTP will not actually be open. We add this check here to
-        // prevent taking any action if the user has already left the NTP. https://crbug.com/640468.
-        // TODO(peconn): Instead, close the context menu when a snippet is clicked.
-        if (!ViewCompat.isAttachedToWindow(itemView)) return true;
-
-        // The UMA is used to compare how the user views the article linked from a snippet.
-        switch (item.getItemId()) {
-            case ID_OPEN_IN_NEW_WINDOW:
-                NewTabPageUma.recordOpenSnippetMethod(
-                        NewTabPageUma.OPEN_SNIPPET_METHODS_NEW_WINDOW);
-                mNewTabPageManager.openSnippet(WindowOpenDisposition.NEW_WINDOW, mArticle);
-                return true;
-            case ID_OPEN_IN_NEW_TAB:
-                NewTabPageUma.recordOpenSnippetMethod(
-                        NewTabPageUma.OPEN_SNIPPET_METHODS_NEW_TAB);
-                mNewTabPageManager.openSnippet(WindowOpenDisposition.NEW_FOREGROUND_TAB, mArticle);
-                return true;
-            case ID_OPEN_IN_INCOGNITO_TAB:
-                NewTabPageUma.recordOpenSnippetMethod(
-                        NewTabPageUma.OPEN_SNIPPET_METHODS_INCOGNITO);
-                mNewTabPageManager.openSnippet(WindowOpenDisposition.OFF_THE_RECORD, mArticle);
-                return true;
-            case ID_SAVE_FOR_OFFLINE:
-                NewTabPageUma.recordOpenSnippetMethod(
-                        NewTabPageUma.OPEN_SNIPPET_METHODS_SAVE_FOR_OFFLINE);
-                mNewTabPageManager.openSnippet(WindowOpenDisposition.SAVE_TO_DISK, mArticle);
-                return true;
-            case ID_REMOVE:
-                assert isDismissable() : "Context menu should not be shown for peeking card.";
-                // UMA is recorded during dismissal.
-                dismiss();
-                return true;
-            default:
-                return false;
-        }
+    private static void addContextMenuItem(
+            ContextMenu menu, int id, int resourceId, OnMenuItemClickListener listener) {
+        menu.add(Menu.NONE, id, Menu.NONE, resourceId).setOnMenuItemClickListener(listener);
     }
 
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java
index 6ae4ba3e..73ec097 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java

@@ -1352,6 +1352,7 @@
             assert !isFrozen();
 
             if (mContentViewCore != null) mContentViewCore.onShow();
+            if (mBlimpContents != null) mBlimpContents.show();
 
             if (mTabUma != null) {
                 mTabUma.onShow(type, getTimestampMillis(),
@@ -1391,6 +1392,7 @@
             mIsHidden = true;
 
             if (mContentViewCore != null) mContentViewCore.onHide();
+            if (mBlimpContents != null) mBlimpContents.hide();
 
             // Clean up any fullscreen state that might impact other tabs.
             if (mFullscreenManager != null) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/OffTheRecordTabModelImplCreator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModelImplCreator.java
similarity index 91%
rename from chrome/android/java/src/org/chromium/chrome/browser/tabmodel/OffTheRecordTabModelImplCreator.java
rename to chrome/android/java/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModelImplCreator.java
index 8f4399a..069d9874 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/OffTheRecordTabModelImplCreator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModelImplCreator.java

@@ -11,7 +11,7 @@
 /**
  * Stores all the variables needed to create an Incognito TabModelImpl when it is needed.
  */
-class OffTheRecordTabModelImplCreator implements IncognitoTabModelDelegate {
+class IncognitoTabModelImplCreator implements IncognitoTabModelDelegate {
     private final TabCreator mRegularTabCreator;
     private final TabCreator mIncognitoTabCreator;
     private final TabModelSelectorUma mUma;
@@ -21,7 +21,7 @@
     private final TabModelDelegate mModelDelegate;
 
     /**
-     * Constructor for an OffTheRecordTabModelImplCreator, used by {@link IncognitoTabModel}.
+     * Constructor for an IncognitoTabModelImplCreator, used by {@link IncognitoTabModel}.
      *
      * Creating an instance of this class does not create the Incognito TabModelImpl immediately.
      * The {@link IncognitoTabModel} will use this class to create the real TabModelImpl when it
@@ -35,7 +35,7 @@
      * @param tabSaver            Handler for saving tabs.
      * @param modelDelegate       Delegate to handle external dependencies and interactions.
      */
-    public OffTheRecordTabModelImplCreator(TabCreator regularTabCreator,
+    public IncognitoTabModelImplCreator(TabCreator regularTabCreator,
             TabCreator incognitoTabCreator, TabModelSelectorUma uma,
             TabModelOrderController orderController, TabContentManager tabContentManager,
             TabPersistentStore tabSaver, TabModelDelegate modelDelegate) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorImpl.java
index a573260..36ad1bdd 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorImpl.java

@@ -163,7 +163,7 @@
 
         TabModelImpl normalModel = new TabModelImpl(false, mRegularTabCreator, mIncognitoTabCreator,
                 mUma, mOrderController, mTabContentManager, mTabSaver, this, mIsUndoSupported);
-        TabModel incognitoModel = new IncognitoTabModel(new OffTheRecordTabModelImplCreator(
+        TabModel incognitoModel = new IncognitoTabModel(new IncognitoTabModelImplCreator(
                 mRegularTabCreator, mIncognitoTabCreator, mUma, mOrderController,
                 mTabContentManager, mTabSaver, this));
         initialize(isIncognitoSelected(), normalModel, incognitoModel);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelSelector.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelSelector.java
index a5b3b8b..e69d43c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelSelector.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelSelector.java

@@ -70,7 +70,7 @@
     /**
      * TabModel that keeps track of incognito tabs. This may be null if no incognito tabs exist.
      */
-    private final OffTheRecordDocumentTabModel mIncognitoTabModel;
+    private final IncognitoDocumentTabModel mIncognitoTabModel;
 
     /**
      * If the TabModels haven't been initialized yet, prioritize the correct one to load the Tab.
@@ -92,7 +92,7 @@
         final Context context = ContextUtils.getApplicationContext();
         mRegularTabModel = new DocumentTabModelImpl(
                 mActivityDelegate, mStorageDelegate, this, false, sPrioritizedTabId, context);
-        mIncognitoTabModel = new OffTheRecordDocumentTabModel(new IncognitoTabModelDelegate() {
+        mIncognitoTabModel = new IncognitoDocumentTabModel(new IncognitoTabModelDelegate() {
             @Override
             public TabModel createTabModel() {
                 DocumentTabModel incognitoModel = new DocumentTabModelImpl(mActivityDelegate,

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/OffTheRecordDocumentTabModel.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/IncognitoDocumentTabModel.java
similarity index 91%
rename from chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/OffTheRecordDocumentTabModel.java
rename to chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/IncognitoDocumentTabModel.java
index 4056579d..aacdf9b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/OffTheRecordDocumentTabModel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/IncognitoDocumentTabModel.java

@@ -16,10 +16,10 @@
  * specifically, Android doesn't fire signals when tasks are swiped away from the Recents menu if
  * the Activity is dead when it occurs.
  */
-public class OffTheRecordDocumentTabModel extends IncognitoTabModel implements DocumentTabModel {
+public class IncognitoDocumentTabModel extends IncognitoTabModel implements DocumentTabModel {
     private final ActivityDelegate mActivityDelegate;
 
-    public OffTheRecordDocumentTabModel(IncognitoTabModelDelegate offTheRecordDelegate,
+    public IncognitoDocumentTabModel(IncognitoTabModelDelegate offTheRecordDelegate,
             ActivityDelegate delegate) {
         super(offTheRecordDelegate);
         mActivityDelegate = delegate;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/StorageDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/StorageDelegate.java
index 2bd218a6..121e53c5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/StorageDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/document/StorageDelegate.java

@@ -57,7 +57,7 @@
     /**
      * Reads the file containing the minimum info required to restore the state of the
      * {@link DocumentTabModel}.
-     * @param encrypted Whether or not the file corresponds to an OffTheRecord TabModel.
+     * @param encrypted Whether or not the file corresponds to an Incognito TabModel.
      * @return Byte buffer containing the task file's data, or null if it wasn't read.
      */
     protected byte[] readMetadataFileBytes(boolean encrypted) {
@@ -151,7 +151,7 @@
 
     /**
      * Return the filename of the persisted TabModel state.
-     * @param encrypted Whether or not the state belongs to an OffTheRecordDocumentTabModel.
+     * @param encrypted Whether or not the state belongs to an IncognitoDocumentTabModel.
      * @return String pointing at the TabModel's persisted state.
      */
     private String getFilename(boolean encrypted) {

diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index f474e01..4ab381de 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd

@@ -1680,9 +1680,6 @@
       <message name="IDS_DOWNLOAD_CANT_OPEN_FILE" desc="Toast that appears when a downloaded file can't be opened.">
         Can't open file
       </message>
-      <message name="IDS_DOWNLOAD_CANT_SHARE_DELETED" desc="Toast that appears when the user attempts to share downloaded files that have been deleted.">
-        Can't share deleted files
-      </message>
       <message name="IDS_DOWNLOAD_NOTIFICATION_PAUSE_BUTTON" desc="Text on the button that pauses a download.">
         Pause
       </message>
@@ -1803,9 +1800,6 @@
       <message name="IDS_DOWNLOAD_PAGE" desc="Download this page.">
         Download page
       </message>
-      <message name="IDS_DOWNLOAD_MANAGER_UI_DELETED" desc="Indicates that a downloaded file has been deleted.">
-        Deleted
-      </message>
       <message name="IDS_DOWNLOAD_MANAGER_UI_EMPTY" desc="Indicates that there are no downloaded items.">
         No downloads here
       </message>
@@ -2514,7 +2508,7 @@
       <message name="IDS_PHYSICAL_WEB_BOTTOM_BAR" desc="A message displayed in the nearby URLs list activity informing the user that a notification will appear whenever devices broadcasting URLs are nearby">
         Future nearby Physical Web pages will show up in your notifications list
       </message>
-   
+
       <!-- WebUsb Picker UI strings -->
       <message name="IDS_USB_CHOOSER_DIALOG_PROMPT" desc="The text that is used to introduce the USB chooser dialog to the user.">
         <ph name="SITE">%1$s<ex>https://www.google.com</ex></ph> wants to connect to:

diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index 4b0ad7c0..ff24f8c 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni

@@ -895,7 +895,7 @@
   "java/src/org/chromium/chrome/browser/tabmodel/EmptyTabModelObserver.java",
   "java/src/org/chromium/chrome/browser/tabmodel/EmptyTabModelSelectorObserver.java",
   "java/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModel.java",
-  "java/src/org/chromium/chrome/browser/tabmodel/OffTheRecordTabModelImplCreator.java",
+  "java/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModelImplCreator.java",
   "java/src/org/chromium/chrome/browser/tabmodel/SingleTabModel.java",
   "java/src/org/chromium/chrome/browser/tabmodel/SingleTabModelSelector.java",
   "java/src/org/chromium/chrome/browser/tabmodel/TabbedModeTabPersistencePolicy.java",
@@ -925,7 +925,7 @@
   "java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModel.java",
   "java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelImpl.java",
   "java/src/org/chromium/chrome/browser/tabmodel/document/DocumentTabModelSelector.java",
-  "java/src/org/chromium/chrome/browser/tabmodel/document/OffTheRecordDocumentTabModel.java",
+  "java/src/org/chromium/chrome/browser/tabmodel/document/IncognitoDocumentTabModel.java",
   "java/src/org/chromium/chrome/browser/tabmodel/document/StorageDelegate.java",
   "java/src/org/chromium/chrome/browser/tabmodel/document/TabDelegate.java",
   "java/src/org/chromium/chrome/browser/toolbar/ActionModeController.java",

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageUtilsTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageUtilsTest.java
index ac0e9cb..0e7d541 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageUtilsTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageUtilsTest.java

@@ -11,6 +11,7 @@
 import org.chromium.base.Callback;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.base.test.util.DisabledTest;
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.offlinepages.OfflinePageBridge.OfflinePageModelObserver;
 import org.chromium.chrome.browser.offlinepages.OfflinePageBridge.SavePageCallback;
@@ -243,6 +244,7 @@
         return result;
     }
 
+    @DisabledTest(message = "Flaky, crbug.com/640319")
     @SmallTest
     public void testCopyToShareableLocation() throws Exception {
         // Save an offline page.

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabPersistentStoreTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabPersistentStoreTest.java
index e78bdacf..3ac0148 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabPersistentStoreTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabPersistentStoreTest.java

@@ -171,7 +171,7 @@
             };
             TabModelImpl regularTabModel = ThreadUtils.runOnUiThreadBlocking(callable);
             TabModel incognitoTabModel = new IncognitoTabModel(
-                    new OffTheRecordTabModelImplCreator(mTabCreatorManager.getTabCreator(false),
+                    new IncognitoTabModelImplCreator(mTabCreatorManager.getTabCreator(false),
                             mTabCreatorManager.getTabCreator(true),
                             null, mTabModelOrderController, null, mTabPersistentStore, this));
             initialize(false, regularTabModel, incognitoTabModel);

diff --git a/chrome/android/webapk/shell_apk/res/layout/main.xml b/chrome/android/webapk/shell_apk/res/layout/main.xml
deleted file mode 100644
index 90c10d89..0000000
--- a/chrome/android/webapk/shell_apk/res/layout/main.xml
+++ /dev/null

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2015 The Chromium Authors. All rights reserved.
-     Use of this source code is governed by a BSD-style license that can be
-     found in the LICENSE file. -->
-
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    android:layout_height="match_parent"
-    android:layout_width="match_parent"
-    android:padding="5dp"
-    android:orientation="vertical" >
-</LinearLayout>

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 58980477..9175545 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -7704,16 +7704,16 @@
       <if expr="enable_extensions">
         <!-- Feedback Dialog -->
         <message name="IDS_FEEDBACK_REPORT_PAGE_TITLE" desc="Label showing the title of the page that will be reported">
-          Tell us what's happening.
+          Tell us what's happening
         </message>
         <message name="IDS_FEEDBACK_REPORT_URL_LABEL" desc="Label showing the URL that will be reported">
-          URL (optional):
+          URL
         </message>
         <message name="IDS_FEEDBACK_USER_EMAIL_LABEL" desc="Label showing the e-mail address that will be reported">
-          Email (optional):
+          Email
         </message>
         <message name="IDS_FEEDBACK_SCREENSHOT_LABEL" desc="Label for the screenshot field if current screenshots are being shown">
-          Include this screenshot:
+          Include this screenshot
         </message>
         <message name="IDS_FEEDBACK_INCLUDE_PERFORMANCE_TRACE_CHECKBOX" desc="Checkbox for including system performance data on the bug report dialog box">
           Send performance trace data
@@ -7738,10 +7738,10 @@
           </message>
         </if>
         <message name="IDS_FEEDBACK_ATTACH_FILE_NOTE" desc="Text for describing the maximum size for an attached file">
-          The attached file is uploaded to Google servers for debugging.
+          File will be sent to Google for debugging
         </message>
         <message name="IDS_FEEDBACK_ATTACH_FILE_LABEL" desc="Text for the label for the attached filename">
-          Attach file:
+          Attach file
         </message>
         <message name="IDS_FEEDBACK_READING_FILE" desc="Text to display if reading a file when the user clicks the send report button">
           Reading file..
@@ -7764,7 +7764,7 @@
           Please tell us what is happening before sending the feedback.
         </message>
         <message name="IDS_FEEDBACK_SEND_REPORT" desc="Text for OK button of the send feedback dialog">
-          Send feedback
+          Send
         </message>
         <message name="IDS_FEEDBACK_SYSINFO_PAGE_TITLE" desc="The title of the system information preview page">
           System Information Preview
@@ -7772,6 +7772,9 @@
         <message name="IDS_FEEDBACK_SYSINFO_PAGE_LOADING" desc="The message showing the status of the system information preview page that it is still loading">
           Loading...
         </message>
+        <message name="IDS_FEEDBACK_ADDITIONAL_INFO_LABEL" desc="Text for the group label to indicate that some fields are optional.">
+          Additional info (optional)
+        </message>
 
         <!-- Feedback Dialog SRT Prompt -->
         <message name="IDS_FEEDBACK_SRT_PROMPT_BODY" desc="Body text explaining what the Chrome Software Removal Tool is">

diff --git a/chrome/app/mash/BUILD.gn b/chrome/app/mash/BUILD.gn
index 2bb7254..a797215 100644
--- a/chrome/app/mash/BUILD.gn
+++ b/chrome/app/mash/BUILD.gn

@@ -47,6 +47,7 @@
     "//mash/session:manifest",
     "//mash/task_viewer:manifest",
     "//services/ui:manifest",
+    "//services/ui/ime/test_ime_driver:manifest",
   ]
   packaged_services = [
     "app_driver",
@@ -54,6 +55,7 @@
     "mash_session",
     "quick_launch",
     "task_viewer",
+    "test_ime_driver",
     "touch_hud",
     "ui",
   ]

diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 869b654..756b383 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp

@@ -1500,8 +1500,8 @@
   <message name="IDS_SETTINGS_SITE_SETTINGS_JAVASCRIPT" desc="Label for the javascript site settings.">
     Javascript
   </message>
-  <message name="IDS_SETTINGS_SITE_SETTINGS_PLUGINS" desc="Label for the plugins site settings.">
-    Plugins
+  <message name="IDS_SETTINGS_SITE_SETTINGS_FLASH" desc="Label for the Flash site settings.">
+    Flash
   </message>
   <message name="IDS_SETTINGS_SITE_SETTINGS_POPUPS" desc="Label for the popups site settings.">
     Popups

diff --git a/chrome/browser/android/blimp/blimp_client_context_factory.cc b/chrome/browser/android/blimp/blimp_client_context_factory.cc
index 1cf0fedb..835fbed 100644
--- a/chrome/browser/android/blimp/blimp_client_context_factory.cc
+++ b/chrome/browser/android/blimp/blimp_client_context_factory.cc

@@ -7,6 +7,7 @@
 #include "base/memory/singleton.h"
 #include "base/supports_user_data.h"
 #include "blimp/client/public/blimp_client_context.h"
+#include "blimp/client/public/compositor/compositor_dependencies.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
@@ -38,7 +39,8 @@
       content::BrowserThread::GetTaskRunnerForThread(
           content::BrowserThread::IO),
       content::BrowserThread::GetTaskRunnerForThread(
-          content::BrowserThread::FILE));
+          content::BrowserThread::FILE),
+      nullptr);
 }
 
 content::BrowserContext* BlimpClientContextFactory::GetBrowserContextToUse(

diff --git a/chrome/browser/android/offline_pages/prerendering_loader.cc b/chrome/browser/android/offline_pages/prerendering_loader.cc
index 6f454028..2b84f713 100644
--- a/chrome/browser/android/offline_pages/prerendering_loader.cc
+++ b/chrome/browser/android/offline_pages/prerendering_loader.cc

@@ -157,17 +157,30 @@
   if (IsIdle())
     return;
 
-  if (adapter_->IsActive()) {
-    DVLOG(1) << "Load failed: " << adapter_->GetFinalStatus();
-    adapter_->DestroyActive();
-  }
   // Request status depends on whether we are still loading (failed) or
   // did load and then loading was stopped (cancel - from prerender stack).
   Offliner::RequestStatus request_status =
       IsLoaded() ? Offliner::RequestStatus::PRERENDERING_CANCELED
                  : Offliner::RequestStatus::PRERENDERING_FAILED;
-  // TODO(dougarnett): For failure, determine from final status if retry-able
-  // and report different failure statuses if retry-able or not.
+
+  if (adapter_->IsActive()) {
+    prerender::FinalStatus final_status = adapter_->GetFinalStatus();
+    DVLOG(1) << "Load failed: " << final_status;
+
+    // Loss of network connection can show up as unsupported scheme per
+    // a redirect to a special data URL is used to navigate to error page.
+    // We want to be able to retry these request so for now treat any
+    // unsupported scheme error as a cancel.
+    // TODO(dougarnett): Use new FinalStatus code if/when supported (642768).
+    // TODO(dougarnett): Create whitelist of final status codes that should
+    // not be considered failures (and define new RequestStatus code for them).
+    if (adapter_->GetFinalStatus() ==
+        prerender::FinalStatus::FINAL_STATUS_UNSUPPORTED_SCHEME) {
+      request_status = Offliner::RequestStatus::PRERENDERING_CANCELED;
+    }
+    adapter_->DestroyActive();
+  }
+
   snapshot_controller_.reset(nullptr);
   session_contents_.reset(nullptr);
   state_ = State::IDLE;

diff --git a/chrome/browser/android/offline_pages/prerendering_loader_unittest.cc b/chrome/browser/android/offline_pages/prerendering_loader_unittest.cc
index f662f123..d90a2183 100644
--- a/chrome/browser/android/offline_pages/prerendering_loader_unittest.cc
+++ b/chrome/browser/android/offline_pages/prerendering_loader_unittest.cc

@@ -147,6 +147,7 @@
   loader_.reset(new PrerenderingLoader(&profile_));
   test_adapter_ = new TestAdapter(loader_.get());
   loader_->SetAdapterForTesting(base::WrapUnique(test_adapter_));
+  callback_called_ = false;
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 }
 
@@ -252,6 +253,32 @@
   PumpLoop();
 }
 
+TEST_F(PrerenderingLoaderTest, LoadPageLoadFailedUnsupportedScheme) {
+  test_adapter()->Configure(
+      nullptr /* web_contents */,
+      prerender::FinalStatus::FINAL_STATUS_UNSUPPORTED_SCHEME);
+  GURL gurl("http://testit.sea");
+  EXPECT_TRUE(loader()->IsIdle());
+  EXPECT_TRUE(loader()->LoadPage(
+      gurl,
+      base::Bind(&PrerenderingLoaderTest::OnLoadDone, base::Unretained(this))));
+  EXPECT_FALSE(loader()->IsIdle());
+  EXPECT_FALSE(loader()->IsLoaded());
+
+  test_adapter()->GetObserver()->OnPrerenderDomContentLoaded();
+  PumpLoop();
+  EXPECT_TRUE(loader()->IsIdle());
+  EXPECT_TRUE(callback_called());
+  // Unsupported Scheme final status currently considered a cancel rather
+  // than failure in case it is due to lost network connectivity.
+  EXPECT_EQ(Offliner::RequestStatus::PRERENDERING_CANCELED,
+            callback_load_status());
+
+  // Stopped event causes no harm.
+  test_adapter()->GetObserver()->OnPrerenderStop();
+  PumpLoop();
+}
+
 TEST_F(PrerenderingLoaderTest, LoadPageLoadCanceledFromStopLoading) {
   GURL gurl("http://testit.sea");
   EXPECT_TRUE(loader()->IsIdle());

diff --git a/chrome/browser/browsing_data/browsing_data_remover.cc b/chrome/browser/browsing_data/browsing_data_remover.cc
index cc347365..c3d9da8 100644
--- a/chrome/browser/browsing_data/browsing_data_remover.cc
+++ b/chrome/browser/browsing_data/browsing_data_remover.cc

@@ -170,10 +170,12 @@
   return predicate.Run(primary_pattern);
 }
 
-void ClearHostnameResolutionCacheOnIOThread(IOThread* io_thread) {
+void ClearHostnameResolutionCacheOnIOThread(
+    IOThread* io_thread,
+    base::Callback<bool(const std::string&)> host_filter) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  io_thread->ClearHostCache();
+  io_thread->ClearHostCache(host_filter);
 }
 
 void ClearNetworkPredictorOnIOThread(chrome_browser_net::Predictor* predictor) {
@@ -513,6 +515,13 @@
 #endif
     }
 
+    ntp_snippets::ContentSuggestionsService* content_suggestions_service =
+        ContentSuggestionsServiceFactory::GetForProfile(profile_);
+    if (content_suggestions_service) {
+      content_suggestions_service->ClearHistory(delete_begin_, delete_end_,
+                                                filter);
+    }
+
 #if defined(ENABLE_EXTENSIONS)
     // Clear launch times as they are a form of history.
     extensions::ExtensionPrefs* extension_prefs =
@@ -528,15 +537,18 @@
       origin_power_map->ClearOriginMap(nullable_filter);
 
     // Need to clear the host cache and accumulated speculative data, as it also
-    // reveals some history: we have no mechanism to track when these items were
-    // created, so we'll clear them all. Better safe than sorry.
+    // reveals some history. We have no mechanism to track when these items were
+    // created, so we'll not honor the time range.
+    // TODO(msramek): We can use the plugin filter here because plugins, same
+    // as the hostname resolution cache, key their entries by hostname. Rename
+    // BuildPluginFilter() to something more general to reflect this use.
     if (g_browser_process->io_thread()) {
-      // TODO(dmurph): Support all backends with filter (crbug.com/113621).
       waiting_for_clear_hostname_resolution_cache_ = true;
       BrowserThread::PostTaskAndReply(
           BrowserThread::IO, FROM_HERE,
           base::Bind(&ClearHostnameResolutionCacheOnIOThread,
-                     g_browser_process->io_thread()),
+                     g_browser_process->io_thread(),
+                     filter_builder.BuildPluginFilter()),
           base::Bind(&BrowsingDataRemover::OnClearedHostnameResolutionCache,
                      weak_ptr_factory_.GetWeakPtr()));
     }
@@ -557,15 +569,16 @@
         TemplateURLServiceFactory::GetForProfile(profile_);
 
     if (keywords_model && !keywords_model->loaded()) {
+      // TODO(msramek): Store filters from the currently executed task on the
+      // object to avoid having to copy them to callback methods.
       template_url_sub_ = keywords_model->RegisterOnLoadedCallback(
           base::Bind(&BrowsingDataRemover::OnKeywordsLoaded,
-                     weak_ptr_factory_.GetWeakPtr()));
+                     weak_ptr_factory_.GetWeakPtr(), filter));
       keywords_model->Load();
       waiting_for_clear_keyword_data_ = true;
     } else if (keywords_model) {
-      // TODO(dmurph): Support all backends with filter (crbug.com/113621).
-      keywords_model->RemoveAutoGeneratedForOriginBetween(GURL(), delete_begin_,
-                                                          delete_end_);
+      keywords_model->RemoveAutoGeneratedForUrlsBetween(filter, delete_begin_,
+                                                        delete_end_);
     }
 
     // The PrerenderManager keeps history of prerendered pages, so clear that.
@@ -1233,12 +1246,14 @@
          !waiting_for_clear_auto_sign_in_;
 }
 
-void BrowsingDataRemover::OnKeywordsLoaded() {
+void BrowsingDataRemover::OnKeywordsLoaded(
+    base::Callback<bool(const GURL&)> url_filter) {
   // Deletes the entries from the model, and if we're not waiting on anything
   // else notifies observers and deletes this BrowsingDataRemover.
   TemplateURLService* model =
       TemplateURLServiceFactory::GetForProfile(profile_);
-  model->RemoveAutoGeneratedBetween(delete_begin_, delete_end_);
+  model->RemoveAutoGeneratedForUrlsBetween(url_filter, delete_begin_,
+                                           delete_end_);
   waiting_for_clear_keyword_data_ = false;
   template_url_sub_.reset();
   NotifyIfDone();

diff --git a/chrome/browser/browsing_data/browsing_data_remover.h b/chrome/browser/browsing_data/browsing_data_remover.h
index 3c2ecb0..e52122a7 100644
--- a/chrome/browser/browsing_data/browsing_data_remover.h
+++ b/chrome/browser/browsing_data/browsing_data_remover.h

@@ -382,7 +382,7 @@
 
   // Callback for when TemplateURLService has finished loading. Clears the data,
   // clears the respective waiting flag, and invokes NotifyIfDone.
-  void OnKeywordsLoaded();
+  void OnKeywordsLoaded(base::Callback<bool(const GURL&)> url_filter);
 
 #if defined(ENABLE_PLUGINS)
   // Called when plugin data has been cleared. Invokes NotifyIfDone.

diff --git a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc
index 20ea73b..caa1f27c 100644
--- a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc
+++ b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc

@@ -65,7 +65,7 @@
 namespace {
 
 // Install attributes for tests.
-EnterpriseInstallAttributes* g_testing_install_attributes = nullptr;
+EnterpriseInstallAttributes* g_testing_install_attributes = NULL;
 
 // Helper that returns a new SequencedTaskRunner backed by the blocking pool.
 // Each SequencedTaskRunner returned is independent from the others.
@@ -79,12 +79,12 @@
 }  // namespace
 
 BrowserPolicyConnectorChromeOS::BrowserPolicyConnectorChromeOS()
-    : device_cloud_policy_manager_(nullptr),
-      global_user_cloud_policy_provider_(nullptr),
+    : device_cloud_policy_manager_(NULL),
+      global_user_cloud_policy_provider_(NULL),
       weak_ptr_factory_(this) {
   if (g_testing_install_attributes) {
     install_attributes_.reset(g_testing_install_attributes);
-    g_testing_install_attributes = nullptr;
+    g_testing_install_attributes = NULL;
   }
 
   // SystemSaltGetter or DBusThreadManager may be uninitialized on unit tests.
@@ -271,7 +271,7 @@
 void BrowserPolicyConnectorChromeOS::RemoveInstallAttributesForTesting() {
   if (g_testing_install_attributes) {
     delete g_testing_install_attributes;
-    g_testing_install_attributes = nullptr;
+    g_testing_install_attributes = NULL;
   }
 }
 

diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
index d51fe88..1d154ff9 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc

@@ -73,13 +73,7 @@
       device_store_(device_store),
       manager_(manager),
       attestation_flow_(std::move(attestation_flow)),
-      signing_service_(base::MakeUnique<TpmEnrollmentKeySigningService>(
-          async_method_caller)) {}
-
-void DeviceCloudPolicyInitializer::SetSigningServiceForTesting(
-    std::unique_ptr<policy::SigningService> signing_service) {
-  signing_service_ = std::move(signing_service);
-}
+      signing_service_(async_method_caller) {}
 
 DeviceCloudPolicyInitializer::~DeviceCloudPolicyInitializer() {
   DCHECK(!is_initialized_);
@@ -263,7 +257,7 @@
       DeviceCloudPolicyManagerChromeOS::GetMachineID(),
       DeviceCloudPolicyManagerChromeOS::GetMachineModel(),
       kPolicyVerificationKeyHash, device_management_service,
-      g_browser_process->system_request_context(), signing_service_.get());
+      g_browser_process->system_request_context(), &signing_service_);
 }
 
 void DeviceCloudPolicyInitializer::TryToCreateClient() {

diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h
index ff6725c1..30dfe31 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h

@@ -11,7 +11,6 @@
 
 #include "base/callback_forward.h"
 #include "base/compiler_specific.h"
-#include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
@@ -98,12 +97,8 @@
   void OnStoreLoaded(CloudPolicyStore* store) override;
   void OnStoreError(CloudPolicyStore* store) override;
 
-  // Allows testing code to set a signing service tailored to its needs.
-  void SetSigningServiceForTesting(
-      std::unique_ptr<policy::SigningService> signing_service);
-
  private:
-  // Signing class implementing the policy::SigningService interface to
+  // Signing class implemting the policy::SigningService interface to
   // sign data using the enrollment certificate's TPM-bound key.
   class TpmEnrollmentKeySigningService : public policy::SigningService {
    public:
@@ -153,7 +148,7 @@
   ServerBackedStateKeysBroker::Subscription state_keys_update_subscription_;
 
   // Our signing service.
-  std::unique_ptr<SigningService> signing_service_;
+  TpmEnrollmentKeySigningService signing_service_;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyInitializer);
 };

diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
index 904c8583..4f7089dd 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc

@@ -46,7 +46,6 @@
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/cloud_policy_core.h"
 #include "components/policy/core/common/cloud/mock_device_management_service.h"
-#include "components/policy/core/common/cloud/mock_signing_service.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/policy_types.h"
 #include "components/policy/core/common/schema_registry.h"
@@ -125,7 +124,7 @@
     chromeos::system::StatisticsProvider::SetTestProvider(NULL);
   }
 
-  virtual bool ShouldRegisterWithCert() const { return false; }
+  virtual bool ShouldRegisterWitCert() const { return false; }
 
   void SetUp() override {
     DeviceSettingsTestBase::SetUp();
@@ -169,7 +168,7 @@
   CreateAttestationFlow() {
     StrictMock<chromeos::attestation::MockAttestationFlow>* mock =
         new StrictMock<chromeos::attestation::MockAttestationFlow>();
-    if (ShouldRegisterWithCert()) {
+    if (ShouldRegisterWitCert()) {
       EXPECT_CALL(*mock, GetCertificate(_, _, _, _, _))
           .WillOnce(WithArgs<4>(Invoke(CertCallbackSuccess)));
     }
@@ -212,8 +211,6 @@
         base::ThreadTaskRunnerHandle::Get(), install_attributes_.get(),
         &state_keys_broker_, store_, manager_.get(),
         cryptohome::AsyncMethodCaller::GetInstance(), std::move(unique_flow)));
-    initializer_->SetSigningServiceForTesting(
-        base::MakeUnique<FakeSigningService>());
     initializer_->Init();
   }
 
@@ -397,8 +394,7 @@
 }
 
 class DeviceCloudPolicyManagerChromeOSEnrollmentTest
-    : public DeviceCloudPolicyManagerChromeOSTest,
-      public testing::WithParamInterface<bool> {
+    : public DeviceCloudPolicyManagerChromeOSTest {
  public:
   void Done(EnrollmentStatus status) {
     status_ = status;
@@ -463,7 +459,7 @@
   }
 
   void RunTest() {
-    const bool with_cert = ShouldRegisterWithCert();
+    const bool with_cert = ShouldRegisterWitCert();
     // Trigger enrollment.
     MockDeviceManagementJob* register_job = NULL;
     EXPECT_CALL(
@@ -602,25 +598,6 @@
     ReloadDeviceSettings();
   }
 
-  bool ShouldRegisterWithCert() const override { return GetParam(); }
-
-  const em::DeviceRegisterRequest& GetDeviceRegisterRequest() {
-    if (ShouldRegisterWithCert()) {
-      const em::SignedData& signed_request =
-          register_request_.cert_based_register_request().signed_request();
-      em::CertificateBasedDeviceRegistrationData data;
-      EXPECT_TRUE(data.ParseFromString(signed_request.data().substr(
-          0,
-          signed_request.data().size() - signed_request.extra_data_bytes())));
-      EXPECT_EQ(em::CertificateBasedDeviceRegistrationData::
-                    ENTERPRISE_ENROLLMENT_CERTIFICATE,
-                data.certificate_type());
-      return data.device_register_request();
-    } else {
-      return register_request_.register_request();
-    }
-  }
-
   DeviceManagementStatus register_status_;
   em::DeviceManagementResponse register_response_;
 
@@ -643,34 +620,43 @@
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
 };
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
-  RunTest();
-  ExpectSuccessfulEnrollment();
-}
-
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
+// TODO(drcrash): Handle cert-based tests (http://crbug.com/641447).
+TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
   LockDevice();
   RunTest();
   ExpectSuccessfulEnrollment();
-  EXPECT_TRUE(GetDeviceRegisterRequest().reregister());
+  EXPECT_TRUE(register_request_.register_request().reregister());
   EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
+class ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest
+    : public DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+      public testing::WithParamInterface<bool> {
+ protected:
+  bool ShouldRegisterWitCert() const override { return GetParam(); }
+};
+
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
+  RunTest();
+  ExpectSuccessfulEnrollment();
+}
+
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       RegistrationFailed) {
   register_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotAuthCodeFetchFailed) {
   robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_AUTH_FETCH_FAILED);
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshTokenFetchResponseCodeFailed) {
   url_fetcher_response_code_ = 400;
   RunTest();
@@ -678,14 +664,14 @@
   EXPECT_EQ(400, status_.http_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshTokenFetchResponseStringFailed) {
   url_fetcher_response_string_ = "invalid response json";
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
        RobotRefreshEncryptionFailed) {
   // The encryption lib is a noop for tests, but empty results from encryption
   // is an error, so we simulate an encryption error by returning an empty
@@ -697,14 +683,16 @@
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       PolicyFetchFailed) {
   policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       ValidationFailed) {
   device_policy_.policy().set_policy_data_signature("bad");
   policy_fetch_response_.clear_policy_response();
   policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
@@ -715,7 +703,8 @@
             status_.validation_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       StoreError) {
   store_result_ = false;
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
@@ -723,7 +712,7 @@
             status_.store_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
   loaded_blob_.clear();
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
@@ -731,7 +720,8 @@
             status_.store_status());
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, UnregisterSucceeds) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       UnregisterSucceeds) {
   // Enroll first.
   RunTest();
   ExpectSuccessfulEnrollment();
@@ -751,7 +741,8 @@
       base::Unretained(this)));
 }
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentTest, UnregisterFails) {
+TEST_P(ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
+       UnregisterFails) {
   // Enroll first.
   RunTest();
   ExpectSuccessfulEnrollment();
@@ -779,20 +770,16 @@
   }
 };
 
-TEST_P(DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest,
+TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest,
        RobotRefreshSaveFailed) {
   // Without the system salt, the robot token can't be stored.
   RunTest();
   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 }
 
-INSTANTIATE_TEST_CASE_P(Cert,
-                        DeviceCloudPolicyManagerChromeOSEnrollmentTest,
-                        ::testing::Values(false, true));
-
 INSTANTIATE_TEST_CASE_P(
     Cert,
-    DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest,
+    ParameterizedDeviceCloudPolicyManagerChromeOSEnrollmentTest,
     ::testing::Values(false, true));
 
 }  // namespace

diff --git a/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc b/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc
index 8e22782..d94ac073 100644
--- a/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc
+++ b/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc

@@ -159,6 +159,7 @@
 #define SET_STRING(id, idr) \
   dict->SetString(id, l10n_util::GetStringUTF16(idr))
   SET_STRING("page-title", IDS_FEEDBACK_REPORT_PAGE_TITLE);
+  SET_STRING("additionalInfo", IDS_FEEDBACK_ADDITIONAL_INFO_LABEL);
   SET_STRING("page-url", IDS_FEEDBACK_REPORT_URL_LABEL);
   SET_STRING("screenshot", IDS_FEEDBACK_SCREENSHOT_LABEL);
   SET_STRING("user-email", IDS_FEEDBACK_USER_EMAIL_LABEL);

diff --git a/chrome/browser/extensions/app_background_page_apitest.cc b/chrome/browser/extensions/app_background_page_apitest.cc
index 3c134afe..aadf4523 100644
--- a/chrome/browser/extensions/app_background_page_apitest.cc
+++ b/chrome/browser/extensions/app_background_page_apitest.cc

@@ -304,7 +304,8 @@
   UnloadExtension(extension->id());
 }
 
-IN_PROC_BROWSER_TEST_F(AppBackgroundPageApiTest, NoJsBackgroundPage) {
+// TODO(crbug.com/642482) Disabled test for flakyness.
+IN_PROC_BROWSER_TEST_F(AppBackgroundPageApiTest, DISABLED_NoJsBackgroundPage) {
   // Keep the task manager up through this test to verify that a crash doesn't
   // happen when window.open creates a background page that switches
   // RenderViewHosts. See http://crbug.com/165138.

diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index b4bfcd69..08a0f09 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc

@@ -748,12 +748,13 @@
           globals_->http_auth_preferences.get(), globals_->host_resolver.get());
 }
 
-void IOThread::ClearHostCache() {
+void IOThread::ClearHostCache(
+    const base::Callback<bool(const std::string&)>& host_filter) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   net::HostCache* host_cache = globals_->host_resolver->GetHostCache();
   if (host_cache)
-    host_cache->clear();
+    host_cache->ClearForHosts(host_filter);
 }
 
 const net::HttpNetworkSession::Params& IOThread::NetworkSessionParams() const {
@@ -773,7 +774,7 @@
 
   // Clear the host cache to avoid showing entries from the OTR session
   // in about:net-internals.
-  ClearHostCache();
+  ClearHostCache(base::Callback<bool(const std::string&)>());
 }
 
 void IOThread::InitSystemRequestContext() {

diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index 574151a..6bf09ef 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h

@@ -222,10 +222,12 @@
   // Returns a getter for the URLRequestContext.  Only called on the UI thread.
   net::URLRequestContextGetter* system_url_request_context_getter();
 
-  // Clears the host cache.  Intended to be used to prevent exposing recently
+  // Clears the host cache. Intended to be used to prevent exposing recently
   // visited sites on about:net-internals/#dns and about:dns pages.  Must be
-  // called on the IO thread.
-  void ClearHostCache();
+  // called on the IO thread. If |host_filter| is not null, only hosts matched
+  // by it are deleted from the cache.
+  void ClearHostCache(
+      const base::Callback<bool(const std::string&)>& host_filter);
 
   const net::HttpNetworkSession::Params& NetworkSessionParams() const;
 

diff --git a/chrome/browser/metrics/chrome_metrics_services_manager_client.cc b/chrome/browser/metrics/chrome_metrics_services_manager_client.cc
index 66885589..aa86d9be 100644
--- a/chrome/browser/metrics/chrome_metrics_services_manager_client.cc
+++ b/chrome/browser/metrics/chrome_metrics_services_manager_client.cc

@@ -127,8 +127,7 @@
           1, 1, base::FieldTrial::ONE_TIME_RANDOMIZED, nullptr));
 
   // Like the trial name, the order that these two groups are added to the trial
-  // must be kept in sync with the order that they appear in the server
-  // config.
+  // must be kept in sync with the order that they appear in the server config.
 
   // 100 per-mille sampling rate group.
   static const char kInSampleGroup[] = "InReportingSample";

diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index 401cda0..840d559 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc

@@ -246,7 +246,9 @@
   }
 #endif  // OS_ANDROID
 
-  if (base::FeatureList::IsEnabled(ntp_snippets::kBookmarkSuggestionsFeature)) {
+  // |bookmark_model| can be null in tests.
+  if (base::FeatureList::IsEnabled(ntp_snippets::kBookmarkSuggestionsFeature) &&
+      bookmark_model) {
     RegisterBookmarkProvider(bookmark_model, service, category_factory,
                              pref_service);
   }

diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js
index f5546f5..c464f1cf 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js

@@ -335,6 +335,9 @@
     if (!this.inExcursion_ && newRange)
       this.savedRange_ = new cursors.Range(newRange.start, newRange.end);
 
+    if (newRange && !newRange.isValid())
+      return;
+
     this.currentRange_ = newRange;
     var oldMode = this.mode_;
     var newMode = this.getMode();

diff --git a/chrome/browser/resources/feedback/css/feedback.css b/chrome/browser/resources/feedback/css/feedback.css
index ad3ad53..5c12f22e 100644
--- a/chrome/browser/resources/feedback/css/feedback.css
+++ b/chrome/browser/resources/feedback/css/feedback.css

@@ -56,6 +56,10 @@
   width: 100%;
 }
 
+.content #additional-info-label {
+  -webkit-margin-start: 10px;
+}
+
 .content .text-field-container {
   -webkit-align-items: center;
   -webkit-padding-start: 10px;

diff --git a/chrome/browser/resources/feedback/html/default.html b/chrome/browser/resources/feedback/html/default.html
index b77b640..43dba457 100644
--- a/chrome/browser/resources/feedback/html/default.html
+++ b/chrome/browser/resources/feedback/html/default.html

@@ -39,6 +39,9 @@
   </div>
   <div id="content-pane" class="content">
     <textarea id="description-text" aria-labelledby="title-bar"></textarea>
+    <div>
+      <p id="additional-info-label" i18n-content="additionalInfo"><p>
+    </div>
     <div id="page-url" class="text-field-container">
       <label id="page-url-label" i18n-content="page-url"></label>
       <input id="page-url-text" aria-labelledby="page-url-label" type="text">

diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/chrome/browser/resources/settings/privacy_page/privacy_page.html
index b7247f8..c63bd6c 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page.html
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page.html

@@ -263,8 +263,8 @@
           </site-settings-category>
         </settings-subpage>
       </template>
-      <template is="dom-if" route-path="/siteSettings/plugins" no-search>
-        <settings-subpage page-title="$i18n{siteSettingsPlugins}">
+      <template is="dom-if" route-path="/siteSettings/flash" no-search>
+        <settings-subpage page-title="$i18n{siteSettingsFlash}">
           <site-settings-category
               selected-site="{{selectedSite}}"
               category="{{ContentSettingsTypes.PLUGINS}}">

diff --git a/chrome/browser/resources/settings/route.js b/chrome/browser/resources/settings/route.js
index b2af218f..81e872d 100644
--- a/chrome/browser/resources/settings/route.js
+++ b/chrome/browser/resources/settings/route.js

@@ -153,7 +153,7 @@
   r.SITE_SETTINGS_LOCATION = r.SITE_SETTINGS.createChild('location');
   r.SITE_SETTINGS_MICROPHONE = r.SITE_SETTINGS.createChild('microphone');
   r.SITE_SETTINGS_NOTIFICATIONS = r.SITE_SETTINGS.createChild('notifications');
-  r.SITE_SETTINGS_PLUGINS = r.SITE_SETTINGS.createChild('plugins');
+  r.SITE_SETTINGS_FLASH = r.SITE_SETTINGS.createChild('flash');
   r.SITE_SETTINGS_POPUPS = r.SITE_SETTINGS.createChild('popups');
   r.SITE_SETTINGS_UNSANDBOXED_PLUGINS =
       r.SITE_SETTINGS.createChild('unsandboxedPlugins');

diff --git a/chrome/browser/resources/settings/site_settings/site_settings_behavior.js b/chrome/browser/resources/settings/site_settings/site_settings_behavior.js
index 7c48cbb..41b7821 100644
--- a/chrome/browser/resources/settings/site_settings/site_settings_behavior.js
+++ b/chrome/browser/resources/settings/site_settings/site_settings_behavior.js

@@ -136,7 +136,7 @@
       case settings.ContentSettingsTypes.NOTIFICATIONS:
         return settings.Route.SITE_SETTINGS_NOTIFICATIONS;
       case settings.ContentSettingsTypes.PLUGINS:
-        return settings.Route.SITE_SETTINGS_PLUGINS;
+        return settings.Route.SITE_SETTINGS_FLASH;
       case settings.ContentSettingsTypes.POPUPS:
         return settings.Route.SITE_SETTINGS_POPUPS;
       case settings.ContentSettingsTypes.PROTOCOL_HANDLERS:
@@ -230,7 +230,7 @@
       case settings.ContentSettingsTypes.NOTIFICATIONS:
         return loadTimeData.getString('siteSettingsNotifications');
       case settings.ContentSettingsTypes.PLUGINS:
-        return loadTimeData.getString('siteSettingsPlugins');
+        return loadTimeData.getString('siteSettingsFlash');
       case settings.ContentSettingsTypes.POPUPS:
         return loadTimeData.getString('siteSettingsPopups');
       case settings.ContentSettingsTypes.PROTOCOL_HANDLERS:

diff --git a/chrome/browser/search_engines/template_url_service_unittest.cc b/chrome/browser/search_engines/template_url_service_unittest.cc
index cb16554..482d6dd 100644
--- a/chrome/browser/search_engines/template_url_service_unittest.cc
+++ b/chrome/browser/search_engines/template_url_service_unittest.cc

@@ -571,7 +571,7 @@
   EXPECT_EQ(2U, model()->GetTemplateURLs().size());
 }
 
-TEST_F(TemplateURLServiceTest, ClearBrowsingData_KeywordsForOrigin) {
+TEST_F(TemplateURLServiceTest, ClearBrowsingData_KeywordsForUrls) {
   Time now = Time::Now();
   TimeDelta one_day = TimeDelta::FromDays(1);
   Time month_ago = now - TimeDelta::FromDays(30);
@@ -594,7 +594,9 @@
   EXPECT_EQ(3U, model()->GetTemplateURLs().size());
 
   // Try removing foo2. This should delete foo2, but leave foo1 and 3 untouched.
-  model()->RemoveAutoGeneratedForOriginBetween(GURL("http://foo2"), month_ago,
+  GURL url2("http://foo2");
+  model()->RemoveAutoGeneratedForUrlsBetween(
+      base::Bind(&GURL::operator==, base::Unretained(&url2)), month_ago,
       now + one_day);
   EXPECT_EQ(2U, model()->GetTemplateURLs().size());
   EXPECT_EQ(ASCIIToUTF16("key1"), model()->GetTemplateURLs()[0]->keyword());
@@ -604,7 +606,9 @@
 
   // Try removing foo1, but outside the range in which it was modified. It
   // should remain untouched.
-  model()->RemoveAutoGeneratedForOriginBetween(GURL("http://foo1"), now,
+  GURL url1("http://foo1");
+  model()->RemoveAutoGeneratedForUrlsBetween(
+      base::Bind(&GURL::operator==, base::Unretained(&url1)), now,
       now + one_day);
   EXPECT_EQ(2U, model()->GetTemplateURLs().size());
   EXPECT_EQ(ASCIIToUTF16("key1"), model()->GetTemplateURLs()[0]->keyword());
@@ -612,9 +616,10 @@
   EXPECT_EQ(ASCIIToUTF16("key3"), model()->GetTemplateURLs()[1]->keyword());
   EXPECT_TRUE(model()->GetTemplateURLs()[1]->safe_for_autoreplace());
 
-
   // Try removing foo3. This should delete foo3, but leave foo1 untouched.
-  model()->RemoveAutoGeneratedForOriginBetween(GURL("http://foo3"), month_ago,
+  GURL url3("http://foo3");
+  model()->RemoveAutoGeneratedForUrlsBetween(
+      base::Bind(&GURL::operator==, base::Unretained(&url3)), month_ago,
       now + one_day + one_day);
   EXPECT_EQ(1U, model()->GetTemplateURLs().size());
   EXPECT_EQ(ASCIIToUTF16("key1"), model()->GetTemplateURLs()[0]->keyword());

diff --git a/chrome/browser/task_manager/sampling/shared_sampler_win.cc b/chrome/browser/task_manager/sampling/shared_sampler_win.cc
index 6dd66472..4cd06e9 100644
--- a/chrome/browser/task_manager/sampling/shared_sampler_win.cc
+++ b/chrome/browser/task_manager/sampling/shared_sampler_win.cc

@@ -356,12 +356,13 @@
 
 void SharedSampler::Refresh(base::ProcessId process_id, int64_t refresh_flags) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  DCHECK(callbacks_map_.find(process_id) != callbacks_map_.end());
   DCHECK_NE(0, refresh_flags & GetSupportedFlags());
 
   if (process_id == 0)
     return;
 
+  DCHECK(callbacks_map_.find(process_id) != callbacks_map_.end());
+
   if (refresh_flags_ == 0) {
     base::PostTaskAndReplyWithResult(
         blocking_pool_runner_.get(), FROM_HERE,

diff --git a/chrome/browser/task_manager/task_manager_browsertest.cc b/chrome/browser/task_manager/task_manager_browsertest.cc
index 69a60f8..926845ff 100644
--- a/chrome/browser/task_manager/task_manager_browsertest.cc
+++ b/chrome/browser/task_manager/task_manager_browsertest.cc

@@ -699,7 +699,9 @@
       WaitForTaskManagerRows(1, MatchUtility(proxy_resolver_name)));
 }
 
-IN_PROC_BROWSER_TEST_F(TaskManagerBrowserTest, DevToolsNewDockedWindow) {
+// TODO(crbug.com/642482): Disabled flaky test.
+IN_PROC_BROWSER_TEST_F(TaskManagerBrowserTest,
+                       DISABLED_DevToolsNewDockedWindow) {
   ShowTaskManager();  // Task manager shown BEFORE dev tools window.
 
   ASSERT_NO_FATAL_FAILURE(WaitForTaskManagerRows(1, MatchAnyTab()));
@@ -710,7 +712,9 @@
   DevToolsWindowTesting::CloseDevToolsWindowSync(devtools);
 }
 
-IN_PROC_BROWSER_TEST_F(TaskManagerBrowserTest, DevToolsNewUndockedWindow) {
+// TODO(crbug.com/642482): Disabled flaky test.
+IN_PROC_BROWSER_TEST_F(TaskManagerBrowserTest,
+                       DISABLED_DevToolsNewUndockedWindow) {
   ShowTaskManager();  // Task manager shown BEFORE dev tools window.
   ASSERT_NO_FATAL_FAILURE(WaitForTaskManagerRows(1, MatchAnyTab()));
   DevToolsWindow* devtools =

diff --git a/chrome/browser/ui/android/infobars/autofill_save_card_infobar.cc b/chrome/browser/ui/android/infobars/autofill_save_card_infobar.cc
index 79cf77ed..b100550 100644
--- a/chrome/browser/ui/android/infobars/autofill_save_card_infobar.cc
+++ b/chrome/browser/ui/android/infobars/autofill_save_card_infobar.cc

@@ -25,7 +25,7 @@
 
 std::unique_ptr<infobars::InfoBar> CreateSaveCardInfoBarMobile(
     std::unique_ptr<AutofillSaveCardInfoBarDelegateMobile> delegate) {
-  return base::WrapUnique(new AutofillSaveCardInfoBar(std::move(delegate)));
+  return base::MakeUnique<AutofillSaveCardInfoBar>(std::move(delegate));
 }
 
 }  // namespace autofill

diff --git a/chrome/browser/ui/android/infobars/confirm_infobar.cc b/chrome/browser/ui/android/infobars/confirm_infobar.cc
index 9a76c7e..2b5b5f7 100644
--- a/chrome/browser/ui/android/infobars/confirm_infobar.cc
+++ b/chrome/browser/ui/android/infobars/confirm_infobar.cc

@@ -25,7 +25,7 @@
 
 std::unique_ptr<infobars::InfoBar> InfoBarService::CreateConfirmInfoBar(
     std::unique_ptr<ConfirmInfoBarDelegate> delegate) {
-  return base::WrapUnique(new ConfirmInfoBar(std::move(delegate)));
+  return base::MakeUnique<ConfirmInfoBar>(std::move(delegate));
 }
 
 

diff --git a/chrome/browser/ui/android/infobars/generated_password_saved_infobar.cc b/chrome/browser/ui/android/infobars/generated_password_saved_infobar.cc
index e6725d7..2292eae 100644
--- a/chrome/browser/ui/android/infobars/generated_password_saved_infobar.cc
+++ b/chrome/browser/ui/android/infobars/generated_password_saved_infobar.cc

@@ -19,9 +19,9 @@
 void GeneratedPasswordSavedInfoBarDelegateAndroid::Create(
     content::WebContents* web_contents) {
   InfoBarService::FromWebContents(web_contents)
-      ->AddInfoBar(base::WrapUnique(new GeneratedPasswordSavedInfoBar(
-          base::WrapUnique(new GeneratedPasswordSavedInfoBarDelegateAndroid(
-              web_contents)))));
+      ->AddInfoBar(
+          base::MakeUnique<GeneratedPasswordSavedInfoBar>(base::WrapUnique(
+              new GeneratedPasswordSavedInfoBarDelegateAndroid(web_contents))));
 }
 
 GeneratedPasswordSavedInfoBar::GeneratedPasswordSavedInfoBar(

diff --git a/chrome/browser/ui/android/infobars/save_password_infobar.cc b/chrome/browser/ui/android/infobars/save_password_infobar.cc
index a8ca336..f3592e2 100644
--- a/chrome/browser/ui/android/infobars/save_password_infobar.cc
+++ b/chrome/browser/ui/android/infobars/save_password_infobar.cc

@@ -50,5 +50,5 @@
 
 std::unique_ptr<infobars::InfoBar> CreateSavePasswordInfoBar(
     std::unique_ptr<SavePasswordInfoBarDelegate> delegate) {
-  return base::WrapUnique(new SavePasswordInfoBar(std::move(delegate)));
+  return base::MakeUnique<SavePasswordInfoBar>(std::move(delegate));
 }

diff --git a/chrome/browser/ui/android/infobars/simple_confirm_infobar_builder.cc b/chrome/browser/ui/android/infobars/simple_confirm_infobar_builder.cc
index 4cd497e..b952de8 100644
--- a/chrome/browser/ui/android/infobars/simple_confirm_infobar_builder.cc
+++ b/chrome/browser/ui/android/infobars/simple_confirm_infobar_builder.cc

@@ -161,9 +161,9 @@
   InfoBarService* service = InfoBarService::FromWebContents(
       TabAndroid::GetNativeTab(env, j_tab)->web_contents());
   service->AddInfoBar(service->CreateConfirmInfoBar(
-      base::WrapUnique(new SimpleConfirmInfoBarDelegate(
+      base::MakeUnique<SimpleConfirmInfoBarDelegate>(
           j_listener, infobar_identifier, icon_bitmap, message_str, primary_str,
-          secondary_str, auto_expire))));
+          secondary_str, auto_expire)));
 }
 
 bool RegisterSimpleConfirmInfoBarBuilder(JNIEnv* env) {

diff --git a/chrome/browser/ui/android/infobars/translate_infobar.cc b/chrome/browser/ui/android/infobars/translate_infobar.cc
index f9dbd080..24747da 100644
--- a/chrome/browser/ui/android/infobars/translate_infobar.cc
+++ b/chrome/browser/ui/android/infobars/translate_infobar.cc

@@ -25,7 +25,7 @@
 
 std::unique_ptr<infobars::InfoBar> ChromeTranslateClient::CreateInfoBar(
     std::unique_ptr<translate::TranslateInfoBarDelegate> delegate) const {
-  return base::WrapUnique(new TranslateInfoBar(std::move(delegate)));
+  return base::MakeUnique<TranslateInfoBar>(std::move(delegate));
 }
 
 

diff --git a/chrome/browser/ui/app_list/app_list_syncable_service_factory.cc b/chrome/browser/ui/app_list/app_list_syncable_service_factory.cc
index 7d3509b..ea2e3e44b 100644
--- a/chrome/browser/ui/app_list/app_list_syncable_service_factory.cc
+++ b/chrome/browser/ui/app_list/app_list_syncable_service_factory.cc

@@ -51,8 +51,8 @@
 #endif
   VLOG(1) << "BuildInstanceFor: " << profile->GetDebugName()
           << " (" << profile << ")";
-  return base::WrapUnique(new AppListSyncableService(
-      profile, extensions::ExtensionSystem::Get(profile)));
+  return base::MakeUnique<AppListSyncableService>(
+      profile, extensions::ExtensionSystem::Get(profile));
 }
 
 // static

diff --git a/chrome/browser/ui/app_list/arc/arc_app_model_builder.cc b/chrome/browser/ui/app_list/arc/arc_app_model_builder.cc
index b10e01bc..eb081a1 100644
--- a/chrome/browser/ui/app_list/arc/arc_app_model_builder.cc
+++ b/chrome/browser/ui/app_list/arc/arc_app_model_builder.cc

@@ -40,8 +40,8 @@
 std::unique_ptr<ArcAppItem> ArcAppModelBuilder::CreateApp(
     const std::string& app_id,
     const ArcAppListPrefs::AppInfo& app_info) {
-  return base::WrapUnique(new ArcAppItem(profile(), GetSyncItem(app_id), app_id,
-                                         app_info.name));
+  return base::MakeUnique<ArcAppItem>(profile(), GetSyncItem(app_id), app_id,
+                                      app_info.name);
 }
 
 void ArcAppModelBuilder::OnAppRegistered(

diff --git a/chrome/browser/ui/app_list/extension_app_model_builder.cc b/chrome/browser/ui/app_list/extension_app_model_builder.cc
index 2ae9b540..75f50629 100644
--- a/chrome/browser/ui/app_list/extension_app_model_builder.cc
+++ b/chrome/browser/ui/app_list/extension_app_model_builder.cc

@@ -205,9 +205,9 @@
     const std::string& extension_name,
     const gfx::ImageSkia& installing_icon,
     bool is_platform_app) {
-  return base::WrapUnique(
-      new ExtensionAppItem(profile(), GetSyncItem(extension_id), extension_id,
-                           extension_name, installing_icon, is_platform_app));
+  return base::MakeUnique<ExtensionAppItem>(
+      profile(), GetSyncItem(extension_id), extension_id, extension_name,
+      installing_icon, is_platform_app);
 }
 
 void ExtensionAppModelBuilder::BuildModel() {

diff --git a/chrome/browser/ui/app_list/launcher_page_event_dispatcher.cc b/chrome/browser/ui/app_list/launcher_page_event_dispatcher.cc
index 16b6c03..cbb705d0 100644
--- a/chrome/browser/ui/app_list/launcher_page_event_dispatcher.cc
+++ b/chrome/browser/ui/app_list/launcher_page_event_dispatcher.cc

@@ -28,15 +28,15 @@
 }
 
 void LauncherPageEventDispatcher::ProgressChanged(double progress) {
-  DispatchEvent(base::WrapUnique(new extensions::Event(
+  DispatchEvent(base::MakeUnique<extensions::Event>(
       extensions::events::LAUNCHER_PAGE_ON_TRANSITION_CHANGED,
-      OnTransitionChanged::kEventName, OnTransitionChanged::Create(progress))));
+      OnTransitionChanged::kEventName, OnTransitionChanged::Create(progress)));
 }
 
 void LauncherPageEventDispatcher::PopSubpage() {
-  DispatchEvent(base::WrapUnique(
-      new extensions::Event(extensions::events::LAUNCHER_PAGE_ON_POP_SUBPAGE,
-                            OnPopSubpage::kEventName, OnPopSubpage::Create())));
+  DispatchEvent(base::MakeUnique<extensions::Event>(
+      extensions::events::LAUNCHER_PAGE_ON_POP_SUBPAGE,
+      OnPopSubpage::kEventName, OnPopSubpage::Create()));
 }
 
 void LauncherPageEventDispatcher::DispatchEvent(

diff --git a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_icon_image_loader_unittest.cc b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_icon_image_loader_unittest.cc
index a7d45ba6..43f10fb 100644
--- a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_icon_image_loader_unittest.cc
+++ b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_icon_image_loader_unittest.cc

@@ -98,7 +98,7 @@
   const std::string& GetLastWarningMessage() { return *last_message_.get(); }
 
   std::unique_ptr<ErrorReporter> Duplicate() override {
-    return base::WrapUnique(new FakeErrorReporter(last_message_));
+    return base::MakeUnique<FakeErrorReporter>(last_message_);
   }
 
  private:
@@ -136,7 +136,7 @@
   void SetUp() override { extension_ = CreateTestExtension(kTestExtensionId); }
 
   std::unique_ptr<FakeErrorReporter> GetFakeErrorReporter() {
-    return base::WrapUnique(new FakeErrorReporter());
+    return base::MakeUnique<FakeErrorReporter>();
   }
 
   scoped_refptr<extensions::Extension> extension_;

diff --git a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc
index 067830a0..ccc91f1 100644
--- a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc
+++ b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc

@@ -62,8 +62,8 @@
   DCHECK(Service::Get(profile_)->IsQueryRunning());
 
   // Add this extension's results (erasing any existing results).
-  extension_results_[extension_id] = base::WrapUnique(
-      new ScopedVector<LauncherSearchResult>(std::move(results)));
+  extension_results_[extension_id] =
+      base::MakeUnique<ScopedVector<LauncherSearchResult>>(std::move(results));
 
   // Update results with other extension results.
   ClearResults();

diff --git a/chrome/browser/ui/app_list/search/search_controller_factory.cc b/chrome/browser/ui/app_list/search/search_controller_factory.cc
index 53e0bbf6..1239302 100644
--- a/chrome/browser/ui/app_list/search/search_controller_factory.cc
+++ b/chrome/browser/ui/app_list/search/search_controller_factory.cc

@@ -77,7 +77,7 @@
   controller->AddProvider(
       apps_group_id,
       std::unique_ptr<SearchProvider>(new AppSearchProvider(
-          profile, list_controller, base::WrapUnique(new base::DefaultClock()),
+          profile, list_controller, base::MakeUnique<base::DefaultClock>(),
           model->top_level_item_list())));
   controller->AddProvider(omnibox_group_id,
                           std::unique_ptr<SearchProvider>(

diff --git a/chrome/browser/ui/app_list/search/search_resource_manager.cc b/chrome/browser/ui/app_list/search/search_resource_manager.cc
index 554f58c..c5189b9 100644
--- a/chrome/browser/ui/app_list/search/search_resource_manager.cc
+++ b/chrome/browser/ui/app_list/search/search_resource_manager.cc

@@ -24,12 +24,12 @@
     return nullptr;
 
   ui::ResourceBundle& bundle = ui::ResourceBundle::GetSharedInstance();
-  return base::WrapUnique(new SearchBoxModel::SpeechButtonProperty(
+  return base::MakeUnique<SearchBoxModel::SpeechButtonProperty>(
       *bundle.GetImageSkiaNamed(IDR_APP_LIST_MIC_HOTWORD_ON),
       l10n_util::GetStringUTF16(IDS_APP_LIST_HOTWORD_LISTENING),
       *bundle.GetImageSkiaNamed(IDR_APP_LIST_MIC_HOTWORD_OFF),
       l10n_util::GetStringUTF16(IDS_APP_LIST_START_SPEECH_RECOGNITION),
-      l10n_util::GetStringUTF16(IDS_TOOLTIP_MIC_SEARCH)));
+      l10n_util::GetStringUTF16(IDS_TOOLTIP_MIC_SEARCH));
 }
 
 }  // namespace

diff --git a/chrome/browser/ui/app_list/test/fast_show_pickler_unittest.cc b/chrome/browser/ui/app_list/test/fast_show_pickler_unittest.cc
index 21304ee..159b5578 100644
--- a/chrome/browser/ui/app_list/test/fast_show_pickler_unittest.cc
+++ b/chrome/browser/ui/app_list/test/fast_show_pickler_unittest.cc

@@ -81,15 +81,15 @@
 
 TEST_F(AppListModelPicklerUnitTest, OneItem) {
   AppListModel model;
-  model.AddItem(base::WrapUnique(new AppListItem("abc")));
+  model.AddItem(base::MakeUnique<AppListItem>("abc"));
   DoConsistencyChecks(&model);
 }
 
 TEST_F(AppListModelPicklerUnitTest, TwoItems) {
   AppListModel model;
-  AppListItem* app1 = model.AddItem(base::WrapUnique(new AppListItem("abc")));
+  AppListItem* app1 = model.AddItem(base::MakeUnique<AppListItem>("abc"));
   model.SetItemNameAndShortName(app1, "hello, there", "ht");
-  AppListItem* app2 = model.AddItem(base::WrapUnique(new AppListItem("abc2")));
+  AppListItem* app2 = model.AddItem(base::MakeUnique<AppListItem>("abc2"));
   model.SetItemNameAndShortName(app2, "hello, there 2", "ht2");
 
   DoConsistencyChecks(&model);
@@ -97,10 +97,10 @@
 
 TEST_F(AppListModelPicklerUnitTest, Images) {
   AppListModel model;
-  AppListItem* app1 = model.AddItem(base::WrapUnique(new AppListItem("abc")));
+  AppListItem* app1 = model.AddItem(base::MakeUnique<AppListItem>("abc"));
   model.SetItemName(app1, "hello, there");
   app1->SetIcon(MakeImage());
-  AppListItem* app2 = model.AddItem(base::WrapUnique(new AppListItem("abc2")));
+  AppListItem* app2 = model.AddItem(base::MakeUnique<AppListItem>("abc2"));
   model.SetItemName(app2, "hello, there 2");
 
   DoConsistencyChecks(&model);
@@ -108,7 +108,7 @@
 
 TEST_F(AppListModelPicklerUnitTest, EmptyImage) {
   AppListModel model;
-  AppListItem* app1 = model.AddItem(base::WrapUnique(new AppListItem("abc")));
+  AppListItem* app1 = model.AddItem(base::MakeUnique<AppListItem>("abc"));
   model.SetItemName(app1, "hello, there");
   app1->SetIcon(gfx::ImageSkia());
 

diff --git a/chrome/browser/ui/ash/app_list/app_list_service_ash.cc b/chrome/browser/ui/ash/app_list/app_list_service_ash.cc
index 8b4cddcf..25171e9 100644
--- a/chrome/browser/ui/ash/app_list/app_list_service_ash.cc
+++ b/chrome/browser/ui/ash/app_list/app_list_service_ash.cc

@@ -59,8 +59,8 @@
 
   std::unique_ptr<app_list::AppListPresenterDelegate> GetDelegate(
       app_list::AppListPresenter* presenter) override {
-    return base::WrapUnique(
-        new AppListPresenterDelegateMus(view_delegate_factory_.get()));
+    return base::MakeUnique<AppListPresenterDelegateMus>(
+        view_delegate_factory_.get());
   }
 
  private:
@@ -80,10 +80,10 @@
 AppListServiceAsh::AppListServiceAsh() {
   if (chrome::IsRunningInMash()) {
     presenter_delegate_factory_.reset(new AppListPresenterDelegateFactoryMus(
-        base::WrapUnique(new ViewDelegateFactoryImpl(this))));
+        base::MakeUnique<ViewDelegateFactoryImpl>(this)));
   } else {
     presenter_delegate_factory_.reset(new ash::AppListPresenterDelegateFactory(
-        base::WrapUnique(new ViewDelegateFactoryImpl(this))));
+        base::MakeUnique<ViewDelegateFactoryImpl>(this)));
   }
   app_list_presenter_.reset(
       new app_list::AppListPresenterImpl(presenter_delegate_factory_.get()));

diff --git a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_unittest.cc b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_unittest.cc
index 7e316ae..3d07dc8 100644
--- a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_unittest.cc
+++ b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_impl_unittest.cc

@@ -522,8 +522,8 @@
   void StartAppSyncService(const syncer::SyncDataList& init_sync_list) {
     app_service_->MergeDataAndStartSyncing(
         syncer::APP_LIST, init_sync_list,
-        base::WrapUnique(new syncer::FakeSyncChangeProcessor()),
-        base::WrapUnique(new syncer::SyncErrorFactoryMock()));
+        base::MakeUnique<syncer::FakeSyncChangeProcessor>(),
+        base::MakeUnique<syncer::SyncErrorFactoryMock>());
     EXPECT_EQ(init_sync_list.size(), app_service_->sync_items().size());
   }
 

diff --git a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
index 904de32..196200a4f 100644
--- a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
+++ b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc

@@ -173,8 +173,8 @@
 
 std::unique_ptr<ash::CastConfigDelegate> CreateCastConfigDelegate() {
   if (CastConfigDelegateMediaRouter::IsEnabled())
-    return base::WrapUnique(new CastConfigDelegateMediaRouter());
-  return base::WrapUnique(new CastConfigDelegateChromeos());
+    return base::MakeUnique<CastConfigDelegateMediaRouter>();
+  return base::MakeUnique<CastConfigDelegateChromeos>();
 }
 
 void ShowSettingsSubPageForActiveUser(const std::string& sub_page) {

diff --git a/chrome/browser/ui/autofill/chrome_autofill_client.cc b/chrome/browser/ui/autofill/chrome_autofill_client.cc
index 5b27e87..539c816a 100644
--- a/chrome/browser/ui/autofill/chrome_autofill_client.cc
+++ b/chrome/browser/ui/autofill/chrome_autofill_client.cc

@@ -183,9 +183,9 @@
 #if defined(OS_ANDROID)
   InfoBarService::FromWebContents(web_contents())
       ->AddInfoBar(CreateSaveCardInfoBarMobile(
-          base::WrapUnique(new AutofillSaveCardInfoBarDelegateMobile(
+          base::MakeUnique<AutofillSaveCardInfoBarDelegateMobile>(
               false, card, std::unique_ptr<base::DictionaryValue>(nullptr),
-              callback))));
+              callback)));
 #else
   // Do lazy initialization of SaveCardBubbleControllerImpl.
   autofill::SaveCardBubbleControllerImpl::CreateForWebContents(
@@ -203,8 +203,8 @@
 #if defined(OS_ANDROID)
   InfoBarService::FromWebContents(web_contents())
       ->AddInfoBar(CreateSaveCardInfoBarMobile(
-          base::WrapUnique(new AutofillSaveCardInfoBarDelegateMobile(
-              true, card, std::move(legal_message), callback))));
+          base::MakeUnique<AutofillSaveCardInfoBarDelegateMobile>(
+              true, card, std::move(legal_message), callback)));
 #else
   // Do lazy initialization of SaveCardBubbleControllerImpl.
   autofill::SaveCardBubbleControllerImpl::CreateForWebContents(web_contents());

diff --git a/chrome/browser/ui/browser_window_state.cc b/chrome/browser/ui/browser_window_state.cc
index 9c8179a6..db4308b 100644
--- a/chrome/browser/ui/browser_window_state.cc
+++ b/chrome/browser/ui/browser_window_state.cc

@@ -86,8 +86,7 @@
   DCHECK(!window_name.empty());
   // A normal DictionaryPrefUpdate will suffice for non-app windows.
   if (prefs->FindPreference(window_name.c_str())) {
-    return base::WrapUnique(
-        new DictionaryPrefUpdate(prefs, window_name.c_str()));
+    return base::MakeUnique<DictionaryPrefUpdate>(prefs, window_name.c_str());
   }
   return std::unique_ptr<DictionaryPrefUpdate>(
       new WindowPlacementPrefUpdate(prefs, window_name));

diff --git a/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm b/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm
index 22d49cec..1b867940 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm

@@ -104,7 +104,7 @@
 std::unique_ptr<ExtensionView> ExtensionViewHost::CreateExtensionView(
     ExtensionViewHost* host,
     Browser* browser) {
-  return base::WrapUnique(new ExtensionViewMac(host, browser));
+  return base::MakeUnique<ExtensionViewMac>(host, browser);
 }
 
 }  // namespace extensions

diff --git a/chrome/browser/ui/cocoa/website_settings/chooser_bubble_ui_cocoa.mm b/chrome/browser/ui/cocoa/website_settings/chooser_bubble_ui_cocoa.mm
index 0072bf2..bf44f56 100644
--- a/chrome/browser/ui/cocoa/website_settings/chooser_bubble_ui_cocoa.mm
+++ b/chrome/browser/ui/cocoa/website_settings/chooser_bubble_ui_cocoa.mm

@@ -29,8 +29,8 @@
 #include "ui/base/cocoa/window_size_constants.h"
 
 std::unique_ptr<BubbleUi> ChooserBubbleDelegate::BuildBubbleUi() {
-  return base::WrapUnique(
-      new ChooserBubbleUiCocoa(browser_, std::move(chooser_controller_)));
+  return base::MakeUnique<ChooserBubbleUiCocoa>(browser_,
+                                                std::move(chooser_controller_));
 }
 
 @interface ChooserBubbleUiController

diff --git a/chrome/browser/ui/cocoa/website_settings/permission_prompt_impl_views_mac.mm b/chrome/browser/ui/cocoa/website_settings/permission_prompt_impl_views_mac.mm
index 518e5b8..55da7da2 100644
--- a/chrome/browser/ui/cocoa/website_settings/permission_prompt_impl_views_mac.mm
+++ b/chrome/browser/ui/cocoa/website_settings/permission_prompt_impl_views_mac.mm

@@ -35,5 +35,5 @@
 std::unique_ptr<PermissionPrompt> PermissionPrompt::Create(Browser* browser) {
   if (chrome::ToolkitViewsWebUIDialogsEnabled())
     return base::WrapUnique(new PermissionPromptImpl(browser));
-  return base::WrapUnique(new PermissionBubbleCocoa(browser));
+  return base::MakeUnique<PermissionBubbleCocoa>(browser);
 }

diff --git a/chrome/browser/ui/content_settings/content_setting_image_model.cc b/chrome/browser/ui/content_settings/content_setting_image_model.cc
index 627fe65..5e3a5ee 100644
--- a/chrome/browser/ui/content_settings/content_setting_image_model.cc
+++ b/chrome/browser/ui/content_settings/content_setting_image_model.cc

@@ -204,16 +204,16 @@
 ContentSettingSimpleImageModel::CreateForContentTypeForTesting(
     ContentSettingsType content_settings_type) {
   if (content_settings_type == CONTENT_SETTINGS_TYPE_GEOLOCATION)
-    return base::WrapUnique(new ContentSettingGeolocationImageModel());
+    return base::MakeUnique<ContentSettingGeolocationImageModel>();
 
   if (content_settings_type == CONTENT_SETTINGS_TYPE_PROTOCOL_HANDLERS)
-    return base::WrapUnique(new ContentSettingRPHImageModel());
+    return base::MakeUnique<ContentSettingRPHImageModel>();
 
   if (content_settings_type == CONTENT_SETTINGS_TYPE_MIDI_SYSEX)
-    return base::WrapUnique(new ContentSettingMIDISysExImageModel());
+    return base::MakeUnique<ContentSettingMIDISysExImageModel>();
 
-  return base::WrapUnique(
-      new ContentSettingBlockedImageModel(content_settings_type));
+  return base::MakeUnique<ContentSettingBlockedImageModel>(
+      content_settings_type);
 }
 
 // Generic blocked content settings --------------------------------------------

diff --git a/chrome/browser/ui/extensions/extension_enable_flow.cc b/chrome/browser/ui/extensions/extension_enable_flow.cc
index 6fd22ee..9af3285 100644
--- a/chrome/browser/ui/extensions/extension_enable_flow.cc
+++ b/chrome/browser/ui/extensions/extension_enable_flow.cc

@@ -118,12 +118,11 @@
   ExtensionInstallPrompt::PromptType type =
       ExtensionInstallPrompt::GetReEnablePromptTypeForExtension(profile_,
                                                                 extension);
-  prompt_->ShowDialog(
-      base::Bind(&ExtensionEnableFlow::InstallPromptDone,
-                 weak_ptr_factory_.GetWeakPtr()),
-      extension, nullptr,
-      base::WrapUnique(new ExtensionInstallPrompt::Prompt(type)),
-      ExtensionInstallPrompt::GetDefaultShowDialogCallback());
+  prompt_->ShowDialog(base::Bind(&ExtensionEnableFlow::InstallPromptDone,
+                                 weak_ptr_factory_.GetWeakPtr()),
+                      extension, nullptr,
+                      base::MakeUnique<ExtensionInstallPrompt::Prompt>(type),
+                      ExtensionInstallPrompt::GetDefaultShowDialogCallback());
 }
 
 void ExtensionEnableFlow::CreatePrompt() {

diff --git a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
index 1105bd3..d38c4b2 100644
--- a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
+++ b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc

@@ -127,7 +127,7 @@
 
 std::unique_ptr<AutocompleteProviderClient>
 ChromeOmniboxClient::CreateAutocompleteProviderClient() {
-  return base::WrapUnique(new ChromeAutocompleteProviderClient(profile_));
+  return base::MakeUnique<ChromeAutocompleteProviderClient>(profile_);
 }
 
 std::unique_ptr<OmniboxNavigationObserver>
@@ -135,8 +135,8 @@
     const base::string16& text,
     const AutocompleteMatch& match,
     const AutocompleteMatch& alternate_nav_match) {
-  return base::WrapUnique(new ChromeOmniboxNavigationObserver(
-      profile_, text, match, alternate_nav_match));
+  return base::MakeUnique<ChromeOmniboxNavigationObserver>(
+      profile_, text, match, alternate_nav_match);
 }
 
 bool ChromeOmniboxClient::CurrentPageExists() const {

diff --git a/chrome/browser/ui/omnibox/omnibox_controller_unittest.cc b/chrome/browser/ui/omnibox/omnibox_controller_unittest.cc
index d0c31dec..c46bbb4 100644
--- a/chrome/browser/ui/omnibox/omnibox_controller_unittest.cc
+++ b/chrome/browser/ui/omnibox/omnibox_controller_unittest.cc

@@ -29,7 +29,7 @@
   // OmniboxClient:
   std::unique_ptr<AutocompleteProviderClient> CreateAutocompleteProviderClient()
       override {
-    return base::WrapUnique(new ChromeAutocompleteProviderClient(profile_));
+    return base::MakeUnique<ChromeAutocompleteProviderClient>(profile_);
   }
   std::unique_ptr<OmniboxNavigationObserver> CreateOmniboxNavigationObserver(
       const base::string16& text,

diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model_unittest.cc b/chrome/browser/ui/passwords/manage_passwords_bubble_model_unittest.cc
index c8280de..692c8fa 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model_unittest.cc
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model_unittest.cc

@@ -84,7 +84,7 @@
 
 std::unique_ptr<KeyedService> TestingSyncFactoryFunction(
     content::BrowserContext* context) {
-  return base::WrapUnique(new TestSyncService(static_cast<Profile*>(context)));
+  return base::MakeUnique<TestSyncService>(static_cast<Profile*>(context));
 }
 
 }  // namespace

diff --git a/chrome/browser/ui/passwords/password_dialog_controller_impl_unittest.cc b/chrome/browser/ui/passwords/password_dialog_controller_impl_unittest.cc
index c112fedb4..874ac93 100644
--- a/chrome/browser/ui/passwords/password_dialog_controller_impl_unittest.cc
+++ b/chrome/browser/ui/passwords/password_dialog_controller_impl_unittest.cc

@@ -88,11 +88,11 @@
   local_form2.username_value = base::ASCIIToUTF16(kUsername2);
   autofill::PasswordForm idp_form = GetFederationProviderForm();
   std::vector<std::unique_ptr<autofill::PasswordForm>> locals;
-  locals.push_back(base::WrapUnique(new autofill::PasswordForm(local_form)));
-  locals.push_back(base::WrapUnique(new autofill::PasswordForm(local_form2)));
+  locals.push_back(base::MakeUnique<autofill::PasswordForm>(local_form));
+  locals.push_back(base::MakeUnique<autofill::PasswordForm>(local_form2));
   autofill::PasswordForm* local_form_ptr = locals[0].get();
   std::vector<std::unique_ptr<autofill::PasswordForm>> federations;
-  federations.push_back(base::WrapUnique(new autofill::PasswordForm(idp_form)));
+  federations.push_back(base::MakeUnique<autofill::PasswordForm>(idp_form));
 
   EXPECT_CALL(prompt, ShowAccountChooser());
   controller().ShowAccountChooser(&prompt,
@@ -126,7 +126,7 @@
   StrictMock<MockPasswordPrompt> prompt;
   autofill::PasswordForm local_form = GetLocalForm();
   std::vector<std::unique_ptr<autofill::PasswordForm>> locals;
-  locals.push_back(base::WrapUnique(new autofill::PasswordForm(local_form)));
+  locals.push_back(base::MakeUnique<autofill::PasswordForm>(local_form));
   std::vector<std::unique_ptr<autofill::PasswordForm>> federations;
 
   EXPECT_CALL(prompt, ShowAccountChooser());
@@ -156,8 +156,7 @@
   base::HistogramTester histogram_tester;
   StrictMock<MockPasswordPrompt> prompt;
   std::vector<std::unique_ptr<autofill::PasswordForm>> locals;
-  locals.push_back(
-      base::WrapUnique(new autofill::PasswordForm(GetLocalForm())));
+  locals.push_back(base::MakeUnique<autofill::PasswordForm>(GetLocalForm()));
   EXPECT_CALL(prompt, ShowAccountChooser());
   controller().ShowAccountChooser(&prompt, std::move(locals),
                                   PasswordDialogController::FormsVector());

diff --git a/chrome/browser/ui/passwords/password_manager_presenter.cc b/chrome/browser/ui/passwords/password_manager_presenter.cc
index d9ace948..d271456e 100644
--- a/chrome/browser/ui/passwords/password_manager_presenter.cc
+++ b/chrome/browser/ui/passwords/password_manager_presenter.cc

@@ -248,7 +248,7 @@
   std::vector<std::unique_ptr<autofill::PasswordForm>> ret_val;
 
   for (const auto& form : password_list_) {
-    ret_val.push_back(base::WrapUnique(new autofill::PasswordForm(*form)));
+    ret_val.push_back(base::MakeUnique<autofill::PasswordForm>(*form));
   }
 
   return ret_val;

diff --git a/chrome/browser/ui/startup/default_browser_infobar_delegate_unittest.cc b/chrome/browser/ui/startup/default_browser_infobar_delegate_unittest.cc
index 1a356c6d..ce745007 100644
--- a/chrome/browser/ui/startup/default_browser_infobar_delegate_unittest.cc
+++ b/chrome/browser/ui/startup/default_browser_infobar_delegate_unittest.cc

@@ -79,7 +79,7 @@
 
   void AddDefaultBrowserInfoBar() {
     infobar_service_->AddInfoBar(infobar_service_->CreateConfirmInfoBar(
-        base::WrapUnique(new FakeDefaultBrowserInfoBarDelegate())));
+        base::MakeUnique<FakeDefaultBrowserInfoBarDelegate>()));
   }
 
   InfoBarService* infobar_service() { return infobar_service_; }

diff --git a/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc b/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc
index 6733814..5f7a0b7d 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc

@@ -1182,7 +1182,7 @@
   policy_map_.Set(policy::key::kMetricsReportingEnabled,
                   policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
                   policy::POLICY_SOURCE_CLOUD,
-                  base::WrapUnique(new base::FundamentalValue(false)), nullptr);
+                  base::MakeUnique<base::FundamentalValue>(false), nullptr);
   provider_.UpdateChromePolicy(policy_map_);
 #endif  // defined(OS_LINUX) && defined(GOOGLE_CHROME_BUILD)
 

diff --git a/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc b/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc
index 6c59a7c..081f573 100644
--- a/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc
+++ b/chrome/browser/ui/sync/one_click_signin_sync_starter_unittest.cc

@@ -97,11 +97,11 @@
   static std::unique_ptr<KeyedService> BuildSigninManager(
       content::BrowserContext* context) {
     Profile* profile = static_cast<Profile*>(context);
-    return base::WrapUnique(new FakeSigninManager(
+    return base::MakeUnique<FakeSigninManager>(
         ChromeSigninClientFactory::GetForProfile(profile),
         ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
         AccountTrackerServiceFactory::GetForProfile(profile),
-        GaiaCookieManagerServiceFactory::GetForProfile(profile)));
+        GaiaCookieManagerServiceFactory::GetForProfile(profile));
   }
 
   DISALLOW_COPY_AND_ASSIGN(OneClickSigninSyncStarterTest);

diff --git a/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc b/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc
index 31c44e8..7ba1521 100644
--- a/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc
+++ b/chrome/browser/ui/tabs/pinned_tab_service_unittest.cc

@@ -24,7 +24,7 @@
 
 std::unique_ptr<KeyedService> BuildPinnedTabService(
     content::BrowserContext* profile) {
-  return base::WrapUnique(new PinnedTabService(static_cast<Profile*>(profile)));
+  return base::MakeUnique<PinnedTabService>(static_cast<Profile*>(profile));
 }
 
 PinnedTabService* BuildForProfile(Profile* profile) {

diff --git a/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model_unittest.cc b/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model_unittest.cc
index 7c2f2751..e4b4581 100644
--- a/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model_unittest.cc
+++ b/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model_unittest.cc

@@ -150,10 +150,10 @@
 
   static std::unique_ptr<KeyedService> GetTabRestoreService(
       content::BrowserContext* browser_context) {
-    return base::WrapUnique(new sessions::PersistentTabRestoreService(
+    return base::MakeUnique<sessions::PersistentTabRestoreService>(
         base::WrapUnique(new ChromeTabRestoreServiceClient(
             Profile::FromBrowserContext(browser_context))),
-        nullptr));
+        nullptr);
   }
 
   sync_driver::OpenTabsUIDelegate* GetOpenTabsDelegate() {

diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
index 7cd6c1b..93d769c 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc

@@ -242,9 +242,9 @@
   }
 
   std::unique_ptr<views::InkDropRipple> CreateInkDropRipple() const override {
-    return base::WrapUnique(new views::FloodFillInkDropRipple(
+    return base::MakeUnique<views::FloodFillInkDropRipple>(
         CalculateInkDropBounds(size()), GetInkDropCenterBasedOnLastEvent(),
-        GetInkDropBaseColor(), ink_drop_visible_opacity()));
+        GetInkDropBaseColor(), ink_drop_visible_opacity());
   }
 
   std::unique_ptr<views::InkDropHighlight> CreateInkDropHighlight()
@@ -253,9 +253,9 @@
       return nullptr;
 
     const gfx::Rect bounds = CalculateInkDropBounds(size());
-    return base::WrapUnique(new views::InkDropHighlight(
+    return base::MakeUnique<views::InkDropHighlight>(
         bounds.size(), 0, gfx::RectF(bounds).CenterPoint(),
-        GetInkDropBaseColor()));
+        GetInkDropBaseColor());
   }
 
   SkColor GetInkDropBaseColor() const override {
@@ -343,9 +343,9 @@
   }
 
   std::unique_ptr<views::InkDropRipple> CreateInkDropRipple() const override {
-    return base::WrapUnique(new views::FloodFillInkDropRipple(
+    return base::MakeUnique<views::FloodFillInkDropRipple>(
         CalculateInkDropBounds(size()), GetInkDropCenterBasedOnLastEvent(),
-        GetInkDropBaseColor(), ink_drop_visible_opacity()));
+        GetInkDropBaseColor(), ink_drop_visible_opacity());
   }
 
   std::unique_ptr<views::InkDropHighlight> CreateInkDropHighlight()
@@ -354,9 +354,9 @@
       return nullptr;
 
     const gfx::Rect bounds = CalculateInkDropBounds(size());
-    return base::WrapUnique(new views::InkDropHighlight(
+    return base::MakeUnique<views::InkDropHighlight>(
         bounds.size(), 0, gfx::RectF(bounds).CenterPoint(),
-        GetInkDropBaseColor()));
+        GetInkDropBaseColor());
   }
 
   SkColor GetInkDropBaseColor() const override {

diff --git a/chrome/browser/ui/views/certificate_selector_browsertest.cc b/chrome/browser/ui/views/certificate_selector_browsertest.cc
index 5147c3bd..e5e72c7 100644
--- a/chrome/browser/ui/views/certificate_selector_browsertest.cc
+++ b/chrome/browser/ui/views/certificate_selector_browsertest.cc

@@ -36,8 +36,8 @@
   }
 
   void Init() {
-    InitWithText(base::WrapUnique(
-        new views::Label(base::ASCIIToUTF16("some arbitrary text"))));
+    InitWithText(base::MakeUnique<views::Label>(
+        base::ASCIIToUTF16("some arbitrary text")));
   }
 
   bool Accept() override {

diff --git a/chrome/browser/ui/views/download/download_item_view_md.cc b/chrome/browser/ui/views/download/download_item_view_md.cc
index 732c7f8..87200361 100644
--- a/chrome/browser/ui/views/download/download_item_view_md.cc
+++ b/chrome/browser/ui/views/download/download_item_view_md.cc

@@ -493,10 +493,10 @@
 
 std::unique_ptr<views::InkDropRipple> DownloadItemViewMd::CreateInkDropRipple()
     const {
-  return base::WrapUnique(new views::FloodFillInkDropRipple(
+  return base::MakeUnique<views::FloodFillInkDropRipple>(
       GetLocalBounds(), GetInkDropCenterBasedOnLastEvent(),
       color_utils::DeriveDefaultIconColor(GetTextColor()),
-      ink_drop_visible_opacity()));
+      ink_drop_visible_opacity());
 }
 
 std::unique_ptr<views::InkDropHighlight>
@@ -505,10 +505,10 @@
     return nullptr;
 
   gfx::Size size = GetPreferredSize();
-  return base::WrapUnique(new views::InkDropHighlight(
+  return base::MakeUnique<views::InkDropHighlight>(
       size, kInkDropSmallCornerRadius,
       gfx::RectF(gfx::SizeF(size)).CenterPoint(),
-      color_utils::DeriveDefaultIconColor(GetTextColor())));
+      color_utils::DeriveDefaultIconColor(GetTextColor()));
 }
 
 void DownloadItemViewMd::OnGestureEvent(ui::GestureEvent* event) {
@@ -802,8 +802,8 @@
   if (!GetThemeProvider())
     return;
 
-  SetBorder(base::WrapUnique(new SeparatorBorder(GetThemeProvider()->GetColor(
-      ThemeProperties::COLOR_TOOLBAR_VERTICAL_SEPARATOR))));
+  SetBorder(base::MakeUnique<SeparatorBorder>(GetThemeProvider()->GetColor(
+      ThemeProperties::COLOR_TOOLBAR_VERTICAL_SEPARATOR)));
 
   SkColor text_color = GetTextColor();
   if (dangerous_download_label_)

diff --git a/chrome/browser/ui/views/dropdown_bar_view.cc b/chrome/browser/ui/views/dropdown_bar_view.cc
index 2d5bb20f..c63254a 100644
--- a/chrome/browser/ui/views/dropdown_bar_view.cc
+++ b/chrome/browser/ui/views/dropdown_bar_view.cc

@@ -104,6 +104,6 @@
   int border_image_ids[3] = {left_border_image_id, middle_border_image_id,
       right_border_image_id};
   SetBorder(views::Border::CreateBorderPainter(
-      base::WrapUnique(new views::HorizontalPainter(border_image_ids)),
+      base::MakeUnique<views::HorizontalPainter>(border_image_ids),
       gfx::Insets()));
 }

diff --git a/chrome/browser/ui/views/find_bar_view.cc b/chrome/browser/ui/views/find_bar_view.cc
index af64e73..8c9fad33 100644
--- a/chrome/browser/ui/views/find_bar_view.cc
+++ b/chrome/browser/ui/views/find_bar_view.cc

@@ -547,13 +547,13 @@
 
 void FindBarView::InitViewsForMaterial() {
   // The background color is not used since there's no arrow.
-  SetBorder(base::WrapUnique(new views::BubbleBorder(
+  SetBorder(base::MakeUnique<views::BubbleBorder>(
       views::BubbleBorder::NONE, views::BubbleBorder::SMALL_SHADOW,
-      SK_ColorGREEN)));
+      SK_ColorGREEN));
 
   match_count_text_ = new MatchCountLabel();
   match_count_text_->SetEventTargeter(
-      base::WrapUnique(new views::ViewTargeter(this)));
+      base::MakeUnique<views::ViewTargeter>(this));
   AddChildViewAt(match_count_text_, 1);
 
   separator_ = new views::Separator(views::Separator::VERTICAL);

diff --git a/chrome/browser/ui/views/frame/test_with_browser_view.cc b/chrome/browser/ui/views/frame/test_with_browser_view.cc
index 251b991..967ffc2 100644
--- a/chrome/browser/ui/views/frame/test_with_browser_view.cc
+++ b/chrome/browser/ui/views/frame/test_with_browser_view.cc

@@ -37,7 +37,7 @@
 std::unique_ptr<KeyedService> CreateTemplateURLService(
     content::BrowserContext* context) {
   Profile* profile = static_cast<Profile*>(context);
-  return base::WrapUnique(new TemplateURLService(
+  return base::MakeUnique<TemplateURLService>(
       profile->GetPrefs(),
       std::unique_ptr<SearchTermsData>(new UIThreadSearchTermsData(profile)),
       WebDataServiceFactory::GetKeywordWebDataForProfile(
@@ -46,19 +46,19 @@
           new ChromeTemplateURLServiceClient(
               HistoryServiceFactory::GetForProfile(
                   profile, ServiceAccessType::EXPLICIT_ACCESS))),
-      nullptr, nullptr, base::Closure()));
+      nullptr, nullptr, base::Closure());
 }
 
 std::unique_ptr<KeyedService> CreateAutocompleteClassifier(
     content::BrowserContext* context) {
   Profile* profile = static_cast<Profile*>(context);
-  return base::WrapUnique(new AutocompleteClassifier(
+  return base::MakeUnique<AutocompleteClassifier>(
       base::WrapUnique(new AutocompleteController(
           base::WrapUnique(new ChromeAutocompleteProviderClient(profile)),
 
           nullptr, AutocompleteClassifier::kDefaultOmniboxProviders)),
       std::unique_ptr<AutocompleteSchemeClassifier>(
-          new TestSchemeClassifier())));
+          new TestSchemeClassifier()));
 }
 
 }  // namespace

diff --git a/chrome/browser/ui/views/infobars/alternate_nav_infobar_view.cc b/chrome/browser/ui/views/infobars/alternate_nav_infobar_view.cc
index 764ead46..2b5bcc59 100644
--- a/chrome/browser/ui/views/infobars/alternate_nav_infobar_view.cc
+++ b/chrome/browser/ui/views/infobars/alternate_nav_infobar_view.cc

@@ -22,7 +22,7 @@
 // static
 std::unique_ptr<infobars::InfoBar> AlternateNavInfoBarDelegate::CreateInfoBar(
     std::unique_ptr<AlternateNavInfoBarDelegate> delegate) {
-  return base::WrapUnique(new AlternateNavInfoBarView(std::move(delegate)));
+  return base::MakeUnique<AlternateNavInfoBarView>(std::move(delegate));
 }
 
 

diff --git a/chrome/browser/ui/views/infobars/confirm_infobar.cc b/chrome/browser/ui/views/infobars/confirm_infobar.cc
index 1322140..a606868 100644
--- a/chrome/browser/ui/views/infobars/confirm_infobar.cc
+++ b/chrome/browser/ui/views/infobars/confirm_infobar.cc

@@ -22,7 +22,7 @@
 
 std::unique_ptr<infobars::InfoBar> InfoBarService::CreateConfirmInfoBar(
     std::unique_ptr<ConfirmInfoBarDelegate> delegate) {
-  return base::WrapUnique(new ConfirmInfoBar(std::move(delegate)));
+  return base::MakeUnique<ConfirmInfoBar>(std::move(delegate));
 }
 
 

diff --git a/chrome/browser/ui/views/infobars/infobar_view.cc b/chrome/browser/ui/views/infobars/infobar_view.cc
index 3a0467a..da8b2196 100644
--- a/chrome/browser/ui/views/infobars/infobar_view.cc
+++ b/chrome/browser/ui/views/infobars/infobar_view.cc

@@ -87,7 +87,7 @@
   set_owned_by_client();  // InfoBar deletes itself at the appropriate time.
   set_background(
       new InfoBarBackground(infobars::InfoBar::delegate()->GetInfoBarType()));
-  SetEventTargeter(base::WrapUnique(new views::ViewTargeter(this)));
+  SetEventTargeter(base::MakeUnique<views::ViewTargeter>(this));
 
   AddChildView(child_container_);
 

diff --git a/chrome/browser/ui/views/location_bar/content_setting_image_view.cc b/chrome/browser/ui/views/location_bar/content_setting_image_view.cc
index 5022cfd..f155616 100644
--- a/chrome/browser/ui/views/location_bar/content_setting_image_view.cc
+++ b/chrome/browser/ui/views/location_bar/content_setting_image_view.cc

@@ -28,9 +28,8 @@
 
 
 // static
-const int ContentSettingImageView::kOpenTimeMS = 150;
 const int ContentSettingImageView::kAnimationDurationMS =
-    (kOpenTimeMS * 2) + kStayOpenTimeMS;
+    (IconLabelBubbleView::kOpenTimeMS * 2) + kStayOpenTimeMS;
 
 ContentSettingImageView::ContentSettingImageView(
     ContentSettingImageModel* image_model,

diff --git a/chrome/browser/ui/views/location_bar/content_setting_image_view.h b/chrome/browser/ui/views/location_bar/content_setting_image_view.h
index c3dae045..d0ef127 100644
--- a/chrome/browser/ui/views/location_bar/content_setting_image_view.h
+++ b/chrome/browser/ui/views/location_bar/content_setting_image_view.h

@@ -52,10 +52,6 @@
   void Update(content::WebContents* web_contents);
 
  private:
-  // Number of milliseconds spent animating open; also the time spent animating
-  // closed.
-  static const int kOpenTimeMS;
-
   // The total animation time, including open and close as well as an
   // intervening "stay open" period.
   static const int kAnimationDurationMS;

diff --git a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h
index 7676039c..35faf5d 100644
--- a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h
+++ b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.h

@@ -54,6 +54,8 @@
   views::ImageView* GetImageView() { return image_; }
 
  protected:
+  static constexpr int kOpenTimeMS = 150;
+
   views::ImageView* image() { return image_; }
   views::Label* label() { return label_; }
   const views::Label* label() const { return label_; }

diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.cc b/chrome/browser/ui/views/location_bar/location_bar_view.cc
index e181c52..979ddac9 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.cc
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.cc

@@ -326,10 +326,10 @@
     case DEEMPHASIZED_TEXT:
       return color_utils::AlphaBlend(GetColor(TEXT), GetColor(BACKGROUND), 128);
 
-    case EV_BUBBLE_TEXT_AND_BORDER:
+    case SECURITY_CHIP_TEXT:
       return ui::MaterialDesignController::IsModeMaterial()
                  ? GetSecureTextColor(
-                       security_state::SecurityStateModel::EV_SECURE)
+                       GetToolbarModel()->GetSecurityLevel(false))
                  : SkColorSetRGB(7, 149, 0);
   }
   NOTREACHED();
@@ -358,7 +358,7 @@
                security_state::SecurityStateModel::SECURITY_ERROR) {
       text_color = SkColorSetRGB(162, 0, 0);
     } else {
-      text_color = GetColor(EV_BUBBLE_TEXT_AND_BORDER);
+      text_color = GetColor(SECURITY_CHIP_TEXT);
     }
   }
   return color_utils::GetReadableColor(text_color, GetColor(BACKGROUND));
@@ -532,11 +532,11 @@
   int leading_width = edge_thickness;
   if (ShouldShowKeywordBubble()) {
     // The selected keyword view can collapse completely.
-  } else if (ShouldShowEVBubble()) {
-    leading_width += GetLayoutConstant(LOCATION_BAR_BUBBLE_HORIZONTAL_PADDING) +
-                     location_icon_view_->GetMinimumSizeForLabelText(
-                                            GetToolbarModel()->GetEVCertName())
-                         .width();
+  } else if (ShouldShowSecurityChip()) {
+    base::string16 security_text = GetSecurityText();
+    leading_width +=
+        GetLayoutConstant(LOCATION_BAR_BUBBLE_HORIZONTAL_PADDING) +
+        location_icon_view_->GetMinimumSizeForLabelText(security_text).width();
   } else {
     leading_width += padding + location_icon_view_->GetMinimumSize().width();
   }
@@ -612,8 +612,8 @@
         selected_keyword_view_->set_is_extension_icon(false);
       }
     }
-  } else if (ShouldShowEVBubble()) {
-    location_icon_view_->SetLabel(GetToolbarModel()->GetEVCertName());
+  } else if (ShouldShowSecurityChip()) {
+    location_icon_view_->SetLabel(GetSecurityText());
     location_icon_view_->SetBackground(true);
     // The largest fraction of the omnibox that can be taken by the EV bubble.
     const double kMaxBubbleFraction = 0.5;
@@ -790,7 +790,7 @@
   RefreshTranslateIcon();
   RefreshSaveCreditCardIconView();
   RefreshManagePasswordsIconView();
-  content::WebContents* web_contents_for_sub_views =
+  WebContents* web_contents_for_sub_views =
       GetToolbarModel()->input_in_progress() ? nullptr : GetWebContents();
   open_pdf_in_reader_view_->Update(web_contents_for_sub_views);
 
@@ -802,6 +802,9 @@
   else
     omnibox_view_->Update();
 
+  bool should_show = ShouldShowSecurityChip();
+  location_icon_view_->SetSecurityState(should_show, should_show && !contents);
+
   OnChanged();  // NOTE: Calls Layout().
 }
 
@@ -1038,6 +1041,11 @@
       !suggested_text_view_->size().IsEmpty();
 }
 
+base::string16 LocationBarView::GetSecurityText() const {
+  return ShouldShowEVBubble() ? GetToolbarModel()->GetEVCertName()
+                              : GetToolbarModel()->GetSecureVerboseText();
+}
+
 bool LocationBarView::ShouldShowKeywordBubble() const {
   return !omnibox_view_->model()->keyword().empty() &&
       !omnibox_view_->model()->is_keyword_hint();
@@ -1048,6 +1056,13 @@
           security_state::SecurityStateModel::EV_SECURE);
 }
 
+bool LocationBarView::ShouldShowSecurityChip() const {
+  using SecurityLevel = security_state::SecurityStateModel::SecurityLevel;
+  SecurityLevel level = GetToolbarModel()->GetSecurityLevel(false);
+  return level == SecurityLevel::SECURE || level == SecurityLevel::EV_SECURE ||
+         level == SecurityLevel::SECURITY_ERROR;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // LocationBarView, private LocationBar implementation:
 

diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.h b/chrome/browser/ui/views/location_bar/location_bar_view.h
index dea93ce..992a372 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.h
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.h

@@ -109,7 +109,7 @@
     TEXT,
     SELECTED_TEXT,
     DEEMPHASIZED_TEXT,
-    EV_BUBBLE_TEXT_AND_BORDER,
+    SECURITY_CHIP_TEXT,
   };
 
   // The location bar view's class name.
@@ -318,9 +318,17 @@
   // Returns true if the suggest text is valid.
   bool HasValidSuggestText() const;
 
+  // Returns text describing the URL's security level, to be placed in the
+  // security chip.
+  base::string16 GetSecurityText() const;
+
   bool ShouldShowKeywordBubble() const;
   bool ShouldShowEVBubble() const;
 
+  // Returns true when the current page is explicitly secure or insecure.
+  // In these cases, we should show the state of the security chip.
+  bool ShouldShowSecurityChip() const;
+
   // Used to "reverse" the URL showing/hiding animations, since we use separate
   // animations whose curves are not true inverses of each other.  Based on the
   // current position of the omnibox, calculates what value the desired

diff --git a/chrome/browser/ui/views/location_bar/location_icon_view.cc b/chrome/browser/ui/views/location_bar/location_icon_view.cc
index 19505a7..8ed384c 100644
--- a/chrome/browser/ui/views/location_bar/location_icon_view.cc
+++ b/chrome/browser/ui/views/location_bar/location_icon_view.cc

@@ -22,7 +22,6 @@
 #include "ui/views/controls/label.h"
 #include "ui/views/painter.h"
 
-using content::NavigationController;
 using content::NavigationEntry;
 using content::WebContents;
 
@@ -34,7 +33,8 @@
                           parent_background_color,
                           true),
       suppress_mouse_released_action_(false),
-      location_bar_(location_bar) {
+      location_bar_(location_bar),
+      animation_(this) {
   set_id(VIEW_ID_LOCATION_ICON);
 
 #if defined(OS_MACOSX)
@@ -44,6 +44,7 @@
 #endif
 
   SetBackground(false);
+  animation_.SetSlideDuration(kOpenTimeMS);
 }
 
 LocationIconView::~LocationIconView() {
@@ -104,7 +105,7 @@
 }
 
 SkColor LocationIconView::GetTextColor() const {
-  return location_bar_->GetColor(LocationBarView::EV_BUBBLE_TEXT_AND_BORDER);
+  return location_bar_->GetColor(LocationBarView::SECURITY_CHIP_TEXT);
 }
 
 SkColor LocationIconView::GetBorderColor() const {
@@ -146,6 +147,25 @@
     UnsetBackgroundImageGrid();
 }
 
+void LocationIconView::SetSecurityState(bool should_show, bool should_animate) {
+  if (!should_animate) {
+    animation_.Reset(should_show);
+  } else if (should_show) {
+    animation_.Show();
+  } else {
+    animation_.Hide();
+  }
+}
+
+double LocationIconView::WidthMultiplier() const {
+  return animation_.GetCurrentValue();
+}
+
+void LocationIconView::AnimationProgressed(const gfx::Animation*) {
+  location_bar_->Layout();
+  location_bar_->SchedulePaint();
+}
+
 void LocationIconView::ProcessLocatedEvent(const ui::LocatedEvent& event) {
   if (HitTestPoint(event.location()))
     OnActivate(event);

diff --git a/chrome/browser/ui/views/location_bar/location_icon_view.h b/chrome/browser/ui/views/location_bar/location_icon_view.h
index f056a1c4..62d9310 100644
--- a/chrome/browser/ui/views/location_bar/location_icon_view.h
+++ b/chrome/browser/ui/views/location_bar/location_icon_view.h

@@ -7,6 +7,8 @@
 
 #include "base/macros.h"
 #include "chrome/browser/ui/views/location_bar/icon_label_bubble_view.h"
+#include "ui/gfx/animation/animation_delegate.h"
+#include "ui/gfx/animation/slide_animation.h"
 
 class LocationBarView;
 
@@ -18,7 +20,8 @@
 // Use a LocationIconView to display an icon on the leading side of the edit
 // field. It shows the user's current action (while the user is editing), or the
 // page security status (after navigation has completed).
-class LocationIconView : public IconLabelBubbleView {
+class LocationIconView : public IconLabelBubbleView,
+                         public gfx::AnimationDelegate {
  public:
   LocationIconView(const gfx::FontList& font_list,
                    SkColor parent_background_color,
@@ -49,7 +52,18 @@
   // HTTPS contexts.
   void SetBackground(bool should_show_ev);
 
+  // Sets whether the verbose security state text should be visible.
+  // |should_animate| controls whether any necessary transition to this state
+  // should be animated.
+  void SetSecurityState(bool should_show, bool should_animate);
+
  private:
+  // IconLabelBubbleView:
+  double WidthMultiplier() const override;
+
+  // gfx::AnimationDelegate:
+  void AnimationProgressed(const gfx::Animation*) override;
+
   void ProcessLocatedEvent(const ui::LocatedEvent& event);
 
   // Returns what the minimum size would be if the preferred size were |size|.
@@ -68,6 +82,7 @@
   bool show_tooltip_;
 
   LocationBarView* location_bar_;
+  gfx::SlideAnimation animation_;
 
   DISALLOW_COPY_AND_ASSIGN(LocationIconView);
 };

diff --git a/chrome/browser/ui/views/sync/one_click_signin_dialog_view_unittest.cc b/chrome/browser/ui/views/sync/one_click_signin_dialog_view_unittest.cc
index 693c7b3..28a5c37 100644
--- a/chrome/browser/ui/views/sync/one_click_signin_dialog_view_unittest.cc
+++ b/chrome/browser/ui/views/sync/one_click_signin_dialog_view_unittest.cc

@@ -50,7 +50,7 @@
   OneClickSigninDialogView* ShowOneClickSigninDialog() {
     OneClickSigninDialogView::ShowDialog(
         base::string16(),
-        base::WrapUnique(new TestOneClickSigninLinksDelegate(this)),
+        base::MakeUnique<TestOneClickSigninLinksDelegate>(this),
         anchor_widget_->GetNativeWindow(),
         base::Bind(&OneClickSigninDialogViewTest::OnStartSync,
                    base::Unretained(this)));

diff --git a/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc b/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
index e88e6b2..0449d75 100644
--- a/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc
+++ b/chrome/browser/ui/views/website_settings/chooser_bubble_ui_view.cc

@@ -28,8 +28,8 @@
 #include "ui/views/window/dialog_client_view.h"
 
 std::unique_ptr<BubbleUi> ChooserBubbleDelegate::BuildBubbleUi() {
-  return base::WrapUnique(
-      new ChooserBubbleUiView(browser_, std::move(chooser_controller_)));
+  return base::MakeUnique<ChooserBubbleUiView>(browser_,
+                                               std::move(chooser_controller_));
 }
 
 ///////////////////////////////////////////////////////////////////////////////

diff --git a/chrome/browser/ui/webui/chromeos/login/base_screen_handler.cc b/chrome/browser/ui/webui/chromeos/login/base_screen_handler.cc
index 3ee58aa..db6ab4e 100644
--- a/chrome/browser/ui/webui/chromeos/login/base_screen_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/base_screen_handler.cc

@@ -43,7 +43,7 @@
 }
 
 void BaseScreenHandler::GetLocalizedStrings(base::DictionaryValue* dict) {
-  auto builder = base::WrapUnique(new ::login::LocalizedValuesBuilder(dict));
+  auto builder = base::MakeUnique<::login::LocalizedValuesBuilder>(dict);
   DeclareLocalizedValues(builder.get());
   GetAdditionalParameters(dict);
 }

diff --git a/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc b/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc
index faffffd..063fa2a0 100644
--- a/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc

@@ -6,6 +6,7 @@
 
 #include "ash/common/system/chromeos/devicetype_utils.h"
 #include "base/bind.h"
+#include "base/callback.h"
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ -162,7 +163,7 @@
   if (browser_shutdown::IsTryingToQuit())
     return;
 
-  io_thread->ClearHostCache();
+  io_thread->ClearHostCache(base::Callback<bool(const std::string&)>());
 }
 
 void PushFrontIMIfNotExists(const std::string& input_method,

diff --git a/chrome/browser/ui/webui/media_router/media_router_ui_unittest.cc b/chrome/browser/ui/webui/media_router/media_router_ui_unittest.cc
index 5352c09f..1434703 100644
--- a/chrome/browser/ui/webui/media_router/media_router_ui_unittest.cc
+++ b/chrome/browser/ui/webui/media_router/media_router_ui_unittest.cc

@@ -402,7 +402,7 @@
   std::string id = "extensionid";
   GURL url = GURL("chrome-extension://" + id);
   std::unique_ptr<extensions::ExtensionRegistry> registry =
-      base::WrapUnique(new extensions::ExtensionRegistry(nullptr));
+      base::MakeUnique<extensions::ExtensionRegistry>(nullptr);
   scoped_refptr<extensions::Extension> app =
       extensions::test_util::BuildApp(extensions::ExtensionBuilder())
           .MergeManifest(extensions::DictionaryBuilder()
@@ -420,7 +420,7 @@
   std::string id = "extensionid";
   GURL url = GURL("chrome-extension://" + id);
   std::unique_ptr<extensions::ExtensionRegistry> registry =
-      base::WrapUnique(new extensions::ExtensionRegistry(nullptr));
+      base::MakeUnique<extensions::ExtensionRegistry>(nullptr);
 
   EXPECT_EQ("", MediaRouterUI::GetExtensionName(url, registry.get()));
 }
@@ -428,7 +428,7 @@
 TEST_F(MediaRouterUITest, GetExtensionNameEmptyWhenNotExtensionURL) {
   GURL url = GURL("https://www.google.com");
   std::unique_ptr<extensions::ExtensionRegistry> registry =
-      base::WrapUnique(new extensions::ExtensionRegistry(nullptr));
+      base::MakeUnique<extensions::ExtensionRegistry>(nullptr);
 
   EXPECT_EQ("", MediaRouterUI::GetExtensionName(url, registry.get()));
 }

diff --git a/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc b/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc
index 28eadd6..41f35c9 100644
--- a/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc
+++ b/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc

@@ -211,6 +211,6 @@
 
 void OmniboxPageHandler::ResetController() {
   controller_.reset(new AutocompleteController(
-      base::WrapUnique(new ChromeAutocompleteProviderClient(profile_)), this,
+      base::MakeUnique<ChromeAutocompleteProviderClient>(profile_), this,
       AutocompleteClassifier::kDefaultOmniboxProviders));
 }

diff --git a/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc b/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc
index 8870f1c..c9e1308 100644
--- a/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc
+++ b/chrome/browser/ui/webui/options/certificate_manager_browsertest.cc

@@ -49,10 +49,10 @@
     const std::string& user_policy_blob =
         chromeos::onc::test_utils::ReadTestData(filename);
     policy::PolicyMap policy;
-    policy.Set(
-        policy::key::kOpenNetworkConfiguration, policy::POLICY_LEVEL_MANDATORY,
-        policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-        base::WrapUnique(new base::StringValue(user_policy_blob)), nullptr);
+    policy.Set(policy::key::kOpenNetworkConfiguration,
+               policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+               policy::POLICY_SOURCE_CLOUD,
+               base::MakeUnique<base::StringValue>(user_policy_blob), nullptr);
     provider_.UpdateChromePolicy(policy);
     content::RunAllPendingInMessageLoop();
   }

diff --git a/chrome/browser/ui/webui/options/home_page_overlay_handler.cc b/chrome/browser/ui/webui/options/home_page_overlay_handler.cc
index cecd5be..586373c7 100644
--- a/chrome/browser/ui/webui/options/home_page_overlay_handler.cc
+++ b/chrome/browser/ui/webui/options/home_page_overlay_handler.cc

@@ -38,7 +38,7 @@
 void HomePageOverlayHandler::InitializeHandler() {
   Profile* profile = Profile::FromWebUI(web_ui());
   autocomplete_controller_.reset(new AutocompleteController(
-      base::WrapUnique(new ChromeAutocompleteProviderClient(profile)), this,
+      base::MakeUnique<ChromeAutocompleteProviderClient>(profile), this,
       AutocompleteClassifier::kDefaultOmniboxProviders));
 }
 

diff --git a/chrome/browser/ui/webui/options/preferences_browsertest.cc b/chrome/browser/ui/webui/options/preferences_browsertest.cc
index 6be16344..17a7753 100644
--- a/chrome/browser/ui/webui/options/preferences_browsertest.cc
+++ b/chrome/browser/ui/webui/options/preferences_browsertest.cc

@@ -883,7 +883,7 @@
     policy::PolicyMap map;
     map.Set(policy_name, policy::POLICY_LEVEL_MANDATORY, scope,
             policy::POLICY_SOURCE_CLOUD,
-            base::WrapUnique(new base::StringValue(onc_policy)), nullptr);
+            base::MakeUnique<base::StringValue>(onc_policy), nullptr);
     policy_provider_.UpdateChromePolicy(map);
 
     content::RunAllPendingInMessageLoop();

diff --git a/chrome/browser/ui/webui/options/startup_pages_handler.cc b/chrome/browser/ui/webui/options/startup_pages_handler.cc
index d19fa21f..067123f 100644
--- a/chrome/browser/ui/webui/options/startup_pages_handler.cc
+++ b/chrome/browser/ui/webui/options/startup_pages_handler.cc

@@ -110,7 +110,7 @@
                  base::Unretained(this)));
 
   autocomplete_controller_.reset(new AutocompleteController(
-      base::WrapUnique(new ChromeAutocompleteProviderClient(profile)), this,
+      base::MakeUnique<ChromeAutocompleteProviderClient>(profile), this,
       AutocompleteClassifier::kDefaultOmniboxProviders));
 }
 

diff --git a/chrome/browser/ui/webui/policy_ui_browsertest.cc b/chrome/browser/ui/webui/policy_ui_browsertest.cc
index 60b84149..5487dfb 100644
--- a/chrome/browser/ui/webui/policy_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/policy_ui_browsertest.cc

@@ -224,22 +224,21 @@
   expected_values[policy::key::kRestoreOnStartupURLs] = "aaa,bbb,ccc";
   values.Set(policy::key::kHomepageLocation, policy::POLICY_LEVEL_MANDATORY,
              policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD,
-             base::WrapUnique(new base::StringValue("http://google.com")),
-             nullptr);
+             base::MakeUnique<base::StringValue>("http://google.com"), nullptr);
   expected_values[policy::key::kHomepageLocation] = "http://google.com";
   values.Set(policy::key::kRestoreOnStartup, policy::POLICY_LEVEL_RECOMMENDED,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD,
-             base::WrapUnique(new base::FundamentalValue(4)), nullptr);
+             base::MakeUnique<base::FundamentalValue>(4), nullptr);
   expected_values[policy::key::kRestoreOnStartup] = "4";
   values.Set(policy::key::kShowHomeButton, policy::POLICY_LEVEL_RECOMMENDED,
              policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD,
-             base::WrapUnique(new base::FundamentalValue(true)), nullptr);
+             base::MakeUnique<base::FundamentalValue>(true), nullptr);
   expected_values[policy::key::kShowHomeButton] = "true";
   // Set the value of a policy that does not exist.
   const std::string kUnknownPolicy = "NoSuchThing";
   values.Set(kUnknownPolicy, policy::POLICY_LEVEL_MANDATORY,
              policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_PLATFORM,
-             base::WrapUnique(new base::FundamentalValue(true)), nullptr);
+             base::MakeUnique<base::FundamentalValue>(true), nullptr);
   expected_values[kUnknownPolicy] = "true";
   UpdateProviderPolicy(values);
 

diff --git a/chrome/browser/ui/webui/policy_ui_handler.cc b/chrome/browser/ui/webui/policy_ui_handler.cc
index 1b2b0c1..ec282bab 100644
--- a/chrome/browser/ui/webui/policy_ui_handler.cc
+++ b/chrome/browser/ui/webui/policy_ui_handler.cc

@@ -174,7 +174,7 @@
   base::JSONWriter::WriteWithOptions(dict,
                                      base::JSONWriter::OPTIONS_PRETTY_PRINT,
                                      &json_string);
-  return base::WrapUnique(new base::StringValue(json_string));
+  return base::MakeUnique<base::StringValue>(json_string);
 }
 
 // Returns a copy of |value| with some values converted to a representation that

diff --git a/chrome/browser/ui/webui/print_preview/extension_printer_handler_unittest.cc b/chrome/browser/ui/webui/print_preview/extension_printer_handler_unittest.cc
index 8e7776d..9a97248d 100644
--- a/chrome/browser/ui/webui/print_preview/extension_printer_handler_unittest.cc
+++ b/chrome/browser/ui/webui/print_preview/extension_printer_handler_unittest.cc

@@ -449,7 +449,7 @@
 
 std::unique_ptr<KeyedService> BuildTestingPrinterProviderAPI(
     content::BrowserContext* context) {
-  return base::WrapUnique(new FakePrinterProviderAPI());
+  return base::MakeUnique<FakePrinterProviderAPI>();
 }
 
 }  // namespace

diff --git a/chrome/browser/ui/webui/settings/certificates_handler.cc b/chrome/browser/ui/webui/settings/certificates_handler.cc
index 4df5f74..ba7d12ce 100644
--- a/chrome/browser/ui/webui/settings/certificates_handler.cc
+++ b/chrome/browser/ui/webui/settings/certificates_handler.cc

@@ -1037,7 +1037,7 @@
 
   {
     std::unique_ptr<base::ListValue> nodes =
-        base::WrapUnique(new base::ListValue());
+        base::MakeUnique<base::ListValue>();
     for (CertificateManagerModel::OrgGroupingMap::iterator i = map.begin();
          i != map.end(); ++i) {
       // Populate first level (org name).
@@ -1124,7 +1124,7 @@
         IDS_SETTINGS_CERTIFICATE_MANAGER_IMPORT_SOME_NOT_IMPORTED);
 
   std::unique_ptr<base::ListValue> cert_error_list =
-      base::WrapUnique(new base::ListValue());
+      base::MakeUnique<base::ListValue>();
   for (size_t i = 0; i < not_imported.size(); ++i) {
     const net::NSSCertDatabase::ImportCertFailure& failure = not_imported[i];
     std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);

diff --git a/chrome/browser/ui/webui/settings/chromeos/easy_unlock_settings_handler_unittest.cc b/chrome/browser/ui/webui/settings/chromeos/easy_unlock_settings_handler_unittest.cc
index 0a013ace..e954336 100644
--- a/chrome/browser/ui/webui/settings/chromeos/easy_unlock_settings_handler_unittest.cc
+++ b/chrome/browser/ui/webui/settings/chromeos/easy_unlock_settings_handler_unittest.cc

@@ -96,8 +96,8 @@
 
 std::unique_ptr<KeyedService> CreateEasyUnlockServiceForTest(
     content::BrowserContext* context) {
-  return base::WrapUnique(
-      new FakeEasyUnlockService(Profile::FromBrowserContext(context)));
+  return base::MakeUnique<FakeEasyUnlockService>(
+      Profile::FromBrowserContext(context));
 }
 
 }  // namespace

diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 0a5fddd..cb88aed 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

@@ -1256,7 +1256,7 @@
       {"siteSettingsNotifications", IDS_SETTINGS_SITE_SETTINGS_NOTIFICATIONS},
       {"siteSettingsImages", IDS_SETTINGS_SITE_SETTINGS_IMAGES},
       {"siteSettingsJavascript", IDS_SETTINGS_SITE_SETTINGS_JAVASCRIPT},
-      {"siteSettingsPlugins", IDS_SETTINGS_SITE_SETTINGS_PLUGINS},
+      {"siteSettingsFlash", IDS_SETTINGS_SITE_SETTINGS_FLASH},
       {"siteSettingsPopups", IDS_SETTINGS_SITE_SETTINGS_POPUPS},
       {"siteSettingsUnsandboxedPlugins",
        IDS_SETTINGS_SITE_SETTINGS_UNSANDBOXED_PLUGINS},

diff --git a/chrome/browser/ui/webui/settings/metrics_reporting_handler_unittest.cc b/chrome/browser/ui/webui/settings/metrics_reporting_handler_unittest.cc
index 381a1934..7d129887 100644
--- a/chrome/browser/ui/webui/settings/metrics_reporting_handler_unittest.cc
+++ b/chrome/browser/ui/webui/settings/metrics_reporting_handler_unittest.cc

@@ -51,7 +51,7 @@
     EXPECT_TRUE(test_web_ui()->call_data().empty());
 
     base::ListValue args;
-    args.Append(base::WrapUnique(new base::FundamentalValue(1)));
+    args.Append(base::MakeUnique<base::FundamentalValue>(1));
     handler()->HandleGetMetricsReporting(&args);
 
     EXPECT_TRUE(handler()->IsJavascriptAllowed());
@@ -105,11 +105,9 @@
 TEST_F(MetricsReportingHandlerTest, PolicyChangesNotifyPage) {
   // Change the policy, check that the page was notified.
   map()->Set(policy::key::kMetricsReportingEnabled,
-             policy::POLICY_LEVEL_MANDATORY,
-             policy::POLICY_SCOPE_USER,
+             policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
              policy::POLICY_SOURCE_CLOUD,
-             base::WrapUnique(new base::FundamentalValue(true)),
-             nullptr);
+             base::MakeUnique<base::FundamentalValue>(true), nullptr);
   provider()->UpdateChromePolicy(*map());
   EXPECT_EQ(1u, test_web_ui()->call_data().size());
 
@@ -118,11 +116,9 @@
 
   // Policies changing while JavaScript is disabled shouldn't notify the page.
   map()->Set(policy::key::kMetricsReportingEnabled,
-             policy::POLICY_LEVEL_MANDATORY,
-             policy::POLICY_SCOPE_USER,
+             policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
              policy::POLICY_SOURCE_CLOUD,
-             base::WrapUnique(new base::FundamentalValue(false)),
-             nullptr);
+             base::MakeUnique<base::FundamentalValue>(false), nullptr);
   provider()->UpdateChromePolicy(*map());
   EXPECT_TRUE(test_web_ui()->call_data().empty());
 }

diff --git a/chrome/browser/ui/webui/settings/search_engines_handler.cc b/chrome/browser/ui/webui/settings/search_engines_handler.cc
index 9e7e3e3..467007d 100644
--- a/chrome/browser/ui/webui/settings/search_engines_handler.cc
+++ b/chrome/browser/ui/webui/settings/search_engines_handler.cc

@@ -101,7 +101,7 @@
 
   // Build the first list (default search engines).
   std::unique_ptr<base::ListValue> defaults =
-      base::WrapUnique(new base::ListValue());
+      base::MakeUnique<base::ListValue>();
   int last_default_engine_index =
       list_controller_.table_model()->last_search_engine_index();
   for (int i = 0; i < last_default_engine_index; ++i) {
@@ -110,8 +110,7 @@
   }
 
   // Build the second list (other search engines).
-  std::unique_ptr<base::ListValue> others =
-      base::WrapUnique(new base::ListValue());
+  std::unique_ptr<base::ListValue> others = base::MakeUnique<base::ListValue>();
   int last_other_engine_index =
       list_controller_.table_model()->last_other_engine_index();
   for (int i = std::max(last_default_engine_index, 0);
@@ -121,7 +120,7 @@
 
   // Build the third list (omnibox extensions).
   std::unique_ptr<base::ListValue> extensions =
-      base::WrapUnique(new base::ListValue());
+      base::MakeUnique<base::ListValue>();
   int engine_count = list_controller_.table_model()->RowCount();
   for (int i = std::max(last_other_engine_index, 0); i < engine_count; ++i) {
     extensions->Append(CreateDictionaryForEngine(i, i == default_index));

diff --git a/chrome/browser/ui/webui/sync_internals_message_handler.cc b/chrome/browser/ui/webui/sync_internals_message_handler.cc
index 4b71bd9..58f7c63e 100644
--- a/chrome/browser/ui/webui/sync_internals_message_handler.cc
+++ b/chrome/browser/ui/webui/sync_internals_message_handler.cc

@@ -43,7 +43,7 @@
 
 SyncInternalsMessageHandler::SyncInternalsMessageHandler()
     : SyncInternalsMessageHandler(
-          base::WrapUnique(new UtilAboutSyncDataExtractor())) {}
+          base::MakeUnique<UtilAboutSyncDataExtractor>()) {}
 
 SyncInternalsMessageHandler::SyncInternalsMessageHandler(
     std::unique_ptr<AboutSyncDataExtractor> about_sync_data_extractor)

diff --git a/chrome/installer/mac/app/AppDelegate.mm b/chrome/installer/mac/app/AppDelegate.mm
index 1f6e4e99..688ca3fd 100644
--- a/chrome/installer/mac/app/AppDelegate.mm
+++ b/chrome/installer/mac/app/AppDelegate.mm

@@ -39,7 +39,9 @@
 
 // Sets up the main window and begins the downloading process.
 - (void)applicationDidFinishLaunching:(NSNotification*)aNotification {
-  // TODO: fix UI not loading until after asking for authorization.
+  // TODO: Despite what the code implies -- when the installer is run, the main
+  // window of the application is not visible until the user has taken action on
+  // the Authorization modal.
   window_.delegate = self;
   installerWindowController_ =
       [[InstallerWindowController alloc] initWithWindow:window_];
@@ -63,7 +65,9 @@
 // applicationShouldTerminateAfterLastWindowClosed: to make sure that the
 // application does correctly terminate after closing the installer, but does
 // not terminate when we call orderOut: to hide the installer during its
-// tear-down steps.
+// tear-down steps. If the user force-quits the application, the below delegate
+// method gets called. However, when orderOut is called, the below delegate
+// method does not get called.
 - (BOOL)windowShouldClose:(id)sender {
   [self exit];
   return YES;
@@ -84,7 +88,7 @@
 
 - (void)onLoadInstallationToolFailure {
   NSError* loadToolError = [NSError
-       errorForAlerts:@"Could not load installion tool"
+       errorForAlerts:@"Internal Error"
       withDescription:
           @"Your Chrome Installer may be corrupted. Download and try again."
         isRecoverable:NO];
@@ -135,14 +139,15 @@
 - (void)unpacker:(Unpacker*)unpacker onMountSuccess:(NSString*)tempAppPath {
   SecStaticCodeRef diskStaticCode;
   SecRequirementRef diskRequirement;
-  // TODO: flush out error handling more
+  // TODO: Include some better error handling below than NSLog
   OSStatus oserror;
   oserror = SecStaticCodeCreateWithPath(
       (__bridge CFURLRef)[NSURL fileURLWithPath:tempAppPath isDirectory:NO],
       kSecCSDefaultFlags, &diskStaticCode);
   if (oserror != errSecSuccess)
     NSLog(@"code %d", oserror);
-  // TODO: add in a more specific code sign requirement
+  // TODO: The below requirement is too general as most signed entities have the
+  // below requirement; replace it with something adequately specific.
   oserror =
       SecRequirementCreateWithString((CFStringRef) @"anchor apple generic",
                                      kSecCSDefaultFlags, &diskRequirement);
@@ -171,6 +176,11 @@
   if ([installerWindowController_ isDefaultBrowserChecked])
     [installerSettings
         addObject:[NSString
+                      // NOTE: the |kMakeDefaultBrowser| constant used as a
+                      // command-line switch here only will apply at a user
+                      // level, since the application itself is not running with
+                      // privileges. grt@ suggested this constant should be
+                      // renamed |kMakeDefaultBrowserforUser|.
                       stringWithUTF8String:switches::kMakeDefaultBrowser]];
 
   NSError* error = nil;
@@ -186,7 +196,7 @@
     NSLog(@"Chrome failed to launch: %@", error);
   }
 
-  // Begin teardown stuff!
+  // Begin teardown step!
   dispatch_async(dispatch_get_main_queue(), ^{
     [window_ orderOut:nil];
   });
@@ -196,7 +206,7 @@
 
 - (void)unpacker:(Unpacker*)unpacker onMountFailure:(NSError*)error {
   NSError* extractError =
-      [NSError errorForAlerts:@"Install Failure"
+      [NSError errorForAlerts:@"Install Error"
               withDescription:@"Unable to add Google Chrome to Applications."
                 isRecoverable:NO];
   [self displayError:extractError];
@@ -209,9 +219,9 @@
 
 - (void)unpacker:(Unpacker*)unpacker onUnmountFailure:(NSError*)error {
   NSLog(@"error unmounting");
-  // NOTE: since we are not deleting the temporary folder if the unmount fails,
+  // NOTE: Since we are not deleting the temporary folder if the unmount fails,
   // we'll just leave it up to the computer to delete the temporary folder on
-  // its own time, and to unmount the disk during a restart at some point. There
+  // its own time and to unmount the disk during a restart at some point. There
   // is no other work to be done in the mean time.
   [self exit];
 }

diff --git a/chrome/installer/mac/app/AuthorizedInstall.h b/chrome/installer/mac/app/AuthorizedInstall.h
index 8ee0efaf..3f547e24 100644
--- a/chrome/installer/mac/app/AuthorizedInstall.h
+++ b/chrome/installer/mac/app/AuthorizedInstall.h

@@ -10,7 +10,8 @@
 
 @interface AuthorizedInstall : NSObject
 
-// Attempts to gain elevated permissions and starts a subprocess.
+// Attempts to gain elevated permissions, then starts the subprocess with the
+// appropriate level of privilege.
 - (BOOL)loadInstallationTool;
 
 // Signals the tool to begin the installation. Returns the path to the

diff --git a/chrome/installer/mac/app/AuthorizedInstall.m b/chrome/installer/mac/app/AuthorizedInstall.m
index 07dde8a3..67929bed 100644
--- a/chrome/installer/mac/app/AuthorizedInstall.m
+++ b/chrome/installer/mac/app/AuthorizedInstall.m

@@ -11,7 +11,7 @@
 @end
 
 @implementation AuthorizedInstall
-// Does the setup needed to authorize a tool to run as admin.
+// Does the setup needed to authorize a subprocess to run as root.
 - (OSStatus)setUpAuthorization:(AuthorizationRef*)authRef {
   OSStatus status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment,
                                         kAuthorizationFlagDefaults, authRef);
@@ -82,10 +82,6 @@
   }
 }
 
-// Attempts to gain authorization to run installation tool with elevated
-// permissions.
-// Then starts the tool with the appropiate paths for the tools elevation
-// status.
 - (BOOL)loadInstallationTool {
   AuthorizationRef authRef = NULL;
   OSStatus status = [self setUpAuthorization:&authRef];
@@ -117,11 +113,6 @@
   return true;
 }
 
-- (NSString*)startInstall:(NSString*)appBundlePath {
-  [self sendMessageToTool:appBundlePath];
-  return destinationAppBundlePath_;
-}
-
 // Sends a message to the tool's stdin. The tool is using 'read' to wait for
 // input. 'read' adds to its buffer until it receives a newline to continue so
 // append '\n' to the message to end the read.
@@ -130,4 +121,9 @@
                dataUsingEncoding:NSUTF8StringEncoding]];
 }
 
+- (NSString*)startInstall:(NSString*)appBundlePath {
+  [self sendMessageToTool:appBundlePath];
+  return destinationAppBundlePath_;
+}
+
 @end

diff --git a/chrome/installer/mac/app/Downloader.m b/chrome/installer/mac/app/Downloader.m
index ce8482a4..5473f06b 100644
--- a/chrome/installer/mac/app/Downloader.m
+++ b/chrome/installer/mac/app/Downloader.m

@@ -33,7 +33,6 @@
   [delegate_ downloader:self percentProgress:downloadProgressPercentage];
 }
 
-// Delegate method to move downloaded disk image to user's Download directory.
 - (void)URLSession:(NSURLSession*)session
                  downloadTask:(NSURLSessionDownloadTask*)downloadTask
     didFinishDownloadingToURL:(NSURL*)location {

diff --git a/chrome/installer/mac/app/InstallerWindowController.m b/chrome/installer/mac/app/InstallerWindowController.m
index ebd2f47..b5c2c2ab 100644
--- a/chrome/installer/mac/app/InstallerWindowController.m
+++ b/chrome/installer/mac/app/InstallerWindowController.m

@@ -19,24 +19,13 @@
 
 @implementation InstallerWindowController
 
-// Most buttons have the same style and differ only by their title, this method
-// simplifies styling the buttons and provides an argument for the title.
+// Simplify styling and naming buttons.
 - (void)stylizeButton:(NSButton*)button withTitle:(NSString*)title {
   button.buttonType = NSSwitchButton;
   button.bezelStyle = NSRoundedBezelStyle;
   button.title = title;
 }
 
-// Similar to stylizeButton except works with NSTextField objects instead.
-- (void)stylizeTextField:(NSTextField*)textField
-         withDescription:(NSString*)description {
-  textField.backgroundColor = NSColor.clearColor;
-  textField.textColor = NSColor.blackColor;
-  textField.stringValue = description;
-  textField.bezeled = NO;
-  textField.editable = NO;
-}
-
 // Positions and stylizes buttons.
 - (void)setUpButtons {
   importButton_ = [[NSButton alloc] initWithFrame:NSMakeRect(30, 20, 300, 25)];
@@ -60,6 +49,16 @@
   [launchButton_ setAction:@selector(launchButtonClicked)];
 }
 
+// Simplfy styling NSTextField objects.
+- (void)stylizeTextField:(NSTextField*)textField
+         withDescription:(NSString*)description {
+  textField.backgroundColor = NSColor.clearColor;
+  textField.textColor = NSColor.blackColor;
+  textField.stringValue = description;
+  textField.bezeled = NO;
+  textField.editable = NO;
+}
+
 // Positions and stylizes textfields.
 - (void)setUpTextfields {
   statusDescription_ =
@@ -84,9 +83,9 @@
   progressBar_.doubleValue = 0.0;
 }
 
-// Positions and adds the rest of the UI elements to main window. Prevents
-// resizing the window so that the absolute position will look the same on all
-// computers. Window is hidden until all positioning is finished.
+// Positions the main window and adds the rest of the UI elements to it.
+// Prevents resizing the window so that the absolute position will look the same
+// on all computers. Window is hidden until all positioning is finished.
 - (id)initWithWindow:(NSWindow*)window {
   if (self = [super initWithWindow:window]) {
     [window setFrame:NSMakeRect(0, 0, 430, 220) display:YES];
@@ -111,11 +110,10 @@
 }
 
 - (void)updateStatusDescription:(NSString*)text {
-  // First setStringValue statement is required to clear the original string.
-  // Omitting the first line will cause occasional ghosting of the previous
-  // string.
-  // TODO: Find a real solution to the ghosting problem.
-  //  downloadProgressDescription_.stringValue = @"";
+  // TODO: This method somehow causes ghosting of the previous string's contents
+  // after a redraw. The below line of code is a temporary hack to clear the
+  // ghosting behavior, but it should be replaced with a legitimate bug fix.
+  downloadProgressDescription_.stringValue = @"";
   downloadProgressDescription_.stringValue = text;
 }
 
@@ -123,6 +121,9 @@
   if (progressPercent > 0.0) {
     progressBar_.doubleValue = progressPercent;
   } else {
+    // After the progress bar is made indeterminate, it will not need to track
+    // determinate progress any more. Therefore, there is nothing implemented to
+    // set indeterminate to NO.
     progressBar_.doubleValue = 0.0;
     progressBar_.indeterminate = YES;
     [progressBar_ startAnimation:nil];

diff --git a/chrome/installer/mac/app/NSError+ChromeInstallerAdditions.h b/chrome/installer/mac/app/NSError+ChromeInstallerAdditions.h
index 1cdc08c3..5c98df9 100644
--- a/chrome/installer/mac/app/NSError+ChromeInstallerAdditions.h
+++ b/chrome/installer/mac/app/NSError+ChromeInstallerAdditions.h

@@ -8,8 +8,8 @@
 #import <Foundation/Foundation.h>
 
 @interface NSError (ChromeInstallerAdditions)
-// Creates a custom error object to be used as the popup alert that the user
-// will be shown.
+// Creates a custom error object to be used to create an alert to be shown to
+// the user.
 + (NSError*)errorForAlerts:(NSString*)message
            withDescription:(NSString*)description
              isRecoverable:(BOOL)recoverable;

diff --git a/chrome/installer/mac/app/OmahaCommunication.h b/chrome/installer/mac/app/OmahaCommunication.h
index 40e5da8..98e8a59 100644
--- a/chrome/installer/mac/app/OmahaCommunication.h
+++ b/chrome/installer/mac/app/OmahaCommunication.h

@@ -23,8 +23,7 @@
 - (id)init;
 - (id)initWithBody:(NSXMLDocument*)xmlBody;
 
-// Asks the Omaha servers for the most updated version of Chrome by sending a
-// request using this function.
+// Asks the Omaha servers for the most updated version of Chrome.
 - (void)fetchDownloadURLs;
 
 @end

diff --git a/chrome/installer/mac/app/OmahaCommunication.m b/chrome/installer/mac/app/OmahaCommunication.m
index 55d23d4..30e3459e 100644
--- a/chrome/installer/mac/app/OmahaCommunication.m
+++ b/chrome/installer/mac/app/OmahaCommunication.m

@@ -7,7 +7,7 @@
 #import "OmahaXMLRequest.h"
 #import "OmahaXMLParser.h"
 
-// TODO: turn this string to a command-line flag
+// TODO: Turn the below string into a command line flag for testing.
 static NSString* const omahaURLPath =
     @"https://tools.google.com/service/update2";
 

diff --git a/chrome/installer/mac/app/OmahaXMLParser.h b/chrome/installer/mac/app/OmahaXMLParser.h
index 8cad7d9c..d3fd806 100644
--- a/chrome/installer/mac/app/OmahaXMLParser.h
+++ b/chrome/installer/mac/app/OmahaXMLParser.h

@@ -9,9 +9,9 @@
 
 @interface OmahaXMLParser : NSObject
 
-// Parses an XML document and extracts the URLs and name of the Chrome DMG from
-// Omaha, then returns an array with all the URLs concatenated with the
-// filename.
+// Parses the XML body from Omaha's HTTP response and extracts the URLs and name
+// of the Chrome disk image. Then, returns an array with all the URLs
+// concatenated with the filename.
 + (NSArray*)parseXML:(NSData*)omahaResponseXML error:(NSError**)error;
 
 @end

diff --git a/chrome/installer/mac/app/OmahaXMLParser.m b/chrome/installer/mac/app/OmahaXMLParser.m
index fa901b2e..2493b8d 100644
--- a/chrome/installer/mac/app/OmahaXMLParser.m
+++ b/chrome/installer/mac/app/OmahaXMLParser.m

@@ -32,9 +32,10 @@
   }
 
   if ([completeDownloadURLs count] < 1) {
-    // TODO: currently whatever error is passed in doesn't matter... we should
-    // make it so that the type of error informs what the installer will do
-    // about the error
+    // TODO: The below error exists only so the caller of this method would
+    // catch the error created here. A better way to handle this is to make the
+    // error's contents inform what the installer will try next when it attempts
+    // to recover from an issue.
     *error = [NSError errorWithDomain:@"ChromeErrorDomain" code:1 userInfo:nil];
     return nil;
   }
@@ -42,10 +43,9 @@
   return completeDownloadURLs;
 }
 
-// Method implementation for XMLParserDelegate.
 // Searches the XML data for the tag "URL" and the subsequent "codebase"
 // attribute that indicates a URL follows. Copies each URL into an array.
-// Note that the URLs in the XML file are incomplete. They need the filename
+// NOTE: The URLs in the XML file are incomplete. They need the filename
 // appended to end. The second if statement checks for the tag "package" which
 // contains the filename needed to complete the URLs.
 - (void)parser:(NSXMLParser*)parser

diff --git a/chrome/installer/mac/app/OmahaXMLRequest.m b/chrome/installer/mac/app/OmahaXMLRequest.m
index b98dfe4..52a9bfc 100644
--- a/chrome/installer/mac/app/OmahaXMLRequest.m
+++ b/chrome/installer/mac/app/OmahaXMLRequest.m

@@ -23,7 +23,8 @@
 // user attributes that Omaha actually looks at. The other parameters are useful
 // for logging purposes but otherwise not directly used.
 + (NSXMLDocument*)createXMLRequestBody {
-  // TODO: not hard-code protocol version #?
+  // TODO: This protocol version number probably shouldn't be hard-coded. Check
+  // with borisv@ regarding changing protocol verions.
   NSString* protocol = @"3.0";
 
   NSString* platform = @"mac";

diff --git a/chrome/installer/mac/app/README.md b/chrome/installer/mac/app/README.md
index 9ebf022..1a1f7f9 100644
--- a/chrome/installer/mac/app/README.md
+++ b/chrome/installer/mac/app/README.md

@@ -21,7 +21,9 @@
 Each of the above modules are designed to carry one action before returning via
 delegate method. All of these main steps occur on a primary working thread
 (non-UI), with the exception of `AuthorizedInstall`, which makes use of an
-authorized-if-able subprocess.
+authorized-if-able subprocess. If the user does not provide permission to
+escalate privileges, `AuthorizedInstall` still does its job, but opts for the
+User's Applications folder instead of the system Applications folder.
 
 The OmahaXML* classes and SystemInfo class are simply classes to help
 OmahaCommunication do its work.

diff --git a/chrome/installer/mac/app/SystemInfo.h b/chrome/installer/mac/app/SystemInfo.h
index 4ac9b97..3deeaa0 100644
--- a/chrome/installer/mac/app/SystemInfo.h
+++ b/chrome/installer/mac/app/SystemInfo.h

@@ -13,7 +13,7 @@
 
 @interface SystemInfo : NSObject
 // Gets the CPU architecture type of the client's system, which will be used
-// when crafting the query to Omaha. This will return either "x84_64h" for
+// when crafting the query to Omaha. This should return either "x84_64h" for
 // systems running on Intel Haswell chips, "i486" for other Intel machines, or
 // strings representing other CPU types ("amd", "pentium", and "i686", for
 // example, are all possible; however, due to the above macro, the possible

diff --git a/chrome/installer/mac/app/SystemInfo.m b/chrome/installer/mac/app/SystemInfo.m
index 66e3cf8..364fe79 100644
--- a/chrome/installer/mac/app/SystemInfo.m
+++ b/chrome/installer/mac/app/SystemInfo.m

@@ -9,6 +9,8 @@
 @implementation SystemInfo
 
 + (NSString*)getArch {
+  // NOTE: It seems the below function `NSGetLocalArchInfo` returns an
+  // arch->name that is either "x84_64h" or "i486".
   const NXArchInfo* arch = NXGetLocalArchInfo();
   NSString* archName = [NSString stringWithUTF8String:arch->name];
   return archName;

diff --git a/chrome/installer/mac/app/Unpacker.m b/chrome/installer/mac/app/Unpacker.m
index f3b9072..5d16bff 100644
--- a/chrome/installer/mac/app/Unpacker.m
+++ b/chrome/installer/mac/app/Unpacker.m

@@ -49,15 +49,16 @@
 - (void)cleanUp {
   [mountTask_ terminate];
   // It's not the end of the world if this temporary directory is not removed
-  // here. It will be deleted when the operating system itself decides to
-  // anyway.
+  // here. The directory will be deleted when the operating system itself
+  // decides to anyway.
   [[NSFileManager defaultManager] removeItemAtURL:temporaryDirectoryURL_
                                             error:nil];
   [[NSNotificationCenter defaultCenter] removeObserver:self];
 }
 
-// TODO: the failure delegate methods need to be revised to be more meaningfully
-// deal with the errors (pipe in stderr / stdout)
+// TODO: The failure delegate methods need to be revised to meaningfully deal
+// with the errors (pipe in stderr / stdout to handle the error according to
+// what the error was).
 - (void)mountDMGFromURL:(NSURL*)fileURL {
   NSError* error = nil;
   temporaryDirectoryURL_ = [[NSFileManager defaultManager]

diff --git a/chrome/installer/mac/app/copy_to_disk.sh b/chrome/installer/mac/app/copy_to_disk.sh
index 89c881c..b56aa0c 100755
--- a/chrome/installer/mac/app/copy_to_disk.sh
+++ b/chrome/installer/mac/app/copy_to_disk.sh

@@ -12,9 +12,9 @@
 # used on the first line to prevent bash from setting the effective user ID to
 # the real user ID (dropping root privileges).
 
-# The 'e' flag causes the script to terminate if it comes across an error while
-# running. The 'u' flag will raise an error if a variable isn't set.
-# 'u pipefail' will set the return exit code to the last non-zero  error code.
+# 'e': terminate if error arises
+# 'u': raise an error if a variable isn't set
+# 'o pipefail': set the return exit code to the last non-zero error code
 set -euo pipefail
 
 # Waits for the main app to pass the path to the app bundle inside the mounted
@@ -26,9 +26,11 @@
 FULL_DEST="${DEST}"/"${APPBUNDLENAME}"
 
 # Starts the copy
-# The 'l' flag tells rsync to copy symlinks as symlinks. 'r' is for recursive,
-# so copy all files, 'p' is to preserve permisisons. 't' is to preserve times.
-# 'q' is for quiet mode so rynsc will only log to console if an error occurs.
+# 'l': copy symlinks as symlinks
+# 'r': recursive copy
+# 'p': preserve permissions
+# 't': preserve times
+# 'q': quiet mode, so rynsc will only log to console if an error occurs
 rsync -lrptq "${SRC}" "${DEST}"
 
 # If this script is run as root, change ownership to root and set elevated

diff --git a/chrome/installer/mac/app/testing/Unpacker_test.mm b/chrome/installer/mac/app/testing/Unpacker_test.mm
index 3f6d632..b447623c 100644
--- a/chrome/installer/mac/app/testing/Unpacker_test.mm
+++ b/chrome/installer/mac/app/testing/Unpacker_test.mm

@@ -74,12 +74,12 @@
 namespace {
 
 TEST(UnpackerTest, IntegrationTest) {
-  // create objects and semaphore
+  // Create objects and semaphore
   Unpacker* unpack = [[Unpacker alloc] init];
   TestDelegate* test_delegate = [[TestDelegate alloc] init];
   unpack.delegate = test_delegate;
 
-  // get a disk image to use to test
+  // Get a disk image to use to test
   base::FilePath originalPath;
   PathService::Get(base::DIR_SOURCE_ROOT, &originalPath);
   originalPath = originalPath.AppendASCII("chrome/test/data/mac_installer/");
@@ -88,22 +88,25 @@
       (originalPath.AppendASCII("test-dmg.dmg")).value());
   NSString* diskImageCopiedPath = base::SysUTF8ToNSString(
       (originalPath.AppendASCII("test-dmg2.dmg")).value());
+  // The unpacker moves (not copies) a downloaded disk image directly into its
+  // own temporary directory, so if the below copy didn't happen, `test-dmg.dmg`
+  // would disappear every time this test was run
   [[NSFileManager defaultManager] copyItemAtPath:diskImageOriginalPath
                                           toPath:diskImageCopiedPath
                                            error:nil];
   NSURL* dmgURL = [NSURL fileURLWithPath:diskImageCopiedPath isDirectory:NO];
-  // start mount step
+  // Start mount step
   [unpack mountDMGFromURL:dmgURL];
   [test_delegate wait];
 
-  // is the disk image mounted?
+  // Is the disk image mounted?
   ASSERT_TRUE([test_delegate pass]);
 
-  // start unmount step
+  // Start unmount step
   [unpack unmountDMG];
   [test_delegate wait];
 
-  // is the disk image gone?
+  // Is the disk image gone?
   EXPECT_TRUE([test_delegate pass]);
 }
 

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index dcadd5c..0a1bbcb4 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -2489,6 +2489,7 @@
       "//mash/session:manifest",
       "//mash/task_viewer:manifest",
       "//services/ui:manifest",
+      "//services/ui/ime/test_ime_driver:manifest",
     ]
     packaged_services = [
       "app_driver",
@@ -2496,6 +2497,7 @@
       "mash_session",
       "quick_launch",
       "task_viewer",
+      "test_ime_driver",
       "touch_hud",
       "ui",
     ]

diff --git a/chrome/test/data/webui/settings/cr_settings_browsertest.js b/chrome/test/data/webui/settings/cr_settings_browsertest.js
index cc5ab56..2f5ea0c 100644
--- a/chrome/test/data/webui/settings/cr_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_browsertest.js

@@ -442,7 +442,8 @@
   ]),
 };
 
-TEST_F('CrSettingsPrivacyPageTest', 'PrivacyPage', function() {
+// TODO(crbug.com/642574) Disabled because test is flaky.
+TEST_F('CrSettingsPrivacyPageTest', 'DISABLED_PrivacyPage', function() {
   settings_privacy_page.registerTests();
   mocha.run();
 });

diff --git a/chromeos/chromeos.gyp b/chromeos/chromeos.gyp
index 207e2162..2c5f5bd 100644
--- a/chromeos/chromeos.gyp
+++ b/chromeos/chromeos.gyp

@@ -120,8 +120,6 @@
       'dbus/fake_gsm_sms_client.h',
       'dbus/fake_image_burner_client.cc',
       'dbus/fake_image_burner_client.h',
-      'dbus/fake_introspectable_client.cc',
-      'dbus/fake_introspectable_client.h',
       'dbus/fake_lorgnette_manager_client.cc',
       'dbus/fake_lorgnette_manager_client.h',
       'dbus/fake_modem_messaging_client.cc',
@@ -150,8 +148,6 @@
       'dbus/gsm_sms_client.h',
       'dbus/image_burner_client.cc',
       'dbus/image_burner_client.h',
-      'dbus/introspectable_client.cc',
-      'dbus/introspectable_client.h',
       'dbus/lorgnette_manager_client.cc',
       'dbus/lorgnette_manager_client.h',
       'dbus/modem_messaging_client.cc',
@@ -412,7 +408,6 @@
       'dbus/fake_easy_unlock_client_unittest.cc',
       'dbus/fake_power_manager_client_unittest.cc',
       'dbus/gsm_sms_client_unittest.cc',
-      'dbus/introspectable_client_unittest.cc',
       'dbus/modem_messaging_client_unittest.cc',
       'dbus/power_policy_controller_unittest.cc',
       'dbus/services/cros_dbus_service_unittest.cc',

diff --git a/chromeos/dbus/README.md b/chromeos/dbus/README.md
index 394bc30..c1b72f6 100644
--- a/chromeos/dbus/README.md
+++ b/chromeos/dbus/README.md

@@ -5,6 +5,7 @@
 
   * Amplifier (amplifier_client.cc)
   * Audio DSP (audio_dsp_client.cc)
+  * Introspection (introspectable_client.cc)
   * NFC (nfc_manager_client.cc)
   * peerd (peer_daemon_manager_client.cc)
   * privetd (privet_daemon_manager_client.cc)

diff --git a/chromeos/dbus/dbus_client_bundle.cc b/chromeos/dbus/dbus_client_bundle.cc
index 4b7514a..a9bc4a09 100644
--- a/chromeos/dbus/dbus_client_bundle.cc
+++ b/chromeos/dbus/dbus_client_bundle.cc

@@ -25,7 +25,6 @@
 #include "chromeos/dbus/fake_easy_unlock_client.h"
 #include "chromeos/dbus/fake_gsm_sms_client.h"
 #include "chromeos/dbus/fake_image_burner_client.h"
-#include "chromeos/dbus/fake_introspectable_client.h"
 #include "chromeos/dbus/fake_lorgnette_manager_client.h"
 #include "chromeos/dbus/fake_modem_messaging_client.h"
 #include "chromeos/dbus/fake_permission_broker_client.h"
@@ -39,7 +38,6 @@
 #include "chromeos/dbus/fake_system_clock_client.h"
 #include "chromeos/dbus/gsm_sms_client.h"
 #include "chromeos/dbus/image_burner_client.h"
-#include "chromeos/dbus/introspectable_client.h"
 #include "chromeos/dbus/lorgnette_manager_client.h"
 #include "chromeos/dbus/modem_messaging_client.h"
 #include "chromeos/dbus/permission_broker_client.h"
@@ -75,7 +73,6 @@
     { "shill",  DBusClientBundle::SHILL },
     { "gsm_sms",  DBusClientBundle::GSM_SMS },
     { "image_burner",  DBusClientBundle::IMAGE_BURNER },
-    { "introspectable",  DBusClientBundle::INTROSPECTABLE },
     { "modem_messaging",  DBusClientBundle::MODEM_MESSAGING },
     { "permission_broker",  DBusClientBundle::PERMISSION_BROKER },
     { "power_manager",  DBusClientBundle::POWER_MANAGER },
@@ -168,11 +165,6 @@
   else
     image_burner_client_.reset(new FakeImageBurnerClient);
 
-  if (!IsUsingStub(INTROSPECTABLE))
-    introspectable_client_.reset(IntrospectableClient::Create());
-  else
-    introspectable_client_.reset(new FakeIntrospectableClient);
-
   if (!IsUsingStub(MODEM_MESSAGING))
     modem_messaging_client_.reset(ModemMessagingClient::Create());
   else

diff --git a/chromeos/dbus/dbus_client_bundle.h b/chromeos/dbus/dbus_client_bundle.h
index 64ee28d7..176e3ac 100644
--- a/chromeos/dbus/dbus_client_bundle.h
+++ b/chromeos/dbus/dbus_client_bundle.h

@@ -21,7 +21,6 @@
 class EasyUnlockClient;
 class GsmSMSClient;
 class ImageBurnerClient;
-class IntrospectableClient;
 class LorgnetteManagerClient;
 class ModemMessagingClient;
 class PermissionBrokerClient;
@@ -58,15 +57,14 @@
     SHILL = 1 << 7,
     GSM_SMS = 1 << 8,
     IMAGE_BURNER = 1 << 9,
-    INTROSPECTABLE = 1 << 10,
-    MODEM_MESSAGING = 1 << 11,
-    PERMISSION_BROKER = 1 << 12,
-    POWER_MANAGER = 1 << 13,
-    SESSION_MANAGER = 1 << 14,
-    SMS = 1 << 15,
-    SYSTEM_CLOCK = 1 << 16,
-    UPDATE_ENGINE = 1 << 17,
-    ARC_OBB_MOUNTER = 1 << 18,
+    MODEM_MESSAGING = 1 << 10,
+    PERMISSION_BROKER = 1 << 11,
+    POWER_MANAGER = 1 << 12,
+    SESSION_MANAGER = 1 << 13,
+    SMS = 1 << 14,
+    SYSTEM_CLOCK = 1 << 15,
+    UPDATE_ENGINE = 1 << 16,
+    ARC_OBB_MOUNTER = 1 << 17,
   };
 
   explicit DBusClientBundle(DBusClientTypeMask unstub_client_mask);
@@ -145,10 +143,6 @@
     return image_burner_client_.get();
   }
 
-  IntrospectableClient* introspectable_client() {
-    return introspectable_client_.get();
-  }
-
   ModemMessagingClient* modem_messaging_client() {
     return modem_messaging_client_.get();
   }
@@ -200,7 +194,6 @@
       shill_third_party_vpn_driver_client_;
   std::unique_ptr<GsmSMSClient> gsm_sms_client_;
   std::unique_ptr<ImageBurnerClient> image_burner_client_;
-  std::unique_ptr<IntrospectableClient> introspectable_client_;
   std::unique_ptr<ModemMessagingClient> modem_messaging_client_;
   std::unique_ptr<PermissionBrokerClient> permission_broker_client_;
   std::unique_ptr<SystemClockClient> system_clock_client_;

diff --git a/chromeos/dbus/dbus_thread_manager.cc b/chromeos/dbus/dbus_thread_manager.cc
index f4384f3..ecb6af2 100644
--- a/chromeos/dbus/dbus_thread_manager.cc
+++ b/chromeos/dbus/dbus_thread_manager.cc

@@ -20,7 +20,6 @@
 #include "chromeos/dbus/easy_unlock_client.h"
 #include "chromeos/dbus/gsm_sms_client.h"
 #include "chromeos/dbus/image_burner_client.h"
-#include "chromeos/dbus/introspectable_client.h"
 #include "chromeos/dbus/lorgnette_manager_client.h"
 #include "chromeos/dbus/modem_messaging_client.h"
 #include "chromeos/dbus/permission_broker_client.h"
@@ -165,10 +164,6 @@
   return client_bundle_->image_burner_client();
 }
 
-IntrospectableClient* DBusThreadManager::GetIntrospectableClient() {
-  return client_bundle_->introspectable_client();
-}
-
 ModemMessagingClient* DBusThreadManager::GetModemMessagingClient() {
   return client_bundle_->modem_messaging_client();
 }
@@ -206,7 +201,6 @@
   GetEasyUnlockClient()->Init(GetSystemBus());
   GetGsmSMSClient()->Init(GetSystemBus());
   GetImageBurnerClient()->Init(GetSystemBus());
-  GetIntrospectableClient()->Init(GetSystemBus());
   GetLorgnetteManagerClient()->Init(GetSystemBus());
   GetModemMessagingClient()->Init(GetSystemBus());
   GetPermissionBrokerClient()->Init(GetSystemBus());
@@ -417,12 +411,6 @@
       std::move(client);
 }
 
-void DBusThreadManagerSetter::SetIntrospectableClient(
-    std::unique_ptr<IntrospectableClient> client) {
-  DBusThreadManager::Get()->client_bundle_->introspectable_client_ =
-      std::move(client);
-}
-
 void DBusThreadManagerSetter::SetModemMessagingClient(
     std::unique_ptr<ModemMessagingClient> client) {
   DBusThreadManager::Get()->client_bundle_->modem_messaging_client_ =

diff --git a/chromeos/dbus/dbus_thread_manager.h b/chromeos/dbus/dbus_thread_manager.h
index cb26f9e..5f1ab82 100644
--- a/chromeos/dbus/dbus_thread_manager.h
+++ b/chromeos/dbus/dbus_thread_manager.h

@@ -35,7 +35,6 @@
 class EasyUnlockClient;
 class GsmSMSClient;
 class ImageBurnerClient;
-class IntrospectableClient;
 class LorgnetteManagerClient;
 class ModemMessagingClient;
 class PermissionBrokerClient;
@@ -109,7 +108,6 @@
   EasyUnlockClient* GetEasyUnlockClient();
   GsmSMSClient* GetGsmSMSClient();
   ImageBurnerClient* GetImageBurnerClient();
-  IntrospectableClient* GetIntrospectableClient();
   LorgnetteManagerClient* GetLorgnetteManagerClient();
   ModemMessagingClient* GetModemMessagingClient();
   PermissionBrokerClient* GetPermissionBrokerClient();
@@ -183,7 +181,6 @@
       std::unique_ptr<ShillThirdPartyVpnDriverClient> client);
   void SetGsmSMSClient(std::unique_ptr<GsmSMSClient> client);
   void SetImageBurnerClient(std::unique_ptr<ImageBurnerClient> client);
-  void SetIntrospectableClient(std::unique_ptr<IntrospectableClient> client);
   void SetModemMessagingClient(std::unique_ptr<ModemMessagingClient> client);
   void SetPermissionBrokerClient(
       std::unique_ptr<PermissionBrokerClient> client);

diff --git a/chromeos/dbus/fake_introspectable_client.cc b/chromeos/dbus/fake_introspectable_client.cc
deleted file mode 100644
index 9b30b6f9..0000000
--- a/chromeos/dbus/fake_introspectable_client.cc
+++ /dev/null

@@ -1,26 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chromeos/dbus/fake_introspectable_client.h"
-
-#include "base/callback.h"
-#include "base/logging.h"
-#include "dbus/object_path.h"
-
-namespace chromeos {
-
-FakeIntrospectableClient::FakeIntrospectableClient() {}
-
-FakeIntrospectableClient::~FakeIntrospectableClient() {}
-
-void FakeIntrospectableClient::Init(dbus::Bus* bus) {}
-
-void FakeIntrospectableClient::Introspect(const std::string& service_name,
-                                          const dbus::ObjectPath& object_path,
-                                          const IntrospectCallback& callback) {
-  VLOG(1) << "Introspect: " << service_name << " " << object_path.value();
-  callback.Run(service_name, object_path, "", false);
-}
-
-}  // namespace chromeos

diff --git a/chromeos/dbus/fake_introspectable_client.h b/chromeos/dbus/fake_introspectable_client.h
deleted file mode 100644
index 6525ec8f..0000000
--- a/chromeos/dbus/fake_introspectable_client.h
+++ /dev/null

@@ -1,28 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROMEOS_DBUS_FAKE_INTROSPECTABLE_CLIENT_H_
-#define CHROMEOS_DBUS_FAKE_INTROSPECTABLE_CLIENT_H_
-
-#include "base/compiler_specific.h"
-#include "chromeos/dbus/introspectable_client.h"
-
-namespace chromeos {
-
-// The IntrospectableClient implementation used on Linux desktop, which does
-// nothing.
-class FakeIntrospectableClient: public IntrospectableClient {
- public:
-  FakeIntrospectableClient();
-  ~FakeIntrospectableClient() override;
-
-  void Init(dbus::Bus* bus) override;
-  void Introspect(const std::string& service_name,
-                  const dbus::ObjectPath& object_path,
-                  const IntrospectCallback& callback) override;
-};
-
-}  // namespace chromeos
-
-#endif  // CHROMEOS_DBUS_INTROSPECTABLE_CLIENT_H_

diff --git a/chromeos/dbus/introspectable_client.cc b/chromeos/dbus/introspectable_client.cc
deleted file mode 100644
index 8f7754b..0000000
--- a/chromeos/dbus/introspectable_client.cc
+++ /dev/null

@@ -1,135 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chromeos/dbus/introspectable_client.h"
-
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "base/macros.h"
-#include "dbus/bus.h"
-#include "dbus/message.h"
-#include "dbus/object_proxy.h"
-#include "third_party/libxml/chromium/libxml_utils.h"
-
-namespace {
-
-// D-Bus specification constants.
-const char kIntrospectableInterface[] = "org.freedesktop.DBus.Introspectable";
-const char kIntrospect[] = "Introspect";
-
-// String constants used for parsing D-Bus Introspection XML data.
-const char kInterfaceNode[] = "interface";
-const char kInterfaceNameAttribute[] = "name";
-
-}  // namespace
-
-namespace chromeos {
-
-// The IntrospectableClient implementation used in production.
-class IntrospectableClientImpl : public IntrospectableClient {
- public:
-  IntrospectableClientImpl() : bus_(NULL), weak_ptr_factory_(this) {}
-
-  ~IntrospectableClientImpl() override {}
-
-  // IntrospectableClient override.
-  void Introspect(const std::string& service_name,
-                  const dbus::ObjectPath& object_path,
-                  const IntrospectCallback& callback) override {
-    dbus::MethodCall method_call(kIntrospectableInterface, kIntrospect);
-
-    dbus::ObjectProxy* object_proxy = bus_->GetObjectProxy(service_name,
-                                                           object_path);
-
-    object_proxy->CallMethod(
-        &method_call,
-        dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&IntrospectableClientImpl::OnIntrospect,
-                   weak_ptr_factory_.GetWeakPtr(),
-                   service_name, object_path, callback));
-  }
-
- protected:
-  void Init(dbus::Bus* bus) override { bus_ = bus; }
-
- private:
-  // Called by dbus:: when a response for Introspect() is recieved.
-  void OnIntrospect(const std::string& service_name,
-                    const dbus::ObjectPath& object_path,
-                    const IntrospectCallback& callback,
-                    dbus::Response* response) {
-    // Parse response.
-    bool success = false;
-    std::string xml_data;
-    if (response != NULL) {
-      dbus::MessageReader reader(response);
-      if (!reader.PopString(&xml_data)) {
-        LOG(WARNING) << "Introspect response has incorrect paramters: "
-                     << response->ToString();
-      } else {
-        success = true;
-      }
-    }
-
-    // Notify client.
-    callback.Run(service_name, object_path, xml_data, success);
-  }
-
-  dbus::Bus* bus_;
-
-  // Weak pointer factory for generating 'this' pointers that might live longer
-  // than we do.
-  // Note: This should remain the last member so it'll be destroyed and
-  // invalidate its weak pointers before any other members are destroyed.
-  base::WeakPtrFactory<IntrospectableClientImpl> weak_ptr_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(IntrospectableClientImpl);
-};
-
-IntrospectableClient::IntrospectableClient() {
-}
-
-IntrospectableClient::~IntrospectableClient() {
-}
-
-// static
-std::vector<std::string>
-IntrospectableClient::GetInterfacesFromIntrospectResult(
-    const std::string& xml_data) {
-  std::vector<std::string> interfaces;
-
-  XmlReader reader;
-  if (!reader.Load(xml_data))
-    return interfaces;
-
-  do {
-    // Skip to the next open tag, exit when done.
-    while (!reader.SkipToElement()) {
-      if (!reader.Read()) {
-        return interfaces;
-      }
-    }
-
-    // Only look at interface nodes.
-    if (reader.NodeName() != kInterfaceNode)
-      continue;
-
-    // Skip if missing the interface name.
-    std::string interface_name;
-    if (!reader.NodeAttribute(kInterfaceNameAttribute, &interface_name))
-      continue;
-
-    interfaces.push_back(interface_name);
-  } while (reader.Read());
-
-  return interfaces;
-}
-
-// static
-IntrospectableClient* IntrospectableClient::Create() {
-  return new IntrospectableClientImpl();
-}
-
-}  // namespace chromeos

diff --git a/chromeos/dbus/introspectable_client.h b/chromeos/dbus/introspectable_client.h
deleted file mode 100644
index 49693f2..0000000
--- a/chromeos/dbus/introspectable_client.h
+++ /dev/null

@@ -1,59 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROMEOS_DBUS_INTROSPECTABLE_CLIENT_H_
-#define CHROMEOS_DBUS_INTROSPECTABLE_CLIENT_H_
-
-#include <string>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/macros.h"
-#include "chromeos/chromeos_export.h"
-#include "chromeos/dbus/dbus_client.h"
-#include "dbus/object_path.h"
-
-namespace chromeos {
-
-// IntrospectableClient is used to retrieve the D-Bus introspection data
-// from a remote object.
-class CHROMEOS_EXPORT IntrospectableClient : public DBusClient {
- public:
-  ~IntrospectableClient() override;
-
-  // The IntrospectCallback is used for the Introspect() method. It receives
-  // four arguments, the first two are the |service_name| and |object_path|
-  // of the remote object being introspected, the third is the |xml_data| of
-  // the object as described in
-  // http://dbus.freedesktop.org/doc/dbus-specification.html, the fourth
-  // |success| indicates whether the request succeeded.
-  typedef base::Callback<void(const std::string&, const dbus::ObjectPath&,
-                              const std::string&, bool)> IntrospectCallback;
-
-  // Retrieves introspection data from the remote object on service name
-  // |service_name| with object path |object_path|, calling |callback| with
-  // the XML-formatted data received.
-  virtual void Introspect(const std::string& service_name,
-                          const dbus::ObjectPath& object_path,
-                          const IntrospectCallback& callback) = 0;
-
-  // Parses XML-formatted introspection data returned by
-  // org.freedesktop.DBus.Introspectable.Introspect and returns the list of
-  // interface names declared within.
-  static std::vector<std::string> GetInterfacesFromIntrospectResult(
-      const std::string& xml_data);
-
-  // Creates the instance
-  static IntrospectableClient* Create();
-
- protected:
-  IntrospectableClient();
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(IntrospectableClient);
-};
-
-}  // namespace chromeos
-
-#endif  // CHROMEOS_DBUS_INTROSPECTABLE_CLIENT_H_

diff --git a/chromeos/dbus/introspectable_client_unittest.cc b/chromeos/dbus/introspectable_client_unittest.cc
deleted file mode 100644
index 5e98b1c..0000000
--- a/chromeos/dbus/introspectable_client_unittest.cc
+++ /dev/null

@@ -1,68 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chromeos/dbus/introspectable_client.h"
-
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace {
-
-const char kXmlData[] =
-"<!DOCTYPE node PUBLIC "
-"\"-//freedesktop//DTD D-BUS Object Introspection 1.0//EN\" "
-"\"http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd\">\n"
-"<node>\n"
-"  <interface name=\"org.freedesktop.DBus.Introspectable\">\n"
-"    <method name=\"Introspect\">\n"
-"      <arg type=\"s\" direction=\"out\"/>\n"
-"    </method>\n"
-"  </interface>\n"
-"  <interface name=\"org.bluez.Device\">\n"
-"    <method name=\"GetProperties\">\n"
-"      <arg type=\"a{sv}\" direction=\"out\"/>\n"
-"    </method>\n"
-"    <method name=\"SetProperty\">\n"
-"      <arg type=\"s\" direction=\"in\"/>\n"
-"      <arg type=\"v\" direction=\"in\"/>\n"
-"    </method>\n"
-"    <method name=\"DiscoverServices\">\n"
-"      <arg type=\"s\" direction=\"in\"/>\n"
-"      <arg type=\"a{us}\" direction=\"out\"/>\n"
-"    </method>\n"
-"    <method name=\"CancelDiscovery\"/>\n"
-"    <method name=\"Disconnect\"/>\n"
-"    <signal name=\"PropertyChanged\">\n"
-"      <arg type=\"s\"/>\n"
-"      <arg type=\"v\"/>\n"
-"    </signal>\n"
-"    <signal name=\"DisconnectRequested\"/>\n"
-"  </interface>\n"
-"  <interface name=\"org.bluez.Input\">\n"
-"    <method name=\"Connect\"/>\n"
-"    <method name=\"Disconnect\"/>\n"
-"    <method name=\"GetProperties\">\n"
-"      <arg type=\"a{sv}\" direction=\"out\"/>\n"
-"    </method>\n"
-"    <signal name=\"PropertyChanged\">\n"
-"      <arg type=\"s\"/>\n"
-"      <arg type=\"v\"/>\n"
-"    </signal>\n"
-"  </interface>\n"
-"</node>";
-
-}  // namespace
-
-namespace chromeos {
-
-TEST(IntrospectableClientTest, GetInterfacesFromIntrospectResult) {
-  std::vector<std::string> interfaces =
-      IntrospectableClient::GetInterfacesFromIntrospectResult(kXmlData);
-
-  ASSERT_EQ(3U, interfaces.size());
-  EXPECT_EQ("org.freedesktop.DBus.Introspectable", interfaces[0]);
-  EXPECT_EQ("org.bluez.Device", interfaces[1]);
-  EXPECT_EQ("org.bluez.Input", interfaces[2]);
-}
-
-}  // namespace chromeos

diff --git a/chromeos/dbus/session_manager_client.cc b/chromeos/dbus/session_manager_client.cc
index 7d64e53..c98a7c9 100644
--- a/chromeos/dbus/session_manager_client.cc
+++ b/chromeos/dbus/session_manager_client.cc

@@ -83,10 +83,6 @@
   remote_auth_fd->CheckValidity();
 }
 
-void HandleDBusError(dbus::ErrorResponse* response) {
-  LOG(ERROR) << "DBus error " << response->ToString();
-}
-
 }  // namespace
 
 // The SessionManagerClient implementation used in production.
@@ -512,12 +508,11 @@
     // Ownership of local_auth_fd is passed to the callback that is to be
     // called on completion of this method call. This keeps the browser end
     // of the socket-pair alive for the duration of the RPC.
-    session_manager_proxy_->CallMethodWithErrorCallback(
+    session_manager_proxy_->CallMethod(
         &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
         base::Bind(&SessionManagerClientImpl::OnRestartJob,
                    weak_ptr_factory_.GetWeakPtr(),
-                   base::Passed(&local_auth_fd)),
-        base::Bind(HandleDBusError));
+                   base::Passed(&local_auth_fd)));
   }
 
   // Called when kSessionManagerRestartJob method is complete.

diff --git a/components/arc/arc_service_manager.cc b/components/arc/arc_service_manager.cc
index a206fd4c..4bcdcd24 100644
--- a/components/arc/arc_service_manager.cc
+++ b/components/arc/arc_service_manager.cc

@@ -55,17 +55,16 @@
         ArcBridgeBootstrap::Create()));
   }
 
-  AddService(base::WrapUnique(new ArcAudioBridge(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcBluetoothBridge(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcClipboardBridge(arc_bridge_service())));
-  AddService(
-      base::WrapUnique(new ArcCrashCollectorBridge(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcImeService(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcMetricsService(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcNetHostImpl(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcObbMounterBridge(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcPowerBridge(arc_bridge_service())));
-  AddService(base::WrapUnique(new ArcStorageManager(arc_bridge_service())));
+  AddService(base::MakeUnique<ArcAudioBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcBluetoothBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcClipboardBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcCrashCollectorBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcImeService>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcMetricsService>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcNetHostImpl>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcObbMounterBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcPowerBridge>(arc_bridge_service()));
+  AddService(base::MakeUnique<ArcStorageManager>(arc_bridge_service()));
 }
 
 ArcServiceManager::~ArcServiceManager() {
@@ -99,8 +98,8 @@
     const AccountId& account_id,
     std::unique_ptr<BooleanPrefMember> arc_enabled_pref) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  AddService(base::WrapUnique(
-      new ArcNotificationManager(arc_bridge_service(), account_id)));
+  AddService(base::MakeUnique<ArcNotificationManager>(arc_bridge_service(),
+                                                      account_id));
 }
 
 void ArcServiceManager::Shutdown() {

diff --git a/components/arc/bluetooth/arc_bluetooth_bridge.cc b/components/arc/bluetooth/arc_bluetooth_bridge.cc
index 964f1986..7d11d20 100644
--- a/components/arc/bluetooth/arc_bluetooth_bridge.cc
+++ b/components/arc/bluetooth/arc_bluetooth_bridge.cc

@@ -834,8 +834,8 @@
     return;
   }
   bluetooth_adapter_->StartDiscoverySessionWithFilter(
-      base::WrapUnique(
-          new BluetoothDiscoveryFilter(device::BLUETOOTH_TRANSPORT_LE)),
+      base::MakeUnique<BluetoothDiscoveryFilter>(
+          device::BLUETOOTH_TRANSPORT_LE),
       base::Bind(&ArcBluetoothBridge::OnDiscoveryStarted,
                  weak_factory_.GetWeakPtr()),
       base::Bind(&ArcBluetoothBridge::OnDiscoveryError,
@@ -964,8 +964,8 @@
 void ArcBluetoothBridge::StartLEListen(const StartLEListenCallback& callback) {
   DCHECK(CalledOnValidThread());
   std::unique_ptr<BluetoothAdvertisement::Data> adv_data =
-      base::WrapUnique(new BluetoothAdvertisement::Data(
-          BluetoothAdvertisement::ADVERTISEMENT_TYPE_BROADCAST));
+      base::MakeUnique<BluetoothAdvertisement::Data>(
+          BluetoothAdvertisement::ADVERTISEMENT_TYPE_BROADCAST);
   bluetooth_adapter_->RegisterAdvertisement(
       std::move(adv_data), base::Bind(&ArcBluetoothBridge::OnStartLEListenDone,
                                       weak_factory_.GetWeakPtr(), callback),

diff --git a/components/autofill/content/browser/content_autofill_driver_factory.cc b/components/autofill/content/browser/content_autofill_driver_factory.cc
index 7cc11640..32465df 100644
--- a/components/autofill/content/browser/content_autofill_driver_factory.cc
+++ b/components/autofill/content/browser/content_autofill_driver_factory.cc

@@ -100,8 +100,8 @@
       frame_driver_map_.insert(std::make_pair(render_frame_host, nullptr));
   // This is called twice for the main frame.
   if (insertion_result.second) {  // This was the first time.
-    insertion_result.first->second = base::WrapUnique(new ContentAutofillDriver(
-        render_frame_host, client_, app_locale_, enable_download_manager_));
+    insertion_result.first->second = base::MakeUnique<ContentAutofillDriver>(
+        render_frame_host, client_, app_locale_, enable_download_manager_);
   }
 }
 

diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 282f10a..34e28598 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc

@@ -367,7 +367,7 @@
     it->second.second |= added_flags;
   } else {
     (*field_value_and_properties_map)[element] = std::make_pair(
-        value ? base::WrapUnique(new base::string16(*value)) : nullptr,
+        value ? base::MakeUnique<base::string16>(*value) : nullptr,
         added_flags);
   }
 }

diff --git a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
index 9fef94f..5169e0b 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils_browsertest.cc

@@ -187,8 +187,8 @@
         input_element->setActivatedSubmit(true);
       if (with_user_input) {
         const base::string16 element_value = input_element->value();
-        user_input[control_elements[i]] = std::make_pair(
-            base::WrapUnique(new base::string16(element_value)), 0U);
+        user_input[control_elements[i]] =
+            std::make_pair(base::MakeUnique<base::string16>(element_value), 0U);
       }
     }
 

diff --git a/components/autofill/core/browser/payments/payments_client.cc b/components/autofill/core/browser/payments/payments_client.cc
index 7c7d75b..b34ad10 100644
--- a/components/autofill/core/browser/payments/payments_client.cc
+++ b/components/autofill/core/browser/payments/payments_client.cc

@@ -171,7 +171,7 @@
     request_dict.SetString("credit_card_id", request_details_.card.server_id());
     request_dict.Set("risk_data_encoded",
                      BuildRiskDictionary(request_details_.risk_data));
-    request_dict.Set("context", base::WrapUnique(new base::DictionaryValue()));
+    request_dict.Set("context", base::MakeUnique<base::DictionaryValue>());
 
     int value = 0;
     if (base::StringToInt(request_details_.user_response.exp_month, &value))
@@ -357,17 +357,16 @@
 
 void PaymentsClient::UnmaskCard(
     const PaymentsClient::UnmaskRequestDetails& request_details) {
-  IssueRequest(base::WrapUnique(new UnmaskCardRequest(request_details)), true);
+  IssueRequest(base::MakeUnique<UnmaskCardRequest>(request_details), true);
 }
 
 void PaymentsClient::GetUploadDetails(const std::string& app_locale) {
-  IssueRequest(base::WrapUnique(new GetUploadDetailsRequest(app_locale)),
-               false);
+  IssueRequest(base::MakeUnique<GetUploadDetailsRequest>(app_locale), false);
 }
 
 void PaymentsClient::UploadCard(
     const PaymentsClient::UploadRequestDetails& request_details) {
-  IssueRequest(base::WrapUnique(new UploadCardRequest(request_details)), true);
+  IssueRequest(base::MakeUnique<UploadCardRequest>(request_details), true);
 }
 
 void PaymentsClient::IssueRequest(std::unique_ptr<PaymentsRequest> request,

diff --git a/components/bookmarks/browser/bookmark_expanded_state_tracker_unittest.cc b/components/bookmarks/browser/bookmark_expanded_state_tracker_unittest.cc
index 9890f27..1053474 100644
--- a/components/bookmarks/browser/bookmark_expanded_state_tracker_unittest.cc
+++ b/components/bookmarks/browser/bookmark_expanded_state_tracker_unittest.cc

@@ -46,7 +46,7 @@
   prefs_.registry()->RegisterListPref(prefs::kBookmarkEditorExpandedNodes,
                                       new base::ListValue);
   prefs_.registry()->RegisterListPref(prefs::kManagedBookmarks);
-  model_.reset(new BookmarkModel(base::WrapUnique(new TestBookmarkClient())));
+  model_.reset(new BookmarkModel(base::MakeUnique<TestBookmarkClient>()));
   model_->Load(&prefs_, base::FilePath(),
                base::ThreadTaskRunnerHandle::Get(),
                base::ThreadTaskRunnerHandle::Get());

diff --git a/components/bookmarks/browser/bookmark_index_unittest.cc b/components/bookmarks/browser/bookmark_index_unittest.cc
index 8b56b40..3e23cc38 100644
--- a/components/bookmarks/browser/bookmark_index_unittest.cc
+++ b/components/bookmarks/browser/bookmark_index_unittest.cc

@@ -529,7 +529,7 @@
 
   std::unique_ptr<BookmarkModel> model =
       TestBookmarkClient::CreateModelWithClient(
-          base::WrapUnique(new BookmarkClientMock(typed_count_map)));
+          base::MakeUnique<BookmarkClientMock>(typed_count_map));
 
   for (size_t i = 0; i < arraysize(data); ++i)
     // Populate the BookmarkIndex.

diff --git a/components/browsing_data/core/counters/browsing_data_counter.cc b/components/browsing_data/core/counters/browsing_data_counter.cc
index 26a374ac..1af879c6 100644
--- a/components/browsing_data/core/counters/browsing_data_counter.cc
+++ b/components/browsing_data/core/counters/browsing_data_counter.cc

@@ -45,14 +45,14 @@
   if (!pref_service_->GetBoolean(GetPrefName()))
     return;
 
-  callback_.Run(base::WrapUnique(new Result(this)));
+  callback_.Run(base::MakeUnique<Result>(this));
 
   Count();
 }
 
 void BrowsingDataCounter::ReportResult(ResultInt value) {
   DCHECK(initialized_);
-  callback_.Run(base::WrapUnique(new FinishedResult(this, value)));
+  callback_.Run(base::MakeUnique<FinishedResult>(this, value));
 }
 
 void BrowsingDataCounter::ReportResult(std::unique_ptr<Result> result) {

diff --git a/components/browsing_data/core/counters/history_counter.cc b/components/browsing_data/core/counters/history_counter.cc
index 44364153..26e652d 100644
--- a/components/browsing_data/core/counters/history_counter.cc
+++ b/components/browsing_data/core/counters/history_counter.cc

@@ -147,8 +147,8 @@
   if (!local_counting_finished_ || !web_counting_finished_)
     return;
 
-  ReportResult(base::WrapUnique(
-      new HistoryResult(this, local_result_, has_synced_visits_)));
+  ReportResult(
+      base::MakeUnique<HistoryResult>(this, local_result_, has_synced_visits_));
 }
 
 HistoryCounter::HistoryResult::HistoryResult(const HistoryCounter* source,

diff --git a/components/cast_certificate/cast_cert_validator.cc b/components/cast_certificate/cast_cert_validator.cc
index e08eae7..c1c3438 100644
--- a/components/cast_certificate/cast_cert_validator.cc
+++ b/components/cast_certificate/cast_cert_validator.cc

@@ -116,7 +116,7 @@
 //   * Hashes: All SHA hashes including SHA-1 (despite being known weak).
 //   * RSA keys must have a modulus at least 2048-bits long.
 std::unique_ptr<net::SignaturePolicy> CreateCastSignaturePolicy() {
-  return base::WrapUnique(new net::SimpleSignaturePolicy(2048));
+  return base::MakeUnique<net::SimpleSignaturePolicy>(2048);
 }
 
 class CertVerificationContextImpl : public CertVerificationContext {
@@ -352,8 +352,8 @@
     const base::StringPiece& spki) {
   // Use a bogus CommonName, since this is just exposed for testing signature
   // verification by unittests.
-  return base::WrapUnique(
-      new CertVerificationContextImpl(net::der::Input(spki), "CommonName"));
+  return base::MakeUnique<CertVerificationContextImpl>(net::der::Input(spki),
+                                                       "CommonName");
 }
 
 }  // namespace cast_certificate

diff --git a/components/cast_certificate/cast_crl.cc b/components/cast_certificate/cast_crl.cc
index c1b15be8..1fd52eb 100644
--- a/components/cast_certificate/cast_crl.cc
+++ b/components/cast_certificate/cast_crl.cc

@@ -92,7 +92,7 @@
 // The required algorithms are:
 // RSASSA PKCS#1 v1.5 with SHA-256, using RSA keys 2048-bits or longer.
 std::unique_ptr<net::SignaturePolicy> CreateCastSignaturePolicy() {
-  return base::WrapUnique(new net::SimpleSignaturePolicy(2048));
+  return base::MakeUnique<net::SimpleSignaturePolicy>(2048);
 }
 
 // Verifies the CRL is signed by a trusted CRL authority at the time the CRL
@@ -338,7 +338,7 @@
       LOG(ERROR) << "CRL - Verification failed.";
       return nullptr;
     }
-    return base::WrapUnique(new CastCRLImpl(tbs_crl, overall_not_after));
+    return base::MakeUnique<CastCRLImpl>(tbs_crl, overall_not_after);
   }
   LOG(ERROR) << "No supported version of revocation data.";
   return nullptr;

diff --git a/components/certificate_reporting/error_reporter.cc b/components/certificate_reporting/error_reporter.cc
index 6015dcf..124d2f260 100644
--- a/components/certificate_reporting/error_reporter.cc
+++ b/components/certificate_reporting/error_reporter.cc

@@ -112,13 +112,14 @@
     net::URLRequestContext* request_context,
     const GURL& upload_url,
     net::ReportSender::CookiesPreference cookies_preference)
-    : ErrorReporter(upload_url,
-                    kServerPublicKey,
-                    kServerPublicKeyVersion,
-                    base::WrapUnique(new net::ReportSender(
-                        request_context,
-                        cookies_preference,
-                        base::Bind(RecordUMAOnFailure)))) {}
+    : ErrorReporter(
+          upload_url,
+          kServerPublicKey,
+          kServerPublicKeyVersion,
+          base::MakeUnique<net::ReportSender>(request_context,
+                                              cookies_preference,
+                                              base::Bind(RecordUMAOnFailure))) {
+}
 
 ErrorReporter::ErrorReporter(
     const GURL& upload_url,

diff --git a/components/component_updater/component_updater_service.cc b/components/component_updater/component_updater_service.cc
index 2d3346c..91e3bd5 100644
--- a/components/component_updater/component_updater_service.cc
+++ b/components/component_updater/component_updater_service.cc

@@ -456,8 +456,7 @@
     const scoped_refptr<Configurator>& config) {
   DCHECK(config);
   auto update_client = update_client::UpdateClientFactory(config);
-  return base::WrapUnique(
-      new CrxUpdateService(config, std::move(update_client)));
+  return base::MakeUnique<CrxUpdateService>(config, std::move(update_client));
 }
 
 }  // namespace component_updater

diff --git a/components/component_updater/component_updater_service_unittest.cc b/components/component_updater/component_updater_service_unittest.cc
index 0ad90d5..caac5add 100644
--- a/components/component_updater/component_updater_service_unittest.cc
+++ b/components/component_updater/component_updater_service_unittest.cc

@@ -169,7 +169,7 @@
 std::unique_ptr<ComponentUpdateService> TestComponentUpdateServiceFactory(
     const scoped_refptr<Configurator>& config) {
   DCHECK(config);
-  return base::WrapUnique(new CrxUpdateService(config, new MockUpdateClient()));
+  return base::MakeUnique<CrxUpdateService>(config, new MockUpdateClient());
 }
 
 ComponentUpdaterTest::ComponentUpdaterTest()

diff --git a/components/content_settings/core/browser/content_settings_pref_provider.cc b/components/content_settings/core/browser/content_settings_pref_provider.cc
index c544e18..caa4c7b 100644
--- a/components/content_settings/core/browser/content_settings_pref_provider.cc
+++ b/components/content_settings/core/browser/content_settings_pref_provider.cc

@@ -95,10 +95,10 @@
   for (const WebsiteSettingsInfo* info : *website_settings) {
     content_settings_prefs_.insert(std::make_pair(
         info->type(),
-        base::WrapUnique(new ContentSettingsPref(
+        base::MakeUnique<ContentSettingsPref>(
             info->type(), prefs_, &pref_change_registrar_, info->pref_name(),
             is_incognito_,
-            base::Bind(&PrefProvider::Notify, base::Unretained(this))))));
+            base::Bind(&PrefProvider::Notify, base::Unretained(this)))));
   }
 
   if (!is_incognito_) {

diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index cdcccc5..1b96d20 100644
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc

@@ -358,9 +358,9 @@
     return;
 
   DCHECK(!base::ContainsKey(content_settings_info_, type));
-  content_settings_info_[type] = base::WrapUnique(
-      new ContentSettingsInfo(website_settings_info, whitelisted_schemes,
-                              valid_settings, incognito_behavior));
+  content_settings_info_[type] = base::MakeUnique<ContentSettingsInfo>(
+      website_settings_info, whitelisted_schemes, valid_settings,
+      incognito_behavior);
 }
 
 }  // namespace content_settings

diff --git a/components/content_settings/core/browser/content_settings_utils.cc b/components/content_settings/core/browser/content_settings_utils.cc
index c5816325..ed0a256 100644
--- a/components/content_settings/core/browser/content_settings_utils.cc
+++ b/components/content_settings/core/browser/content_settings_utils.cc

@@ -128,7 +128,7 @@
       setting >= CONTENT_SETTING_NUM_SETTINGS) {
     return nullptr;
   }
-  return base::WrapUnique(new base::FundamentalValue(setting));
+  return base::MakeUnique<base::FundamentalValue>(setting);
 }
 
 void GetRendererContentSettingRules(const HostContentSettingsMap* map,

diff --git a/components/content_settings/core/browser/website_settings_registry_unittest.cc b/components/content_settings/core/browser/website_settings_registry_unittest.cc
index 5e3630c0..4d0c96f 100644
--- a/components/content_settings/core/browser/website_settings_registry_unittest.cc
+++ b/components/content_settings/core/browser/website_settings_registry_unittest.cc

@@ -88,7 +88,7 @@
 
   // Register a new setting.
   registry()->Register(static_cast<ContentSettingsType>(10), "test",
-                       base::WrapUnique(new base::FundamentalValue(999)),
+                       base::MakeUnique<base::FundamentalValue>(999),
                        WebsiteSettingsInfo::SYNCABLE,
                        WebsiteSettingsInfo::LOSSY,
                        WebsiteSettingsInfo::TOP_LEVEL_ORIGIN_ONLY_SCOPE,
@@ -117,7 +117,7 @@
 
 TEST_F(WebsiteSettingsRegistryTest, Iteration) {
   registry()->Register(static_cast<ContentSettingsType>(10), "test",
-                       base::WrapUnique(new base::FundamentalValue(999)),
+                       base::MakeUnique<base::FundamentalValue>(999),
                        WebsiteSettingsInfo::SYNCABLE,
                        WebsiteSettingsInfo::LOSSY,
                        WebsiteSettingsInfo::TOP_LEVEL_ORIGIN_ONLY_SCOPE,

diff --git a/components/cronet/android/BUILD.gn b/components/cronet/android/BUILD.gn
index 2e491716..6aa67435 100644
--- a/components/cronet/android/BUILD.gn
+++ b/components/cronet/android/BUILD.gn

@@ -289,7 +289,6 @@
     "api/src/org/chromium/net/HttpUrlConnectionUrlRequestFactory.java",
     "api/src/org/chromium/net/HttpUrlRequest.java",
     "api/src/org/chromium/net/HttpUrlRequestFactory.java",
-    "api/src/org/chromium/net/HttpUrlRequestFactoryConfig.java",
     "api/src/org/chromium/net/HttpUrlRequestListener.java",
     "api/src/org/chromium/net/InputStreamChannel.java",
     "api/src/org/chromium/net/JavaCronetEngine.java",
@@ -304,7 +303,6 @@
     "api/src/org/chromium/net/UploadDataProviders.java",
     "api/src/org/chromium/net/UploadDataSink.java",
     "api/src/org/chromium/net/UrlRequest.java",
-    "api/src/org/chromium/net/UrlRequestContextConfig.java",
     "api/src/org/chromium/net/UrlRequestException.java",
     "api/src/org/chromium/net/UrlResponseInfo.java",
     "api/src/org/chromium/net/UserAgent.java",

diff --git a/components/cronet/android/api/build.xml b/components/cronet/android/api/build.xml
index 5a8a5df..7fba722 100644
--- a/components/cronet/android/api/build.xml
+++ b/components/cronet/android/api/build.xml

@@ -12,7 +12,6 @@
           <exclude name="**/ChunkedWritableByteChannel*.java"/>
           <exclude name="**/HttpUrl*.java"/>
           <exclude name="**/ResponseTooLargeException.java"/>
-          <exclude name="**/UrlRequestContextConfig.java"/>
           <!-- This file is removed but it still appears in the checkout of one bot. See crbug.com/637887 -->
           <!-- TODO(xunjieli): Remove this. -->
           <exclude name="**/RequestFinishedListener.java"/>

diff --git a/components/cronet/android/api/src/org/chromium/net/HttpUrlRequestFactoryConfig.java b/components/cronet/android/api/src/org/chromium/net/HttpUrlRequestFactoryConfig.java
deleted file mode 100644
index 6f7c158..0000000
--- a/components/cronet/android/api/src/org/chromium/net/HttpUrlRequestFactoryConfig.java
+++ /dev/null

@@ -1,21 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.net;
-
-/**
- * A config for HttpUrlRequestFactory, which allows runtime configuration of
- * HttpUrlRequestFactory.
- * @deprecated Use {@link CronetEngine.Builder} instead.
- */
-@Deprecated
-public class HttpUrlRequestFactoryConfig extends UrlRequestContextConfig {
-
-    /**
-     * Default config enables SPDY, QUIC, in memory http cache.
-     */
-    public HttpUrlRequestFactoryConfig() {
-        super();
-    }
-}

diff --git a/components/cronet/android/api/src/org/chromium/net/UrlRequestContextConfig.java b/components/cronet/android/api/src/org/chromium/net/UrlRequestContextConfig.java
deleted file mode 100644
index 2ecc2c4..0000000
--- a/components/cronet/android/api/src/org/chromium/net/UrlRequestContextConfig.java
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.net;
-
-/**
- * A config for CronetEngine, which allows runtime configuration of
- * CronetEngine.
- * @deprecated use {@link CronetEngine.Builder} instead.
- */
-@Deprecated
-public class UrlRequestContextConfig extends CronetEngine.Builder {
-    public UrlRequestContextConfig() {
-        // Context will be passed in later when the ChromiumUrlRequestFactory
-        // or ChromiumUrlRequestContext is created.
-        super(null);
-    }
-}

diff --git a/components/cronet/android/cronet_data_reduction_proxy.cc b/components/cronet/android/cronet_data_reduction_proxy.cc
index 14ce124..fa5a3cbf 100644
--- a/components/cronet/android/cronet_data_reduction_proxy.cc
+++ b/components/cronet/android/cronet_data_reduction_proxy.cc

@@ -126,8 +126,8 @@
       data_reduction_proxy_service(
           new data_reduction_proxy::DataReductionProxyService(
               settings_.get(), prefs_.get(), url_request_context_getter_.get(),
-              base::WrapUnique(new data_reduction_proxy::DataStore()),
-              task_runner_, task_runner_, task_runner_, base::TimeDelta()));
+              base::MakeUnique<data_reduction_proxy::DataStore>(), task_runner_,
+              task_runner_, task_runner_, base::TimeDelta()));
   io_data_->SetDataReductionProxyService(
       data_reduction_proxy_service->GetWeakPtr());
   settings_->InitDataReductionProxySettings(

diff --git a/components/cronet/android/cronet_url_request_context_adapter.cc b/components/cronet/android/cronet_url_request_context_adapter.cc
index 12de78c..f805328a 100644
--- a/components/cronet/android/cronet_url_request_context_adapter.cc
+++ b/components/cronet/android/cronet_url_request_context_adapter.cc

@@ -639,7 +639,7 @@
         new net::SdchOwner(context_->sdch_manager(), context_.get()));
     if (json_pref_store_) {
       sdch_owner_->EnablePersistentStorage(
-          base::WrapUnique(new SdchOwnerPrefStorage(json_pref_store_.get())));
+          base::MakeUnique<SdchOwnerPrefStorage>(json_pref_store_.get()));
     }
   }
 
@@ -996,9 +996,9 @@
   URLRequestContextConfig* config =
       reinterpret_cast<URLRequestContextConfig*>(jurl_request_context_config);
   config->quic_hints.push_back(
-      base::WrapUnique(new URLRequestContextConfig::QuicHint(
+      base::MakeUnique<URLRequestContextConfig::QuicHint>(
           base::android::ConvertJavaStringToUTF8(env, jhost), jport,
-          jalternate_port)));
+          jalternate_port));
 }
 
 // Add a public key pin to URLRequestContextConfig.

diff --git a/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlTest.java b/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlTest.java
index e9b2876..c7a6d65 100644
--- a/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlTest.java
+++ b/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlTest.java

@@ -75,8 +75,7 @@
         File directory = new File(PathUtils.getDataDirectory(context));
         File file = File.createTempFile("cronet", "json", directory);
         HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(
-                context,
-                new UrlRequestContextConfig().setLibraryName("cronet_tests"));
+                context, new CronetEngine.Builder(null /*context*/).setLibraryName("cronet_tests"));
         // Start NetLog immediately after the request context is created to make
         // sure that the call won't crash the app even when the native request
         // context is not fully initialized. See crbug.com/470196.

diff --git a/components/cronet/android/test/javatests/src/org/chromium/net/HttpUrlRequestFactoryTest.java b/components/cronet/android/test/javatests/src/org/chromium/net/HttpUrlRequestFactoryTest.java
index e6ff514..9e36e126 100644
--- a/components/cronet/android/test/javatests/src/org/chromium/net/HttpUrlRequestFactoryTest.java
+++ b/components/cronet/android/test/javatests/src/org/chromium/net/HttpUrlRequestFactoryTest.java

@@ -39,12 +39,12 @@
     @SmallTest
     @Feature({"Cronet"})
     public void testCreateFactory() throws Throwable {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
-        config.enableQuic(true);
-        config.addQuicHint("www.google.com", 443, 443);
-        config.addQuicHint("www.youtube.com", 443, 443);
-        config.setLibraryName("cronet_tests");
-        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), config);
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
+        builder.enableQuic(true);
+        builder.addQuicHint("www.google.com", 443, 443);
+        builder.addQuicHint("www.youtube.com", 443, 443);
+        builder.setLibraryName("cronet_tests");
+        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), builder);
         assertNotNull("Factory should be created", factory);
         assertTrue("Factory should be Chromium/n.n.n.n@r but is "
                            + factory.getName(),
@@ -56,10 +56,10 @@
     @Feature({"Cronet"})
     @OnlyRunNativeCronet
     public void testCreateLegacyFactory() {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
-        config.enableLegacyMode(true);
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
+        builder.enableLegacyMode(true);
 
-        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), config);
+        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), builder);
         assertNotNull("Factory should be created", factory);
         assertTrue("Factory should be HttpUrlConnection/n.n.n.n@r but is "
                            + factory.getName(),
@@ -79,10 +79,10 @@
     @Feature({"Cronet"})
     @OnlyRunNativeCronet
     public void testCreateLegacyFactoryUsingUrlRequestContextConfig() {
-        UrlRequestContextConfig config = new UrlRequestContextConfig();
-        config.enableLegacyMode(true);
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
+        builder.enableLegacyMode(true);
 
-        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), config);
+        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), builder);
         assertNotNull("Factory should be created", factory);
         assertTrue("Factory should be HttpUrlConnection/n.n.n.n@r but is "
                            + factory.getName(),
@@ -101,10 +101,10 @@
     @SmallTest
     @Feature({"Cronet"})
     public void testQuicHintHost() {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
-        config.addQuicHint("www.google.com", 443, 443);
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
+        builder.addQuicHint("www.google.com", 443, 443);
         try {
-            config.addQuicHint("https://www.google.com", 443, 443);
+            builder.addQuicHint("https://www.google.com", 443, 443);
         } catch (IllegalArgumentException e) {
             return;
         }
@@ -114,12 +114,12 @@
     @SmallTest
     @Feature({"Cronet"})
     public void testConfigUserAgent() throws Throwable {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
         String userAgentName = "User-Agent";
         String userAgentValue = "User-Agent-Value";
-        config.setUserAgent(userAgentValue);
-        config.setLibraryName("cronet_tests");
-        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), config);
+        builder.setUserAgent(userAgentValue);
+        builder.setLibraryName("cronet_tests");
+        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), builder);
         assertTrue(NativeTestServer.startNativeTestServer(getContext()));
         String url = NativeTestServer.getEchoHeaderURL(userAgentName);
         TestHttpUrlRequestListener listener = new TestHttpUrlRequestListener();
@@ -135,12 +135,12 @@
     @SmallTest
     @Feature({"Cronet"})
     public void testConfigUserAgentLegacy() throws Throwable {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
         String userAgentName = "User-Agent";
         String userAgentValue = "User-Agent-Value";
-        config.setUserAgent(userAgentValue);
-        config.enableLegacyMode(true);
-        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), config);
+        builder.setUserAgent(userAgentValue);
+        builder.enableLegacyMode(true);
+        HttpUrlRequestFactory factory = HttpUrlRequestFactory.createFactory(getContext(), builder);
         assertTrue("Factory should be HttpUrlConnection/n.n.n.n@r but is "
                            + factory.getName(),
                    Pattern.matches(
@@ -164,17 +164,17 @@
     @SmallTest
     @Feature({"Cronet"})
     public void testEnableHttpCache() {
-        HttpUrlRequestFactoryConfig config = new HttpUrlRequestFactoryConfig();
-        config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_DISABLED, 0);
-        config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_IN_MEMORY, 0);
+        CronetEngine.Builder builder = new CronetEngine.Builder(null /*context*/);
+        builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISABLED, 0);
+        builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_IN_MEMORY, 0);
         try {
-            config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_DISK, 0);
+            builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISK, 0);
             fail("IllegalArgumentException must be thrown");
         } catch (IllegalArgumentException e) {
             assertEquals("Storage path must be set", e.getMessage());
         }
         try {
-            config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_DISK_NO_HTTP, 0);
+            builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISK_NO_HTTP, 0);
             fail("IllegalArgumentException must be thrown");
         } catch (IllegalArgumentException e) {
             assertEquals("Storage path must be set", e.getMessage());
@@ -183,11 +183,11 @@
         // Create a new directory to hold the disk cache data.
         File dir = getContext().getDir("disk_cache_dir", Context.MODE_PRIVATE);
         String path = dir.getPath();
-        config.setStoragePath(path);
-        config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_DISK, 100);
-        config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_DISK_NO_HTTP, 100);
+        builder.setStoragePath(path);
+        builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISK, 100);
+        builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISK_NO_HTTP, 100);
         try {
-            config.enableHttpCache(HttpUrlRequestFactoryConfig.HTTP_CACHE_IN_MEMORY, 0);
+            builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_IN_MEMORY, 0);
             fail("IllegalArgumentException must be thrown");
         } catch (IllegalArgumentException e) {
             assertEquals("Storage path must not be set", e.getMessage());

diff --git a/components/cronet/android/url_request_context_adapter.cc b/components/cronet/android/url_request_context_adapter.cc
index 9f437b4..69e1086 100644
--- a/components/cronet/android/url_request_context_adapter.cc
+++ b/components/cronet/android/url_request_context_adapter.cc

@@ -153,7 +153,7 @@
   net::URLRequestContextBuilder context_builder;
 
   context_builder.set_network_delegate(
-      base::WrapUnique(new BasicNetworkDelegate()));
+      base::MakeUnique<BasicNetworkDelegate>());
   context_builder.set_proxy_config_service(std::move(proxy_config_service_));
   config_->ConfigureURLRequestContextBuilder(&context_builder,
                                              g_net_log.Pointer(), nullptr);

diff --git a/components/cronet/ios/test/cronet_bidirectional_stream_test.mm b/components/cronet/ios/test/cronet_bidirectional_stream_test.mm
index 8348fe7..98b44f2 100644
--- a/components/cronet/ios/test/cronet_bidirectional_stream_test.mm
+++ b/components/cronet/ios/test/cronet_bidirectional_stream_test.mm

@@ -176,7 +176,7 @@
 
   void AddWriteData(const std::string& data) { AddWriteData(data, true); }
   void AddWriteData(const std::string& data, bool flush) {
-    write_data.push_back(base::WrapUnique(new WriteData(data, flush)));
+    write_data.push_back(base::MakeUnique<WriteData>(data, flush));
   }
 
   virtual void MaybeWriteNextData(cronet_bidirectional_stream* stream) {

diff --git a/components/cronet/url_request_context_config_unittest.cc b/components/cronet/url_request_context_config_unittest.cc
index 2c9508a..0c82e96b 100644
--- a/components/cronet/url_request_context_config_unittest.cc
+++ b/components/cronet/url_request_context_config_unittest.cc

@@ -72,8 +72,9 @@
   net::NetLog net_log;
   config.ConfigureURLRequestContextBuilder(&builder, &net_log, nullptr);
   // Set a ProxyConfigService to avoid DCHECK failure when building.
-  builder.set_proxy_config_service(base::WrapUnique(
-      new net::ProxyConfigServiceFixed(net::ProxyConfig::CreateDirect())));
+  builder.set_proxy_config_service(
+      base::MakeUnique<net::ProxyConfigServiceFixed>(
+          net::ProxyConfig::CreateDirect()));
   std::unique_ptr<net::URLRequestContext> context(builder.Build());
   const net::HttpNetworkSession::Params* params =
       context->GetNetworkSessionParams();
@@ -163,8 +164,9 @@
   net::NetLog net_log;
   config.ConfigureURLRequestContextBuilder(&builder, &net_log, nullptr);
   // Set a ProxyConfigService to avoid DCHECK failure when building.
-  builder.set_proxy_config_service(base::WrapUnique(
-      new net::ProxyConfigServiceFixed(net::ProxyConfig::CreateDirect())));
+  builder.set_proxy_config_service(
+      base::MakeUnique<net::ProxyConfigServiceFixed>(
+          net::ProxyConfig::CreateDirect()));
   std::unique_ptr<net::URLRequestContext> context(builder.Build());
   const net::HttpNetworkSession::Params* params =
       context->GetNetworkSessionParams();

diff --git a/components/devtools_http_handler/devtools_http_handler_unittest.cc b/components/devtools_http_handler/devtools_http_handler_unittest.cc
index 4a02899..e8e82f6a 100644
--- a/components/devtools_http_handler/devtools_http_handler_unittest.cc
+++ b/components/devtools_http_handler/devtools_http_handler_unittest.cc

@@ -77,7 +77,7 @@
   std::unique_ptr<net::ServerSocket> CreateForHttpServer() override {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::Bind(&QuitFromHandlerThread, quit_closure_1_));
-    return base::WrapUnique(new DummyServerSocket());
+    return base::MakeUnique<DummyServerSocket>();
   }
 
   base::Closure quit_closure_1_;

diff --git a/components/display_compositor/buffer_queue.cc b/components/display_compositor/buffer_queue.cc
index 5bd18aae..fafdb40 100644
--- a/components/display_compositor/buffer_queue.cc
+++ b/components/display_compositor/buffer_queue.cc

@@ -239,8 +239,8 @@
   allocated_count_++;
   gl_->BindTexture(texture_target_, texture);
   gl_->BindTexImage2DCHROMIUM(texture_target_, id);
-  return base::WrapUnique(new AllocatedSurface(this, std::move(buffer), texture,
-                                               id, gfx::Rect(size_)));
+  return base::MakeUnique<AllocatedSurface>(this, std::move(buffer), texture,
+                                            id, gfx::Rect(size_));
 }
 
 BufferQueue::AllocatedSurface::AllocatedSurface(

diff --git a/components/display_compositor/compositor_overlay_candidate_validator_android.cc b/components/display_compositor/compositor_overlay_candidate_validator_android.cc
index d2befbe..805dae3 100644
--- a/components/display_compositor/compositor_overlay_candidate_validator_android.cc
+++ b/components/display_compositor/compositor_overlay_candidate_validator_android.cc

@@ -21,8 +21,7 @@
 
 void CompositorOverlayCandidateValidatorAndroid::GetStrategies(
     cc::OverlayProcessor::StrategyList* strategies) {
-  strategies->push_back(
-      base::WrapUnique(new cc::OverlayStrategyUnderlay(this)));
+  strategies->push_back(base::MakeUnique<cc::OverlayStrategyUnderlay>(this));
 }
 
 void CompositorOverlayCandidateValidatorAndroid::CheckOverlaySupport(

diff --git a/components/display_compositor/compositor_overlay_candidate_validator_ozone.cc b/components/display_compositor/compositor_overlay_candidate_validator_ozone.cc
index f96c2c9..ada664c 100644
--- a/components/display_compositor/compositor_overlay_candidate_validator_ozone.cc
+++ b/components/display_compositor/compositor_overlay_candidate_validator_ozone.cc

@@ -42,13 +42,11 @@
 void CompositorOverlayCandidateValidatorOzone::GetStrategies(
     cc::OverlayProcessor::StrategyList* strategies) {
   if (single_fullscreen_) {
-    strategies->push_back(
-        base::WrapUnique(new cc::OverlayStrategyFullscreen()));
+    strategies->push_back(base::MakeUnique<cc::OverlayStrategyFullscreen>());
   } else {
     strategies->push_back(
-        base::WrapUnique(new cc::OverlayStrategySingleOnTop(this)));
-    strategies->push_back(
-        base::WrapUnique(new cc::OverlayStrategyUnderlay(this)));
+        base::MakeUnique<cc::OverlayStrategySingleOnTop>(this));
+    strategies->push_back(base::MakeUnique<cc::OverlayStrategyUnderlay>(this));
   }
 }
 

diff --git a/components/dom_distiller/core/distillable_page_detector_unittest.cc b/components/dom_distiller/core/distillable_page_detector_unittest.cc
index fc51fc96..d56be15 100644
--- a/components/dom_distiller/core/distillable_page_detector_unittest.cc
+++ b/components/dom_distiller/core/distillable_page_detector_unittest.cc

@@ -30,8 +30,8 @@
     }
     proto_.set_num_features(num_features);
     proto_.set_num_stumps(proto_.stump_size());
-    return base::WrapUnique(new DistillablePageDetector(
-        base::WrapUnique(new AdaBoostProto(proto_))));
+    return base::MakeUnique<DistillablePageDetector>(
+        base::WrapUnique(new AdaBoostProto(proto_)));
   }
 
  private:

diff --git a/components/dom_distiller/core/dom_distiller_store_unittest.cc b/components/dom_distiller/core/dom_distiller_store_unittest.cc
index 83d21cca..9ac8004 100644
--- a/components/dom_distiller/core/dom_distiller_store_unittest.cc
+++ b/components/dom_distiller/core/dom_distiller_store_unittest.cc

@@ -353,8 +353,7 @@
   article_proto.set_title("A title");
   attachments.set_distilled_article(article_proto);
   store_->UpdateAttachments(
-      entry.entry_id(),
-      base::WrapUnique(new ArticleAttachmentsData(attachments)),
+      entry.entry_id(), base::MakeUnique<ArticleAttachmentsData>(attachments),
       callbacks.UpdateCallback());
   EXPECT_CALL(callbacks, Update(true));
   base::RunLoop().RunUntilIdle();

diff --git a/components/domain_reliability/monitor.cc b/components/domain_reliability/monitor.cc
index 85b5658a..2da1d509 100644
--- a/components/domain_reliability/monitor.cc
+++ b/components/domain_reliability/monitor.cc

@@ -256,10 +256,10 @@
   DCHECK(config);
   DCHECK(config->IsValid());
 
-  return base::WrapUnique(new DomainReliabilityContext(
+  return base::MakeUnique<DomainReliabilityContext>(
       time_.get(), scheduler_params_, upload_reporter_string_,
       &last_network_change_time_, &dispatcher_, uploader_.get(),
-      std::move(config)));
+      std::move(config));
 }
 
 DomainReliabilityMonitor::RequestInfo::RequestInfo() {}

diff --git a/components/drive/chromeos/change_list_loader.cc b/components/drive/chromeos/change_list_loader.cc
index be3c96d2..e2bb5b31 100644
--- a/components/drive/chromeos/change_list_loader.cc
+++ b/components/drive/chromeos/change_list_loader.cc

@@ -181,8 +181,8 @@
   DCHECK(thread_checker_.CalledOnValidThread());
 
   ++lock_count_;
-  return base::WrapUnique(new base::ScopedClosureRunner(
-      base::Bind(&LoaderController::Unlock, weak_ptr_factory_.GetWeakPtr())));
+  return base::MakeUnique<base::ScopedClosureRunner>(
+      base::Bind(&LoaderController::Unlock, weak_ptr_factory_.GetWeakPtr()));
 }
 
 void LoaderController::ScheduleRun(const base::Closure& task) {
@@ -283,8 +283,7 @@
 
   for (size_t i = 0; i < callbacks.size(); ++i) {
     callbacks[i].Run(
-        status,
-        base::WrapUnique(new google_apis::AboutResource(*about_resource)));
+        status, base::MakeUnique<google_apis::AboutResource>(*about_resource));
   }
 }
 
@@ -512,8 +511,8 @@
   change_feed_fetcher_->Run(
       base::Bind(&ChangeListLoader::LoadChangeListFromServerAfterLoadChangeList,
                  weak_ptr_factory_.GetWeakPtr(),
-                 base::Passed(base::WrapUnique(new google_apis::AboutResource(
-                     *about_resource_loader_->cached_about_resource()))),
+                 base::Passed(base::MakeUnique<google_apis::AboutResource>(
+                     *about_resource_loader_->cached_about_resource())),
                  is_delta_update));
 }
 

diff --git a/components/drive/chromeos/file_system/download_operation.cc b/components/drive/chromeos/file_system/download_operation.cc
index ba8e57c..4e8d01d 100644
--- a/components/drive/chromeos/file_system/download_operation.cc
+++ b/components/drive/chromeos/file_system/download_operation.cc

@@ -284,7 +284,7 @@
   void OnCacheFileFound(const base::FilePath& cache_file_path) {
     if (!initialized_callback_.is_null()) {
       initialized_callback_.Run(FILE_ERROR_OK, cache_file_path,
-                                base::WrapUnique(new ResourceEntry(*entry_)));
+                                base::MakeUnique<ResourceEntry>(*entry_));
     }
     completion_callback_.Run(FILE_ERROR_OK, cache_file_path, std::move(entry_));
   }
@@ -297,7 +297,7 @@
 
     DCHECK(entry_);
     initialized_callback_.Run(FILE_ERROR_OK, base::FilePath(),
-                              base::WrapUnique(new ResourceEntry(*entry_)));
+                              base::MakeUnique<ResourceEntry>(*entry_));
   }
 
   void OnError(FileError error) const {

diff --git a/components/drive/chromeos/search_metadata.cc b/components/drive/chromeos/search_metadata.cc
index 9471e6c6..b9d0251 100644
--- a/components/drive/chromeos/search_metadata.cc
+++ b/components/drive/chromeos/search_metadata.cc

@@ -158,7 +158,7 @@
   if (result_candidates->size() == at_most_num_matches)
     result_candidates->pop();
   result_candidates->push(
-      base::WrapUnique(new ResultCandidate(it->GetID(), entry, highlighted)));
+      base::MakeUnique<ResultCandidate>(it->GetID(), entry, highlighted));
   return FILE_ERROR_OK;
 }
 

diff --git a/components/drive/resource_metadata_storage.cc b/components/drive/resource_metadata_storage.cc
index 704f47e..8a0eb35b 100644
--- a/components/drive/resource_metadata_storage.cc
+++ b/components/drive/resource_metadata_storage.cc

@@ -826,7 +826,7 @@
 
   std::unique_ptr<leveldb::Iterator> it(
       resource_map_->NewIterator(leveldb::ReadOptions()));
-  return base::WrapUnique(new Iterator(std::move(it)));
+  return base::MakeUnique<Iterator>(std::move(it));
 }
 
 FileError ResourceMetadataStorage::GetChild(const std::string& parent_id,

diff --git a/components/drive/service/fake_drive_service.cc b/components/drive/service/fake_drive_service.cc
index c691f1f..ad0d1f6 100644
--- a/components/drive/service/fake_drive_service.cc
+++ b/components/drive/service/fake_drive_service.cc

@@ -548,8 +548,8 @@
   if (entry && entry->change_resource.file()) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::Bind(callback, HTTP_SUCCESS,
-                              base::Passed(base::WrapUnique(new FileResource(
-                                  *entry->change_resource.file())))));
+                              base::Passed(base::MakeUnique<FileResource>(
+                                  *entry->change_resource.file()))));
     return CancelCallback();
   }
 
@@ -836,7 +836,7 @@
   copied_entry->content_data = entry->content_data;
   copied_entry->share_url = entry->share_url;
   copied_entry->change_resource.set_file(
-      base::WrapUnique(new FileResource(*entry->change_resource.file())));
+      base::MakeUnique<FileResource>(*entry->change_resource.file()));
 
   ChangeResource* new_change = &copied_entry->change_resource;
   FileResource* new_file = new_change->mutable_file();
@@ -863,7 +863,7 @@
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(callback, HTTP_SUCCESS,
-                 base::Passed(base::WrapUnique(new FileResource(*new_file)))));
+                 base::Passed(base::MakeUnique<FileResource>(*new_file))));
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&FakeDriveService::NotifyObservers,
@@ -932,7 +932,7 @@
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(callback, HTTP_SUCCESS,
-                 base::Passed(base::WrapUnique(new FileResource(*file)))));
+                 base::Passed(base::MakeUnique<FileResource>(*file))));
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&FakeDriveService::NotifyObservers,
@@ -1219,7 +1219,7 @@
 
     completion_callback.Run(
         HTTP_CREATED,
-        base::WrapUnique(new FileResource(*new_entry->change_resource.file())));
+        base::MakeUnique<FileResource>(*new_entry->change_resource.file()));
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(&FakeDriveService::NotifyObservers,
@@ -1246,8 +1246,7 @@
   AddNewChangestamp(change);
   UpdateETag(file);
 
-  completion_callback.Run(HTTP_SUCCESS,
-                          base::WrapUnique(new FileResource(*file)));
+  completion_callback.Run(HTTP_SUCCESS, base::MakeUnique<FileResource>(*file));
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&FakeDriveService::NotifyObservers,
@@ -1409,8 +1408,8 @@
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::Bind(callback, HTTP_CREATED,
-                            base::Passed(base::WrapUnique(new FileResource(
-                                *new_entry->change_resource.file())))));
+                            base::Passed(base::MakeUnique<FileResource>(
+                                *new_entry->change_resource.file()))));
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&FakeDriveService::NotifyObservers,
@@ -1453,8 +1452,8 @@
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::Bind(callback, HTTP_CREATED,
-                            base::Passed(base::WrapUnique(new FileResource(
-                                *new_entry->change_resource.file())))));
+                            base::Passed(base::MakeUnique<FileResource>(
+                                *new_entry->change_resource.file()))));
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(&FakeDriveService::NotifyObservers,
@@ -1491,7 +1490,7 @@
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::Bind(callback, HTTP_SUCCESS,
-                 base::Passed(base::WrapUnique(new FileResource(*file)))));
+                 base::Passed(base::MakeUnique<FileResource>(*file))));
 }
 
 google_apis::DriveApiErrorCode FakeDriveService::SetUserPermission(
@@ -1719,8 +1718,7 @@
       entry_copied->set_file_id(entry.file_id());
       entry_copied->set_deleted(entry.is_deleted());
       if (entry.file()) {
-        entry_copied->set_file(
-            base::WrapUnique(new FileResource(*entry.file())));
+        entry_copied->set_file(base::MakeUnique<FileResource>(*entry.file()));
       }
       entry_copied->set_modification_date(entry.modification_date());
       entries.push_back(entry_copied.release());

diff --git a/components/exo/buffer.cc b/components/exo/buffer.cc
index 7ec46c5..205a646 100644
--- a/components/exo/buffer.cc
+++ b/components/exo/buffer.cc

@@ -439,9 +439,9 @@
   // if one doesn't already exist. The contents of this buffer are copied to
   // |texture| using a call to CopyTexImage.
   if (!contents_texture_) {
-    contents_texture_ = base::WrapUnique(
-        new Texture(context_factory, context_provider.get(),
-                    gpu_memory_buffer_.get(), texture_target_, query_type_));
+    contents_texture_ = base::MakeUnique<Texture>(
+        context_factory, context_provider.get(), gpu_memory_buffer_.get(),
+        texture_target_, query_type_);
   }
 
   if (use_zero_copy_) {
@@ -466,7 +466,7 @@
   // Create a mailbox texture that we copy the buffer contents to.
   if (!texture_) {
     texture_ =
-        base::WrapUnique(new Texture(context_factory, context_provider.get()));
+        base::MakeUnique<Texture>(context_factory, context_provider.get());
   }
 
   // Copy the contents of |contents_texture| to |texture| and produce a

diff --git a/components/exo/display.cc b/components/exo/display.cc
index 4d51b34..df470b2 100644
--- a/components/exo/display.cc
+++ b/components/exo/display.cc

@@ -55,7 +55,7 @@
   if (!base::SharedMemory::IsHandleValid(handle))
     return nullptr;
 
-  return base::WrapUnique(new SharedMemory(handle));
+  return base::MakeUnique<SharedMemory>(handle);
 }
 
 #if defined(USE_OZONE)
@@ -96,10 +96,10 @@
       std::find(std::begin(kOverlayFormats), std::end(kOverlayFormats),
                 format) != std::end(kOverlayFormats);
 
-  return base::WrapUnique(new Buffer(
+  return base::MakeUnique<Buffer>(
       std::move(gpu_memory_buffer), GL_TEXTURE_EXTERNAL_OES,
       // COMMANDS_COMPLETED queries are required by native pixmaps.
-      GL_COMMANDS_COMPLETED_CHROMIUM, use_zero_copy, is_overlay_candidate));
+      GL_COMMANDS_COMPLETED_CHROMIUM, use_zero_copy, is_overlay_candidate);
 }
 #endif
 
@@ -112,9 +112,9 @@
     return nullptr;
   }
 
-  return base::WrapUnique(
-      new ShellSurface(surface, nullptr, gfx::Rect(), true /* activatable */,
-                       ash::kShellWindowId_DefaultContainer));
+  return base::MakeUnique<ShellSurface>(surface, nullptr, gfx::Rect(),
+                                        true /* activatable */,
+                                        ash::kShellWindowId_DefaultContainer);
 }
 
 std::unique_ptr<ShellSurface> Display::CreatePopupShellSurface(
@@ -143,9 +143,9 @@
           ->window(),
       parent->GetWidget()->GetNativeWindow()->parent(), &initial_bounds);
 
-  return base::WrapUnique(
-      new ShellSurface(surface, parent, initial_bounds, false /* activatable */,
-                       ash::kShellWindowId_DefaultContainer));
+  return base::MakeUnique<ShellSurface>(surface, parent, initial_bounds,
+                                        false /* activatable */,
+                                        ash::kShellWindowId_DefaultContainer);
 }
 
 std::unique_ptr<ShellSurface> Display::CreateRemoteShellSurface(
@@ -159,8 +159,8 @@
     return nullptr;
   }
 
-  return base::WrapUnique(new ShellSurface(surface, nullptr, gfx::Rect(1, 1),
-                                           true /* activatable */, container));
+  return base::MakeUnique<ShellSurface>(surface, nullptr, gfx::Rect(1, 1),
+                                        true /* activatable */, container);
 }
 
 std::unique_ptr<SubSurface> Display::CreateSubSurface(Surface* surface,
@@ -178,7 +178,7 @@
     return nullptr;
   }
 
-  return base::WrapUnique(new SubSurface(surface, parent));
+  return base::MakeUnique<SubSurface>(surface, parent);
 }
 
 std::unique_ptr<NotificationSurface> Display::CreateNotificationSurface(

diff --git a/components/exo/shared_memory.cc b/components/exo/shared_memory.cc
index 7545f6c..d0b2176 100644
--- a/components/exo/shared_memory.cc
+++ b/components/exo/shared_memory.cc

@@ -84,14 +84,14 @@
   // buffers. Making the copy explicit allows the buffer to be reused earlier.
   bool use_zero_copy = false;
 
-  return base::WrapUnique(
-      new Buffer(std::move(gpu_memory_buffer), GL_TEXTURE_2D,
-                 // COMMANDS_ISSUED queries are sufficient for shared memory
-                 // buffers as binding to texture is implemented using a call to
-                 // glTexImage2D and the buffer can be reused as soon as that
-                 // command has been issued.
-                 GL_COMMANDS_ISSUED_CHROMIUM, use_zero_copy,
-                 false /* is_overlay_candidate */));
+  return base::MakeUnique<Buffer>(
+      std::move(gpu_memory_buffer), GL_TEXTURE_2D,
+      // COMMANDS_ISSUED queries are sufficient for shared memory
+      // buffers as binding to texture is implemented using a call to
+      // glTexImage2D and the buffer can be reused as soon as that
+      // command has been issued.
+      GL_COMMANDS_ISSUED_CHROMIUM, use_zero_copy,
+      false /* is_overlay_candidate */);
 }
 
 }  // namespace exo

diff --git a/components/exo/shared_memory_unittest.cc b/components/exo/shared_memory_unittest.cc
index a3f3730..567f7a3 100644
--- a/components/exo/shared_memory_unittest.cc
+++ b/components/exo/shared_memory_unittest.cc

@@ -24,7 +24,7 @@
   base::SharedMemoryHandle handle =
       base::SharedMemory::DuplicateHandle(shared_memory->handle());
   DCHECK(base::SharedMemory::IsHandleValid(handle));
-  return base::WrapUnique(new SharedMemory(handle));
+  return base::MakeUnique<SharedMemory>(handle);
 }
 
 TEST_F(SharedMemoryTest, CreateBuffer) {

diff --git a/components/exo/sub_surface_unittest.cc b/components/exo/sub_surface_unittest.cc
index 2cd92ff..1132dec 100644
--- a/components/exo/sub_surface_unittest.cc
+++ b/components/exo/sub_surface_unittest.cc

@@ -40,7 +40,7 @@
 
   // Create and commit a new sub-surface using the same surface.
   sub_surface.reset();
-  sub_surface = base::WrapUnique(new SubSurface(surface.get(), parent.get()));
+  sub_surface = base::MakeUnique<SubSurface>(surface.get(), parent.get());
   parent->Commit();
 
   // Initial position should be reset to origin.

diff --git a/components/exo/wayland/server.cc b/components/exo/wayland/server.cc
index fdbdeea..fdc1b88 100644
--- a/components/exo/wayland/server.cc
+++ b/components/exo/wayland/server.cc

@@ -734,7 +734,7 @@
                                 wl_resource* resource,
                                 uint32_t id) {
   std::unique_ptr<LinuxBufferParams> linux_buffer_params =
-      base::WrapUnique(new LinuxBufferParams(GetUserDataAs<Display>(resource)));
+      base::MakeUnique<LinuxBufferParams>(GetUserDataAs<Display>(resource));
 
   wl_resource* linux_buffer_params_resource =
       wl_resource_create(client, &zwp_linux_buffer_params_v1_interface, 1, id);
@@ -1117,9 +1117,8 @@
   wl_resource* resource = wl_resource_create(
       client, &wl_output_interface, std::min(version, output_version), id);
 
-  SetImplementation(
-      resource, nullptr,
-      base::WrapUnique(new WaylandPrimaryDisplayObserver(resource)));
+  SetImplementation(resource, nullptr,
+                    base::MakeUnique<WaylandPrimaryDisplayObserver>(resource));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1907,8 +1906,8 @@
                          std::min(version, remote_shell_version), id);
 
   SetImplementation(resource, &remote_shell_implementation,
-                    base::WrapUnique(new WaylandRemoteShell(
-                        static_cast<Display*>(data), resource)));
+                    base::MakeUnique<WaylandRemoteShell>(
+                        static_cast<Display*>(data), resource));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -2457,9 +2456,9 @@
   wl_resource* pointer_resource = wl_resource_create(
       client, &wl_pointer_interface, wl_resource_get_version(resource), id);
 
-  SetImplementation(pointer_resource, &pointer_implementation,
-                    base::WrapUnique(new Pointer(
-                        new WaylandPointerDelegate(pointer_resource))));
+  SetImplementation(
+      pointer_resource, &pointer_implementation,
+      base::MakeUnique<Pointer>(new WaylandPointerDelegate(pointer_resource)));
 }
 
 void seat_get_keyboard(wl_client* client, wl_resource* resource, uint32_t id) {
@@ -2469,8 +2468,8 @@
       wl_resource_create(client, &wl_keyboard_interface, version, id);
 
   SetImplementation(keyboard_resource, &keyboard_implementation,
-                    base::WrapUnique(new Keyboard(
-                        new WaylandKeyboardDelegate(keyboard_resource))));
+                    base::MakeUnique<Keyboard>(
+                        new WaylandKeyboardDelegate(keyboard_resource)));
 
   // TODO(reveman): Keep repeat info synchronized with chromium and the host OS.
   if (version >= WL_KEYBOARD_REPEAT_INFO_SINCE_VERSION)
@@ -2486,7 +2485,7 @@
 
   SetImplementation(
       touch_resource, &touch_implementation,
-      base::WrapUnique(new Touch(new WaylandTouchDelegate(touch_resource))));
+      base::MakeUnique<Touch>(new WaylandTouchDelegate(touch_resource)));
 }
 
 void seat_release(wl_client* client, wl_resource* resource) {
@@ -2631,7 +2630,7 @@
       client, &wp_viewport_interface, wl_resource_get_version(resource), id);
 
   SetImplementation(viewport_resource, &viewport_implementation,
-                    base::WrapUnique(new Viewport(surface)));
+                    base::MakeUnique<Viewport>(surface));
 }
 
 const struct wp_viewporter_interface viewporter_implementation = {
@@ -2720,7 +2719,7 @@
       wl_resource_create(client, &zwp_security_v1_interface, 1, id);
 
   SetImplementation(security_resource, &security_implementation,
-                    base::WrapUnique(new Security(surface)));
+                    base::MakeUnique<Security>(surface));
 }
 
 const struct zwp_secure_output_v1_interface secure_output_implementation = {
@@ -2837,7 +2836,7 @@
       wl_resource_create(client, &zwp_blending_v1_interface, 1, id);
 
   SetImplementation(blending_resource, &blending_implementation,
-                    base::WrapUnique(new Blending(surface)));
+                    base::MakeUnique<Blending>(surface));
 }
 
 const struct zwp_alpha_compositing_v1_interface
@@ -2922,8 +2921,8 @@
 
   SetImplementation(
       gamepad_resource, &gamepad_implementation,
-      base::WrapUnique(new Gamepad(new WaylandGamepadDelegate(gamepad_resource),
-                                   gaming_input_thread->task_runner().get())));
+      base::MakeUnique<Gamepad>(new WaylandGamepadDelegate(gamepad_resource),
+                                gaming_input_thread->task_runner().get()));
 }
 
 const struct zwp_gaming_input_v1_interface gaming_input_implementation = {
@@ -3007,9 +3006,9 @@
   wl_resource* stylus_resource =
       wl_resource_create(client, &zwp_pointer_stylus_v1_interface, 1, id);
 
-  SetImplementation(stylus_resource, &pointer_stylus_implementation,
-                    base::WrapUnique(new WaylandPointerStylusDelegate(
-                        stylus_resource, pointer)));
+  SetImplementation(
+      stylus_resource, &pointer_stylus_implementation,
+      base::MakeUnique<WaylandPointerStylusDelegate>(stylus_resource, pointer));
 }
 
 const struct zwp_stylus_v1_interface stylus_implementation = {

diff --git a/components/feedback/anonymizer_tool.cc b/components/feedback/anonymizer_tool.cc
index 4b5070f..bc8a223 100644
--- a/components/feedback/anonymizer_tool.cc
+++ b/components/feedback/anonymizer_tool.cc

@@ -239,7 +239,7 @@
     RE2::Options options;
     // set_multiline of pcre is not supported by RE2, yet.
     options.set_dot_nl(true);  // Dot matches a new line.
-    std::unique_ptr<RE2> re = base::WrapUnique(new RE2(pattern, options));
+    std::unique_ptr<RE2> re = base::MakeUnique<RE2>(pattern, options);
     DCHECK_EQ(re2::RE2::NoError, re->error_code())
         << "Failed to parse:\n" << pattern << "\n" << re->error();
     regexp_cache_[pattern] = std::move(re);

diff --git a/components/feedback/feedback_data_unittest.cc b/components/feedback/feedback_data_unittest.cc
index 5ba234e..c41e0724 100644
--- a/components/feedback/feedback_data_unittest.cc
+++ b/components/feedback/feedback_data_unittest.cc

@@ -46,7 +46,7 @@
 }
 
 std::unique_ptr<std::string> MakeScoped(const char* str) {
-  return base::WrapUnique(new std::string(str));
+  return base::MakeUnique<std::string>(str);
 }
 
 }  // namespace

diff --git a/components/feedback/feedback_uploader_unittest.cc b/components/feedback/feedback_uploader_unittest.cc
index 7539e8bd..c4bcb61 100644
--- a/components/feedback/feedback_uploader_unittest.cc
+++ b/components/feedback/feedback_uploader_unittest.cc

@@ -37,7 +37,7 @@
 
 std::unique_ptr<KeyedService> CreateFeedbackUploaderService(
     content::BrowserContext* context) {
-  return base::WrapUnique(new feedback::FeedbackUploaderChrome(context));
+  return base::MakeUnique<feedback::FeedbackUploaderChrome>(context);
 }
 
 }  // namespace

diff --git a/components/guest_view/browser/guest_view_base.cc b/components/guest_view/browser/guest_view_base.cc
index c878c6e..f816a6ec 100644
--- a/components/guest_view/browser/guest_view_base.cc
+++ b/components/guest_view/browser/guest_view_base.cc

@@ -267,7 +267,7 @@
   args->SetInteger(kNewWidth, new_size.width());
   args->SetInteger(kNewHeight, new_size.height());
   DispatchEventToGuestProxy(
-      base::WrapUnique(new GuestViewEvent(kEventResize, std::move(args))));
+      base::MakeUnique<GuestViewEvent>(kEventResize, std::move(args)));
 }
 
 gfx::Size GuestViewBase::GetDefaultSize() const {

diff --git a/components/guest_view/browser/guest_view_message_filter.cc b/components/guest_view/browser/guest_view_message_filter.cc
index 4213918..bb17ea69 100644
--- a/components/guest_view/browser/guest_view_message_filter.cc
+++ b/components/guest_view/browser/guest_view_message_filter.cc

@@ -52,8 +52,7 @@
   auto* manager = GuestViewManager::FromBrowserContext(browser_context_);
   if (!manager) {
     manager = GuestViewManager::CreateWithDelegate(
-        browser_context_, base::WrapUnique(
-                              new GuestViewManagerDelegate()));
+        browser_context_, base::MakeUnique<GuestViewManagerDelegate>());
   }
   return manager;
 }

diff --git a/components/history/core/browser/visitsegment_database.cc b/components/history/core/browser/visitsegment_database.cc
index 0e8244e..afe0712 100644
--- a/components/history/core/browser/visitsegment_database.cc
+++ b/components/history/core/browser/visitsegment_database.cc

@@ -228,7 +228,7 @@
   while (statement.Step()) {
     SegmentID segment_id = statement.ColumnInt64(0);
     if (segment_id != previous_segment_id) {
-      segments.push_back(base::WrapUnique(new PageUsageData(segment_id)));
+      segments.push_back(base::MakeUnique<PageUsageData>(segment_id));
       previous_segment_id = segment_id;
     }
 

diff --git a/components/history/core/test/history_client_fake_bookmarks.cc b/components/history/core/test/history_client_fake_bookmarks.cc
index e14ee32..6759650 100644
--- a/components/history/core/test/history_client_fake_bookmarks.cc
+++ b/components/history/core/test/history_client_fake_bookmarks.cc

@@ -184,7 +184,7 @@
 
 std::unique_ptr<HistoryBackendClient>
 HistoryClientFakeBookmarks::CreateBackendClient() {
-  return base::WrapUnique(new HistoryBackendClientFakeBookmarks(bookmarks_));
+  return base::MakeUnique<HistoryBackendClientFakeBookmarks>(bookmarks_);
 }
 
 }  // namespace history

diff --git a/components/history/core/test/history_service_test_util.cc b/components/history/core/test/history_service_test_util.cc
index 012fd9e..e2d01eb 100644
--- a/components/history/core/test/history_service_test_util.cc
+++ b/components/history/core/test/history_service_test_util.cc

@@ -59,7 +59,7 @@
   base::RunLoop run_loop;
   base::CancelableTaskTracker tracker;
   history_service->ScheduleDBTask(
-      base::WrapUnique(new QuitTask(run_loop.QuitClosure())), &tracker);
+      base::MakeUnique<QuitTask>(run_loop.QuitClosure()), &tracker);
   run_loop.Run();
 
   // Spin the runloop again until idle.  The QuitTask above is destroyed via a

diff --git a/components/invalidation/impl/gcm_invalidation_bridge.cc b/components/invalidation/impl/gcm_invalidation_bridge.cc
index f1e2383..09aca1e 100644
--- a/components/invalidation/impl/gcm_invalidation_bridge.cc
+++ b/components/invalidation/impl/gcm_invalidation_bridge.cc

@@ -176,8 +176,8 @@
 std::unique_ptr<syncer::GCMNetworkChannelDelegate>
 GCMInvalidationBridge::CreateDelegate() {
   DCHECK(CalledOnValidThread());
-  return base::WrapUnique(new Core(weak_factory_.GetWeakPtr(),
-                                   base::ThreadTaskRunnerHandle::Get()));
+  return base::MakeUnique<Core>(weak_factory_.GetWeakPtr(),
+                                base::ThreadTaskRunnerHandle::Get());
 }
 
 void GCMInvalidationBridge::CoreInitializationDone(

diff --git a/components/invalidation/impl/sync_system_resources.cc b/components/invalidation/impl/sync_system_resources.cc
index 089f7a15..f4f04e0 100644
--- a/components/invalidation/impl/sync_system_resources.cc
+++ b/components/invalidation/impl/sync_system_resources.cc

@@ -170,14 +170,14 @@
     const notifier::NotifierOptions& notifier_options) {
   std::unique_ptr<notifier::PushClient> push_client(
       notifier::PushClient::CreateDefaultOnIOThread(notifier_options));
-  return base::WrapUnique(new PushClientChannel(std::move(push_client)));
+  return base::MakeUnique<PushClientChannel>(std::move(push_client));
 }
 
 std::unique_ptr<SyncNetworkChannel> SyncNetworkChannel::CreateGCMNetworkChannel(
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     std::unique_ptr<GCMNetworkChannelDelegate> delegate) {
-  return base::WrapUnique(
-      new GCMNetworkChannel(request_context_getter, std::move(delegate)));
+  return base::MakeUnique<GCMNetworkChannel>(request_context_getter,
+                                             std::move(delegate));
 }
 
 void SyncNetworkChannel::NotifyNetworkStatusChange(bool online) {

diff --git a/components/invalidation/impl/ticl_invalidation_service_unittest.cc b/components/invalidation/impl/ticl_invalidation_service_unittest.cc
index 6d24df6..67efc5e 100644
--- a/components/invalidation/impl/ticl_invalidation_service_unittest.cc
+++ b/components/invalidation/impl/ticl_invalidation_service_unittest.cc

@@ -68,7 +68,7 @@
     gcm_driver_.reset(new gcm::FakeGCMDriver());
     invalidation_service_.reset(new TiclInvalidationService(
         "TestUserAgent",
-        base::WrapUnique(new FakeIdentityProvider(&token_service_)),
+        base::MakeUnique<FakeIdentityProvider>(&token_service_),
         std::unique_ptr<TiclSettingsProvider>(new FakeTiclSettingsProvider),
         gcm_driver_.get(), NULL));
   }

diff --git a/components/metrics/file_metrics_provider.cc b/components/metrics/file_metrics_provider.cc
index 14d853a..aa81a0c 100644
--- a/components/metrics/file_metrics_provider.cc
+++ b/components/metrics/file_metrics_provider.cc

@@ -325,8 +325,8 @@
 
   // Create an allocator for the mapped file. Ownership passes to the allocator.
   source->allocator.reset(new base::PersistentHistogramAllocator(
-      base::WrapUnique(new base::FilePersistentMemoryAllocator(
-          std::move(mapped), 0, 0, base::StringPiece(), read_only))));
+      base::MakeUnique<base::FilePersistentMemoryAllocator>(
+          std::move(mapped), 0, 0, base::StringPiece(), read_only)));
 
   return ACCESS_RESULT_SUCCESS;
 }

diff --git a/components/metrics/metrics_log_manager_unittest.cc b/components/metrics/metrics_log_manager_unittest.cc
index 7a63460..48f95f8 100644
--- a/components/metrics/metrics_log_manager_unittest.cc
+++ b/components/metrics/metrics_log_manager_unittest.cc

@@ -133,11 +133,11 @@
   MetricsLogManager log_manager(&pref_service, 0);
   log_manager.LoadPersistedUnsentLogs();
 
-  log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-      "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service)));
+  log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+      "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service));
   log_manager.PauseCurrentLog();
-  log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-      "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service)));
+  log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+      "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service));
   log_manager.FinishCurrentLog();
   log_manager.ResumePausedLog();
   log_manager.StageNextLogForUpload();
@@ -173,11 +173,11 @@
     log_manager.LoadPersistedUnsentLogs();
     EXPECT_TRUE(log_manager.has_unsent_logs());
 
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service));
     log_manager.FinishCurrentLog();
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service));
     log_manager.StageNextLogForUpload();
     log_manager.FinishCurrentLog();
 
@@ -234,8 +234,8 @@
     MetricsLogManager log_manager(&pref_service, 0);
     log_manager.LoadPersistedUnsentLogs();
 
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service));
     log_manager.FinishCurrentLog();
     log_manager.StageNextLogForUpload();
     log_manager.PersistUnsentLogs();
@@ -249,8 +249,8 @@
     MetricsLogManager log_manager(&pref_service, 0);
     log_manager.LoadPersistedUnsentLogs();
 
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service));
     log_manager.FinishCurrentLog();
     log_manager.StageNextLogForUpload();
     log_manager.PersistUnsentLogs();
@@ -267,11 +267,11 @@
   MetricsLogManager log_manager(&pref_service, 1);
   log_manager.LoadPersistedUnsentLogs();
 
-  log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-      "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service)));
+  log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+      "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service));
   log_manager.FinishCurrentLog();
-  log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-      "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service)));
+  log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+      "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service));
   log_manager.FinishCurrentLog();
 
   // Only the ongoing log should be written out, due to the threshold.
@@ -289,11 +289,11 @@
     MetricsLogManager log_manager(&pref_service, 0);
     log_manager.LoadPersistedUnsentLogs();
 
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::INITIAL_STABILITY_LOG, &client, &pref_service));
     log_manager.FinishCurrentLog();
-    log_manager.BeginLoggingWithLog(base::WrapUnique(new MetricsLog(
-        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service)));
+    log_manager.BeginLoggingWithLog(base::MakeUnique<MetricsLog>(
+        "id", 0, MetricsLog::ONGOING_LOG, &client, &pref_service));
     log_manager.StageNextLogForUpload();
     log_manager.FinishCurrentLog();
     log_manager.DiscardStagedLog();

diff --git a/components/metrics/metrics_service.cc b/components/metrics/metrics_service.cc
index a472188..2c6b8ef0 100644
--- a/components/metrics/metrics_service.cc
+++ b/components/metrics/metrics_service.cc

@@ -1140,9 +1140,8 @@
 
 std::unique_ptr<MetricsLog> MetricsService::CreateLog(
     MetricsLog::LogType log_type) {
-  return base::WrapUnique(new MetricsLog(state_manager_->client_id(),
-                                         session_id_, log_type, client_,
-                                         local_state_));
+  return base::MakeUnique<MetricsLog>(state_manager_->client_id(), session_id_,
+                                      log_type, client_, local_state_);
 }
 
 void MetricsService::RecordCurrentEnvironment(MetricsLog* log) {

diff --git a/components/navigation_interception/intercept_navigation_delegate.cc b/components/navigation_interception/intercept_navigation_delegate.cc
index 23dab25..710c0c78 100644
--- a/components/navigation_interception/intercept_navigation_delegate.cc
+++ b/components/navigation_interception/intercept_navigation_delegate.cc

@@ -88,8 +88,8 @@
 std::unique_ptr<content::NavigationThrottle>
 InterceptNavigationDelegate::CreateThrottleFor(
     content::NavigationHandle* handle) {
-  return base::WrapUnique(new InterceptNavigationThrottle(
-      handle, base::Bind(&CheckIfShouldIgnoreNavigationOnUIThread), false));
+  return base::MakeUnique<InterceptNavigationThrottle>(
+      handle, base::Bind(&CheckIfShouldIgnoreNavigationOnUIThread), false);
 }
 
 // static

diff --git a/components/navigation_interception/intercept_navigation_throttle_unittest.cc b/components/navigation_interception/intercept_navigation_throttle_unittest.cc
index 33817bb..a32c2fc 100644
--- a/components/navigation_interception/intercept_navigation_throttle_unittest.cc
+++ b/components/navigation_interception/intercept_navigation_throttle_unittest.cc

@@ -65,11 +65,11 @@
         content::NavigationHandle::CreateNavigationHandleForTesting(url,
                                                                     main_rfh());
     test_handle->RegisterThrottleForTesting(
-        base::WrapUnique(new InterceptNavigationThrottle(
+        base::MakeUnique<InterceptNavigationThrottle>(
             test_handle.get(),
             base::Bind(&MockInterceptCallbackReceiver::ShouldIgnoreNavigation,
                        base::Unretained(mock_callback_receiver_.get())),
-            true)));
+            true));
     return test_handle->CallWillStartRequestForTesting(
         is_post, content::Referrer(), false, ui::PAGE_TRANSITION_LINK, false);
   }
@@ -79,11 +79,11 @@
         content::NavigationHandle::CreateNavigationHandleForTesting(
             GURL(kTestUrl), main_rfh());
     test_handle->RegisterThrottleForTesting(
-        base::WrapUnique(new InterceptNavigationThrottle(
+        base::MakeUnique<InterceptNavigationThrottle>(
             test_handle.get(),
             base::Bind(&MockInterceptCallbackReceiver::ShouldIgnoreNavigation,
                        base::Unretained(mock_callback_receiver_.get())),
-            true)));
+            true));
     test_handle->CallWillStartRequestForTesting(
         true, content::Referrer(), false, ui::PAGE_TRANSITION_LINK, false);
     return test_handle->CallWillRedirectRequestForTesting(GURL(kTestUrl), false,

diff --git a/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.cc b/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.cc
index 4e2cfdc..e990e6a0 100644
--- a/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.cc
+++ b/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.cc

@@ -184,6 +184,13 @@
       FROM_HERE, base::Bind(callback, gfx::Image()));
 }
 
+void BookmarkSuggestionsProvider::ClearHistory(
+    base::Time begin,
+    base::Time end,
+    const base::Callback<bool(const GURL& url)>& filter) {
+  // TODO(vitaliii): Implement. See crbug.com/641321.
+}
+
 void BookmarkSuggestionsProvider::ClearCachedSuggestions(Category category) {
   DCHECK_EQ(category, provided_category_);
   // Ignored.

diff --git a/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.h b/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.h
index e9bf12c5..7f75a2e 100644
--- a/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.h
+++ b/components/ntp_snippets/bookmarks/bookmark_suggestions_provider.h

@@ -42,6 +42,10 @@
   void DismissSuggestion(const std::string& suggestion_id) override;
   void FetchSuggestionImage(const std::string& suggestion_id,
                             const ImageFetchedCallback& callback) override;
+  void ClearHistory(
+      base::Time begin,
+      base::Time end,
+      const base::Callback<bool(const GURL& url)>& filter) override;
   void ClearCachedSuggestions(Category category) override;
   void GetDismissedSuggestionsForDebugging(
       Category category,

diff --git a/components/ntp_snippets/content_suggestion.h b/components/ntp_snippets/content_suggestion.h
index 86e306b..f289706 100644
--- a/components/ntp_snippets/content_suggestion.h
+++ b/components/ntp_snippets/content_suggestion.h

@@ -77,7 +77,6 @@
   GURL amp_url_;
   base::string16 title_;
   base::string16 snippet_text_;
-  GURL salient_image_url_;
   base::Time publish_date_;
   base::string16 publisher_name_;
   float score_;

diff --git a/components/ntp_snippets/content_suggestions_provider.h b/components/ntp_snippets/content_suggestions_provider.h
index 36cc5fb..d479eec 100644
--- a/components/ntp_snippets/content_suggestions_provider.h
+++ b/components/ntp_snippets/content_suggestions_provider.h

@@ -101,6 +101,17 @@
   virtual void FetchSuggestionImage(const std::string& suggestion_id,
                                     const ImageFetchedCallback& callback) = 0;
 
+  // Removes history from the specified time range where the URL matches the
+  // |filter|. The data removed depends on the provider. Note that the
+  // data outside the time range may be deleted, for example suggestions, which
+  // are based on history from that time range. Providers should immediately
+  // clear any data related to history from the specified time range where the
+  // URL matches the |filter|.
+  virtual void ClearHistory(
+      base::Time begin,
+      base::Time end,
+      const base::Callback<bool(const GURL& url)>& filter) = 0;
+
   // Clears all caches for the given category, so that the next fetch starts
   // from scratch.
   virtual void ClearCachedSuggestions(Category category) = 0;

diff --git a/components/ntp_snippets/content_suggestions_service.cc b/components/ntp_snippets/content_suggestions_service.cc
index 725d241..c1977e5 100644
--- a/components/ntp_snippets/content_suggestions_service.cc
+++ b/components/ntp_snippets/content_suggestions_service.cc

@@ -81,6 +81,15 @@
                                                          callback);
 }
 
+void ContentSuggestionsService::ClearHistory(
+    base::Time begin,
+    base::Time end,
+    const base::Callback<bool(const GURL& url)>& filter) {
+  for (const auto& provider : providers_) {
+    provider->ClearHistory(begin, end, filter);
+  }
+}
+
 void ContentSuggestionsService::ClearAllCachedSuggestions() {
   suggestions_by_category_.clear();
   id_category_map_.clear();

diff --git a/components/ntp_snippets/content_suggestions_service.h b/components/ntp_snippets/content_suggestions_service.h
index bc8fb93..8ddd4914 100644
--- a/components/ntp_snippets/content_suggestions_service.h
+++ b/components/ntp_snippets/content_suggestions_service.h

@@ -13,6 +13,7 @@
 #include "base/callback_forward.h"
 #include "base/observer_list.h"
 #include "base/optional.h"
+#include "base/time/time.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "components/ntp_snippets/category_factory.h"
 #include "components/ntp_snippets/category_status.h"
@@ -119,6 +120,16 @@
   // called only once per provider.
   void RegisterProvider(std::unique_ptr<ContentSuggestionsProvider> provider);
 
+  // Removes history from the specified time range where the URL matches the
+  // |filter| from all providers. The data removed depends on the provider. Note
+  // that the data outside the time range may be deleted, for example
+  // suggestions, which are based on history from that time range. Providers
+  // should immediately clear any data related to history from the specified
+  // time range where the URL matches the |filter|.
+  void ClearHistory(base::Time begin,
+                    base::Time end,
+                    const base::Callback<bool(const GURL& url)>& filter);
+
   // Removes all suggestions from all caches or internal stores in all
   // providers. See |ClearCachedSuggestions|.
   void ClearAllCachedSuggestions();

diff --git a/components/ntp_snippets/content_suggestions_service_unittest.cc b/components/ntp_snippets/content_suggestions_service_unittest.cc
index 44eea01..842b097d 100644
--- a/components/ntp_snippets/content_suggestions_service_unittest.cc
+++ b/components/ntp_snippets/content_suggestions_service_unittest.cc

@@ -100,6 +100,10 @@
     observer()->OnSuggestionInvalidated(this, category, suggestion_id);
   }
 
+  MOCK_METHOD3(ClearHistory,
+               void(base::Time begin,
+                    base::Time end,
+                    const base::Callback<bool(const GURL& url)>& filter));
   MOCK_METHOD1(ClearCachedSuggestions, void(Category category));
   MOCK_METHOD2(GetDismissedSuggestionsForDebugging,
                void(Category category,
@@ -565,4 +569,14 @@
   EXPECT_THAT(service()->GetCategories(), ElementsAre(remote, bookmarks));
 }
 
+TEST_F(ContentSuggestionsServiceTest, ShouldForwardClearHistory) {
+  Category category = FromKnownCategory(KnownCategories::DOWNLOADS);
+  MockProvider* provider = RegisterProvider(category);
+  base::Time begin = base::Time::FromTimeT(123),
+             end = base::Time::FromTimeT(456);
+  EXPECT_CALL(*provider, ClearHistory(begin, end, _));
+  base::Callback<bool(const GURL& url)> filter;
+  service()->ClearHistory(begin, end, filter);
+}
+
 }  // namespace ntp_snippets

diff --git a/components/ntp_snippets/ntp_snippets_database.cc b/components/ntp_snippets/ntp_snippets_database.cc
index 4b14279..547aaa1 100644
--- a/components/ntp_snippets/ntp_snippets_database.cc
+++ b/components/ntp_snippets/ntp_snippets_database.cc

@@ -84,8 +84,7 @@
 }
 
 void NTPSnippetsDatabase::DeleteSnippet(const std::string& snippet_id) {
-  DeleteSnippetsImpl(
-      base::WrapUnique(new std::vector<std::string>(1, snippet_id)));
+  DeleteSnippetsImpl(base::MakeUnique<std::vector<std::string>>(1, snippet_id));
 }
 
 void NTPSnippetsDatabase::DeleteSnippets(
@@ -117,15 +116,13 @@
   entries_to_save->emplace_back(snippet_id, std::move(image_proto));
 
   image_database_->UpdateEntries(
-      std::move(entries_to_save),
-      base::WrapUnique(new std::vector<std::string>()),
+      std::move(entries_to_save), base::MakeUnique<std::vector<std::string>>(),
       base::Bind(&NTPSnippetsDatabase::OnImageDatabaseSaved,
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
 void NTPSnippetsDatabase::DeleteImage(const std::string& snippet_id) {
-  DeleteImagesImpl(
-      base::WrapUnique(new std::vector<std::string>(1, snippet_id)));
+  DeleteImagesImpl(base::MakeUnique<std::vector<std::string>>(1, snippet_id));
 }
 
 void NTPSnippetsDatabase::OnDatabaseInited(bool success) {
@@ -259,8 +256,7 @@
     std::unique_ptr<std::vector<std::string>> keys_to_remove) {
   DCHECK(IsInitialized());
 
-  DeleteImagesImpl(
-      base::WrapUnique(new std::vector<std::string>(*keys_to_remove)));
+  DeleteImagesImpl(base::MakeUnique<std::vector<std::string>>(*keys_to_remove));
 
   std::unique_ptr<KeyEntryVector> entries_to_save(new KeyEntryVector());
   database_->UpdateEntries(std::move(entries_to_save),
@@ -283,8 +279,7 @@
   DCHECK(IsInitialized());
 
   image_database_->UpdateEntries(
-      base::WrapUnique(new ImageKeyEntryVector()),
-      std::move(keys_to_remove),
+      base::MakeUnique<ImageKeyEntryVector>(), std::move(keys_to_remove),
       base::Bind(&NTPSnippetsDatabase::OnImageDatabaseSaved,
                  weak_ptr_factory_.GetWeakPtr()));
 }

diff --git a/components/ntp_snippets/ntp_snippets_fetcher_unittest.cc b/components/ntp_snippets/ntp_snippets_fetcher_unittest.cc
index 8605b0ef..c83dec1 100644
--- a/components/ntp_snippets/ntp_snippets_fetcher_unittest.cc
+++ b/components/ntp_snippets/ntp_snippets_fetcher_unittest.cc

@@ -111,9 +111,9 @@
   std::unique_ptr<net::URLFetcher> CreateURLFetcher(
       int id, const GURL& url, net::URLFetcher::RequestType request_type,
       net::URLFetcherDelegate* d) override {
-    return base::WrapUnique(new net::FakeURLFetcher(
+    return base::MakeUnique<net::FakeURLFetcher>(
         url, d, /*response_data=*/std::string(), net::HTTP_NOT_FOUND,
-        net::URLRequestStatus::FAILED));
+        net::URLRequestStatus::FAILED);
   }
 };
 

diff --git a/components/ntp_snippets/ntp_snippets_service.cc b/components/ntp_snippets/ntp_snippets_service.cc
index 7e0fc87..dbc713966 100644
--- a/components/ntp_snippets/ntp_snippets_service.cc
+++ b/components/ntp_snippets/ntp_snippets_service.cc

@@ -335,6 +335,13 @@
                  base::Unretained(this), callback, snippet_id));
 }
 
+void NTPSnippetsService::ClearHistory(
+    base::Time begin,
+    base::Time end,
+    const base::Callback<bool(const GURL& url)>& filter) {
+  // TODO(vitaliii): Implement. See crbug.com/641321.
+}
+
 void NTPSnippetsService::ClearCachedSuggestions(Category category) {
   DCHECK_EQ(category, provided_category_);
   if (!initialized())

diff --git a/components/ntp_snippets/ntp_snippets_service.h b/components/ntp_snippets/ntp_snippets_service.h
index 555e092..b8e1d93 100644
--- a/components/ntp_snippets/ntp_snippets_service.h
+++ b/components/ntp_snippets/ntp_snippets_service.h

@@ -140,6 +140,10 @@
   void DismissSuggestion(const std::string& suggestion_id) override;
   void FetchSuggestionImage(const std::string& suggestion_id,
                             const ImageFetchedCallback& callback) override;
+  void ClearHistory(
+      base::Time begin,
+      base::Time end,
+      const base::Callback<bool(const GURL& url)>& filter) override;
   void ClearCachedSuggestions(Category category) override;
   void GetDismissedSuggestionsForDebugging(
       Category category,

diff --git a/components/ntp_snippets/ntp_snippets_service_unittest.cc b/components/ntp_snippets/ntp_snippets_service_unittest.cc
index fd7814d..974f2e8 100644
--- a/components/ntp_snippets/ntp_snippets_service_unittest.cc
+++ b/components/ntp_snippets/ntp_snippets_service_unittest.cc

@@ -455,7 +455,6 @@
   EXPECT_EQ(MakeUniqueID(*service, kSnippetUrl), suggestion.id());
   EXPECT_EQ(kSnippetTitle, base::UTF16ToUTF8(suggestion.title()));
   EXPECT_EQ(kSnippetText, base::UTF16ToUTF8(suggestion.snippet_text()));
-  // EXPECT_EQ(GURL(kSnippetSalientImage), suggestion.salient_image_url());
   EXPECT_EQ(GetDefaultCreationTime(), suggestion.publish_date());
   EXPECT_EQ(kSnippetPublisherName,
             base::UTF16ToUTF8(suggestion.publisher_name()));

diff --git a/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.cc b/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.cc
index 79675d4..dd2ed10 100644
--- a/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.cc
+++ b/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.cc

@@ -150,6 +150,13 @@
       FROM_HERE, base::Bind(callback, gfx::Image()));
 }
 
+void OfflinePageSuggestionsProvider::ClearHistory(
+    base::Time begin,
+    base::Time end,
+    const base::Callback<bool(const GURL& url)>& filter) {
+  // TODO(vitaliii): Implement. See crbug.com/641321.
+}
+
 void OfflinePageSuggestionsProvider::ClearCachedSuggestions(Category category) {
   // Ignored.
 }

diff --git a/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.h b/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.h
index aedba0d1..6a83e68 100644
--- a/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.h
+++ b/components/ntp_snippets/offline_pages/offline_page_suggestions_provider.h

@@ -53,6 +53,10 @@
   void DismissSuggestion(const std::string& suggestion_id) override;
   void FetchSuggestionImage(const std::string& suggestion_id,
                             const ImageFetchedCallback& callback) override;
+  void ClearHistory(
+      base::Time begin,
+      base::Time end,
+      const base::Callback<bool(const GURL& url)>& filter) override;
   void ClearCachedSuggestions(Category category) override;
   void GetDismissedSuggestionsForDebugging(
       Category category,

diff --git a/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.cc b/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.cc
index ee03cebf..f335ec1 100644
--- a/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.cc
+++ b/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.cc

@@ -86,6 +86,14 @@
       FROM_HERE, base::Bind(callback, gfx::Image()));
 }
 
+void PhysicalWebPageSuggestionsProvider::ClearHistory(
+    base::Time begin,
+    base::Time end,
+    const base::Callback<bool(const GURL& url)>& filter) {
+  // TODO(vitaliii): Implement when dismissed suggestions are supported. See
+  // crbug.com/641321.
+}
+
 void PhysicalWebPageSuggestionsProvider::ClearCachedSuggestions(
     Category category) {
   // Ignored

diff --git a/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.h b/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.h
index ce8eeb57..f79e43b 100644
--- a/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.h
+++ b/components/ntp_snippets/physical_web_pages/physical_web_page_suggestions_provider.h

@@ -48,6 +48,10 @@
   void DismissSuggestion(const std::string& suggestion_id) override;
   void FetchSuggestionImage(const std::string& suggestion_id,
                             const ImageFetchedCallback& callback) override;
+  void ClearHistory(
+      base::Time begin,
+      base::Time end,
+      const base::Callback<bool(const GURL& url)>& filter) override;
   void ClearCachedSuggestions(Category category) override;
   void GetDismissedSuggestionsForDebugging(
       Category category,

diff --git a/components/offline_pages/background/request_coordinator.cc b/components/offline_pages/background/request_coordinator.cc
index eacb002..d6fc985 100644
--- a/components/offline_pages/background/request_coordinator.cc
+++ b/components/offline_pages/background/request_coordinator.cc

@@ -406,7 +406,8 @@
   is_busy_ = false;
   active_request_.reset(nullptr);
 
-  if (status == Offliner::RequestStatus::FOREGROUND_CANCELED) {
+  if (status == Offliner::RequestStatus::FOREGROUND_CANCELED ||
+      status == Offliner::RequestStatus::PRERENDERING_CANCELED) {
     // Update the request for the canceled attempt.
     // TODO(dougarnett): See if we can conclusively identify other attempt
     // aborted cases to treat this way (eg, for Render Process Killed).
@@ -416,7 +417,11 @@
                           base::Bind(&RequestCoordinator::UpdateRequestCallback,
                                      weak_ptr_factory_.GetWeakPtr(),
                                      updated_request.client_id()));
-    NotifyCompleted(updated_request, SavePageStatus::FOREGROUND_CANCELED);
+    SavePageStatus notify_status =
+        (status == Offliner::RequestStatus::FOREGROUND_CANCELED)
+            ? SavePageStatus::FOREGROUND_CANCELED
+            : SavePageStatus::PRERENDER_CANCELED;
+    NotifyCompleted(updated_request, notify_status);
 
   } else if (status == Offliner::RequestStatus::SAVED) {
     // Remove the request from the queue if it succeeded.
@@ -459,11 +464,11 @@
     case Offliner::RequestStatus::SAVED:
     case Offliner::RequestStatus::SAVE_FAILED:
     case Offliner::RequestStatus::REQUEST_COORDINATOR_CANCELED:  // timeout
-    case Offliner::RequestStatus::PRERENDERING_CANCELED:
       // Consider processing another request in this service window.
       TryNextRequest();
       break;
     case Offliner::RequestStatus::FOREGROUND_CANCELED:
+    case Offliner::RequestStatus::PRERENDERING_CANCELED:
     case Offliner::RequestStatus::PRERENDERING_FAILED:
       // No further processing in this service window.
       break;

diff --git a/components/offline_pages/background/request_coordinator_unittest.cc b/components/offline_pages/background/request_coordinator_unittest.cc
index 330e6d7c..25c6311 100644
--- a/components/offline_pages/background/request_coordinator_unittest.cc
+++ b/components/offline_pages/background/request_coordinator_unittest.cc

@@ -543,6 +543,45 @@
   EXPECT_EQ(0L, found_request.completed_attempt_count());
 }
 
+TEST_F(RequestCoordinatorTest, OfflinerDonePrerenderingCancel) {
+  // Add a request to the queue, wait for callbacks to finish.
+  offline_pages::SavePageRequest request(kRequestId1, kUrl1, kClientId1,
+                                         base::Time::Now(), kUserRequested);
+  request.MarkAttemptStarted(base::Time::Now());
+  coordinator()->queue()->AddRequest(
+      request, base::Bind(&RequestCoordinatorTest::AddRequestDone,
+                          base::Unretained(this)));
+  PumpLoop();
+
+  // We need to give a callback to the request.
+  base::Callback<void(bool)> callback = base::Bind(
+      &RequestCoordinatorTest::EmptyCallbackFunction, base::Unretained(this));
+  coordinator()->SetProcessingCallbackForTest(callback);
+
+  // Set up device conditions for the test.
+  DeviceConditions device_conditions(false, 75,
+                                     net::NetworkChangeNotifier::CONNECTION_3G);
+  SetDeviceConditionsForTest(device_conditions);
+
+  // Call the OfflinerDoneCallback to simulate the request failed, wait
+  // for callbacks.
+  EnableOfflinerCallback(true);
+  SendOfflinerDoneCallback(request,
+                           Offliner::RequestStatus::PRERENDERING_CANCELED);
+  PumpLoop();
+
+  // Verify the request is not removed from the queue, and wait for callbacks.
+  coordinator()->queue()->GetRequests(base::Bind(
+      &RequestCoordinatorTest::GetRequestsDone, base::Unretained(this)));
+  PumpLoop();
+
+  // Request still in the queue.
+  EXPECT_EQ(1UL, last_requests().size());
+  // Verify prerendering cancel not counted as an attempt after all.
+  const SavePageRequest& found_request = last_requests().front();
+  EXPECT_EQ(0L, found_request.completed_attempt_count());
+}
+
 // This tests a StopProcessing call before we have actually started the
 // prerenderer.
 TEST_F(RequestCoordinatorTest, StartProcessingThenStopProcessingImmediately) {

diff --git a/components/offline_pages/background/request_notifier.h b/components/offline_pages/background/request_notifier.h
index 25daaca..d9c1b2e 100644
--- a/components/offline_pages/background/request_notifier.h
+++ b/components/offline_pages/background/request_notifier.h

@@ -16,6 +16,7 @@
   enum class SavePageStatus {
     SUCCESS,
     PRERENDER_FAILURE,
+    PRERENDER_CANCELED,
     FOREGROUND_CANCELED,
     SAVE_FAILED,
     EXPIRED,

diff --git a/components/omnibox_strings.grdp b/components/omnibox_strings.grdp
index 2617f43..2a1a7f0 100644
--- a/components/omnibox_strings.grdp
+++ b/components/omnibox_strings.grdp

@@ -13,6 +13,12 @@
   <message name="IDS_SECURE_CONNECTION_EV" desc="Short text shown in the location bar when the connection is secure with an EV cert.">
     <ph name="ORGANIZATION">$1<ex>Paypal Inc.</ex></ph> [<ph name="COUNTRY">$2<ex>US</ex></ph>]
   </message>
+  <message name="IDS_SECURE_VERBOSE_STATE" desc="Text for the Secure Omnibox Verbose State.">
+    Secure
+  </message>
+  <message name="IDS_NOT_SECURE_VERBOSE_STATE" desc="Text for the Now Secure Omnibox Verbose State.">
+    Not Secure
+  </message>
   <if expr="is_ios">
     <message name="IDS_OMNIBOX_EMPTY_HINT" desc="The text displayed in the omnibox when it is empty.">
       Search or type URL

diff --git a/components/policy/core/common/cloud/cloud_policy_client_unittest.cc b/components/policy/core/common/cloud/cloud_policy_client_unittest.cc
index 488f6c2..c07757b 100644
--- a/components/policy/core/common/cloud/cloud_policy_client_unittest.cc
+++ b/components/policy/core/common/cloud/cloud_policy_client_unittest.cc

@@ -111,7 +111,7 @@
 
     em::CertificateBasedDeviceRegisterRequest* cert_based_register_request =
         cert_based_registration_request_.mutable_cert_based_register_request();
-    fake_signing_service_.SignDataSynchronously(data.SerializeAsString(),
+    fake_signing_service_.SignRegistrationData(&data,
         cert_based_register_request->mutable_signed_request());
 
     em::PolicyFetchRequest* policy_fetch_request =

diff --git a/components/policy/core/common/cloud/mock_signing_service.cc b/components/policy/core/common/cloud/mock_signing_service.cc
index 8e281514..aece3a6 100644
--- a/components/policy/core/common/cloud/mock_signing_service.cc
+++ b/components/policy/core/common/cloud/mock_signing_service.cc

@@ -19,17 +19,22 @@
 
 FakeSigningService::~FakeSigningService() {}
 
+void FakeSigningService::SignRegistrationData(
+      const em::CertificateBasedDeviceRegistrationData* registration_data,
+      em::SignedData* signed_data) {
+    DoSignData(registration_data->SerializeAsString(), signed_data);
+  }
+
 void FakeSigningService::SignData(const std::string& data,
                                   const SigningCallback& callback) {
   em::SignedData signed_data;
-  if (success_) {
-    SignDataSynchronously(data, &signed_data);
-  }
+  if (success_)
+    DoSignData(data, &signed_data);
   callback.Run(success_, signed_data);
 }
 
-void FakeSigningService::SignDataSynchronously(const std::string& data,
-    em::SignedData* signed_data) {
+void FakeSigningService::DoSignData(const std::string& data,
+                                    em::SignedData* signed_data) {
   signed_data->set_data(data + kSignedDataNonce);
   signed_data->set_signature(kSignature);
   signed_data->set_extra_data_bytes(sizeof(kSignedDataNonce) - 1);
@@ -44,3 +49,4 @@
 MockSigningService::~MockSigningService() {}
 
 } // namespace policy
+

diff --git a/components/policy/core/common/cloud/mock_signing_service.h b/components/policy/core/common/cloud/mock_signing_service.h
index d8024f3a..beb3f092 100644
--- a/components/policy/core/common/cloud/mock_signing_service.h
+++ b/components/policy/core/common/cloud/mock_signing_service.h

@@ -17,17 +17,19 @@
   FakeSigningService();
   virtual ~FakeSigningService();
 
+  void SignRegistrationData(
+      const enterprise_management::CertificateBasedDeviceRegistrationData*
+          registration_data,
+      enterprise_management::SignedData* signed_data);
+
   void SignData(const std::string& data, const SigningCallback& callback)
       override;
 
-  // Useful for test setups without having to deal with callbacks.
-  void SignDataSynchronously(const std::string& data,
-      enterprise_management::SignedData* signed_data);
-
-  // Determine whether SignData will appear successful or not.
   void set_success(bool success);
-
  private:
+  void DoSignData(const std::string& data,
+                         enterprise_management::SignedData* signed_data);
+
   bool success_ = true;
 };
 

diff --git a/components/precache/core/precache_fetcher.cc b/components/precache/core/precache_fetcher.cc
index 8b7589b..90d05bb7 100644
--- a/components/precache/core/precache_fetcher.cc
+++ b/components/precache/core/precache_fetcher.cc

@@ -456,10 +456,10 @@
   // Fetch the precache configuration settings from the server.
   DCHECK(pool_.IsEmpty()) << "All parallel requests should be available";
   VLOG(3) << "Fetching " << config_url;
-  pool_.Add(base::WrapUnique(new Fetcher(
+  pool_.Add(base::MakeUnique<Fetcher>(
       request_context_.get(), config_url, std::string(),
       base::Bind(&PrecacheFetcher::OnConfigFetchComplete, AsWeakPtr()),
-      false /* is_resource_request */, std::numeric_limits<int32_t>::max())));
+      false /* is_resource_request */, std::numeric_limits<int32_t>::max()));
 }
 
 void PrecacheFetcher::StartNextResourceFetch() {
@@ -471,10 +471,10 @@
                  unfinished_work_->config_settings().max_bytes_total() -
                      unfinished_work_->total_bytes());
     VLOG(3) << "Fetching " << resource.first << " " << resource.second;
-    pool_.Add(base::WrapUnique(new Fetcher(
+    pool_.Add(base::MakeUnique<Fetcher>(
         request_context_.get(), resource.first, resource.second,
         base::Bind(&PrecacheFetcher::OnResourceFetchComplete, AsWeakPtr()),
-        true /* is_resource_request */, max_bytes)));
+        true /* is_resource_request */, max_bytes));
 
     resources_to_fetch_.pop_front();
   }
@@ -487,11 +487,11 @@
   // We only fetch one manifest at a time to keep the size of
   // resources_to_fetch_ as small as possible.
   VLOG(3) << "Fetching " << top_hosts_to_fetch_.front().manifest_url;
-  pool_.Add(base::WrapUnique(new Fetcher(
+  pool_.Add(base::MakeUnique<Fetcher>(
       request_context_.get(), top_hosts_to_fetch_.front().manifest_url,
       top_hosts_to_fetch_.front().hostname,
       base::Bind(&PrecacheFetcher::OnManifestFetchComplete, AsWeakPtr()),
-      false /* is_resource_request */, std::numeric_limits<int32_t>::max())));
+      false /* is_resource_request */, std::numeric_limits<int32_t>::max()));
   top_hosts_to_fetch_.pop_front();
 }
 

diff --git a/components/prefs/in_memory_pref_store_unittest.cc b/components/prefs/in_memory_pref_store_unittest.cc
index d8467945..a31757d 100644
--- a/components/prefs/in_memory_pref_store_unittest.cc
+++ b/components/prefs/in_memory_pref_store_unittest.cc

@@ -28,7 +28,7 @@
   EXPECT_FALSE(store_->GetValue(kTestPref, &value));
   EXPECT_FALSE(store_->GetMutableValue(kTestPref, &mutable_value));
 
-  store_->SetValue(kTestPref, base::WrapUnique(new base::FundamentalValue(42)),
+  store_->SetValue(kTestPref, base::MakeUnique<base::FundamentalValue>(42),
                    WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(store_->GetValue(kTestPref, &value));
   EXPECT_TRUE(base::FundamentalValue(42).Equals(value));
@@ -58,7 +58,7 @@
   store_->AddObserver(&observer_);
 
   // Triggers on SetValue.
-  store_->SetValue(kTestPref, base::WrapUnique(new base::FundamentalValue(42)),
+  store_->SetValue(kTestPref, base::MakeUnique<base::FundamentalValue>(42),
                    WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   observer_.VerifyAndResetChangedKey(kTestPref);
 
@@ -68,7 +68,7 @@
 
   // But not SetValueSilently.
   store_->SetValueSilently(kTestPref,
-                           base::WrapUnique(new base::FundamentalValue(42)),
+                           base::MakeUnique<base::FundamentalValue>(42),
                            WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_EQ(0u, observer_.changed_keys.size());
 
@@ -80,7 +80,7 @@
 
   // Doesn't make call on removed observers.
   store_->RemoveObserver(&observer_);
-  store_->SetValue(kTestPref, base::WrapUnique(new base::FundamentalValue(42)),
+  store_->SetValue(kTestPref, base::MakeUnique<base::FundamentalValue>(42),
                    WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   store_->RemoveValue(kTestPref, WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_EQ(0u, observer_.changed_keys.size());

diff --git a/components/prefs/json_pref_store_unittest.cc b/components/prefs/json_pref_store_unittest.cc
index 18299e2..32e30ea4 100644
--- a/components/prefs/json_pref_store_unittest.cc
+++ b/components/prefs/json_pref_store_unittest.cc

@@ -213,7 +213,7 @@
   base::FilePath some_path(FILE_PATH_LITERAL("/usr/sbin/"));
 
   pref_store->SetValue(kSomeDirectory,
-                       base::WrapUnique(new StringValue(some_path.value())),
+                       base::MakeUnique<StringValue>(some_path.value()),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(pref_store->GetValue(kSomeDirectory, &actual));
   EXPECT_TRUE(actual->GetAsString(&path));
@@ -226,7 +226,7 @@
   EXPECT_TRUE(boolean);
 
   pref_store->SetValue(kNewWindowsInTabs,
-                       base::WrapUnique(new FundamentalValue(false)),
+                       base::MakeUnique<FundamentalValue>(false),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(pref_store->GetValue(kNewWindowsInTabs, &actual));
   EXPECT_TRUE(actual->GetAsBoolean(&boolean));
@@ -236,16 +236,15 @@
   int integer = 0;
   EXPECT_TRUE(actual->GetAsInteger(&integer));
   EXPECT_EQ(20, integer);
-  pref_store->SetValue(kMaxTabs, base::WrapUnique(new FundamentalValue(10)),
+  pref_store->SetValue(kMaxTabs, base::MakeUnique<FundamentalValue>(10),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(pref_store->GetValue(kMaxTabs, &actual));
   EXPECT_TRUE(actual->GetAsInteger(&integer));
   EXPECT_EQ(10, integer);
 
-  pref_store->SetValue(
-      kLongIntPref,
-      base::WrapUnique(new StringValue(base::Int64ToString(214748364842LL))),
-      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
+  pref_store->SetValue(kLongIntPref, base::MakeUnique<StringValue>(
+                                         base::Int64ToString(214748364842LL)),
+                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(pref_store->GetValue(kLongIntPref, &actual));
   EXPECT_TRUE(actual->GetAsString(&string_value));
   int64_t value;
@@ -855,8 +854,7 @@
 
   // Set a normal pref and check that it gets scheduled to be written.
   ASSERT_FALSE(file_writer->HasPendingWrite());
-  pref_store->SetValue("normal",
-                       base::WrapUnique(new base::StringValue("normal")),
+  pref_store->SetValue("normal", base::MakeUnique<base::StringValue>("normal"),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   ASSERT_TRUE(file_writer->HasPendingWrite());
   file_writer->DoScheduledWrite();
@@ -865,8 +863,7 @@
 
   // Set a lossy pref and check that it is not scheduled to be written.
   // SetValue/RemoveValue.
-  pref_store->SetValue("lossy",
-                       base::WrapUnique(new base::StringValue("lossy")),
+  pref_store->SetValue("lossy", base::MakeUnique<base::StringValue>("lossy"),
                        WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_FALSE(file_writer->HasPendingWrite());
   pref_store->RemoveValue("lossy", WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
@@ -874,7 +871,7 @@
 
   // SetValueSilently/RemoveValueSilently.
   pref_store->SetValueSilently("lossy",
-                               base::WrapUnique(new base::StringValue("lossy")),
+                               base::MakeUnique<base::StringValue>("lossy"),
                                WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_FALSE(file_writer->HasPendingWrite());
   pref_store->RemoveValueSilently("lossy",
@@ -882,8 +879,7 @@
   ASSERT_FALSE(file_writer->HasPendingWrite());
 
   // ReportValueChanged.
-  pref_store->SetValue("lossy",
-                       base::WrapUnique(new base::StringValue("lossy")),
+  pref_store->SetValue("lossy", base::MakeUnique<base::StringValue>("lossy"),
                        WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_FALSE(file_writer->HasPendingWrite());
   pref_store->ReportValueChanged("lossy",
@@ -904,14 +900,12 @@
 
   // Set a lossy pref and check that it is not scheduled to be written.
   ASSERT_FALSE(file_writer->HasPendingWrite());
-  pref_store->SetValue("lossy",
-                       base::WrapUnique(new base::StringValue("lossy")),
+  pref_store->SetValue("lossy", base::MakeUnique<base::StringValue>("lossy"),
                        WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_FALSE(file_writer->HasPendingWrite());
 
   // Set a normal pref and check that it is scheduled to be written.
-  pref_store->SetValue("normal",
-                       base::WrapUnique(new base::StringValue("normal")),
+  pref_store->SetValue("normal", base::MakeUnique<base::StringValue>("normal"),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   ASSERT_TRUE(file_writer->HasPendingWrite());
 
@@ -928,14 +922,12 @@
 
   // Set a normal pref and check that it is scheduled to be written.
   ASSERT_FALSE(file_writer->HasPendingWrite());
-  pref_store->SetValue("normal",
-                       base::WrapUnique(new base::StringValue("normal")),
+  pref_store->SetValue("normal", base::MakeUnique<base::StringValue>("normal"),
                        WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   ASSERT_TRUE(file_writer->HasPendingWrite());
 
   // Set a lossy pref and check that the write is still scheduled.
-  pref_store->SetValue("lossy",
-                       base::WrapUnique(new base::StringValue("lossy")),
+  pref_store->SetValue("lossy", base::MakeUnique<base::StringValue>("lossy"),
                        WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_TRUE(file_writer->HasPendingWrite());
 
@@ -951,8 +943,7 @@
   ImportantFileWriter* file_writer = GetImportantFileWriter(pref_store);
 
   // Set a lossy pref and check that it is not scheduled to be written.
-  pref_store->SetValue("lossy",
-                       base::WrapUnique(new base::StringValue("lossy")),
+  pref_store->SetValue("lossy", base::MakeUnique<base::StringValue>("lossy"),
                        WriteablePrefStore::LOSSY_PREF_WRITE_FLAG);
   ASSERT_FALSE(file_writer->HasPendingWrite());
 

diff --git a/components/prefs/overlay_user_pref_store_unittest.cc b/components/prefs/overlay_user_pref_store_unittest.cc
index 1f8916a2..ae32081 100644
--- a/components/prefs/overlay_user_pref_store_unittest.cc
+++ b/components/prefs/overlay_user_pref_store_unittest.cc

@@ -49,22 +49,22 @@
   overlay_->AddObserver(&obs);
 
   // Check that underlay first value is reported.
-  underlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(42)),
+  underlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(42),
                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   obs.VerifyAndResetChangedKey(overlay_key);
 
   // Check that underlay overwriting is reported.
-  underlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(43)),
+  underlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(43),
                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   obs.VerifyAndResetChangedKey(overlay_key);
 
   // Check that overwriting change in overlay is reported.
-  overlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(44)),
+  overlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(44),
                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   obs.VerifyAndResetChangedKey(overlay_key);
 
   // Check that hidden underlay change is not reported.
-  underlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(45)),
+  underlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(45),
                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(obs.changed_keys.empty());
 
@@ -80,16 +80,16 @@
 
   // Check respecting of silence.
   overlay_->SetValueSilently(overlay_key,
-                             base::WrapUnique(new FundamentalValue(46)),
+                             base::MakeUnique<FundamentalValue>(46),
                              WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(obs.changed_keys.empty());
 
   overlay_->RemoveObserver(&obs);
 
   // Check successful unsubscription.
-  underlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(47)),
+  underlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(47),
                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
-  overlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(48)),
+  overlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(48),
                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   EXPECT_TRUE(obs.changed_keys.empty());
 }
@@ -99,7 +99,7 @@
   EXPECT_FALSE(overlay_->GetValue(overlay_key, &value));
   EXPECT_FALSE(underlay_->GetValue(overlay_key, &value));
 
-  underlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(42)),
+  underlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(42),
                       WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
 
   // Value shines through:
@@ -109,7 +109,7 @@
   EXPECT_TRUE(underlay_->GetValue(overlay_key, &value));
   EXPECT_TRUE(base::FundamentalValue(42).Equals(value));
 
-  overlay_->SetValue(overlay_key, base::WrapUnique(new FundamentalValue(43)),
+  overlay_->SetValue(overlay_key, base::MakeUnique<FundamentalValue>(43),
                      WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
 
   EXPECT_TRUE(overlay_->GetValue(overlay_key, &value));

diff --git a/components/prefs/pref_value_map_unittest.cc b/components/prefs/pref_value_map_unittest.cc
index 087e239..a000409 100644
--- a/components/prefs/pref_value_map_unittest.cc
+++ b/components/prefs/pref_value_map_unittest.cc

@@ -17,10 +17,9 @@
   EXPECT_FALSE(map.GetValue("key", &result));
   EXPECT_FALSE(result);
 
-  EXPECT_TRUE(map.SetValue("key", base::WrapUnique(new StringValue("test"))));
-  EXPECT_FALSE(map.SetValue("key", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      map.SetValue("key", base::WrapUnique(new StringValue("hi mom!"))));
+  EXPECT_TRUE(map.SetValue("key", base::MakeUnique<StringValue>("test")));
+  EXPECT_FALSE(map.SetValue("key", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(map.SetValue("key", base::MakeUnique<StringValue>("hi mom!")));
 
   EXPECT_TRUE(map.GetValue("key", &result));
   EXPECT_TRUE(StringValue("hi mom!").Equals(result));
@@ -28,7 +27,7 @@
 
 TEST(PrefValueMapTest, GetAndSetIntegerValue) {
   PrefValueMap map;
-  ASSERT_TRUE(map.SetValue("key", base::WrapUnique(new FundamentalValue(5))));
+  ASSERT_TRUE(map.SetValue("key", base::MakeUnique<FundamentalValue>(5)));
 
   int int_value = 0;
   EXPECT_TRUE(map.GetInteger("key", &int_value));
@@ -41,7 +40,7 @@
 
 TEST(PrefValueMapTest, SetDoubleValue) {
   PrefValueMap map;
-  ASSERT_TRUE(map.SetValue("key", base::WrapUnique(new FundamentalValue(5.5))));
+  ASSERT_TRUE(map.SetValue("key", base::MakeUnique<FundamentalValue>(5.5)));
 
   const Value* result = NULL;
   ASSERT_TRUE(map.GetValue("key", &result));
@@ -54,7 +53,7 @@
   PrefValueMap map;
   EXPECT_FALSE(map.RemoveValue("key"));
 
-  EXPECT_TRUE(map.SetValue("key", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(map.SetValue("key", base::MakeUnique<StringValue>("test")));
   EXPECT_TRUE(map.GetValue("key", NULL));
 
   EXPECT_TRUE(map.RemoveValue("key"));
@@ -65,7 +64,7 @@
 
 TEST(PrefValueMapTest, Clear) {
   PrefValueMap map;
-  EXPECT_TRUE(map.SetValue("key", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(map.SetValue("key", base::MakeUnique<StringValue>("test")));
   EXPECT_TRUE(map.GetValue("key", NULL));
 
   map.Clear();
@@ -75,12 +74,9 @@
 
 TEST(PrefValueMapTest, GetDifferingKeys) {
   PrefValueMap reference;
-  EXPECT_TRUE(
-      reference.SetValue("b", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      reference.SetValue("c", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      reference.SetValue("e", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(reference.SetValue("b", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(reference.SetValue("c", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(reference.SetValue("e", base::MakeUnique<StringValue>("test")));
 
   PrefValueMap check;
   std::vector<std::string> differing_paths;
@@ -92,9 +88,9 @@
   expected_differing_paths.push_back("e");
   EXPECT_EQ(expected_differing_paths, differing_paths);
 
-  EXPECT_TRUE(check.SetValue("a", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(check.SetValue("c", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(check.SetValue("d", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(check.SetValue("a", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(check.SetValue("c", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(check.SetValue("d", base::MakeUnique<StringValue>("test")));
 
   reference.GetDifferingKeys(&check, &differing_paths);
   expected_differing_paths.clear();
@@ -107,20 +103,14 @@
 
 TEST(PrefValueMapTest, SwapTwoMaps) {
   PrefValueMap first_map;
-  EXPECT_TRUE(
-      first_map.SetValue("a", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      first_map.SetValue("b", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      first_map.SetValue("c", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(first_map.SetValue("a", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(first_map.SetValue("b", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(first_map.SetValue("c", base::MakeUnique<StringValue>("test")));
 
   PrefValueMap second_map;
-  EXPECT_TRUE(
-      second_map.SetValue("d", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      second_map.SetValue("e", base::WrapUnique(new StringValue("test"))));
-  EXPECT_TRUE(
-      second_map.SetValue("f", base::WrapUnique(new StringValue("test"))));
+  EXPECT_TRUE(second_map.SetValue("d", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(second_map.SetValue("e", base::MakeUnique<StringValue>("test")));
+  EXPECT_TRUE(second_map.SetValue("f", base::MakeUnique<StringValue>("test")));
 
   first_map.Swap(&second_map);
 

diff --git a/components/prefs/testing_pref_store.cc b/components/prefs/testing_pref_store.cc
index 426bd64..2060c9f 100644
--- a/components/prefs/testing_pref_store.cc
+++ b/components/prefs/testing_pref_store.cc

@@ -118,17 +118,17 @@
 
 void TestingPrefStore::SetString(const std::string& key,
                                  const std::string& value) {
-  SetValue(key, base::WrapUnique(new base::StringValue(value)),
+  SetValue(key, base::MakeUnique<base::StringValue>(value),
            DEFAULT_PREF_WRITE_FLAGS);
 }
 
 void TestingPrefStore::SetInteger(const std::string& key, int value) {
-  SetValue(key, base::WrapUnique(new base::FundamentalValue(value)),
+  SetValue(key, base::MakeUnique<base::FundamentalValue>(value),
            DEFAULT_PREF_WRITE_FLAGS);
 }
 
 void TestingPrefStore::SetBoolean(const std::string& key, bool value) {
-  SetValue(key, base::WrapUnique(new base::FundamentalValue(value)),
+  SetValue(key, base::MakeUnique<base::FundamentalValue>(value),
            DEFAULT_PREF_WRITE_FLAGS);
 }
 

diff --git a/components/printing/test/print_test_content_renderer_client.cc b/components/printing/test/print_test_content_renderer_client.cc
index 7069ee0c..ef569f3 100644
--- a/components/printing/test/print_test_content_renderer_client.cc
+++ b/components/printing/test/print_test_content_renderer_client.cc

@@ -43,7 +43,7 @@
 void PrintTestContentRendererClient::RenderViewCreated(
     content::RenderView* render_view) {
   new printing::PrintWebViewHelper(
-      render_view, base::WrapUnique(new PrintWebViewHelperDelegate()));
+      render_view, base::MakeUnique<PrintWebViewHelperDelegate>());
 }
 
 }  // namespace printing

diff --git a/components/rappor/rappor_service.cc b/components/rappor/rappor_service.cc
index a572c17..40bae45 100644
--- a/components/rappor/rappor_service.cc
+++ b/components/rappor/rappor_service.cc

@@ -84,7 +84,7 @@
   }
   DVLOG(1) << "RapporService reporting to " << server_url.spec();
   InitializeInternal(
-      base::WrapUnique(new LogUploader(server_url, kMimeType, request_context)),
+      base::MakeUnique<LogUploader>(server_url, kMimeType, request_context),
       internal::LoadCohort(pref_service_), internal::LoadSecret(pref_service_));
 }
 

diff --git a/components/safe_browsing_db/database_manager_unittest.cc b/components/safe_browsing_db/database_manager_unittest.cc
index 3c862e6..92cdacf 100644
--- a/components/safe_browsing_db/database_manager_unittest.cc
+++ b/components/safe_browsing_db/database_manager_unittest.cc

@@ -132,7 +132,7 @@
  protected:
   void SetUp() override {
     V4GetHashProtocolManager::RegisterFactory(
-        base::WrapUnique(new TestV4GetHashProtocolManagerFactory()));
+        base::MakeUnique<TestV4GetHashProtocolManagerFactory>());
 
     db_manager_ = new TestSafeBrowsingDatabaseManager();
     db_manager_->StartOnIOThread(NULL, V4ProtocolConfig());

diff --git a/components/search_engines/default_search_policy_handler.cc b/components/search_engines/default_search_policy_handler.cc
index e88983d..d0fd097 100644
--- a/components/search_engines/default_search_policy_handler.cc
+++ b/components/search_engines/default_search_policy_handler.cc

@@ -369,7 +369,7 @@
   base::Value* value;
   base::ListValue* list_value;
   if (!prefs->GetValue(path, &value) || !value->GetAsList(&list_value))
-    prefs->SetValue(path, base::WrapUnique(new base::ListValue()));
+    prefs->SetValue(path, base::MakeUnique<base::ListValue>());
 }
 
 }  // namespace policy

diff --git a/components/search_engines/default_search_policy_handler_unittest.cc b/components/search_engines/default_search_policy_handler_unittest.cc
index 8308aa0..fece4e7a 100644
--- a/components/search_engines/default_search_policy_handler_unittest.cc
+++ b/components/search_engines/default_search_policy_handler_unittest.cc

@@ -88,22 +88,22 @@
   encodings->AppendString("UTF-8");
   policy->Set(key::kDefaultSearchProviderEnabled, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::FundamentalValue(true)), nullptr);
+              base::MakeUnique<base::FundamentalValue>(true), nullptr);
   policy->Set(key::kDefaultSearchProviderSearchURL, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kSearchURL)), nullptr);
+              base::MakeUnique<base::StringValue>(kSearchURL), nullptr);
   policy->Set(key::kDefaultSearchProviderName, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kName)), nullptr);
+              base::MakeUnique<base::StringValue>(kName), nullptr);
   policy->Set(key::kDefaultSearchProviderKeyword, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kKeyword)), nullptr);
+              base::MakeUnique<base::StringValue>(kKeyword), nullptr);
   policy->Set(key::kDefaultSearchProviderSuggestURL, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kSuggestURL)), nullptr);
+              base::MakeUnique<base::StringValue>(kSuggestURL), nullptr);
   policy->Set(key::kDefaultSearchProviderIconURL, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kIconURL)), nullptr);
+              base::MakeUnique<base::StringValue>(kIconURL), nullptr);
   policy->Set(key::kDefaultSearchProviderEncodings, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
               base::WrapUnique(encodings), nullptr);
@@ -112,17 +112,16 @@
               default_alternate_urls_.CreateDeepCopy(), nullptr);
   policy->Set(key::kDefaultSearchProviderSearchTermsReplacementKey,
               POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kReplacementKey)),
-              nullptr);
+              base::MakeUnique<base::StringValue>(kReplacementKey), nullptr);
   policy->Set(key::kDefaultSearchProviderImageURL, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kImageURL)), nullptr);
+              base::MakeUnique<base::StringValue>(kImageURL), nullptr);
   policy->Set(key::kDefaultSearchProviderImageURLPostParams,
               POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kImageParams)), nullptr);
+              base::MakeUnique<base::StringValue>(kImageParams), nullptr);
   policy->Set(key::kDefaultSearchProviderNewTabURL, POLICY_LEVEL_MANDATORY,
               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
-              base::WrapUnique(new base::StringValue(kNewTabURL)), nullptr);
+              base::MakeUnique<base::StringValue>(kNewTabURL), nullptr);
 }
 
 // Checks that if the default search policy is missing, that no elements of the

diff --git a/components/search_engines/search_engine_data_type_controller_unittest.cc b/components/search_engines/search_engine_data_type_controller_unittest.cc
index 7e0d1710..98d6914 100644
--- a/components/search_engines/search_engine_data_type_controller_unittest.cc
+++ b/components/search_engines/search_engine_data_type_controller_unittest.cc

@@ -72,8 +72,8 @@
     search_engine_dtc_->SetGenericChangeProcessorFactoryForTest(
         base::WrapUnique<sync_driver::GenericChangeProcessorFactory>(
             new sync_driver::FakeGenericChangeProcessorFactory(
-                base::WrapUnique(new sync_driver::FakeGenericChangeProcessor(
-                    syncer::SEARCH_ENGINES, this)))));
+                base::MakeUnique<sync_driver::FakeGenericChangeProcessor>(
+                    syncer::SEARCH_ENGINES, this))));
     EXPECT_CALL(model_load_callback_, Run(_, _));
   }
 

diff --git a/components/search_engines/template_url_service.cc b/components/search_engines/template_url_service.cc
index e89bfb30..772db1a9 100644
--- a/components/search_engines/template_url_service.cc
+++ b/components/search_engines/template_url_service.cc

@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/auto_reset.h"
+#include "base/callback.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/guid.h"
@@ -508,14 +509,14 @@
 
 void TemplateURLService::RemoveAutoGeneratedBetween(base::Time created_after,
                                                     base::Time created_before) {
-  RemoveAutoGeneratedForOriginBetween(GURL(), created_after, created_before);
+  RemoveAutoGeneratedForUrlsBetween(base::Callback<bool(const GURL&)>(),
+                                    created_after, created_before);
 }
 
-void TemplateURLService::RemoveAutoGeneratedForOriginBetween(
-    const GURL& origin,
+void TemplateURLService::RemoveAutoGeneratedForUrlsBetween(
+    const base::Callback<bool(const GURL&)>& url_filter,
     base::Time created_after,
     base::Time created_before) {
-  GURL o(origin.GetOrigin());
   bool should_notify = false;
   KeywordWebDataService::BatchModeScoper scoper(web_data_service_.get());
   for (size_t i = 0; i < template_urls_.size();) {
@@ -523,9 +524,9 @@
         (created_before.is_null() ||
          template_urls_[i]->date_created() < created_before) &&
         CanReplace(template_urls_[i]) &&
-        (o.is_empty() ||
-         template_urls_[i]->GenerateSearchURL(
-             search_terms_data()).GetOrigin() == o)) {
+        (url_filter.is_null() ||
+         url_filter.Run(
+             template_urls_[i]->GenerateSearchURL(search_terms_data())))) {
       RemoveNoNotify(template_urls_[i]);
       should_notify = true;
     } else {

diff --git a/components/search_engines/template_url_service.h b/components/search_engines/template_url_service.h
index 06124c5..a4ce879 100644
--- a/components/search_engines/template_url_service.h
+++ b/components/search_engines/template_url_service.h

@@ -202,11 +202,12 @@
                                   base::Time created_before);
 
   // Removes all auto-generated keywords that were created in the specified
-  // range for a specified |origin|. If |origin| is empty, deletes all
+  // range and match |url_filter|. If |url_filter| is_null(), deletes all
   // auto-generated keywords in the range.
-  void RemoveAutoGeneratedForOriginBetween(const GURL& origin,
-                                           base::Time created_after,
-                                           base::Time created_before);
+  void RemoveAutoGeneratedForUrlsBetween(
+      const base::Callback<bool(const GURL&)>& url_filter,
+      base::Time created_after,
+      base::Time created_before);
 
   // Adds a TemplateURL for an extension with an omnibox keyword.
   // Only 1 keyword is allowed for a given extension. If a keyword

diff --git a/components/search_engines/template_url_service_util_unittest.cc b/components/search_engines/template_url_service_util_unittest.cc
index 1ab6321..eeab116 100644
--- a/components/search_engines/template_url_service_util_unittest.cc
+++ b/components/search_engines/template_url_service_util_unittest.cc

@@ -34,8 +34,8 @@
     int prepopulate_id,
     const std::string& keyword,
     TemplateURLID id) {
-  return base::WrapUnique(new TemplateURL(
-      *CreatePrepopulateTemplateURLData(prepopulate_id, keyword, id)));
+  return base::MakeUnique<TemplateURL>(
+      *CreatePrepopulateTemplateURLData(prepopulate_id, keyword, id));
 }
 
 };  // namespace

diff --git a/components/search_provider_logos/logo_cache.cc b/components/search_provider_logos/logo_cache.cc
index 0ef01aeb..70fbe7b 100644
--- a/components/search_provider_logos/logo_cache.cc
+++ b/components/search_provider_logos/logo_cache.cc

@@ -70,7 +70,7 @@
   DCHECK(metadata_);
   DCHECK_EQ(metadata_->fingerprint, metadata.fingerprint);
 
-  UpdateMetadata(base::WrapUnique(new LogoMetadata(metadata)));
+  UpdateMetadata(base::MakeUnique<LogoMetadata>(metadata));
   WriteMetadata();
 }
 

diff --git a/components/signin/core/browser/test_signin_client.cc b/components/signin/core/browser/test_signin_client.cc
index cef73eb24..6595c36e 100644
--- a/components/signin/core/browser/test_signin_client.cc
+++ b/components/signin/core/browser/test_signin_client.cc

@@ -58,7 +58,7 @@
   scoped_refptr<WebDatabaseService> web_database =
       new WebDatabaseService(path, base::ThreadTaskRunnerHandle::Get(),
                              base::ThreadTaskRunnerHandle::Get());
-  web_database->AddTable(base::WrapUnique(new TokenServiceTable()));
+  web_database->AddTable(base::MakeUnique<TokenServiceTable>());
   web_database->LoadDatabase();
   database_ =
       new TokenWebData(web_database, base::ThreadTaskRunnerHandle::Get(),

diff --git a/components/signin/core/browser/webdata/token_web_data.cc b/components/signin/core/browser/webdata/token_web_data.cc
index 679333f9..8c390fa 100644
--- a/components/signin/core/browser/webdata/token_web_data.cc
+++ b/components/signin/core/browser/webdata/token_web_data.cc

@@ -50,8 +50,8 @@
   std::unique_ptr<WDTypedResult> GetAllTokens(WebDatabase* db) {
     std::map<std::string, std::string> map;
     TokenServiceTable::FromWebDatabase(db)->GetAllTokens(&map);
-    return base::WrapUnique(
-        new WDResult<std::map<std::string, std::string>>(TOKEN_RESULT, map));
+    return base::MakeUnique<WDResult<std::map<std::string, std::string>>>(
+        TOKEN_RESULT, map);
   }
 
  protected:

diff --git a/components/ssl_errors/error_classification_unittest.cc b/components/ssl_errors/error_classification_unittest.cc
index ff44211d..425a9f2e 100644
--- a/components/ssl_errors/error_classification_unittest.cc
+++ b/components/ssl_errors/error_classification_unittest.cc

@@ -193,8 +193,8 @@
   network_time::NetworkTimeTracker::RegisterPrefs(pref_service.registry());
   base::MessageLoop loop;
   network_time::NetworkTimeTracker network_time_tracker(
-      base::WrapUnique(new base::DefaultClock()),
-      base::WrapUnique(new base::DefaultTickClock()), &pref_service,
+      base::MakeUnique<base::DefaultClock>(),
+      base::MakeUnique<base::DefaultTickClock>(), &pref_service,
       new net::TestURLRequestContextGetter(
           base::ThreadTaskRunnerHandle::Get()));
 

diff --git a/components/subresource_filter/content/browser/subresource_filter_navigation_throttle_unittests.cc b/components/subresource_filter/content/browser/subresource_filter_navigation_throttle_unittests.cc
index 79e3165f..c51cbf9aa 100644
--- a/components/subresource_filter/content/browser/subresource_filter_navigation_throttle_unittests.cc
+++ b/components/subresource_filter/content/browser/subresource_filter_navigation_throttle_unittests.cc

@@ -71,7 +71,7 @@
   void SetUp() override {
     RenderViewHostTestHarness::SetUp();
     ContentSubresourceFilterDriverFactory::CreateForWebContents(
-        web_contents(), base::WrapUnique(new MockSubresourceFilterClient()));
+        web_contents(), base::MakeUnique<MockSubresourceFilterClient>());
 
     driver_ = new MockSubresourceFilterDriver(main_rfh());
     factory()->SetDriverForFrameHostForTesting(main_rfh(),

diff --git a/components/subresource_filter/core/browser/ruleset_service_unittest.cc b/components/subresource_filter/core/browser/ruleset_service_unittest.cc
index bd44816..272ac156 100644
--- a/components/subresource_filter/core/browser/ruleset_service_unittest.cc
+++ b/components/subresource_filter/core/browser/ruleset_service_unittest.cc

@@ -151,8 +151,8 @@
   }
 
   std::unique_ptr<RulesetService> CreateRulesetService() {
-    return base::WrapUnique(
-        new RulesetService(&pref_service_, task_runner_, base_dir()));
+    return base::MakeUnique<RulesetService>(&pref_service_, task_runner_,
+                                            base_dir());
   }
 
   void ResetService(std::unique_ptr<RulesetService> new_service = nullptr) {

diff --git a/components/suggestions/image_encoder_ios.mm b/components/suggestions/image_encoder_ios.mm
index 1fe64d05..d182926 100644
--- a/components/suggestions/image_encoder_ios.mm
+++ b/components/suggestions/image_encoder_ios.mm

@@ -17,8 +17,8 @@
                                                size_t size) {
   NSData* data = [NSData dataWithBytes:encoded_data length:size];
   UIImage* image = [UIImage imageWithData:data scale:1.0];
-  return base::WrapUnique(
-      new SkBitmap(skia::CGImageToSkBitmap(image.CGImage, [image size], YES)));
+  return base::MakeUnique<SkBitmap>(
+      skia::CGImageToSkBitmap(image.CGImage, [image size], YES));
 }
 
 bool EncodeSkBitmapToJPEG(const SkBitmap& bitmap,

diff --git a/components/sync/core/sync_encryption_handler.h b/components/sync/core/sync_encryption_handler.h
index 09a6298e..41a7b95e 100644
--- a/components/sync/core/sync_encryption_handler.h
+++ b/components/sync/core/sync_encryption_handler.h

@@ -166,10 +166,6 @@
   // types are encrypted.
   virtual bool IsEncryptEverythingEnabled() const = 0;
 
-  // Returns the current state of the passphrase needed to decrypt the
-  // bag of encryption keys in the nigori node.
-  virtual PassphraseType GetPassphraseType() const = 0;
-
   // The set of types that are always encrypted.
   static ModelTypeSet SensitiveTypes();
 };

diff --git a/components/sync/core_impl/sync_encryption_handler_impl.cc b/components/sync/core_impl/sync_encryption_handler_impl.cc
index 1f0b234a..84bf91a 100644
--- a/components/sync/core_impl/sync_encryption_handler_impl.cc
+++ b/components/sync/core_impl/sync_encryption_handler_impl.cc

@@ -195,8 +195,11 @@
 }  // namespace
 
 SyncEncryptionHandlerImpl::Vault::Vault(Encryptor* encryptor,
-                                        ModelTypeSet encrypted_types)
-    : cryptographer(encryptor), encrypted_types(encrypted_types) {}
+                                        ModelTypeSet encrypted_types,
+                                        PassphraseType passphrase_type)
+    : cryptographer(encryptor),
+      encrypted_types(encrypted_types),
+      passphrase_type(passphrase_type) {}
 
 SyncEncryptionHandlerImpl::Vault::~Vault() {}
 
@@ -206,9 +209,10 @@
     const std::string& restored_key_for_bootstrapping,
     const std::string& restored_keystore_key_for_bootstrapping)
     : user_share_(user_share),
-      vault_unsafe_(encryptor, SensitiveTypes()),
+      vault_unsafe_(encryptor,
+                    SensitiveTypes(),
+                    PassphraseType::IMPLICIT_PASSPHRASE),
       encrypt_everything_(false),
-      passphrase_type_(PassphraseType::IMPLICIT_PASSPHRASE),
       nigori_overwrite_count_(0),
       weak_ptr_factory_(this) {
   // Restore the cryptographer's previous keys. Note that we don't add the
@@ -248,7 +252,8 @@
   }
 
   UMA_HISTOGRAM_ENUMERATION(
-      "Sync.PassphraseType", static_cast<unsigned>(GetPassphraseType()),
+      "Sync.PassphraseType",
+      static_cast<unsigned>(GetPassphraseType(trans.GetWrappedTrans())),
       static_cast<unsigned>(PassphraseType::PASSPHRASE_TYPE_SIZE));
 
   bool has_pending_keys =
@@ -263,7 +268,8 @@
     UMA_HISTOGRAM_ENUMERATION("Sync.NigoriMigrationState", MIGRATED,
                               MIGRATION_STATE_SIZE);
     if (has_pending_keys &&
-        passphrase_type_ == PassphraseType::KEYSTORE_PASSPHRASE) {
+        GetPassphraseType(trans.GetWrappedTrans()) ==
+            PassphraseType::KEYSTORE_PASSPHRASE) {
       // If this is happening, it means the keystore decryptor is either
       // undecryptable with the available keystore keys or does not match the
       // nigori keybag's encryption key. Otherwise we're simply missing the
@@ -359,7 +365,8 @@
   if (cryptographer->has_pending_keys())
     pending_keys = cryptographer->GetPendingKeys();
   bool success = false;
-
+  PassphraseType* passphrase_type =
+      &UnlockVaultMutable(trans.GetWrappedTrans())->passphrase_type;
   // There are six cases to handle here:
   // 1. The user has no pending keys and is setting their current GAIA password
   //    as the encryption passphrase. This happens either during first time sync
@@ -380,7 +387,7 @@
   // password). If the account is using an explicit (custom) passphrase, the
   // bootstrap token will be derived from the most recently provided explicit
   // passphrase (that was able to decrypt the data).
-  if (!IsExplicitPassphrase(passphrase_type_)) {
+  if (!IsExplicitPassphrase(*passphrase_type)) {
     if (!cryptographer->has_pending_keys()) {
       if (cryptographer->AddKey(key_params)) {
         // Case 1 and 2. We set a new GAIA passphrase when there are no pending
@@ -388,11 +395,12 @@
         // one (2) when there are no pending keys.
         if (is_explicit) {
           DVLOG(1) << "Setting explicit passphrase for encryption.";
-          passphrase_type_ = PassphraseType::CUSTOM_PASSPHRASE;
+          *passphrase_type = PassphraseType::CUSTOM_PASSPHRASE;
           custom_passphrase_time_ = base::Time::Now();
           FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
                             OnPassphraseTypeChanged(
-                                passphrase_type_, GetExplicitPassphraseTime()));
+                                *passphrase_type,
+                                GetExplicitPassphraseTime(*passphrase_type)));
         } else {
           DVLOG(1) << "Setting implicit passphrase for encryption.";
         }
@@ -446,7 +454,7 @@
         }
       }     // is_explicit
     }       // cryptographer->has_pending_keys()
-  } else {  // IsExplicitPassphrase(passphrase_type_) == true.
+  } else {  // IsExplicitPassphrase(passphrase_type) == true.
     // Case 6. We do not want to override a previously set explicit passphrase,
     // so we return a failure.
     DVLOG(1) << "Failing because an explicit passphrase is already set.";
@@ -486,7 +494,7 @@
   // decrypting with a gaia passphrase, and therefore bypass the
   // DecryptPendingKeysWithExplicitPassphrase logic.
   if (IsNigoriMigratedToKeystore(node.GetNigoriSpecifics()) &&
-      IsExplicitPassphrase(passphrase_type_)) {
+      IsExplicitPassphrase(GetPassphraseType(trans.GetWrappedTrans()))) {
     DecryptPendingKeysWithExplicitPassphrase(passphrase, &trans, &node);
     return;
   }
@@ -520,7 +528,7 @@
   //    encrypted account (after changing passwords).
   // 9. The user is providing a previously set explicit passphrase to decrypt
   //    the pending keys.
-  if (!IsExplicitPassphrase(passphrase_type_)) {
+  if (!IsExplicitPassphrase(GetPassphraseType(trans.GetWrappedTrans()))) {
     if (cryptographer->is_initialized()) {
       // We only want to change the default encryption key to the pending
       // one if the pending keybag already contains the current default.
@@ -626,11 +634,6 @@
   return encrypt_everything_;
 }
 
-PassphraseType SyncEncryptionHandlerImpl::GetPassphraseType() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return passphrase_type_;
-}
-
 // Note: this is called from within a syncable transaction, so we need to post
 // tasks if we want to do any work that creates a new sync_api transaction.
 void SyncEncryptionHandlerImpl::ApplyNigoriUpdate(
@@ -717,7 +720,8 @@
 
   // Note that triggering migration will have no effect if we're already
   // properly migrated with the newest keystore keys.
-  if (ShouldTriggerMigration(nigori, *cryptographer)) {
+  if (ShouldTriggerMigration(nigori, *cryptographer,
+                             GetPassphraseType(trans))) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::Bind(&SyncEncryptionHandlerImpl::RewriteNigori,
                               weak_ptr_factory_.GetWeakPtr()));
@@ -731,6 +735,11 @@
   return UnlockVault(trans).encrypted_types;
 }
 
+PassphraseType SyncEncryptionHandlerImpl::GetPassphraseType(
+    syncable::BaseTransaction* const trans) const {
+  return UnlockVault(trans).passphrase_type;
+}
+
 Cryptographer* SyncEncryptionHandlerImpl::GetCryptographerUnsafe() {
   DCHECK(thread_checker_.CalledOnValidThread());
   return &vault_unsafe_.cryptographer;
@@ -864,6 +873,7 @@
     custom_passphrase_time_ = ProtoTimeToTime(nigori.custom_passphrase_time());
   }
   bool is_nigori_migrated = IsNigoriMigratedToKeystore(nigori);
+  PassphraseType* passphrase_type = &UnlockVaultMutable(trans)->passphrase_type;
   if (is_nigori_migrated) {
     migration_time_ = ProtoTimeToTime(nigori.keystore_migration_time());
     PassphraseType nigori_passphrase_type =
@@ -877,19 +887,20 @@
     // Note: frozen implicit -> custom is not technically a valid transition,
     // but we let it through here as well in case future versions do add support
     // for this transition.
-    if (passphrase_type_ != nigori_passphrase_type &&
+    if (*passphrase_type != nigori_passphrase_type &&
         nigori_passphrase_type != PassphraseType::IMPLICIT_PASSPHRASE &&
-        (passphrase_type_ == PassphraseType::IMPLICIT_PASSPHRASE ||
+        (*passphrase_type == PassphraseType::IMPLICIT_PASSPHRASE ||
          nigori_passphrase_type == PassphraseType::CUSTOM_PASSPHRASE)) {
       DVLOG(1) << "Changing passphrase state from "
-               << PassphraseTypeToString(passphrase_type_) << " to "
+               << PassphraseTypeToString(*passphrase_type) << " to "
                << PassphraseTypeToString(nigori_passphrase_type);
-      passphrase_type_ = nigori_passphrase_type;
-      FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_,
-                                                GetExplicitPassphraseTime()));
+      *passphrase_type = nigori_passphrase_type;
+      FOR_EACH_OBSERVER(
+          SyncEncryptionHandler::Observer, observers_,
+          OnPassphraseTypeChanged(*passphrase_type,
+                                  GetExplicitPassphraseTime(*passphrase_type)));
     }
-    if (passphrase_type_ == PassphraseType::KEYSTORE_PASSPHRASE &&
+    if (*passphrase_type == PassphraseType::KEYSTORE_PASSPHRASE &&
         encrypt_everything_) {
       // This is the case where another client that didn't support keystore
       // encryption attempted to enable full encryption. We detect it
@@ -899,20 +910,22 @@
       // type, we will trigger a rewrite and subsequently a re-migration.
       DVLOG(1) << "Changing passphrase state to FROZEN_IMPLICIT_PASSPHRASE "
                << "due to full encryption.";
-      passphrase_type_ = PassphraseType::FROZEN_IMPLICIT_PASSPHRASE;
-      FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_,
-                                                GetExplicitPassphraseTime()));
+      *passphrase_type = PassphraseType::FROZEN_IMPLICIT_PASSPHRASE;
+      FOR_EACH_OBSERVER(
+          SyncEncryptionHandler::Observer, observers_,
+          OnPassphraseTypeChanged(*passphrase_type,
+                                  GetExplicitPassphraseTime(*passphrase_type)));
     }
   } else {
     // It's possible that while we're waiting for migration a client that does
     // not have keystore encryption enabled switches to a custom passphrase.
     if (nigori.keybag_is_frozen() &&
-        passphrase_type_ != PassphraseType::CUSTOM_PASSPHRASE) {
-      passphrase_type_ = PassphraseType::CUSTOM_PASSPHRASE;
-      FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_,
-                                                GetExplicitPassphraseTime()));
+        *passphrase_type != PassphraseType::CUSTOM_PASSPHRASE) {
+      *passphrase_type = PassphraseType::CUSTOM_PASSPHRASE;
+      FOR_EACH_OBSERVER(
+          SyncEncryptionHandler::Observer, observers_,
+          OnPassphraseTypeChanged(*passphrase_type,
+                                  GetExplicitPassphraseTime(*passphrase_type)));
     }
   }
 
@@ -979,14 +992,14 @@
   // state.
   bool passphrase_type_matches = true;
   if (!is_nigori_migrated) {
-    DCHECK(passphrase_type_ == PassphraseType::CUSTOM_PASSPHRASE ||
-           passphrase_type_ == PassphraseType::IMPLICIT_PASSPHRASE);
+    DCHECK(*passphrase_type == PassphraseType::CUSTOM_PASSPHRASE ||
+           *passphrase_type == PassphraseType::IMPLICIT_PASSPHRASE);
     passphrase_type_matches =
-        nigori.keybag_is_frozen() == IsExplicitPassphrase(passphrase_type_);
+        nigori.keybag_is_frozen() == IsExplicitPassphrase(*passphrase_type);
   } else {
     passphrase_type_matches =
         (ProtoPassphraseTypeToEnum(nigori.passphrase_type()) ==
-         passphrase_type_);
+         *passphrase_type);
   }
   if (!passphrase_type_matches ||
       nigori.encrypt_everything() != encrypt_everything_ ||
@@ -1101,7 +1114,8 @@
   DCHECK(IsNigoriMigratedToKeystore(nigori_node->GetNigoriSpecifics()));
   KeyParams key_params = {"localhost", "dummy", passphrase};
 
-  if (passphrase_type_ != PassphraseType::KEYSTORE_PASSPHRASE) {
+  if (GetPassphraseType(trans->GetWrappedTrans()) !=
+      PassphraseType::KEYSTORE_PASSPHRASE) {
     DVLOG(1) << "Failing to set a custom passphrase because one has already "
              << "been set.";
     FinishSetPassphrase(false, std::string(), trans, nigori_node);
@@ -1129,11 +1143,14 @@
 
   DVLOG(1) << "Setting custom passphrase.";
   cryptographer->GetBootstrapToken(&bootstrap_token);
-  passphrase_type_ = PassphraseType::CUSTOM_PASSPHRASE;
+  PassphraseType* passphrase_type =
+      &UnlockVaultMutable(trans->GetWrappedTrans())->passphrase_type;
+  *passphrase_type = PassphraseType::CUSTOM_PASSPHRASE;
   custom_passphrase_time_ = base::Time::Now();
   FOR_EACH_OBSERVER(
       SyncEncryptionHandler::Observer, observers_,
-      OnPassphraseTypeChanged(passphrase_type_, GetExplicitPassphraseTime()));
+      OnPassphraseTypeChanged(*passphrase_type,
+                              GetExplicitPassphraseTime(*passphrase_type)));
   FinishSetPassphrase(true, bootstrap_token, trans, nigori_node);
 }
 
@@ -1157,7 +1174,7 @@
     WriteTransaction* trans,
     WriteNode* nigori_node) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(IsExplicitPassphrase(passphrase_type_));
+  DCHECK(IsExplicitPassphrase(GetPassphraseType(trans->GetWrappedTrans())));
   KeyParams key_params = {"localhost", "dummy", passphrase};
 
   Cryptographer* cryptographer =
@@ -1171,7 +1188,7 @@
     return;
   }
 
-  DCHECK(IsExplicitPassphrase(passphrase_type_));
+  DCHECK(IsExplicitPassphrase(GetPassphraseType(trans->GetWrappedTrans())));
   bool success = false;
   std::string bootstrap_token;
   if (cryptographer->DecryptPendingKeys(key_params)) {
@@ -1243,11 +1260,13 @@
     if (!cryptographer.GetKeys(nigori.mutable_encryption_keybag()))
       NOTREACHED();
     if (IsNigoriMigratedToKeystore(nigori)) {
-      DCHECK(keystore_key_.empty() || IsExplicitPassphrase(passphrase_type_));
+      DCHECK(keystore_key_.empty() ||
+             IsExplicitPassphrase(GetPassphraseType(trans->GetWrappedTrans())));
       DVLOG(1) << "Leaving nigori migration state untouched after setting"
                << " passphrase.";
     } else {
-      nigori.set_keybag_is_frozen(IsExplicitPassphrase(passphrase_type_));
+      nigori.set_keybag_is_frozen(
+          IsExplicitPassphrase(GetPassphraseType(trans->GetWrappedTrans())));
     }
     // If we set a new custom passphrase, store the timestamp.
     if (!custom_passphrase_time_.is_null()) {
@@ -1299,7 +1318,8 @@
 
 bool SyncEncryptionHandlerImpl::ShouldTriggerMigration(
     const sync_pb::NigoriSpecifics& nigori,
-    const Cryptographer& cryptographer) const {
+    const Cryptographer& cryptographer,
+    PassphraseType passphrase_type) const {
   DCHECK(thread_checker_.CalledOnValidThread());
   // Don't migrate if there are pending encryption keys (because data
   // encrypted with the pending keys will not be decryptable).
@@ -1312,13 +1332,13 @@
     // implicit passphrase but does have full encryption, re-migrate.
     // Note that this is to defend against other clients without keystore
     // encryption enabled transitioning to states that are no longer valid.
-    if (passphrase_type_ != PassphraseType::KEYSTORE_PASSPHRASE &&
+    if (passphrase_type != PassphraseType::KEYSTORE_PASSPHRASE &&
         nigori.passphrase_type() ==
             sync_pb::NigoriSpecifics::KEYSTORE_PASSPHRASE) {
       return true;
-    } else if (IsExplicitPassphrase(passphrase_type_) && !encrypt_everything_) {
+    } else if (IsExplicitPassphrase(passphrase_type) && !encrypt_everything_) {
       return true;
-    } else if (passphrase_type_ == PassphraseType::KEYSTORE_PASSPHRASE &&
+    } else if (passphrase_type == PassphraseType::KEYSTORE_PASSPHRASE &&
                encrypt_everything_) {
       return true;
     } else if (cryptographer.is_ready() &&
@@ -1360,21 +1380,23 @@
       nigori_node->GetNigoriSpecifics();
   Cryptographer* cryptographer =
       &UnlockVaultMutable(trans->GetWrappedTrans())->cryptographer;
-
-  if (!ShouldTriggerMigration(old_nigori, *cryptographer))
+  PassphraseType* passphrase_type =
+      &UnlockVaultMutable(trans->GetWrappedTrans())->passphrase_type;
+  if (!ShouldTriggerMigration(old_nigori, *cryptographer, *passphrase_type))
     return false;
 
   DVLOG(1) << "Starting nigori migration to keystore support.";
   sync_pb::NigoriSpecifics migrated_nigori(old_nigori);
 
-  PassphraseType new_passphrase_type = passphrase_type_;
+  PassphraseType new_passphrase_type =
+      GetPassphraseType(trans->GetWrappedTrans());
   bool new_encrypt_everything = encrypt_everything_;
-  if (encrypt_everything_ && !IsExplicitPassphrase(passphrase_type_)) {
+  if (encrypt_everything_ && !IsExplicitPassphrase(*passphrase_type)) {
     DVLOG(1) << "Switching to frozen implicit passphrase due to already having "
              << "full encryption.";
     new_passphrase_type = PassphraseType::FROZEN_IMPLICIT_PASSPHRASE;
     migrated_nigori.clear_keystore_decryptor_token();
-  } else if (IsExplicitPassphrase(passphrase_type_)) {
+  } else if (IsExplicitPassphrase(*passphrase_type)) {
     DVLOG_IF(1, !encrypt_everything_) << "Enabling encrypt everything due to "
                                       << "explicit passphrase";
     new_encrypt_everything = true;
@@ -1466,11 +1488,12 @@
 
   FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
                     OnCryptographerStateChanged(cryptographer));
-  if (passphrase_type_ != new_passphrase_type) {
-    passphrase_type_ = new_passphrase_type;
+  if (*passphrase_type != new_passphrase_type) {
+    *passphrase_type = new_passphrase_type;
     FOR_EACH_OBSERVER(
         SyncEncryptionHandler::Observer, observers_,
-        OnPassphraseTypeChanged(passphrase_type_, GetExplicitPassphraseTime()));
+        OnPassphraseTypeChanged(*passphrase_type,
+                                GetExplicitPassphraseTime(*passphrase_type)));
   }
 
   if (new_encrypt_everything && !encrypt_everything_) {
@@ -1639,10 +1662,11 @@
   return false;
 }
 
-base::Time SyncEncryptionHandlerImpl::GetExplicitPassphraseTime() const {
-  if (passphrase_type_ == PassphraseType::FROZEN_IMPLICIT_PASSPHRASE)
+base::Time SyncEncryptionHandlerImpl::GetExplicitPassphraseTime(
+    PassphraseType passphrase_type) const {
+  if (passphrase_type == PassphraseType::FROZEN_IMPLICIT_PASSPHRASE)
     return migration_time();
-  else if (passphrase_type_ == PassphraseType::CUSTOM_PASSPHRASE)
+  else if (passphrase_type == PassphraseType::CUSTOM_PASSPHRASE)
     return custom_passphrase_time();
   return base::Time();
 }

diff --git a/components/sync/core_impl/sync_encryption_handler_impl.h b/components/sync/core_impl/sync_encryption_handler_impl.h
index 08f99e3..c08ef6df 100644
--- a/components/sync/core_impl/sync_encryption_handler_impl.h
+++ b/components/sync/core_impl/sync_encryption_handler_impl.h

@@ -61,7 +61,6 @@
   void SetDecryptionPassphrase(const std::string& passphrase) override;
   void EnableEncryptEverything() override;
   bool IsEncryptEverythingEnabled() const override;
-  PassphraseType GetPassphraseType() const override;
 
   // NigoriHandler implementation.
   // Note: all methods are invoked while the caller holds a transaction.
@@ -77,6 +76,8 @@
   // Can be called from any thread.
   ModelTypeSet GetEncryptedTypes(
       syncable::BaseTransaction* const trans) const override;
+  PassphraseType GetPassphraseType(
+      syncable::BaseTransaction* const trans) const override;
 
   // Unsafe getters. Use only if sync is not up and running and there is no risk
   // of other threads calling this.
@@ -127,13 +128,18 @@
   // accessed via UnlockVault(..) and UnlockVaultMutable(..), which enforce
   // that a transaction is held.
   struct Vault {
-    Vault(Encryptor* encryptor, ModelTypeSet encrypted_types);
+    Vault(Encryptor* encryptor,
+          ModelTypeSet encrypted_types,
+          PassphraseType passphrase_type);
     ~Vault();
 
     // Sync's cryptographer. Used for encrypting and decrypting sync data.
     Cryptographer cryptographer;
     // The set of types that require encryption.
     ModelTypeSet encrypted_types;
+    // The current state of the passphrase required to decrypt the encryption
+    // keys stored in the nigori node.
+    PassphraseType passphrase_type;
 
    private:
     DISALLOW_COPY_AND_ASSIGN(Vault);
@@ -226,7 +232,8 @@
   // Note: if the nigori node is migrated but has an invalid state, will return
   // true (e.g. node has KEYSTORE_PASSPHRASE, local is CUSTOM_PASSPHRASE).
   bool ShouldTriggerMigration(const sync_pb::NigoriSpecifics& nigori,
-                              const Cryptographer& cryptographer) const;
+                              const Cryptographer& cryptographer,
+                              PassphraseType passphrase_type) const;
 
   // Performs the actual migration of the |nigori_node| to support keystore
   // encryption iff ShouldTriggerMigration(..) returns true.
@@ -263,7 +270,7 @@
 
   // If an explicit passphrase is in use, returns the time at which it was set
   // (if known). Else return base::Time().
-  base::Time GetExplicitPassphraseTime() const;
+  base::Time GetExplicitPassphraseTime(PassphraseType passphrase_type) const;
 
   // Notify observers when a custom passphrase is set by this device.
   void NotifyObserversOfLocalCustomPassphrase(WriteTransaction* trans);
@@ -284,9 +291,6 @@
   // thread.
   // Whether all current and future types should be encrypted.
   bool encrypt_everything_;
-  // The current state of the passphrase required to decrypt the encryption
-  // keys stored in the nigori node.
-  PassphraseType passphrase_type_;
 
   // The current keystore key provided by the server.
   std::string keystore_key_;

diff --git a/components/sync/core_impl/sync_encryption_handler_impl_unittest.cc b/components/sync/core_impl/sync_encryption_handler_impl_unittest.cc
index 6aa3139e..4b2a6a0 100644
--- a/components/sync/core_impl/sync_encryption_handler_impl_unittest.cc
+++ b/components/sync/core_impl/sync_encryption_handler_impl_unittest.cc

@@ -230,6 +230,12 @@
     return nigori;
   }
 
+  void VerifyPassphraseType(PassphraseType passphrase_type) {
+    ReadTransaction trans(FROM_HERE, user_share());
+    EXPECT_EQ(passphrase_type,
+              encryption_handler()->GetPassphraseType(trans.GetWrappedTrans()));
+  }
+
   // Build a migrated nigori node with the specified default passphrase
   // and keystore key and initialize the encryption handler with it.
   void InitKeystoreMigratedNigori(int64_t migration_time,
@@ -254,8 +260,7 @@
     EXPECT_CALL(*observer(), OnEncryptionComplete()).Times(AtLeast(1));
     encryption_handler()->Init();
     EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-    EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-              PassphraseType::KEYSTORE_PASSPHRASE);
+    VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
     EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
     Mock::VerifyAndClearExpectations(observer());
   }
@@ -282,8 +287,7 @@
     EXPECT_CALL(*observer(), OnEncryptionComplete()).Times(AtLeast(1));
     encryption_handler()->Init();
     EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-    EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-              PassphraseType::CUSTOM_PASSPHRASE);
+    VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
     EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
     Mock::VerifyAndClearExpectations(observer());
   }
@@ -316,7 +320,7 @@
     EXPECT_CALL(*observer(), OnEncryptedTypesChanged(_, false));
     encryption_handler()->Init();
     EXPECT_FALSE(encryption_handler()->MigratedToKeystore());
-    EXPECT_EQ(encryption_handler()->GetPassphraseType(), passphrase_type);
+    VerifyPassphraseType(passphrase_type);
     EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
     Mock::VerifyAndClearExpectations(observer());
   }
@@ -741,8 +745,7 @@
   EXPECT_FALSE(encryption_handler()->MigratedToKeystore());
   encryption_handler()->SetDecryptionPassphrase(kOtherKey);
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::KEYSTORE_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kOtherKey);
 }
 
@@ -800,8 +803,7 @@
   encryption_handler()->SetDecryptionPassphrase(kOtherKey);
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   const base::Time migration_time = encryption_handler()->migration_time();
-  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   VerifyMigratedNigori(PassphraseType::CUSTOM_PASSPHRASE, kOtherKey);
 
   VerifyRestoreAfterCustomPassphrase(
@@ -836,8 +838,7 @@
   // The actual migration gets posted, so run all pending tasks.
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::KEYSTORE_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kCurKey);
 }
@@ -880,8 +881,7 @@
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   const base::Time migration_time = encryption_handler()->migration_time();
-  EXPECT_EQ(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE, kCurKey);
 
@@ -941,8 +941,7 @@
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   const base::Time migration_time = encryption_handler()->migration_time();
-  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::CUSTOM_PASSPHRASE, kCurKey);
 
@@ -992,8 +991,7 @@
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   const base::Time migration_time = encryption_handler()->migration_time();
-  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::CUSTOM_PASSPHRASE, kCurKey);
 
@@ -1016,9 +1014,11 @@
       other_cryptographer, kKeystoreKey, &keystore_decryptor_token));
   EXPECT_FALSE(encryption_handler()->MigratedToKeystore());
   EXPECT_FALSE(GetCryptographer()->is_ready());
-  EXPECT_NE(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
-
+  {
+    ReadTransaction trans(FROM_HERE, user_share());
+    EXPECT_NE(encryption_handler()->GetPassphraseType(trans.GetWrappedTrans()),
+              PassphraseType::KEYSTORE_PASSPHRASE);
+  }
   // Now build a nigori node with the generated keystore decryptor token and
   // initialize the encryption handler with it. The cryptographer should be
   // initialized properly to decrypt both kCurKey and kKeystoreKey.
@@ -1053,8 +1053,7 @@
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(1, PassphraseType::KEYSTORE_PASSPHRASE,
                                     kCurKey);
@@ -1119,8 +1118,7 @@
   Mock::VerifyAndClearExpectations(observer());
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE);
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
 
@@ -1193,8 +1191,7 @@
   Mock::VerifyAndClearExpectations(observer());
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
 
@@ -1258,8 +1255,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(migration_time,
                                     PassphraseType::CUSTOM_PASSPHRASE, kCurKey);
@@ -1298,8 +1294,7 @@
   // Verify we're still migrated and have proper encryption state.
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(1, PassphraseType::CUSTOM_PASSPHRASE,
                                     kCurKey);
@@ -1348,8 +1343,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(1, PassphraseType::CUSTOM_PASSPHRASE,
                                     kCurKey);
@@ -1394,8 +1388,7 @@
   // Verify we're still migrated and have proper encryption state.
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(migration_time,
                                     PassphraseType::CUSTOM_PASSPHRASE, kCurKey);
@@ -1423,9 +1416,11 @@
       other_cryptographer, kKeystoreKey, &keystore_decryptor_token));
   EXPECT_FALSE(encryption_handler()->MigratedToKeystore());
   EXPECT_FALSE(GetCryptographer()->is_ready());
-  EXPECT_NE(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
-
+  {
+    ReadTransaction trans(FROM_HERE, user_share());
+    EXPECT_NE(encryption_handler()->GetPassphraseType(trans.GetWrappedTrans()),
+              PassphraseType::KEYSTORE_PASSPHRASE);
+  }
   // Now build a nigori node with the generated keystore decryptor token and
   // initialize the encryption handler with it. The cryptographer should be
   // initialized properly to decrypt both kCurKey and kKeystoreKey.
@@ -1452,8 +1447,7 @@
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   Mock::VerifyAndClearExpectations(observer());
 
@@ -1471,8 +1465,7 @@
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(1, PassphraseType::KEYSTORE_PASSPHRASE,
                                     kCurKey);
@@ -1537,8 +1530,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   Mock::VerifyAndClearExpectations(observer());
 
@@ -1562,8 +1554,7 @@
   EXPECT_FALSE(captured_bootstrap_token.empty());
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   VerifyMigratedNigoriWithTimestamp(migration_time,
@@ -1640,8 +1631,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   Mock::VerifyAndClearExpectations(observer());
 
@@ -1672,8 +1662,7 @@
   encryption_handler()->SetEncryptionPassphrase(kNewKey, true);
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::CUSTOM_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   VerifyMigratedNigoriWithTimestamp(migration_time,
@@ -1749,8 +1738,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   Mock::VerifyAndClearExpectations(observer());
 
@@ -1769,8 +1757,7 @@
   encryption_handler()->SetEncryptionPassphrase(kNewKey, false);
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(1, PassphraseType::KEYSTORE_PASSPHRASE,
                                     kOldKey);
@@ -1839,8 +1826,7 @@
   encryption_handler()->Init();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->has_pending_keys());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   Mock::VerifyAndClearExpectations(observer());
 
@@ -1867,8 +1853,7 @@
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::FROZEN_IMPLICIT_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigoriWithTimestamp(
       1, PassphraseType::FROZEN_IMPLICIT_PASSPHRASE, kCurKey);
@@ -1926,8 +1911,7 @@
   PumpLoop();
   Mock::VerifyAndClearExpectations(observer());
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kCurKey);
 
   // Now build an old keystore passphrase nigori node.
@@ -1956,8 +1940,7 @@
   // Verify we're still migrated and have proper encryption state.
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kCurKey);
 }
@@ -2011,8 +1994,7 @@
   // key (instead of the old gaia key).
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kKeystoreKey);
 }
@@ -2064,8 +2046,7 @@
   // key (instead of the old gaia key).
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kKeystoreKey);
 }
@@ -2102,8 +2083,7 @@
   EXPECT_FALSE(encryption_handler()->MigratedToKeystore());
   encryption_handler()->SetDecryptionPassphrase(kOldGaiaKey);
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::KEYSTORE_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kKeystoreKey);
 }
 
@@ -2144,8 +2124,7 @@
   // key (instead of the old gaia key).
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
   EXPECT_TRUE(GetCryptographer()->is_ready());
-  EXPECT_EQ(encryption_handler()->GetPassphraseType(),
-            PassphraseType::KEYSTORE_PASSPHRASE);
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   EXPECT_FALSE(encryption_handler()->IsEncryptEverythingEnabled());
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kKeystoreKey);
 }
@@ -2194,8 +2173,7 @@
   PumpLoop();
 
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
-  EXPECT_EQ(PassphraseType::KEYSTORE_PASSPHRASE,
-            encryption_handler()->GetPassphraseType());
+  VerifyPassphraseType(PassphraseType::KEYSTORE_PASSPHRASE);
   VerifyMigratedNigori(PassphraseType::KEYSTORE_PASSPHRASE, kKeystoreKey);
 }
 

diff --git a/components/sync/core_impl/sync_manager_impl_unittest.cc b/components/sync/core_impl/sync_manager_impl_unittest.cc
index cb55f6d0..e2cef4b 100644
--- a/components/sync/core_impl/sync_manager_impl_unittest.cc
+++ b/components/sync/core_impl/sync_manager_impl_unittest.cc

@@ -254,6 +254,7 @@
   UserShare* user_share();
   syncable::Directory* dir();
   SyncEncryptionHandler* encryption_handler();
+  PassphraseType GetPassphraseType(BaseTransaction* trans);
 
  private:
   base::MessageLoop message_loop_;
@@ -272,6 +273,10 @@
   return test_user_share_.encryption_handler();
 }
 
+PassphraseType SyncApiTest::GetPassphraseType(BaseTransaction* trans) {
+  return dir()->GetNigoriHandler()->GetPassphraseType(trans->GetWrappedTrans());
+}
+
 bool SyncApiTest::ReloadDir() {
   return test_user_share_.Reload();
 }
@@ -1126,6 +1131,16 @@
         trans->GetWrappedTrans());
   }
 
+  PassphraseType GetPassphraseType() {
+    ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    return GetPassphraseTypeWithTrans(&trans);
+  }
+
+  PassphraseType GetPassphraseTypeWithTrans(BaseTransaction* trans) {
+    return trans->GetDirectory()->GetNigoriHandler()->GetPassphraseType(
+        trans->GetWrappedTrans());
+  }
+
   void SimulateInvalidatorEnabledForTest(bool is_enabled) {
     DCHECK(sync_manager_.thread_checker_.CalledOnValidThread());
     sync_manager_.SetInvalidatorEnabled(is_enabled);
@@ -1154,8 +1169,7 @@
   void SetImplicitPassphraseAndCheck(const std::string& passphrase) {
     sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(passphrase,
                                                                   false);
-    EXPECT_EQ(PassphraseType::IMPLICIT_PASSPHRASE,
-              sync_manager_.GetEncryptionHandler()->GetPassphraseType());
+    EXPECT_EQ(PassphraseType::IMPLICIT_PASSPHRASE, GetPassphraseType());
   }
 
   void SetCustomPassphraseAndCheck(const std::string& passphrase) {
@@ -1163,8 +1177,7 @@
                 OnPassphraseTypeChanged(PassphraseType::CUSTOM_PASSPHRASE, _));
     sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(passphrase,
                                                                   true);
-    EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-              sync_manager_.GetEncryptionHandler()->GetPassphraseType());
+    EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE, GetPassphraseType());
   }
 
   bool HasUnrecoverableError() {
@@ -1480,8 +1493,7 @@
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   ExpectPassphraseAcceptance();
   sync_manager_.GetEncryptionHandler()->SetDecryptionPassphrase("passphrase2");
-  EXPECT_EQ(PassphraseType::IMPLICIT_PASSPHRASE,
-            sync_manager_.GetEncryptionHandler()->GetPassphraseType());
+  EXPECT_EQ(PassphraseType::IMPLICIT_PASSPHRASE, GetPassphraseType());
   EXPECT_FALSE(IsEncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
@@ -1606,8 +1618,7 @@
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   ExpectPassphraseAcceptance();
   sync_manager_.GetEncryptionHandler()->SetDecryptionPassphrase("explicit");
-  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE,
-            sync_manager_.GetEncryptionHandler()->GetPassphraseType());
+  EXPECT_EQ(PassphraseType::CUSTOM_PASSPHRASE, GetPassphraseType());
   EXPECT_FALSE(IsEncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());

diff --git a/components/sync/syncable/nigori_handler.h b/components/sync/syncable/nigori_handler.h
index 2f9682c..6baa0cca 100644
--- a/components/sync/syncable/nigori_handler.h
+++ b/components/sync/syncable/nigori_handler.h

@@ -21,6 +21,9 @@
 }
 
 namespace syncer {
+
+enum class PassphraseType;
+
 namespace syncable {
 
 class BaseTransaction;
@@ -56,6 +59,10 @@
   // Returns the set of currently encrypted types.
   virtual ModelTypeSet GetEncryptedTypes(
       syncable::BaseTransaction* const trans) const = 0;
+
+  // Returns current value for the passphrase type.
+  virtual PassphraseType GetPassphraseType(
+      syncable::BaseTransaction* const trans) const = 0;
 };
 
 }  // namespace syncable

diff --git a/components/sync/test/fake_sync_encryption_handler.cc b/components/sync/test/fake_sync_encryption_handler.cc
index 1ae13d2..c88014c 100644
--- a/components/sync/test/fake_sync_encryption_handler.cc
+++ b/components/sync/test/fake_sync_encryption_handler.cc

@@ -119,7 +119,8 @@
   return encrypt_everything_;
 }
 
-PassphraseType FakeSyncEncryptionHandler::GetPassphraseType() const {
+PassphraseType FakeSyncEncryptionHandler::GetPassphraseType(
+    syncable::BaseTransaction* const trans) const {
   return passphrase_type_;
 }
 

diff --git a/components/sync/test/fake_sync_encryption_handler.h b/components/sync/test/fake_sync_encryption_handler.h
index 49376ca..d90d1c0 100644
--- a/components/sync/test/fake_sync_encryption_handler.h
+++ b/components/sync/test/fake_sync_encryption_handler.h

@@ -37,7 +37,8 @@
   void SetDecryptionPassphrase(const std::string& passphrase) override;
   void EnableEncryptEverything() override;
   bool IsEncryptEverythingEnabled() const override;
-  PassphraseType GetPassphraseType() const override;
+  PassphraseType GetPassphraseType(
+      syncable::BaseTransaction* const trans) const override;
 
   // NigoriHandler implemenation.
   void ApplyNigoriUpdate(const sync_pb::NigoriSpecifics& nigori,

diff --git a/components/sync_bookmarks/bookmark_data_type_controller_unittest.cc b/components/sync_bookmarks/bookmark_data_type_controller_unittest.cc
index 8a196141..32efcbe 100644
--- a/components/sync_bookmarks/bookmark_data_type_controller_unittest.cc
+++ b/components/sync_bookmarks/bookmark_data_type_controller_unittest.cc

@@ -89,8 +89,8 @@
   };
 
   void CreateBookmarkModel(BookmarkLoadPolicy bookmark_load_policy) {
-    bookmark_model_.reset(new BookmarkModel(
-        base::WrapUnique(new bookmarks::TestBookmarkClient())));
+    bookmark_model_.reset(
+        new BookmarkModel(base::MakeUnique<bookmarks::TestBookmarkClient>()));
     if (bookmark_load_policy == LOAD_MODEL) {
       TestingPrefServiceSimple prefs;
       bookmark_model_->Load(&prefs, base::FilePath(),

diff --git a/components/sync_sessions/favicon_cache_unittest.cc b/components/sync_sessions/favicon_cache_unittest.cc
index b93e6887..db9ce0f 100644
--- a/components/sync_sessions/favicon_cache_unittest.cc
+++ b/components/sync_sessions/favicon_cache_unittest.cc

@@ -403,8 +403,8 @@
 
 std::unique_ptr<syncer::SyncChangeProcessor>
 SyncFaviconCacheTest::CreateAndPassProcessor() {
-  return base::WrapUnique(
-      new syncer::SyncChangeProcessorWrapperForTest(sync_processor_.get()));
+  return base::MakeUnique<syncer::SyncChangeProcessorWrapperForTest>(
+      sync_processor_.get());
 }
 
 std::unique_ptr<syncer::SyncErrorFactory>

diff --git a/components/sync_sessions/revisit/bookmarks_page_revisit_observer_unittest.cc b/components/sync_sessions/revisit/bookmarks_page_revisit_observer_unittest.cc
index a6e887e..46823c8 100644
--- a/components/sync_sessions/revisit/bookmarks_page_revisit_observer_unittest.cc
+++ b/components/sync_sessions/revisit/bookmarks_page_revisit_observer_unittest.cc

@@ -39,7 +39,7 @@
 
 void RunObserver(const std::vector<const bookmarks::BookmarkNode*>& nodes) {
   BookmarksPageRevisitObserver observer(
-      base::WrapUnique(new TestBookmarksByUrlProvider(nodes)));
+      base::MakeUnique<TestBookmarksByUrlProvider>(nodes));
   observer.OnPageVisit(kExampleGurl, PageVisitObserver::kTransitionPage);
 }
 

diff --git a/components/sync_sessions/revisit/page_revisit_broadcaster.cc b/components/sync_sessions/revisit/page_revisit_broadcaster.cc
index 66fe702..6198745 100644
--- a/components/sync_sessions/revisit/page_revisit_broadcaster.cc
+++ b/components/sync_sessions/revisit/page_revisit_broadcaster.cc

@@ -54,7 +54,7 @@
   bool shouldInstrument = group_name == "Enabled";
   if (shouldInstrument) {
     revisit_observers_.push_back(new sync_sessions::SessionsPageRevisitObserver(
-        base::WrapUnique(new SessionsSyncManagerWrapper(manager))));
+        base::MakeUnique<SessionsSyncManagerWrapper>(manager)));
 
     history::HistoryService* history = sessions_client_->GetHistoryService();
     if (history) {
@@ -65,8 +65,9 @@
     bookmarks::BookmarkModel* bookmarks = sessions_client_->GetBookmarkModel();
     if (bookmarks) {
       revisit_observers_.push_back(
-          new sync_sessions::BookmarksPageRevisitObserver(base::WrapUnique(
-              new sync_sessions::BookmarksByUrlProviderImpl(bookmarks))));
+          new sync_sessions::BookmarksPageRevisitObserver(
+              base::MakeUnique<sync_sessions::BookmarksByUrlProviderImpl>(
+                  bookmarks)));
     }
   }
 }

diff --git a/components/sync_sessions/revisit/sessions_page_revisit_observer_unittest.cc b/components/sync_sessions/revisit/sessions_page_revisit_observer_unittest.cc
index 179895e..22bbcd3 100644
--- a/components/sync_sessions/revisit/sessions_page_revisit_observer_unittest.cc
+++ b/components/sync_sessions/revisit/sessions_page_revisit_observer_unittest.cc

@@ -76,7 +76,7 @@
     std::vector<const SyncedSession*> sessions;
     sessions.push_back(session);
     SessionsPageRevisitObserver observer(
-        base::WrapUnique(new TestForeignSessionsProvider(sessions, true)));
+        base::MakeUnique<TestForeignSessionsProvider>(sessions, true));
     CheckAndExpect(&observer, url, current_match, offset_match);
   }
 };
@@ -84,7 +84,7 @@
 TEST_F(SessionsPageRevisitObserverTest, RunMatchersNoSessions) {
   std::vector<const SyncedSession*> sessions;
   SessionsPageRevisitObserver observer(
-      base::WrapUnique(new TestForeignSessionsProvider(sessions, true)));
+      base::MakeUnique<TestForeignSessionsProvider>(sessions, true));
   CheckAndExpect(&observer, GURL(kExampleUrl), false, false);
 }
 
@@ -139,7 +139,7 @@
   std::vector<const SyncedSession*> sessions;
   sessions.push_back(session.get());
   SessionsPageRevisitObserver observer(
-      base::WrapUnique(new TestForeignSessionsProvider(sessions, false)));
+      base::MakeUnique<TestForeignSessionsProvider>(sessions, false));
   CheckAndExpect(&observer, GURL(kExampleUrl), false, false);
 }
 
@@ -189,7 +189,7 @@
   sessions.push_back(session1.get());
   sessions.push_back(session2.get());
   SessionsPageRevisitObserver observer(
-      base::WrapUnique(new TestForeignSessionsProvider(sessions, true)));
+      base::MakeUnique<TestForeignSessionsProvider>(sessions, true));
 
   base::HistogramTester histogram_tester;
   CheckAndExpect(&observer, GURL(kExampleUrl), true, true);

diff --git a/components/sync_sessions/revisit/typed_url_page_revisit_observer.cc b/components/sync_sessions/revisit/typed_url_page_revisit_observer.cc
index 747910b..f102220 100644
--- a/components/sync_sessions/revisit/typed_url_page_revisit_observer.cc
+++ b/components/sync_sessions/revisit/typed_url_page_revisit_observer.cc

@@ -22,7 +22,7 @@
     const PageVisitObserver::TransitionType transition) {
   if (history_) {
     history_->ScheduleDBTask(
-        base::WrapUnique(new TypedUrlPageRevisitTask(url, transition)),
+        base::MakeUnique<TypedUrlPageRevisitTask>(url, transition),
         &task_tracker_);
   }
 }

diff --git a/components/sync_sessions/sync_sessions_metrics_unittest.cc b/components/sync_sessions/sync_sessions_metrics_unittest.cc
index a016250d..902637d 100644
--- a/components/sync_sessions/sync_sessions_metrics_unittest.cc
+++ b/components/sync_sessions/sync_sessions_metrics_unittest.cc

@@ -65,7 +65,7 @@
   void PushTab(size_t tabIndex, int windowIndex, Time timestamp) {
     // First add sessions/windows as necessary.
     while (tabIndex >= sessions_.size()) {
-      sessions_.push_back(base::WrapUnique(new SyncedSession()));
+      sessions_.push_back(base::MakeUnique<SyncedSession>());
     }
     if (sessions_[tabIndex]->windows.find(windowIndex) ==
         sessions_[tabIndex]->windows.end()) {

diff --git a/components/syncable_prefs/pref_service_syncable_unittest.cc b/components/syncable_prefs/pref_service_syncable_unittest.cc
index 08e11ca..b7e2cfa 100644
--- a/components/syncable_prefs/pref_service_syncable_unittest.cc
+++ b/components/syncable_prefs/pref_service_syncable_unittest.cc

@@ -173,7 +173,7 @@
     test_processor_ = new TestSyncProcessorStub(output);
     syncer::SyncMergeResult r = pref_sync_service_->MergeDataAndStartSyncing(
         syncer::PREFERENCES, initial_data, base::WrapUnique(test_processor_),
-        base::WrapUnique(new syncer::SyncErrorFactoryMock()));
+        base::MakeUnique<syncer::SyncErrorFactoryMock>());
     EXPECT_FALSE(r.error().IsSet());
   }
 
@@ -314,7 +314,7 @@
   stub->FailNextProcessSyncChanges();
   syncer::SyncMergeResult r = pref_sync_service_->MergeDataAndStartSyncing(
       syncer::PREFERENCES, syncer::SyncDataList(), base::WrapUnique(stub),
-      base::WrapUnique(new syncer::SyncErrorFactoryMock()));
+      base::MakeUnique<syncer::SyncErrorFactoryMock>());
   EXPECT_TRUE(r.error().IsSet());
 }
 

diff --git a/components/test_runner/tracked_dictionary.cc b/components/test_runner/tracked_dictionary.cc
index 2903f6156..a5a8999 100644
--- a/components/test_runner/tracked_dictionary.cc
+++ b/components/test_runner/tracked_dictionary.cc

@@ -40,12 +40,12 @@
 }
 
 void TrackedDictionary::SetBoolean(const std::string& path, bool new_value) {
-  Set(path, base::WrapUnique(new base::FundamentalValue(new_value)));
+  Set(path, base::MakeUnique<base::FundamentalValue>(new_value));
 }
 
 void TrackedDictionary::SetString(const std::string& path,
                                   const std::string& new_value) {
-  Set(path, base::WrapUnique(new base::StringValue(new_value)));
+  Set(path, base::MakeUnique<base::StringValue>(new_value));
 }
 
 }  // namespace test_runner

diff --git a/components/test_runner/web_test_interfaces.cc b/components/test_runner/web_test_interfaces.cc
index 08b595a..1840322 100644
--- a/components/test_runner/web_test_interfaces.cc
+++ b/components/test_runner/web_test_interfaces.cc

@@ -93,22 +93,22 @@
 std::unique_ptr<WebFrameTestClient> WebTestInterfaces::CreateWebFrameTestClient(
     WebViewTestProxyBase* web_view_test_proxy_base,
     WebFrameTestProxyBase* web_frame_test_proxy_base) {
-  return base::WrapUnique(new WebFrameTestClient(
+  return base::MakeUnique<WebFrameTestClient>(
       interfaces_->GetTestRunner(), interfaces_->GetDelegate(),
-      web_view_test_proxy_base, web_frame_test_proxy_base));
+      web_view_test_proxy_base, web_frame_test_proxy_base);
 }
 
 std::unique_ptr<WebViewTestClient> WebTestInterfaces::CreateWebViewTestClient(
     WebViewTestProxyBase* web_view_test_proxy_base) {
-  return base::WrapUnique(new WebViewTestClient(interfaces_->GetTestRunner(),
-                                                web_view_test_proxy_base));
+  return base::MakeUnique<WebViewTestClient>(interfaces_->GetTestRunner(),
+                                             web_view_test_proxy_base);
 }
 
 std::unique_ptr<WebWidgetTestClient>
 WebTestInterfaces::CreateWebWidgetTestClient(
     WebWidgetTestProxyBase* web_widget_test_proxy_base) {
-  return base::WrapUnique(new WebWidgetTestClient(interfaces_->GetTestRunner(),
-                                                  web_widget_test_proxy_base));
+  return base::MakeUnique<WebWidgetTestClient>(interfaces_->GetTestRunner(),
+                                               web_widget_test_proxy_base);
 }
 
 std::vector<blink::WebView*> WebTestInterfaces::GetWindowList() {

diff --git a/components/toolbar/test_toolbar_model.cc b/components/toolbar/test_toolbar_model.cc
index 0dda07c..31d0f5d0 100644
--- a/components/toolbar/test_toolbar_model.cc
+++ b/components/toolbar/test_toolbar_model.cc

@@ -41,6 +41,10 @@
   return icon_;
 }
 
+base::string16 TestToolbarModel::GetSecureVerboseText() const {
+  return base::string16();
+}
+
 base::string16 TestToolbarModel::GetEVCertName() const {
   return (security_level_ == security_state::SecurityStateModel::EV_SECURE)
              ? ev_cert_name_

diff --git a/components/toolbar/test_toolbar_model.h b/components/toolbar/test_toolbar_model.h
index c0f5cadf..108ef0b 100644
--- a/components/toolbar/test_toolbar_model.h
+++ b/components/toolbar/test_toolbar_model.h

@@ -29,6 +29,7 @@
       bool ignore_editing) const override;
   int GetIcon() const override;
   gfx::VectorIconId GetVectorIcon() const override;
+  base::string16 GetSecureVerboseText() const override;
   base::string16 GetEVCertName() const override;
   bool ShouldDisplayURL() const override;
 

diff --git a/components/toolbar/toolbar_model.h b/components/toolbar/toolbar_model.h
index afe461976..e3641bb8 100644
--- a/components/toolbar/toolbar_model.h
+++ b/components/toolbar/toolbar_model.h

@@ -52,6 +52,9 @@
   // Like GetIcon(), but gets the vector asset ID.
   virtual gfx::VectorIconId GetVectorIcon() const = 0;
 
+  // Returns text for the omnibox secure verbose chip.
+  virtual base::string16 GetSecureVerboseText() const = 0;
+
   // Returns the name of the EV cert holder.  This returns an empty string if
   // the security level is not EV_SECURE.
   virtual base::string16 GetEVCertName() const = 0;

diff --git a/components/toolbar/toolbar_model_impl.cc b/components/toolbar/toolbar_model_impl.cc
index e7d693e6..47388f7 100644
--- a/components/toolbar/toolbar_model_impl.cc
+++ b/components/toolbar/toolbar_model_impl.cc

@@ -129,6 +129,17 @@
       base::UTF8ToUTF16(cert->subject().country_name));
 }
 
+base::string16 ToolbarModelImpl::GetSecureVerboseText() const {
+  switch (GetSecurityLevel(false)) {
+    case SecurityStateModel::SECURE:
+      return l10n_util::GetStringUTF16(IDS_SECURE_VERBOSE_STATE);
+    case SecurityStateModel::SECURITY_ERROR:
+      return l10n_util::GetStringUTF16(IDS_NOT_SECURE_VERBOSE_STATE);
+    default:
+      return base::string16();
+  }
+}
+
 bool ToolbarModelImpl::ShouldDisplayURL() const {
   return delegate_->ShouldDisplayURL();
 }

diff --git a/components/toolbar/toolbar_model_impl.h b/components/toolbar/toolbar_model_impl.h
index 6cc39143..c60177e 100644
--- a/components/toolbar/toolbar_model_impl.h
+++ b/components/toolbar/toolbar_model_impl.h

@@ -34,6 +34,7 @@
       bool ignore_editing) const override;
   int GetIcon() const override;
   gfx::VectorIconId GetVectorIcon() const override;
+  base::string16 GetSecureVerboseText() const override;
   base::string16 GetEVCertName() const override;
   bool ShouldDisplayURL() const override;
 

diff --git a/components/translate/core/browser/translate_manager_unittest.cc b/components/translate/core/browser/translate_manager_unittest.cc
index 7148fb5..724afff 100644
--- a/components/translate/core/browser/translate_manager_unittest.cc
+++ b/components/translate/core/browser/translate_manager_unittest.cc

@@ -93,8 +93,8 @@
   PrefService* GetPrefs() { return prefs_; }
 
   std::unique_ptr<TranslatePrefs> GetTranslatePrefs() {
-    return base::WrapUnique(new TranslatePrefs(prefs_, kAcceptLanguages,
-                                               kLanguagePreferredLanguages));
+    return base::MakeUnique<TranslatePrefs>(prefs_, kAcceptLanguages,
+                                            kLanguagePreferredLanguages);
   }
   MOCK_METHOD0(GetTranslateAcceptLanguages, TranslateAcceptLanguages*());
   MOCK_CONST_METHOD0(GetInfobarIconID, int());

diff --git a/components/translate/core/browser/translate_ui_delegate_unittest.cc b/components/translate/core/browser/translate_ui_delegate_unittest.cc
index 8f040f6..69142ba 100644
--- a/components/translate/core/browser/translate_ui_delegate_unittest.cc
+++ b/components/translate/core/browser/translate_ui_delegate_unittest.cc

@@ -44,8 +44,8 @@
   PrefService* GetPrefs() { return prefs_; }
 
   std::unique_ptr<TranslatePrefs> GetTranslatePrefs() {
-    return base::WrapUnique(new TranslatePrefs(prefs_, "intl.accept_languages",
-                                               preferred_languages_prefs));
+    return base::MakeUnique<TranslatePrefs>(prefs_, "intl.accept_languages",
+                                            preferred_languages_prefs);
   }
 
   MOCK_METHOD0(GetTranslateAcceptLanguages, TranslateAcceptLanguages*());

diff --git a/components/undo/undo_manager_test.cc b/components/undo/undo_manager_test.cc
index 19bbdc3..eea1598 100644
--- a/components/undo/undo_manager_test.cc
+++ b/components/undo/undo_manager_test.cc

@@ -88,7 +88,7 @@
 }
 
 void TestUndoService::TriggerOperation() {
-  undo_manager_.AddUndoOperation(base::WrapUnique(new TestUndoOperation(this)));
+  undo_manager_.AddUndoOperation(base::MakeUnique<TestUndoOperation>(this));
 }
 
 void TestUndoService::RecordUndoCall() {

diff --git a/components/url_matcher/url_matcher_factory.cc b/components/url_matcher/url_matcher_factory.cc
index 848e5d4..5793f68 100644
--- a/components/url_matcher/url_matcher_factory.cc
+++ b/components/url_matcher/url_matcher_factory.cc

@@ -234,7 +234,7 @@
       return nullptr;
     }
   }
-  return base::WrapUnique(new URLMatcherSchemeFilter(schemas));
+  return base::MakeUnique<URLMatcherSchemeFilter>(schemas);
 }
 
 // static
@@ -268,7 +268,7 @@
     }
   }
 
-  return base::WrapUnique(new URLMatcherPortFilter(ranges));
+  return base::MakeUnique<URLMatcherPortFilter>(ranges);
 }
 
 }  // namespace url_matcher

diff --git a/components/user_prefs/tracked/segregated_pref_store_unittest.cc b/components/user_prefs/tracked/segregated_pref_store_unittest.cc
index f3efce2..5d32d02 100644
--- a/components/user_prefs/tracked/segregated_pref_store_unittest.cc
+++ b/components/user_prefs/tracked/segregated_pref_store_unittest.cc

@@ -104,10 +104,10 @@
 
   // Properly stores new values.
   segregated_store_->SetValue(kSelectedPref,
-                              base::WrapUnique(new base::StringValue(kValue1)),
+                              base::MakeUnique<base::StringValue>(kValue1),
                               WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   segregated_store_->SetValue(kUnselectedPref,
-                              base::WrapUnique(new base::StringValue(kValue2)),
+                              base::MakeUnique<base::StringValue>(kValue2),
                               WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
 
   ASSERT_TRUE(selected_store_->GetValue(kSelectedPref, NULL));
@@ -129,10 +129,10 @@
 
 TEST_F(SegregatedPrefStoreTest, ReadValues) {
   selected_store_->SetValue(kSelectedPref,
-                            base::WrapUnique(new base::StringValue(kValue1)),
+                            base::MakeUnique<base::StringValue>(kValue1),
                             WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   default_store_->SetValue(kUnselectedPref,
-                           base::WrapUnique(new base::StringValue(kValue2)),
+                           base::MakeUnique<base::StringValue>(kValue2),
                            WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
 
   // Works properly with values that are already there.
@@ -157,11 +157,11 @@
   EXPECT_TRUE(observer_.initialization_success);
   EXPECT_TRUE(observer_.changed_keys.empty());
   segregated_store_->SetValue(kSelectedPref,
-                              base::WrapUnique(new base::StringValue(kValue1)),
+                              base::MakeUnique<base::StringValue>(kValue1),
                               WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   observer_.VerifyAndResetChangedKey(kSelectedPref);
   segregated_store_->SetValue(kUnselectedPref,
-                              base::WrapUnique(new base::StringValue(kValue2)),
+                              base::MakeUnique<base::StringValue>(kValue2),
                               WriteablePrefStore::DEFAULT_PREF_WRITE_FLAGS);
   observer_.VerifyAndResetChangedKey(kUnselectedPref);
 }

diff --git a/components/variations/service/variations_service.cc b/components/variations/service/variations_service.cc
index 28b69bd9..7d32630 100644
--- a/components/variations/service/variations_service.cc
+++ b/components/variations/service/variations_service.cc

@@ -502,8 +502,8 @@
 #endif
   result.reset(new VariationsService(
       std::move(client),
-      base::WrapUnique(new web_resource::ResourceRequestAllowedNotifier(
-          local_state, disable_network_switch)),
+      base::MakeUnique<web_resource::ResourceRequestAllowedNotifier>(
+          local_state, disable_network_switch),
       local_state, state_manager, ui_string_overrider));
   return result;
 }
@@ -514,8 +514,8 @@
     PrefService* local_state) {
   return base::WrapUnique(new VariationsService(
       std::move(client),
-      base::WrapUnique(new web_resource::ResourceRequestAllowedNotifier(
-          local_state, nullptr)),
+      base::MakeUnique<web_resource::ResourceRequestAllowedNotifier>(
+          local_state, nullptr),
       local_state, nullptr, UIStringOverrider()));
 }
 

diff --git a/components/variations/service/variations_service_unittest.cc b/components/variations/service/variations_service_unittest.cc
index 6530849..d629387 100644
--- a/components/variations/service/variations_service_unittest.cc
+++ b/components/variations/service/variations_service_unittest.cc

@@ -278,7 +278,7 @@
 
   // Create a variations service.
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.SetCreateTrialsFromSeedCalledForTesting(false);
 
@@ -305,7 +305,7 @@
 
   // Create a variations service
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.SetCreateTrialsFromSeedCalledForTesting(false);
 
@@ -332,7 +332,7 @@
 
   // Create a variations service.
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.SetCreateTrialsFromSeedCalledForTesting(false);
 
@@ -356,11 +356,11 @@
 
   std::string value;
   std::unique_ptr<TestVariationsServiceClient> client =
-      base::WrapUnique(new TestVariationsServiceClient());
+      base::MakeUnique<TestVariationsServiceClient>();
   TestVariationsServiceClient* raw_client = client.get();
   VariationsService service(
       std::move(client),
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs, NULL, UIStringOverrider());
   GURL url = service.GetVariationsServerURL(&prefs, std::string());
   EXPECT_TRUE(base::StartsWith(url.spec(), default_variations_url,
@@ -395,7 +395,7 @@
   TestingPrefServiceSimple prefs;
   VariationsService::RegisterPrefs(prefs.registry());
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   const GURL url = service.GetVariationsServerURL(&prefs, std::string());
 
@@ -411,7 +411,7 @@
   // Pass ownership to TestVariationsService, but keep a weak pointer to
   // manipulate it for this test.
   std::unique_ptr<web_resource::TestRequestAllowedNotifier> test_notifier =
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs));
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs);
   web_resource::TestRequestAllowedNotifier* raw_notifier = test_notifier.get();
   TestVariationsService test_service(std::move(test_notifier), &prefs);
 
@@ -431,7 +431,7 @@
   // Pass ownership to TestVariationsService, but keep a weak pointer to
   // manipulate it for this test.
   std::unique_ptr<web_resource::TestRequestAllowedNotifier> test_notifier =
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs));
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs);
   web_resource::TestRequestAllowedNotifier* raw_notifier = test_notifier.get();
   TestVariationsService test_service(std::move(test_notifier), &prefs);
 
@@ -445,7 +445,7 @@
   VariationsService::RegisterPrefs(prefs.registry());
 
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.set_intercepts_fetch(false);
 
@@ -474,7 +474,7 @@
   VariationsService::RegisterPrefs(prefs.registry());
 
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.set_intercepts_fetch(false);
   for (size_t i = 0; i < arraysize(non_ok_status_codes); ++i) {
@@ -496,7 +496,7 @@
   net::TestURLFetcherFactory factory;
 
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.set_intercepts_fetch(false);
   service.DoActualFetch();
@@ -532,7 +532,7 @@
 
   for (size_t i = 0; i < arraysize(cases); ++i) {
     TestVariationsService service(
-        base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+        base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
         &prefs);
     service.set_intercepts_fetch(false);
     service.DoActualFetch();
@@ -556,7 +556,7 @@
   VariationsService::RegisterPrefs(prefs.registry());
 
   TestVariationsService service(
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs);
   service.set_intercepts_fetch(false);
 
@@ -579,8 +579,8 @@
   TestingPrefServiceSimple prefs;
   VariationsService::RegisterPrefs(prefs.registry());
   VariationsService service(
-      base::WrapUnique(new TestVariationsServiceClient()),
-      base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+      base::MakeUnique<TestVariationsServiceClient>(),
+      base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
       &prefs, NULL, UIStringOverrider());
 
   struct {
@@ -679,8 +679,8 @@
     TestingPrefServiceSimple prefs;
     VariationsService::RegisterPrefs(prefs.registry());
     VariationsService service(
-        base::WrapUnique(new TestVariationsServiceClient()),
-        base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+        base::MakeUnique<TestVariationsServiceClient>(),
+        base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
         &prefs, NULL, UIStringOverrider());
 
     if (test.pref_value_before) {
@@ -751,7 +751,7 @@
     TestingPrefServiceSimple prefs;
     VariationsService::RegisterPrefs(prefs.registry());
     TestVariationsService service(
-        base::WrapUnique(new web_resource::TestRequestAllowedNotifier(&prefs)),
+        base::MakeUnique<web_resource::TestRequestAllowedNotifier>(&prefs),
         &prefs);
 
     if (!test.pref_value_before.empty()) {

diff --git a/components/web_resource/web_resource_service.cc b/components/web_resource/web_resource_service.cc
index 6e05d41..544b9d8 100644
--- a/components/web_resource/web_resource_service.cc
+++ b/components/web_resource/web_resource_service.cc

@@ -79,7 +79,7 @@
     // (on Android in particular) we short-cut the full parsing in the case of
     // trivially "empty" JSONs.
     if (data.empty() || data == "{}") {
-      OnUnpackFinished(base::WrapUnique(new base::DictionaryValue()));
+      OnUnpackFinished(base::MakeUnique<base::DictionaryValue>());
     } else {
       parse_json_callback_.Run(data,
                                base::Bind(&WebResourceService::OnUnpackFinished,

diff --git a/components/webcrypto/algorithms/sha.cc b/components/webcrypto/algorithms/sha.cc
index 5baa0e2..cd380a0 100644
--- a/components/webcrypto/algorithms/sha.cc
+++ b/components/webcrypto/algorithms/sha.cc

@@ -125,7 +125,7 @@
 }  // namespace
 
 std::unique_ptr<AlgorithmImplementation> CreateShaImplementation() {
-  return base::WrapUnique(new ShaImplementation());
+  return base::MakeUnique<ShaImplementation>();
 }
 
 std::unique_ptr<blink::WebCryptoDigestor> CreateDigestorImplementation(

diff --git a/components/wifi_sync/wifi_config_delegate_chromeos_unittest.cc b/components/wifi_sync/wifi_config_delegate_chromeos_unittest.cc
index 7a84f66..1551a4ab 100644
--- a/components/wifi_sync/wifi_config_delegate_chromeos_unittest.cc
+++ b/components/wifi_sync/wifi_config_delegate_chromeos_unittest.cc

@@ -224,7 +224,7 @@
   if (!create_configuration_error_callback().is_null()) {
     create_configuration_error_callback().Run(
         "Config.CreateConfiguration Failed",
-        base::WrapUnique(new base::DictionaryValue()));
+        base::MakeUnique<base::DictionaryValue>());
   }
 }
 

diff --git a/components/wifi_sync/wifi_credential.cc b/components/wifi_sync/wifi_credential.cc
index e4e9544..bbbb492 100644
--- a/components/wifi_sync/wifi_credential.cc
+++ b/components/wifi_sync/wifi_credential.cc

@@ -50,7 +50,7 @@
   if (!WifiSecurityClassToOncSecurityString(security_class(), &onc_security)) {
     NOTREACHED() << "Failed to convert SecurityClass with value "
                  << security_class();
-    return base::WrapUnique(new base::DictionaryValue());
+    return base::MakeUnique<base::DictionaryValue>();
   }
 
   std::unique_ptr<base::DictionaryValue> onc_properties(

diff --git a/components/wifi_sync/wifi_credential_syncable_service_factory.cc b/components/wifi_sync/wifi_credential_syncable_service_factory.cc
index 6f42289e..efd8a252 100644
--- a/components/wifi_sync/wifi_credential_syncable_service_factory.cc
+++ b/components/wifi_sync/wifi_credential_syncable_service_factory.cc

@@ -96,9 +96,9 @@
   // ChromeBrowserMainPartsChromeos, and destroyed after all
   // KeyedService instances are destroyed.
   chromeos::NetworkHandler* network_handler = chromeos::NetworkHandler::Get();
-  return base::WrapUnique(new WifiConfigDelegateChromeOs(
+  return base::MakeUnique<WifiConfigDelegateChromeOs>(
       GetUserHash(context, !ignore_login_state_for_test_),
-      network_handler->managed_network_configuration_handler()));
+      network_handler->managed_network_configuration_handler());
 }
 #endif
 

diff --git a/components/wifi_sync/wifi_credential_syncable_service_unittest.cc b/components/wifi_sync/wifi_credential_syncable_service_unittest.cc
index 74799e5..710e9bd4 100644
--- a/components/wifi_sync/wifi_credential_syncable_service_unittest.cc
+++ b/components/wifi_sync/wifi_credential_syncable_service_unittest.cc

@@ -146,8 +146,7 @@
     change_processor_ = change_processor.get();
     syncable_service_->MergeDataAndStartSyncing(
         syncer::WIFI_CREDENTIALS, syncer::SyncDataList(),
-        std::move(change_processor),
-        base::WrapUnique(new SyncErrorFactoryMock()));
+        std::move(change_processor), base::MakeUnique<SyncErrorFactoryMock>());
   }
 
  private:

diff --git a/content/browser/media/session/audio_focus_manager.cc b/content/browser/media/session/audio_focus_manager.cc
index c3589ef..4ff3491 100644
--- a/content/browser/media/session/audio_focus_manager.cc
+++ b/content/browser/media/session/audio_focus_manager.cc

@@ -9,13 +9,6 @@
 
 namespace content {
 
-namespace {
-
-const double kDuckingVolumeMultiplier = 0.2;
-const double kDefaultVolumeMultiplier = 1.0;
-
-}  // anonymous namespace
-
 AudioFocusManager::AudioFocusEntry::AudioFocusEntry(
     WebContents* web_contents,
     AudioFocusManager* audio_focus_manager,
@@ -93,18 +86,14 @@
   if (TransientMayDuckEntriesCount() != 1 || !focus_entry_)
     return;
 
-  // TODO(mlamouri): add StartDuck to MediaSession.
-  MediaSession::Get(focus_entry_->web_contents())
-      ->SetVolumeMultiplier(kDuckingVolumeMultiplier);
+  MediaSession::Get(focus_entry_->web_contents())->StartDucking();
 }
 
 void AudioFocusManager::MaybeStopDucking() const {
   if (TransientMayDuckEntriesCount() != 0 || !focus_entry_)
     return;
 
-  // TODO(mlamouri): add StopDuck to MediaSession.
-  MediaSession::Get(focus_entry_->web_contents())
-      ->SetVolumeMultiplier(kDefaultVolumeMultiplier);
+  MediaSession::Get(focus_entry_->web_contents())->StopDucking();
 }
 
 int AudioFocusManager::TransientMayDuckEntriesCount() const {
@@ -118,8 +107,7 @@
 
 void AudioFocusManager::MaybeRemoveFocusEntry(WebContents* web_contents) {
   if (focus_entry_ && focus_entry_->web_contents() == web_contents) {
-    MediaSession::Get(focus_entry_->web_contents())
-        ->SetVolumeMultiplier(kDefaultVolumeMultiplier);
+    MediaSession::Get(focus_entry_->web_contents())->StopDucking();
     focus_entry_.reset();
   }
 }

diff --git a/content/browser/media/session/audio_focus_manager_unittest.cc b/content/browser/media/session/audio_focus_manager_unittest.cc
index 71e8a6c..11bf186 100644
--- a/content/browser/media/session/audio_focus_manager_unittest.cc
+++ b/content/browser/media/session/audio_focus_manager_unittest.cc

@@ -17,9 +17,6 @@
 
 class AudioFocusManagerTest : public testing::Test {
  public:
-  const double kDuckingVolumeMultiplier = 0.2;
-  const double kDefaultVolumeMultiplier = 1.0;
-
   AudioFocusManagerTest() : ui_thread_(BrowserThread::UI, &message_loop_) {}
 
   void SetUp() override {
@@ -44,8 +41,8 @@
     return AudioFocusManager::GetInstance()->TransientMayDuckEntriesCount();
   }
 
-  double GetVolumeMultiplier(MediaSession* session) {
-    return session->volume_multiplier_;
+  double IsSessionDucking(MediaSession* session) {
+    return session->is_ducking_;  // Quack! Quack!
   }
 
   WebContents* CreateWebContents() {
@@ -135,7 +132,7 @@
       media_session, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
   ASSERT_EQ(nullptr, GetAudioFocusedContent());
   ASSERT_EQ(1, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session));
+  ASSERT_FALSE(IsSessionDucking(media_session));
 }
 
 TEST_F(AudioFocusManagerTest, RequestAudioFocusTransient_FromGainWhileDucking) {
@@ -148,17 +145,17 @@
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
   ASSERT_EQ(0, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
   ASSERT_EQ(1, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
   ASSERT_EQ(2, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, AbandonAudioFocus_RemovesFocusedEntry) {
@@ -203,12 +200,12 @@
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
   ASSERT_EQ(0, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
   ASSERT_EQ(1, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->AbandonAudioFocus(media_session_1);
   ASSERT_EQ(1, GetTransientMaybeDuckCount());
@@ -218,7 +215,7 @@
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, AbandonAudioFocus_StopsDucking) {
@@ -231,17 +228,16 @@
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
   ASSERT_EQ(0, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
   ASSERT_EQ(1, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->AbandonAudioFocus(media_session_2);
   ASSERT_EQ(0, GetTransientMaybeDuckCount());
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
-
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, DuckWhilePlaying) {
@@ -253,11 +249,11 @@
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, DuckWhenStarting) {
@@ -272,7 +268,7 @@
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, DuckWithMultipleTransients) {
@@ -287,21 +283,21 @@
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_3, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->AbandonAudioFocus(media_session_2);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->AbandonAudioFocus(media_session_3);
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 }
 
 TEST_F(AudioFocusManagerTest, WebContentsDestroyed_ReleasesFocus) {
@@ -337,14 +333,14 @@
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_1, AudioFocusManager::AudioFocusType::Gain);
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 
   AudioFocusManager::GetInstance()->RequestAudioFocus(
       media_session_2, AudioFocusManager::AudioFocusType::GainTransientMayDuck);
-  ASSERT_EQ(kDuckingVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_TRUE(IsSessionDucking(media_session_1));
 
   web_contents_2.reset();
-  ASSERT_EQ(kDefaultVolumeMultiplier, GetVolumeMultiplier(media_session_1));
+  ASSERT_FALSE(IsSessionDucking(media_session_1));
 }
 
 }  // namespace content

diff --git a/content/browser/media/session/media_session.cc b/content/browser/media/session/media_session.cc
index 79df567..c95ab3b 100644
--- a/content/browser/media/session/media_session.cc
+++ b/content/browser/media/session/media_session.cc

@@ -16,6 +16,7 @@
 namespace {
 
 const double kDefaultVolumeMultiplier = 1.0;
+const double kDuckingVolumeMultiplier = 0.2;
 
 }  // anonymous namespace
 
@@ -70,7 +71,7 @@
 bool MediaSession::AddPlayer(MediaSessionObserver* observer,
                              int player_id,
                              media::MediaContentType media_content_type) {
-  observer->OnSetVolumeMultiplier(player_id, volume_multiplier_);
+  observer->OnSetVolumeMultiplier(player_id, GetVolumeMultiplier());
 
   // Determine the audio focus type required for playing the new player.
   // TODO(zqzhang): handle duckable and uncontrollable.
@@ -206,10 +207,27 @@
   AbandonSystemAudioFocusIfNeeded();
 }
 
-void MediaSession::SetVolumeMultiplier(double volume_multiplier) {
-  volume_multiplier_ = volume_multiplier;
+void MediaSession::StartDucking() {
+  if (is_ducking_)
+    return;
+  is_ducking_ = true;
+  UpdateVolumeMultiplier();
+}
+
+void MediaSession::StopDucking() {
+  if (!is_ducking_)
+    return;
+  is_ducking_ = false;
+  UpdateVolumeMultiplier();
+}
+
+void MediaSession::UpdateVolumeMultiplier() {
   for (const auto& it : players_)
-    it.observer->OnSetVolumeMultiplier(it.player_id, volume_multiplier_);
+    it.observer->OnSetVolumeMultiplier(it.player_id, GetVolumeMultiplier());
+}
+
+double MediaSession::GetVolumeMultiplier() const {
+  return is_ducking_ ? kDuckingVolumeMultiplier : kDefaultVolumeMultiplier;
 }
 
 bool MediaSession::IsActive() const {
@@ -325,7 +343,7 @@
       audio_focus_state_(State::INACTIVE),
       audio_focus_type_(
           AudioFocusManager::AudioFocusType::GainTransientMayDuck),
-      volume_multiplier_(kDefaultVolumeMultiplier) {}
+      is_ducking_(false) {}
 
 void MediaSession::Initialize() {
   delegate_ = MediaSessionDelegate::Create(this);

diff --git a/content/browser/media/session/media_session.h b/content/browser/media/session/media_session.h
index d791c61ea..9d501fc 100644
--- a/content/browser/media/session/media_session.h
+++ b/content/browser/media/session/media_session.h

@@ -103,8 +103,13 @@
   // |type| represents the origin of the request.
   CONTENT_EXPORT void Stop(SuspendType suspend_type);
 
-  // Change the volume multiplier of the session to |volume_multiplier|.
-  CONTENT_EXPORT void SetVolumeMultiplier(double volume_multiplier);
+  // Let the media session start ducking such that the volume multiplier is
+  // reduced.
+  CONTENT_EXPORT void StartDucking();
+
+  // Let the media session stop ducking such that the volume multiplier is
+  // recovered.
+  CONTENT_EXPORT void StopDucking();
 
   // Returns if the session can be controlled by Resume() and Suspend calls
   // above.
@@ -187,6 +192,13 @@
   // It sets audio_focus_state_ and notifies observers about the state change.
   void SetAudioFocusState(State audio_focus_state);
 
+  // Update the volume multiplier when ducking state changes.
+  void UpdateVolumeMultiplier();
+
+  // Get the volume multiplier, which depends on whether the media session is
+  // ducking.
+  double GetVolumeMultiplier() const;
+
   // Registers a MediaSession state change callback.
   CONTENT_EXPORT std::unique_ptr<base::CallbackList<void(State)>::Subscription>
   RegisterMediaSessionStateChangedCallbackForTest(
@@ -201,9 +213,10 @@
 
   MediaSessionUmaHelper uma_helper_;
 
-  // The volume multiplier of this session. All players in this session should
-  // multiply their volume with this multiplier to get the effective volume.
-  double volume_multiplier_;
+  // The ducking state of this media session. The initial value is |false|, and
+  // is set to |true| after StartDucking(), and will be set to |false| after
+  // StopDucking().
+  bool is_ducking_;
 
   MediaMetadata metadata_;
   base::CallbackList<void(State)> media_session_state_listeners_;

diff --git a/content/browser/media/session/media_session_browsertest.cc b/content/browser/media/session/media_session_browsertest.cc
index 699570f1..4c53b3b5 100644
--- a/content/browser/media/session/media_session_browsertest.cc
+++ b/content/browser/media/session/media_session_browsertest.cc

@@ -34,6 +34,9 @@
 
 namespace {
 
+const double kDefaultVolumeMultiplier = 1.0;
+const double kDuckingVolumeMultiplier = 0.2;
+
 class MockMediaSessionDelegate : public MediaSessionDelegate {
  public:
   bool RequestAudioFocus(content::AudioFocusManager::AudioFocusType) override {
@@ -137,8 +140,12 @@
                   : MediaSession::State::INACTIVE);
   }
 
-  void SystemSetVolumeMultiplier(double volume_multiplier) {
-    media_session_->SetVolumeMultiplier(volume_multiplier);
+  void SystemStartDucking() {
+    media_session_->StartDucking();
+  }
+
+  void SystemStopDucking() {
+    media_session_->StopDucking();
   }
 
   MockWebContentsObserver* mock_web_contents_observer() {
@@ -266,7 +273,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest,
-                       MediaSessionSetVolumeMultiplier) {
+                       InitialVolumeMultiplier) {
   std::unique_ptr<MockMediaSessionObserver> media_session_observer(
       new MockMediaSessionObserver);
 
@@ -275,16 +282,58 @@
   StartNewPlayer(media_session_observer.get(),
                  media::MediaContentType::Persistent);
 
-  double volume_multiplier = 0.2f;
-  SystemSetVolumeMultiplier(volume_multiplier);
+  EXPECT_EQ(kDefaultVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(0));
+  EXPECT_EQ(kDefaultVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(1));
 
-  EXPECT_EQ(volume_multiplier, media_session_observer->GetVolumeMultiplier(0));
-  EXPECT_EQ(volume_multiplier, media_session_observer->GetVolumeMultiplier(1));
+}
+
+IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest,
+                       StartDuckingReducesVolumeMultiplier) {
+  std::unique_ptr<MockMediaSessionObserver> media_session_observer(
+      new MockMediaSessionObserver);
+
+  StartNewPlayer(media_session_observer.get(),
+                 media::MediaContentType::Persistent);
+  StartNewPlayer(media_session_observer.get(),
+                 media::MediaContentType::Persistent);
+  SystemStartDucking();
+
+  EXPECT_EQ(kDuckingVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(0));
+  EXPECT_EQ(kDuckingVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(1));
 
   StartNewPlayer(media_session_observer.get(),
                  media::MediaContentType::Persistent);
 
-  EXPECT_EQ(volume_multiplier, media_session_observer->GetVolumeMultiplier(2));
+  EXPECT_EQ(kDuckingVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(2));
+}
+
+IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest,
+                       StopDuckingRecoversVolumeMultiplier) {
+  std::unique_ptr<MockMediaSessionObserver> media_session_observer(
+      new MockMediaSessionObserver);
+
+  StartNewPlayer(media_session_observer.get(),
+                 media::MediaContentType::Persistent);
+  StartNewPlayer(media_session_observer.get(),
+                 media::MediaContentType::Persistent);
+  SystemStartDucking();
+  SystemStopDucking();
+
+  EXPECT_EQ(kDefaultVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(0));
+  EXPECT_EQ(kDefaultVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(1));
+
+  StartNewPlayer(media_session_observer.get(),
+                 media::MediaContentType::Persistent);
+
+  EXPECT_EQ(kDefaultVolumeMultiplier,
+            media_session_observer->GetVolumeMultiplier(2));
 }
 
 IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest, AudioFocusInitialState) {

diff --git a/content/browser/media/session/media_session_delegate_android.cc b/content/browser/media/session/media_session_delegate_android.cc
index 21bbaad..da826e9 100644
--- a/content/browser/media/session/media_session_delegate_android.cc
+++ b/content/browser/media/session/media_session_delegate_android.cc

@@ -76,9 +76,12 @@
   media_session_->Resume(MediaSession::SuspendType::SYSTEM);
 }
 
-void MediaSessionDelegateAndroid::OnSetVolumeMultiplier(
-    JNIEnv*, jobject, jdouble volume_multiplier) {
-  media_session_->SetVolumeMultiplier(volume_multiplier);
+void MediaSessionDelegateAndroid::OnStartDucking(JNIEnv*, jobject) {
+  media_session_->StartDucking();
+}
+
+void MediaSessionDelegateAndroid::OnStopDucking(JNIEnv*, jobject) {
+  media_session_->StopDucking();
 }
 
 void MediaSessionDelegateAndroid::RecordSessionDuck(

diff --git a/content/browser/media/session/media_session_delegate_android.h b/content/browser/media/session/media_session_delegate_android.h
index 833aa8a..8fe24b7 100644
--- a/content/browser/media/session/media_session_delegate_android.h
+++ b/content/browser/media/session/media_session_delegate_android.h

@@ -37,12 +37,15 @@
   // Called by Java through JNI.
   void OnResume(JNIEnv* env, const base::android::JavaParamRef<jobject>& obj);
 
-  // Called when the Android system requests the MediaSession to duck.
+  // Called when the Android system requests the MediaSession to start ducking.
   // Called by Java through JNI.
-  void OnSetVolumeMultiplier(JNIEnv* env, jobject obj,
-                             jdouble volume_multiplier);
+  void OnStartDucking(JNIEnv* env, jobject obj);
 
-  // Called when the Android system requests the MediaSession to duck.
+  // Called when the Android system requests the MediaSession to stop ducking.
+  // Called by Java through JNI.
+  void OnStopDucking(JNIEnv* env, jobject obj);
+
+  // Record when the Android system requests the MediaSession to duck.
   // Called by Java through JNI.
   void RecordSessionDuck(JNIEnv* env,
                          const base::android::JavaParamRef<jobject> &obj);

diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index ecc36b77..0235161 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi

@@ -778,6 +778,8 @@
     ],
     # WebRTC-specific sources. Put WebRTC plugin-related stuff further below.
     'content_unittests_webrtc_sources': [
+       # |task_queue_unittest.cc| is added to test the webrtc_override of TaskQueue.
+       '../third_party/webrtc/base/task_queue_unittest.cc',
       'browser/renderer_host/p2p/socket_host_tcp_server_unittest.cc',
       'browser/renderer_host/p2p/socket_host_tcp_unittest.cc',
       'browser/renderer_host/p2p/socket_host_test_utils.cc',

diff --git a/content/public/android/java/src/org/chromium/content/browser/MediaSessionDelegate.java b/content/public/android/java/src/org/chromium/content/browser/MediaSessionDelegate.java
index af648e3..c76faca 100644
--- a/content/public/android/java/src/org/chromium/content/browser/MediaSessionDelegate.java
+++ b/content/public/android/java/src/org/chromium/content/browser/MediaSessionDelegate.java

@@ -26,10 +26,6 @@
 public class MediaSessionDelegate implements AudioManager.OnAudioFocusChangeListener {
     private static final String TAG = "MediaSession";
 
-    // These need to match the values in native apps.
-    public static final double DUCKING_VOLUME_MULTIPLIER = 0.2f;
-    public static final double DEFAULT_VOLUME_MULTIPLIER = 1.0f;
-
     private Context mContext;
     private int mFocusType;
     private boolean mIsDucking = false;
@@ -82,8 +78,7 @@
         switch (focusChange) {
             case AudioManager.AUDIOFOCUS_GAIN:
                 if (mIsDucking) {
-                    nativeOnSetVolumeMultiplier(mNativeMediaSessionDelegateAndroid,
-                                                DEFAULT_VOLUME_MULTIPLIER);
+                    nativeOnStopDucking(mNativeMediaSessionDelegateAndroid);
                     mIsDucking = false;
                 } else {
                     nativeOnResume(mNativeMediaSessionDelegateAndroid);
@@ -95,8 +90,7 @@
             case AudioManager.AUDIOFOCUS_LOSS_TRANSIENT_CAN_DUCK:
                 mIsDucking = true;
                 nativeRecordSessionDuck(mNativeMediaSessionDelegateAndroid);
-                nativeOnSetVolumeMultiplier(mNativeMediaSessionDelegateAndroid,
-                                            DUCKING_VOLUME_MULTIPLIER);
+                nativeOnStartDucking(mNativeMediaSessionDelegateAndroid);
                 break;
             case AudioManager.AUDIOFOCUS_LOSS:
                 abandonAudioFocus();
@@ -110,7 +104,7 @@
 
     private native void nativeOnSuspend(long nativeMediaSessionDelegateAndroid, boolean temporary);
     private native void nativeOnResume(long nativeMediaSessionDelegateAndroid);
-    private native void nativeOnSetVolumeMultiplier(long nativeMediaSessionDelegateAndroid,
-                                                    double volumeMultiplier);
+    private native void nativeOnStartDucking(long nativeMediaSessionDelegateAndroid);
+    private native void nativeOnStopDucking(long nativeMediaSessionDelegateAndroid);
     private native void nativeRecordSessionDuck(long nativeMediaSessionDelegateAndroid);
 }

diff --git a/content/renderer/bluetooth/web_bluetooth_impl.cc b/content/renderer/bluetooth/web_bluetooth_impl.cc
index 549d5cf..231cffce 100644
--- a/content/renderer/bluetooth/web_bluetooth_impl.cc
+++ b/content/renderer/bluetooth/web_bluetooth_impl.cc

@@ -189,11 +189,11 @@
     for (size_t i = 0; i < device->uuids.size(); ++i)
       uuids[i] = blink::WebString::fromUTF8(device->uuids[i]);
 
-    callbacks->onSuccess(base::WrapUnique(new blink::WebBluetoothDeviceInit(
+    callbacks->onSuccess(base::MakeUnique<blink::WebBluetoothDeviceInit>(
         blink::WebString::fromUTF8(device->id.str()),
         device->name.is_null() ? blink::WebString()
                                : blink::WebString::fromUTF8(device->name),
-        uuids)));
+        uuids));
   } else {
     callbacks->onError(ToInt32(error));
   }

diff --git a/content/renderer/gpu/frame_swap_message_queue.cc b/content/renderer/gpu/frame_swap_message_queue.cc
index 163760e..2b192e4 100644
--- a/content/renderer/gpu/frame_swap_message_queue.cc
+++ b/content/renderer/gpu/frame_swap_message_queue.cc

@@ -199,7 +199,7 @@
 
 std::unique_ptr<FrameSwapMessageQueue::SendMessageScope>
 FrameSwapMessageQueue::AcquireSendMessageScope() {
-  return base::WrapUnique(new SendMessageScopeImpl(&lock_));
+  return base::MakeUnique<SendMessageScopeImpl>(&lock_);
 }
 
 // static

diff --git a/content/renderer/gpu/frame_swap_message_queue_unittest.cc b/content/renderer/gpu/frame_swap_message_queue_unittest.cc
index 0501640..8488b559 100644
--- a/content/renderer/gpu/frame_swap_message_queue_unittest.cc
+++ b/content/renderer/gpu/frame_swap_message_queue_unittest.cc

@@ -65,7 +65,7 @@
   }
 
   std::unique_ptr<IPC::Message> CloneMessage(const IPC::Message& other) {
-    return base::WrapUnique(new IPC::Message(other));
+    return base::MakeUnique<IPC::Message>(other);
   }
 
   void TestDidNotSwap(cc::SwapPromise::DidNotSwapReason reason);
@@ -264,24 +264,24 @@
 
 TEST_F(FrameSwapMessageQueueTest, TestDeletesNextSwapMessage) {
   bool message_deleted = false;
-  QueueNextSwapMessage(base::WrapUnique(
-      new NotifiesDeletionMessage(&message_deleted, first_message_)));
+  QueueNextSwapMessage(base::MakeUnique<NotifiesDeletionMessage>(
+      &message_deleted, first_message_));
   queue_ = NULL;
   ASSERT_TRUE(message_deleted);
 }
 
 TEST_F(FrameSwapMessageQueueTest, TestDeletesVisualStateMessage) {
   bool message_deleted = false;
-  QueueVisualStateMessage(1, base::WrapUnique(new NotifiesDeletionMessage(
-                                 &message_deleted, first_message_)));
+  QueueVisualStateMessage(1, base::MakeUnique<NotifiesDeletionMessage>(
+                                 &message_deleted, first_message_));
   queue_ = NULL;
   ASSERT_TRUE(message_deleted);
 }
 
 TEST_F(FrameSwapMessageQueueTest, TestDeletesQueuedVisualStateMessage) {
   bool message_deleted = false;
-  QueueVisualStateMessage(1, base::WrapUnique(new NotifiesDeletionMessage(
-                                 &message_deleted, first_message_)));
+  QueueVisualStateMessage(1, base::MakeUnique<NotifiesDeletionMessage>(
+                                 &message_deleted, first_message_));
   queue_->DidActivate(1);
   queue_->DidSwap(1);
   queue_ = NULL;

diff --git a/content/renderer/history_controller.cc b/content/renderer/history_controller.cc
index dbdb112..0618765 100644
--- a/content/renderer/history_controller.cc
+++ b/content/renderer/history_controller.cc

@@ -98,7 +98,7 @@
     if (!render_frame)
       continue;
     render_frame->SetPendingNavigationParams(
-        base::WrapUnique(new NavigationParams(*navigation_params_.get())));
+        base::MakeUnique<NavigationParams>(*navigation_params_.get()));
     WebURLRequest request = frame->toWebLocalFrame()->requestFromHistoryItem(
         item.second, cache_policy);
     frame->toWebLocalFrame()->load(
@@ -113,7 +113,7 @@
     if (!render_frame)
       continue;
     render_frame->SetPendingNavigationParams(
-        base::WrapUnique(new NavigationParams(*navigation_params_.get())));
+        base::MakeUnique<NavigationParams>(*navigation_params_.get()));
     WebURLRequest request = frame->toWebLocalFrame()->requestFromHistoryItem(
         item.second, cache_policy);
     frame->toWebLocalFrame()->load(
@@ -304,7 +304,7 @@
     RenderFrameImpl* frame) const {
   if (navigation_params_.get()) {
     frame->SetPendingNavigationParams(
-        base::WrapUnique(new NavigationParams(*navigation_params_.get())));
+        base::MakeUnique<NavigationParams>(*navigation_params_.get()));
   }
 
   if (!current_entry_)

diff --git a/content/renderer/input/input_event_filter.cc b/content/renderer/input/input_event_filter.cc
index e9bd18ce6..fc373ae 100644
--- a/content/renderer/input/input_event_filter.cc
+++ b/content/renderer/input/input_event_filter.cc

@@ -110,7 +110,7 @@
 
 void InputEventFilter::DidStopFlinging(int routing_id) {
   SetIsFlingingInMainThreadEventQueue(routing_id, false);
-  SendMessage(base::WrapUnique(new InputHostMsg_DidStopFlinging(routing_id)));
+  SendMessage(base::MakeUnique<InputHostMsg_DidStopFlinging>(routing_id));
 }
 
 void InputEventFilter::NotifyInputEventHandled(int routing_id,

diff --git a/content/renderer/input/main_thread_event_queue.cc b/content/renderer/input/main_thread_event_queue.cc
index 5c872c0..c34e08a 100644
--- a/content/renderer/input/main_thread_event_queue.cc
+++ b/content/renderer/input/main_thread_event_queue.cc

@@ -23,9 +23,14 @@
 bool isContinuousEvent(const std::unique_ptr<EventWithDispatchType>& event) {
   switch (event->event().type) {
     case blink::WebInputEvent::MouseMove:
-    case blink::WebInputEvent::TouchMove:
     case blink::WebInputEvent::MouseWheel:
       return true;
+    case blink::WebInputEvent::TouchMove:
+      // TouchMoves that are blocking end up blocking scroll. Do not treat
+      // them as continuous events otherwise we will end up waiting up to an
+      // additional frame.
+      return static_cast<const blink::WebTouchEvent&>(event->event())
+                 .dispatchType != blink::WebInputEvent::Blocking;
     default:
       return false;
   }

diff --git a/content/renderer/input/main_thread_event_queue_unittest.cc b/content/renderer/input/main_thread_event_queue_unittest.cc
index f0b9384e..5ad5ac8 100644
--- a/content/renderer/input/main_thread_event_queue_unittest.cc
+++ b/content/renderer/input/main_thread_event_queue_unittest.cc

@@ -227,7 +227,6 @@
 
 TEST_P(MainThreadEventQueueTest, BlockingTouch) {
   base::HistogramTester histogram_tester;
-
   SyntheticWebTouchEvent kEvents[4];
   kEvents[0].PressPoint(10, 10);
   kEvents[1].PressPoint(10, 10);
@@ -254,6 +253,11 @@
   EXPECT_EQ(kEvents[2].uniqueTouchEventId, additional_acked_events_.at(0));
   EXPECT_EQ(kEvents[3].uniqueTouchEventId, additional_acked_events_.at(1));
 
+  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[3], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  EXPECT_EQ(1u, event_queue().size());
+  RunPendingTasksWithSimulatedRaf();
   histogram_tester.ExpectUniqueSample(kCoalescedCountHistogram, 2, 1);
 }
 
@@ -403,6 +407,18 @@
   EXPECT_EQ(2u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
+
+  // Simulate the touch move being discrete
+  kEvents[0].touchStartOrFirstTouchMove = true;
+  kEvents[1].touchStartOrFirstTouchMove = true;
+
+  for (SyntheticWebTouchEvent& event : kEvents)
+    HandleEvent(event, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+
+  EXPECT_EQ(3u, event_queue().size());
+  EXPECT_TRUE(main_task_runner_->HasPendingTask());
+  EXPECT_FALSE(needs_main_frame_);
+  main_task_runner_->RunUntilIdle();
 }
 
 TEST_P(MainThreadEventQueueTest, RafAlignedMaxSize) {
@@ -459,6 +475,7 @@
 
   kEvents[0].MovePoint(0, 30, 30);
   HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(handle_raf_aligned_input_, !main_task_runner_->HasPendingTask());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());

diff --git a/content/renderer/media/android/media_player_renderer_client_factory.cc b/content/renderer/media/android/media_player_renderer_client_factory.cc
index 66fa36d..0776318 100644
--- a/content/renderer/media/android/media_player_renderer_client_factory.cc
+++ b/content/renderer/media/android/media_player_renderer_client_factory.cc

@@ -38,9 +38,9 @@
   media::ScopedStreamTextureWrapper stream_texture_wrapper =
       get_stream_texture_wrapper_cb_.Run();
 
-  return base::WrapUnique(new MediaPlayerRendererClient(
+  return base::MakeUnique<MediaPlayerRendererClient>(
       media_task_runner, compositor_task_runner_, mojo_renderer,
-      std::move(stream_texture_wrapper), video_renderer_sink));
+      std::move(stream_texture_wrapper), video_renderer_sink);
 }
 
 }  // namespace content

diff --git a/content/renderer/media/gpu/rtc_video_encoder_unittest.cc b/content/renderer/media/gpu/rtc_video_encoder_unittest.cc
index 7531eb2a..475d4c92 100644
--- a/content/renderer/media/gpu/rtc_video_encoder_unittest.cc
+++ b/content/renderer/media/gpu/rtc_video_encoder_unittest.cc

@@ -80,8 +80,8 @@
 
   void CreateEncoder(webrtc::VideoCodecType codec_type) {
     DVLOG(3) << __FUNCTION__;
-    rtc_encoder_ = base::WrapUnique(
-        new RTCVideoEncoder(codec_type, mock_gpu_factories_.get()));
+    rtc_encoder_ = base::MakeUnique<RTCVideoEncoder>(codec_type,
+                                                     mock_gpu_factories_.get());
   }
 
   // media::VideoEncodeAccelerator implementation.

diff --git a/content/renderer/media/renderer_gpu_video_accelerator_factories.cc b/content/renderer/media/renderer_gpu_video_accelerator_factories.cc
index cc16005..2d43151a 100644
--- a/content/renderer/media/renderer_gpu_video_accelerator_factories.cc
+++ b/content/renderer/media/renderer_gpu_video_accelerator_factories.cc

@@ -278,7 +278,7 @@
 RendererGpuVideoAcceleratorFactories::GetGLContextLock() {
   if (CheckContextLost())
     return nullptr;
-  return base::WrapUnique(new ScopedGLContextLockImpl(context_provider_));
+  return base::MakeUnique<ScopedGLContextLockImpl>(context_provider_);
 }
 
 std::unique_ptr<base::SharedMemory>

diff --git a/content/renderer/media/rtc_certificate_generator.cc b/content/renderer/media/rtc_certificate_generator.cc
index 4b819c8..7ea0809 100644
--- a/content/renderer/media/rtc_certificate_generator.cc
+++ b/content/renderer/media/rtc_certificate_generator.cc

@@ -89,11 +89,12 @@
         rtc::RTCCertificateGenerator::GenerateCertificate(
             WebRTCKeyParamsToKeyParams(key_params), expires_ms);
 
-    main_thread_->PostTask(FROM_HERE, base::Bind(
-        &RTCCertificateGeneratorRequest::DoCallbackOnMainThread,
-        this,
-        base::Passed(std::move(observer)),
-        base::Passed(base::WrapUnique(new RTCCertificate(certificate)))));
+    main_thread_->PostTask(
+        FROM_HERE,
+        base::Bind(
+            &RTCCertificateGeneratorRequest::DoCallbackOnMainThread, this,
+            base::Passed(std::move(observer)),
+            base::Passed(base::MakeUnique<RTCCertificate>(certificate))));
   }
 
   void DoCallbackOnMainThread(

diff --git a/content/renderer/media/webrtc_audio_renderer.cc b/content/renderer/media/webrtc_audio_renderer.cc
index 3762a7c..65d03a0 100644
--- a/content/renderer/media/webrtc_audio_renderer.cc
+++ b/content/renderer/media/webrtc_audio_renderer.cc

@@ -302,15 +302,6 @@
 void WebRtcAudioRenderer::Stop() {
   DVLOG(1) << "WebRtcAudioRenderer::Stop()";
   DCHECK(thread_checker_.CalledOnValidThread());
-  // If |max_render_time_| is zero, no render call has been made.
-  if (!max_render_time_.is_zero()) {
-    UMA_HISTOGRAM_CUSTOM_COUNTS(
-        "Media.Audio.Render.GetSourceDataTimeMax.WebRTC",
-        max_render_time_.InMicroseconds(), kRenderTimeHistogramMinMicroseconds,
-        kRenderTimeHistogramMaxMicroseconds, 50);
-    max_render_time_ = base::TimeDelta();
-  }
-
   {
     base::AutoLock auto_lock(lock_);
     if (state_ == UNINITIALIZED)
@@ -326,6 +317,19 @@
     state_ = UNINITIALIZED;
   }
 
+  // Apart from here, |max_render_time_| is only accessed in SourceCallback(),
+  // which is guaranteed to not run after |source_| has been set to null, and
+  // not before this function has returned.
+  // If |max_render_time_| is zero, no render call has been made.
+  if (!max_render_time_.is_zero()) {
+    UMA_HISTOGRAM_CUSTOM_COUNTS(
+        "Media.Audio.Render.GetSourceDataTimeMax.WebRTC",
+        max_render_time_.InMicroseconds(),
+        kRenderTimeHistogramMinMicroseconds,
+        kRenderTimeHistogramMaxMicroseconds, 50);
+    max_render_time_ = base::TimeDelta();
+  }
+
   // Make sure to stop the sink while _not_ holding the lock since the Render()
   // callback may currently be executing and trying to grab the lock while we're
   // stopping the thread on which it runs.

diff --git a/content/renderer/media/webrtc_audio_renderer.h b/content/renderer/media/webrtc_audio_renderer.h
index 272eca0..3c4d22a11 100644
--- a/content/renderer/media/webrtc_audio_renderer.h
+++ b/content/renderer/media/webrtc_audio_renderer.h

@@ -213,7 +213,7 @@
 
   // Protects access to |state_|, |source_|, |audio_fifo_|,
   // |audio_delay_milliseconds_|, |fifo_delay_milliseconds_|, |current_time_|,
-  // |sink_params_| and |render_callback_count_|
+  // |sink_params_|, |render_callback_count_| and |max_render_time_|.
   mutable base::Lock lock_;
 
   // Ref count for the MediaPlayers which are playing audio.

diff --git a/content/renderer/pepper/content_renderer_pepper_host_factory.cc b/content/renderer/pepper/content_renderer_pepper_host_factory.cc
index 6614c9c9..08ae05c 100644
--- a/content/renderer/pepper/content_renderer_pepper_host_factory.cc
+++ b/content/renderer/pepper/content_renderer_pepper_host_factory.cc

@@ -123,8 +123,7 @@
     case PpapiHostMsg_Compositor_Create::ID: {
       if (!CanUseCompositorAPI(host_, instance))
         return nullptr;
-      return base::WrapUnique(
-          new PepperCompositorHost(host_, instance, resource));
+      return base::MakeUnique<PepperCompositorHost>(host_, instance, resource);
     }
     case PpapiHostMsg_FileRef_CreateForFileAPI::ID: {
       PP_Resource file_system;
@@ -134,8 +133,8 @@
         NOTREACHED();
         return nullptr;
       }
-      return base::WrapUnique(new PepperFileRefRendererHost(
-          host_, instance, resource, file_system, internal_path));
+      return base::MakeUnique<PepperFileRefRendererHost>(
+          host_, instance, resource, file_system, internal_path);
     }
     case PpapiHostMsg_FileSystem_Create::ID: {
       PP_FileSystemType file_system_type;
@@ -144,8 +143,8 @@
         NOTREACHED();
         return nullptr;
       }
-      return base::WrapUnique(new PepperFileSystemHost(
-          host_, instance, resource, file_system_type));
+      return base::MakeUnique<PepperFileSystemHost>(host_, instance, resource,
+                                                    file_system_type);
     }
     case PpapiHostMsg_Graphics2D_Create::ID: {
       PP_Size size;
@@ -174,32 +173,31 @@
           host_, instance, resource, size, is_always_opaque, image_data));
     }
     case PpapiHostMsg_URLLoader_Create::ID:
-      return base::WrapUnique(
-          new PepperURLLoaderHost(host_, false, instance, resource));
+      return base::MakeUnique<PepperURLLoaderHost>(host_, false, instance,
+                                                   resource);
     case PpapiHostMsg_VideoDecoder_Create::ID:
-      return base::WrapUnique(
-          new PepperVideoDecoderHost(host_, instance, resource));
+      return base::MakeUnique<PepperVideoDecoderHost>(host_, instance,
+                                                      resource);
     case PpapiHostMsg_VideoEncoder_Create::ID:
-      return base::WrapUnique(
-          new PepperVideoEncoderHost(host_, instance, resource));
+      return base::MakeUnique<PepperVideoEncoderHost>(host_, instance,
+                                                      resource);
     case PpapiHostMsg_WebSocket_Create::ID:
-      return base::WrapUnique(
-          new PepperWebSocketHost(host_, instance, resource));
+      return base::MakeUnique<PepperWebSocketHost>(host_, instance, resource);
 #if defined(ENABLE_WEBRTC)
     case PpapiHostMsg_MediaStreamVideoTrack_Create::ID:
-      return base::WrapUnique(
-          new PepperMediaStreamVideoTrackHost(host_, instance, resource));
+      return base::MakeUnique<PepperMediaStreamVideoTrackHost>(host_, instance,
+                                                               resource);
     // These private MediaStream interfaces are exposed as if they were public
     // so they can be used by NaCl plugins. However, they are available only
     // for whitelisted apps.
     case PpapiHostMsg_VideoDestination_Create::ID:
       if (CanUseMediaStreamAPI(host_, instance))
-        return base::WrapUnique(
-            new PepperVideoDestinationHost(host_, instance, resource));
+        return base::MakeUnique<PepperVideoDestinationHost>(host_, instance,
+                                                            resource);
     case PpapiHostMsg_VideoSource_Create::ID:
       if (CanUseMediaStreamAPI(host_, instance))
-        return base::WrapUnique(
-            new PepperVideoSourceHost(host_, instance, resource));
+        return base::MakeUnique<PepperVideoSourceHost>(host_, instance,
+                                                       resource);
 #endif  // defined(ENABLE_WEBRTC)
   }
 
@@ -207,14 +205,14 @@
   if (GetPermissions().HasPermission(ppapi::PERMISSION_DEV)) {
     switch (message.type()) {
       case PpapiHostMsg_AudioEncoder_Create::ID:
-        return base::WrapUnique(
-            new PepperAudioEncoderHost(host_, instance, resource));
+        return base::MakeUnique<PepperAudioEncoderHost>(host_, instance,
+                                                        resource);
       case PpapiHostMsg_AudioInput_Create::ID:
-        return base::WrapUnique(
-            new PepperAudioInputHost(host_, instance, resource));
+        return base::MakeUnique<PepperAudioInputHost>(host_, instance,
+                                                      resource);
       case PpapiHostMsg_FileChooser_Create::ID:
-        return base::WrapUnique(
-            new PepperFileChooserHost(host_, instance, resource));
+        return base::MakeUnique<PepperFileChooserHost>(host_, instance,
+                                                       resource);
       case PpapiHostMsg_VideoCapture_Create::ID: {
         std::unique_ptr<PepperVideoCaptureHost> host(
             new PepperVideoCaptureHost(host_, instance, resource));

diff --git a/content/renderer/presentation/presentation_dispatcher.cc b/content/renderer/presentation/presentation_dispatcher.cc
index 293b030a..949f03ba 100644
--- a/content/renderer/presentation/presentation_dispatcher.cc
+++ b/content/renderer/presentation/presentation_dispatcher.cc

@@ -386,8 +386,8 @@
 
   DCHECK(!session_info.is_null());
   presentation_service_->ListenForSessionMessages(session_info.Clone());
-  callback->onSuccess(base::WrapUnique(
-      new PresentationConnectionClient(std::move(session_info))));
+  callback->onSuccess(
+      base::MakeUnique<PresentationConnectionClient>(std::move(session_info)));
 }
 
 void PresentationDispatcher::OnConnectionStateChanged(

diff --git a/content/renderer/push_messaging/push_messaging_dispatcher.cc b/content/renderer/push_messaging/push_messaging_dispatcher.cc
index 7c89a76..6756f61d 100644
--- a/content/renderer/push_messaging/push_messaging_dispatcher.cc
+++ b/content/renderer/push_messaging/push_messaging_dispatcher.cc

@@ -122,9 +122,9 @@
       subscription_callbacks_.Lookup(request_id);
   DCHECK(callbacks);
 
-  callbacks->onSuccess(base::WrapUnique(new blink::WebPushSubscription(
+  callbacks->onSuccess(base::MakeUnique<blink::WebPushSubscription>(
       endpoint, options.user_visible_only,
-      blink::WebString::fromLatin1(options.sender_info), p256dh, auth)));
+      blink::WebString::fromLatin1(options.sender_info), p256dh, auth));
 
   subscription_callbacks_.Remove(request_id);
 }

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 60f8125..fbd8279 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -1216,7 +1216,7 @@
 
 void RenderFrameImpl::InitializeBlameContext(RenderFrameImpl* parent_frame) {
   DCHECK(!blame_context_);
-  blame_context_ = base::WrapUnique(new FrameBlameContext(this, parent_frame));
+  blame_context_ = base::MakeUnique<FrameBlameContext>(this, parent_frame);
   blame_context_->Initialize();
 }
 
@@ -2260,7 +2260,7 @@
   }
 
   file_chooser_completions_.push_back(
-      base::WrapUnique(new PendingFileChooser(params, completion)));
+      base::MakeUnique<PendingFileChooser>(params, completion));
   if (file_chooser_completions_.size() == 1) {
     // Actually show the browse dialog when this is the first request.
     Send(new FrameHostMsg_RunFileChooser(routing_id_, params));
@@ -5723,7 +5723,7 @@
   DCHECK(!web_user_media_client_);
   web_user_media_client_ = new UserMediaClientImpl(
       this, RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
-      base::WrapUnique(new MediaStreamDispatcher(this)));
+      base::MakeUnique<MediaStreamDispatcher>(this));
 #endif
 }
 

diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 431af21..605769b 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc

@@ -287,8 +287,8 @@
   // WebThreadImplForWorkerScheduler:
   std::unique_ptr<blink::scheduler::WorkerScheduler> CreateWorkerScheduler()
       override {
-    return base::WrapUnique(
-        new blink::scheduler::CompositorWorkerScheduler(thread()));
+    return base::MakeUnique<blink::scheduler::CompositorWorkerScheduler>(
+        thread());
   }
 
   DISALLOW_COPY_AND_ASSIGN(WebThreadForCompositor);
@@ -1576,8 +1576,8 @@
 
 std::unique_ptr<cc::BeginFrameSource>
 RenderThreadImpl::CreateExternalBeginFrameSource(int routing_id) {
-  return base::WrapUnique(new CompositorExternalBeginFrameSource(
-      compositor_message_filter_.get(), sync_message_filter(), routing_id));
+  return base::MakeUnique<CompositorExternalBeginFrameSource>(
+      compositor_message_filter_.get(), sync_message_filter(), routing_id);
 }
 
 cc::ImageSerializationProcessor*
@@ -1815,9 +1815,9 @@
         cc::VulkanInProcessContextProvider::Create();
     if (vulkan_context_provider) {
       DCHECK(!layout_test_mode());
-      return base::WrapUnique(new CompositorOutputSurface(
+      return base::MakeUnique<CompositorOutputSurface>(
           routing_id, output_surface_id, std::move(vulkan_context_provider),
-          std::move(frame_swap_message_queue)));
+          std::move(frame_swap_message_queue));
     }
   }
 
@@ -1838,9 +1838,9 @@
 
   if (use_software) {
     DCHECK(!layout_test_mode());
-    return base::WrapUnique(new CompositorOutputSurface(
+    return base::MakeUnique<CompositorOutputSurface>(
         routing_id, output_surface_id, nullptr, nullptr,
-        std::move(frame_swap_message_queue)));
+        std::move(frame_swap_message_queue));
   }
 
   scoped_refptr<ContextProviderCommandBuffer> worker_context_provider =
@@ -1890,16 +1890,16 @@
 
 #if defined(OS_ANDROID)
   if (sync_compositor_message_filter_) {
-    return base::WrapUnique(new SynchronousCompositorOutputSurface(
+    return base::MakeUnique<SynchronousCompositorOutputSurface>(
         std::move(context_provider), std::move(worker_context_provider),
         routing_id, output_surface_id, sync_compositor_message_filter_.get(),
-        std::move(frame_swap_message_queue)));
+        std::move(frame_swap_message_queue));
   }
 #endif
 
-  return base::WrapUnique(new CompositorOutputSurface(
+  return base::MakeUnique<CompositorOutputSurface>(
       routing_id, output_surface_id, std::move(context_provider),
-      std::move(worker_context_provider), std::move(frame_swap_message_queue)));
+      std::move(worker_context_provider), std::move(frame_swap_message_queue));
 }
 
 std::unique_ptr<cc::SwapPromise>

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index a9a8099..0fe2dd1 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -792,14 +792,14 @@
     main_render_frame_->Initialize();
 
 #if defined(OS_ANDROID)
-  content_detectors_.push_back(base::WrapUnique(new AddressDetector()));
+  content_detectors_.push_back(base::MakeUnique<AddressDetector>());
   const std::string& contry_iso =
       params.renderer_preferences.network_contry_iso;
   if (!contry_iso.empty()) {
     content_detectors_.push_back(
-        base::WrapUnique(new PhoneNumberDetector(contry_iso)));
+        base::MakeUnique<PhoneNumberDetector>(contry_iso));
   }
-  content_detectors_.push_back(base::WrapUnique(new EmailDetector()));
+  content_detectors_.push_back(base::MakeUnique<EmailDetector>());
 #endif
 
   // If this is a popup, we must wait for the CreatingNew_ACK message before

diff --git a/gin/wrappable.cc b/gin/wrappable.cc
index 0fac4e0b..6e1957e 100644
--- a/gin/wrappable.cc
+++ b/gin/wrappable.cc

@@ -58,8 +58,10 @@
     delete this;
     return wrapper;
   }
-  wrapper->SetAlignedPointerInInternalField(kWrapperInfoIndex, info);
-  wrapper->SetAlignedPointerInInternalField(kEncodedValueIndex, this);
+
+  int indices[] = {kWrapperInfoIndex, kEncodedValueIndex};
+  void* values[] = {info, this};
+  wrapper->SetAlignedPointerInInternalFields(2, indices, values);
   wrapper_.Reset(isolate, wrapper);
   wrapper_.SetWeak(this, FirstWeakCallback, v8::WeakCallbackType::kParameter);
   return wrapper;

diff --git a/infra/config/recipes.cfg b/infra/config/recipes.cfg
index 86e6c8de..9c5e8285 100644
--- a/infra/config/recipes.cfg
+++ b/infra/config/recipes.cfg

@@ -5,13 +5,13 @@
   project_id: "build"
   url: "https://chromium.googlesource.com/chromium/tools/build.git"
   branch: "master"
-  revision: "314ef813f4cf2f862b33e9b2a9796c0df17a7ccb"
+  revision: "3a98a0a38287c090976ffd2f0cd47d12ba21b2d3"
 }
 deps {
   project_id: "depot_tools"
   url: "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
   branch: "master"
-  revision: "06e2710700b619355253228d7c2caa1bc76e13bc"
+  revision: "6d3c290164360907fe08784093e36314069e689f"
 }
 deps {
   project_id: "recipe_engine"

diff --git a/ios/chrome/browser/browsing_data/ios_chrome_browsing_data_remover.mm b/ios/chrome/browser/browsing_data/ios_chrome_browsing_data_remover.mm
index 61d6df5..f06420eb 100644
--- a/ios/chrome/browser/browsing_data/ios_chrome_browsing_data_remover.mm
+++ b/ios/chrome/browser/browsing_data/ios_chrome_browsing_data_remover.mm

@@ -191,8 +191,7 @@
         keywords_model->Load();
         waiting_for_clear_keyword_data_ = true;
       } else if (keywords_model) {
-        keywords_model->RemoveAutoGeneratedForOriginBetween(
-            GURL(), delete_begin_, delete_end_);
+        keywords_model->RemoveAutoGeneratedBetween(delete_begin_, delete_end_);
       }
     }
 

diff --git a/ios/crnet/CrNet.h b/ios/crnet/CrNet.h
index 0be9b776..ce93886e 100644
--- a/ios/crnet/CrNet.h
+++ b/ios/crnet/CrNet.h

@@ -36,12 +36,25 @@
 + (void)setSDCHEnabled:(BOOL)sdchEnabled
          withPrefStore:(NSString *)filename;
 
-// |userAgent| is expected to be of the form Product/Version.
-// Example: Foo/3.0.0.0
-//
+// Set partial UserAgent. This function is a deprecated shortcut for:
+//    [CrNet setUserAgent:userAgent partial:YES];
+// See the documentation for |setUserAgent| for details about the |userAgent|
+// argument.
 // This method only has any effect before |install| is called.
 + (void)setPartialUserAgent:(NSString *)userAgent;
 
+// |userAgent| is expected to be the user agent value sent to remote.
+// If |partial| is set to YES, then actual user agent value is based on device
+// model, OS version, and |userAgent| argument. For example "Foo/3.0.0.0" is
+// sent as "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3 like Mac OS X)
+// AppleWebKit/601.1 (KHTML, like Gecko) Foo/3.0.0.0 Mobile/15G31
+// Safari/601.1.46".
+// If partial is set to NO, then |userAgent| value is complete value sent to
+// the remote. For Example: "Foo/3.0.0.0" is sent as "Foo/3.0.0.0".
+//
+// This method only has any effect before |install| is called.
++ (void)setUserAgent:(NSString*)userAgent partial:(bool)partial;
+
 // Set the block used to determine whether or not CrNet should handle the
 // request. If this is not set, CrNet will handle all requests.
 // Must not be called while requests are in progress. This method can be called

diff --git a/ios/crnet/CrNet.mm b/ios/crnet/CrNet.mm
index f040e25..40aa2910 100644
--- a/ios/crnet/CrNet.mm
+++ b/ios/crnet/CrNet.mm

@@ -14,6 +14,7 @@
 static BOOL g_http2_enabled = YES;
 static BOOL g_quic_enabled = NO;
 static BOOL g_sdch_enabled = NO;
+static BOOL g_user_agent_partial = NO;
 static NSString* g_user_agent = nil;
 static NSString* g_sdch_pref_store_filename = nil;
 static RequestFilterBlock g_request_filter_block = nil;
@@ -35,13 +36,18 @@
 }
 
 + (void)setPartialUserAgent:(NSString *)userAgent {
+  [self setUserAgent:userAgent partial:YES];
+}
+
++ (void)setUserAgent:(NSString*)userAgent partial:(bool)partial {
   g_user_agent = userAgent;
+  g_user_agent_partial = partial;
 }
 
 + (void)installInternal {
   CrNetEnvironment::Initialize();
-  std::string partial_user_agent = base::SysNSStringToUTF8(g_user_agent);
-  g_chrome_net = new CrNetEnvironment(partial_user_agent);
+  std::string user_agent = base::SysNSStringToUTF8(g_user_agent);
+  g_chrome_net = new CrNetEnvironment(user_agent, g_user_agent_partial == YES);
 
   g_chrome_net->set_spdy_enabled(g_http2_enabled);
   g_chrome_net->set_quic_enabled(g_quic_enabled);

diff --git a/ios/crnet/crnet_consumer/BUILD.gn b/ios/crnet/crnet_consumer/BUILD.gn
index 7d57e41..f4b6ea6 100644
--- a/ios/crnet/crnet_consumer/BUILD.gn
+++ b/ios/crnet/crnet_consumer/BUILD.gn

@@ -5,7 +5,7 @@
 import("//build/config/ios/rules.gni")
 
 ios_app_bundle("crnet_consumer") {
-  info_plist = "crnet-consumer-info.plist"
+  info_plist = "crnet-consumer-Info.plist"
 
   deps = [
     "//base",

diff --git a/ios/crnet/crnet_environment.h b/ios/crnet/crnet_environment.h
index 34dd2f8f..e16da23 100644
--- a/ios/crnet/crnet_environment.h
+++ b/ios/crnet/crnet_environment.h

@@ -39,8 +39,9 @@
   // Must be called on the main thread.
   static void Initialize();
 
-  // |user_agent_product_name| will be used to generate the user-agent.
-  CrNetEnvironment(const std::string& user_agent_product_name);
+  // If |user_agent_partial| is true, then |user_agent| will be used to
+  // generate the user-agent, otherwise it will be used directly.
+  CrNetEnvironment(const std::string& user_agent, bool user_agent_partial);
   ~CrNetEnvironment();
 
   // Installs this CrNet environment so requests are intercepted.
@@ -156,7 +157,8 @@
   std::unique_ptr<net::URLRequestContext> main_context_;
   std::unique_ptr<CrNetHttpProtocolHandlerDelegate>
       http_protocol_handler_delegate_;
-  std::string user_agent_product_name_;
+  std::string user_agent_;
+  bool user_agent_partial_;
   std::unique_ptr<net::NetLog> net_log_;
   std::unique_ptr<net::WriteToFileNetLogObserver> net_log_observer_;
 

diff --git a/ios/crnet/crnet_environment.mm b/ios/crnet/crnet_environment.mm
index b63b59df9..8bd9de0 100644
--- a/ios/crnet/crnet_environment.mm
+++ b/ios/crnet/crnet_environment.mm

@@ -264,12 +264,14 @@
   }
 }
 
-CrNetEnvironment::CrNetEnvironment(const std::string& user_agent_product_name)
+CrNetEnvironment::CrNetEnvironment(const std::string& user_agent,
+                                   bool user_agent_partial)
     : spdy_enabled_(false),
       quic_enabled_(false),
       sdch_enabled_(false),
       main_context_(new net::URLRequestContext),
-      user_agent_product_name_(user_agent_product_name),
+      user_agent_(user_agent),
+      user_agent_partial_(user_agent_partial),
       net_log_(new net::NetLog) {}
 
 void CrNetEnvironment::Install() {
@@ -382,16 +384,18 @@
     acceptableLanguages = @"en-US,en";
   std::string acceptable_languages =
       [acceptableLanguages cStringUsingEncoding:NSUTF8StringEncoding];
-  std::string user_agent =
-      web::BuildUserAgentFromProduct(user_agent_product_name_);
+  if (user_agent_partial_) {
+    user_agent_ = web::BuildUserAgentFromProduct(user_agent_);
+    user_agent_partial_ = false;
+  }
   // Set the user agent through NSUserDefaults. This sets it for both
   // UIWebViews and WKWebViews, and javascript calls to navigator.userAgent
   // return this value.
   [[NSUserDefaults standardUserDefaults] registerDefaults:@{
-    @"UserAgent" : [NSString stringWithUTF8String:user_agent.c_str()]
+    @"UserAgent" : [NSString stringWithUTF8String:user_agent_.c_str()]
   }];
   main_context_->set_http_user_agent_settings(
-      new net::StaticHttpUserAgentSettings(acceptable_languages, user_agent));
+      new net::StaticHttpUserAgentSettings(acceptable_languages, user_agent_));
 
   main_context_->set_ssl_config_service(new net::SSLConfigServiceDefaults);
   main_context_->set_transport_security_state(

diff --git a/ios/crnet/test/crnet_http_tests.mm b/ios/crnet/test/crnet_http_tests.mm
index 8aee1af..a8dedb2e 100644
--- a/ios/crnet/test/crnet_http_tests.mm
+++ b/ios/crnet/test/crnet_http_tests.mm

@@ -11,6 +11,7 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #import "ios/third_party/gcdwebserver/src/GCDWebServer/Core/GCDWebServer.h"
+#import "ios/third_party/gcdwebserver/src/GCDWebServer/Responses/GCDWebServerDataResponse.h"
 #include "net/base/mac/url_conversions.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
@@ -99,6 +100,7 @@
 // base::TimeDelta would normally be ideal for this but it does not support
 // nanosecond resolution.
 static const int64_t ns_in_second = 1000000000LL;
+const char kUserAgent[] = "CrNetTest/1.0.0.0";
 
 class HttpTest : public ::testing::Test {
  protected:
@@ -106,7 +108,7 @@
   ~HttpTest() override {}
 
   void SetUp() override {
-    [CrNet setPartialUserAgent:@"CrNetTest/1.0.0.0"];
+    [CrNet setUserAgent:base::SysUTF8ToNSString(kUserAgent) partial:NO];
     [CrNet install];
     NSURLSessionConfiguration* config =
         [NSURLSessionConfiguration ephemeralSessionConfiguration];
@@ -208,11 +210,11 @@
 }
 
 TEST_F(HttpTest, SdchDisabledByDefault) {
-  const char kPath[] = "/foo";
+  const char kPath[] = "/sdchtest";
   RegisterPathHandler(kPath,
       ^GCDWebServerResponse* (GCDWebServerRequest* req) {
         EXPECT_FALSE(HeaderValueContains(req, "Accept-Encoding", "sdch"));
-        return nil;
+        return [GCDWebServerDataResponse responseWithText:@"woot!"];
       });
   StartWebServer();
   NSURL* url = net::NSURLWithGURL(GetURL(kPath));
@@ -222,6 +224,21 @@
   EXPECT_TRUE([delegate_ receivedBytes]);
 }
 
+TEST_F(HttpTest, SetUserAgentIsExact) {
+  const char kPath[] = "/uatest";
+  RegisterPathHandler(kPath, ^GCDWebServerResponse*(GCDWebServerRequest* req) {
+    EXPECT_STREQ(kUserAgent,
+                 [[req.headers valueForKey:@"User-Agent"] UTF8String]);
+    return [GCDWebServerDataResponse responseWithText:@"yay!"];
+  });
+  StartWebServer();
+  NSURL* url = net::NSURLWithGURL(GetURL(kPath));
+  NSURLSessionDataTask* task = [session_ dataTaskWithURL:url];
+  StartDataTaskAndWaitForCompletion(task);
+  EXPECT_EQ(nil, [delegate_ error]);
+  EXPECT_TRUE([delegate_ receivedBytes]);
+}
+
 // TODO(ellyjones): There needs to be a test that enabling SDCH works, but
 // because CrNet is static and 'uninstall' only disables it, there is no way to
 // have an individual test enable or disable SDCH.

diff --git a/ios/testing/earl_grey/BUILD.gn b/ios/testing/earl_grey/BUILD.gn
index 9a21bf0d1..a499d96 100644
--- a/ios/testing/earl_grey/BUILD.gn
+++ b/ios/testing/earl_grey/BUILD.gn

@@ -17,6 +17,8 @@
 
   sources = [
     "disabled_test_macros.h",
+    "matchers.h",
+    "matchers.mm",
     "wait_util.h",
     "wait_util.mm",
   ]

diff --git a/ios/testing/earl_grey/matchers.h b/ios/testing/earl_grey/matchers.h
new file mode 100644
index 0000000..fe40810
--- /dev/null
+++ b/ios/testing/earl_grey/matchers.h

@@ -0,0 +1,27 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_TESTING_EARL_GREY_MATCHERS_H_
+#define IOS_TESTING_EARL_GREY_MATCHERS_H_
+
+#import <Foundation/Foundation.h>
+
+#import <EarlGrey/EarlGrey.h>
+
+namespace testing {
+
+// Matcher for context menu item whose text is exactly |text|.
+id<GREYMatcher> contextMenuItemWithText(NSString* text);
+
+// Matcher for a UI element to tap to dismiss the the context menu, where
+// |cancel_text| is the localized text used for the action sheet cancel control.
+// On phones, where the context menu is an action sheet, this will be a matcher
+// for the menu item with |cancel_text| as its label.
+// On tablets, where the context menu is a popover, this will be a matcher for
+// some element outside of the popover.
+id<GREYMatcher> elementToDismissContextMenu(NSString* cancel_text);
+
+}  // namespace testing
+
+#endif  // IOS_TESTING_EARL_GREY_MATCHERS_H_

diff --git a/ios/testing/earl_grey/matchers.mm b/ios/testing/earl_grey/matchers.mm
new file mode 100644
index 0000000..6138ab3e
--- /dev/null
+++ b/ios/testing/earl_grey/matchers.mm

@@ -0,0 +1,31 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/testing/earl_grey/matchers.h"
+
+namespace testing {
+
+id<GREYMatcher> contextMenuItemWithText(NSString* text) {
+  // Both tablet and phone house context menu views inside an alert controller
+  // view (on tablet that view is itself inside a popover view).
+  id<GREYMatcher> context_menu_container =
+      grey_kindOfClass(NSClassFromString(@"_UIAlertControllerView"));
+
+  return grey_allOf(grey_ancestor(context_menu_container), grey_interactable(),
+                    grey_text(text), nil);
+}
+
+id<GREYMatcher> elementToDismissContextMenu(NSString* cancel_text) {
+  UIUserInterfaceIdiom idiom = [[UIDevice currentDevice] userInterfaceIdiom];
+  if (idiom == UIUserInterfaceIdiomPad) {
+    // On iPad the context menu is dismissed by tapping on something
+    // that isn't the popover. UIKit conveniently labels this element.
+    return grey_accessibilityID(@"PopoverDismissRegion");
+  } else {
+    // On iPhone the context menu is dismissed by tapping on the "Cancel" item.
+    return contextMenuItemWithText(cancel_text);
+  }
+}
+
+}  // namespace testing

diff --git a/ios/web/BUILD.gn b/ios/web/BUILD.gn
index 8441bdf..6038663f 100644
--- a/ios/web/BUILD.gn
+++ b/ios/web/BUILD.gn

@@ -340,6 +340,8 @@
   ]
 
   sources = [
+    "public/test/earl_grey/web_view_actions.h",
+    "public/test/earl_grey/web_view_actions.mm",
     "public/test/earl_grey/web_view_matchers.h",
     "public/test/earl_grey/web_view_matchers.mm",
     "public/test/web_view_interaction_test_util.h",

diff --git a/ios/web/public/test/earl_grey/web_view_actions.h b/ios/web/public/test/earl_grey/web_view_actions.h
new file mode 100644
index 0000000..779a10d
--- /dev/null
+++ b/ios/web/public/test/earl_grey/web_view_actions.h

@@ -0,0 +1,37 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_ACTIONS_H_
+#define IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_ACTIONS_H_
+
+#include <string>
+
+#import <EarlGrey/EarlGrey.h>
+
+#import "ios/web/public/web_state/web_state.h"
+
+namespace web {
+
+// Action wrapper that performs |action| on the webview of |state|.
+// The action will fail (in addition to its own failure modes) if |element_id|
+// can't be located, or if it doesn't trigger a mousedown event on |element_id|
+// inside the webview.
+id<GREYAction> webViewVerifiedActionOnElement(WebState* state,
+                                              id<GREYAction> action,
+                                              const std::string& element_id);
+
+// Executes a longpress on element |element_id| in the webview of
+// |state|. If |triggers_context_menu| is true, this gesture is expected to
+// cause the context menu to appear, and is not expected to trigger events
+// in the webview. If |triggers_context_menu| is false, the converse is true.
+// This action doesn't fail if the context menu isn't displayed; calling code
+// should check for that separately with a matcher.
+id<GREYAction> webViewLongPressElementForContextMenu(
+    WebState* state,
+    const std::string& element_id,
+    bool triggers_context_menu);
+
+}  // namespace web
+
+#endif  // IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_ACTIONS_H_

diff --git a/ios/web/public/test/earl_grey/web_view_actions.mm b/ios/web/public/test/earl_grey/web_view_actions.mm
new file mode 100644
index 0000000..ec9df6b
--- /dev/null
+++ b/ios/web/public/test/earl_grey/web_view_actions.mm

@@ -0,0 +1,215 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web/public/test/earl_grey/web_view_actions.h"
+
+#include "base/callback_helpers.h"
+#include "base/logging.h"
+#include "base/mac/bind_objc_block.h"
+#include "base/strings/stringprintf.h"
+#include "base/test/ios/wait_util.h"
+#include "base/values.h"
+#import "ios/testing/earl_grey/wait_util.h"
+#import "ios/web/public/test/earl_grey/web_view_matchers.h"
+#import "ios/web/public/test/web_view_interaction_test_util.h"
+#import "ios/web/web_state/web_state_impl.h"
+
+using web::test::ExecuteJavaScript;
+
+namespace {
+
+// Long press duration to trigger context menu.
+const NSTimeInterval kContextMenuLongPressDuration = 0.3;
+
+// Callback prefix for injected verifiers.
+const std::string CallbackPrefixForElementId(const std::string& element_id) {
+  return "__web_test_" + element_id + "_interaction";
+}
+
+// Generic verification injector. Injects one-time mousedown verification into
+// |web_state| that will set the boolean pointed to by |verified| to true when
+// |web_state|'s webview registers the mousedown event.
+// RemoveVerifierForElementWithId() should be called after this to ensure
+// future tests can add verifiers with the same prefix.
+bool AddVerifierToElementWithId(web::WebState* web_state,
+                                const std::string& element_id,
+                                bool* verified) {
+  const std::string kCallbackPrefix = CallbackPrefixForElementId(element_id);
+  const char kCallbackCommand[] = "verified";
+  const std::string kCallbackInvocation =
+      kCallbackPrefix + '.' + kCallbackCommand;
+
+  const char kAddInteractionVerifierScriptTemplate[] =
+      "(function() {"
+      // First template param: element ID.
+      "  var elementId = '%1$s';"
+      "  var element = document.getElementById(elementId);"
+      "  if (!element)"
+      "    return 'Element ' + elementId + ' not found';"
+      "  var invokeType = typeof __gCrWeb.message;"
+      "  if (invokeType != 'object')"
+      "    return 'Host invocation not installed (' + invokeType + ')';"
+      "  var options = {'capture' : true, 'once' : true, 'passive' : true};"
+      "  element.addEventListener('mousedown', function(event) {"
+      "      __gCrWeb.message.invokeOnHost("
+      // Second template param: callback command.
+      "          {'command' : '%2$s' });"
+      "  }, options);"
+      "  return true;"
+      "})();";
+
+  const std::string kAddVerifierScript =
+      base::StringPrintf(kAddInteractionVerifierScriptTemplate,
+                         element_id.c_str(), kCallbackInvocation.c_str());
+  NSDate* deadline =
+      [NSDate dateWithTimeIntervalSinceNow:testing::kWaitForUIElementTimeout];
+  bool verifier_added = false;
+  while (([[NSDate date] compare:deadline] != NSOrderedDescending) &&
+         !verifier_added) {
+    std::unique_ptr<base::Value> value =
+        web::test::ExecuteJavaScript(web_state, kAddVerifierScript);
+    if (value) {
+      std::string error;
+      if (value->GetAsString(&error)) {
+        DLOG(ERROR) << "Verifier injection failed: " << error << ", retrying.";
+      } else if (value->GetAsBoolean(&verifier_added)) {
+        verifier_added = true;
+      }
+    }
+    base::test::ios::SpinRunLoopWithMaxDelay(
+        base::TimeDelta::FromSecondsD(testing::kSpinDelaySeconds));
+  }
+
+  if (!verifier_added)
+    return false;
+
+  // The callback doesn't care about any of the parameters, just whether it is
+  // called or not.
+  auto callback = base::BindBlock(^bool(const base::DictionaryValue& /* json */,
+                                        const GURL& /* origin_url */,
+                                        bool /* user_is_interacting */) {
+    *verified = true;
+    return true;
+  });
+
+  static_cast<web::WebStateImpl*>(web_state)->AddScriptCommandCallback(
+      callback, kCallbackPrefix);
+  return true;
+}
+
+// Removes the injected callback.
+void RemoveVerifierForElementWithId(web::WebState* web_state,
+                                    const std::string& element_id) {
+  static_cast<web::WebStateImpl*>(web_state)->RemoveScriptCommandCallback(
+      CallbackPrefixForElementId(element_id));
+}
+
+}  // namespace
+
+namespace web {
+
+id<GREYAction> webViewVerifiedActionOnElement(WebState* state,
+                                              id<GREYAction> action,
+                                              const std::string& element_id) {
+  NSString* action_name =
+      [NSString stringWithFormat:@"Verified action (%@) on webview element %s.",
+                                 action.name, element_id.c_str()];
+
+  GREYPerformBlock verified_tap = ^BOOL(id element, __strong NSError** error) {
+    // A pointer to |verified| is passed into AddVerifierToElementWithId() so
+    // the verifier can update its value, but |verified| also needs to be marked
+    // as __block so that waitUntilCondition(), below, can access it by
+    // reference.
+    __block bool verified = false;
+
+    // Ensure that RemoveVerifierForElementWithId() is run regardless of how
+    // the block exits.
+    base::ScopedClosureRunner cleanup(
+        base::Bind(&RemoveVerifierForElementWithId, state, element_id));
+
+    // Inject the vefifier.
+    bool verifier_added =
+        AddVerifierToElementWithId(state, element_id, &verified);
+    if (!verifier_added) {
+      NSString* description = [NSString
+          stringWithFormat:@"It wasn't possible to add the verification "
+                           @"javascript for element_id %s",
+                           element_id.c_str()];
+      NSDictionary* user_info = @{NSLocalizedDescriptionKey : description};
+      *error = [NSError errorWithDomain:kGREYInteractionErrorDomain
+                                   code:kGREYInteractionActionFailedErrorCode
+                               userInfo:user_info];
+      return NO;
+    }
+
+    // Run the action.
+    [[EarlGrey selectElementWithMatcher:webViewInWebState(state)]
+        performAction:action
+                error:error];
+
+    if (*error) {
+      return NO;
+    }
+
+    // Wait for the verified to trigger and set |verified|.
+    NSString* verification_timeout_message =
+        [NSString stringWithFormat:@"The action (%@) on element_id %s wasn't "
+                                   @"verified before timing out.",
+                                   action.name, element_id.c_str()];
+    testing::WaitUntilCondition(testing::kWaitForJSCompletionTimeout,
+                                verification_timeout_message, ^{
+                                  return verified;
+                                });
+
+    // If |verified| is not true, the wait condition should have already exited
+    // this control flow, so sanity check that it has in fact been set to
+    // true by this point.
+    DCHECK(verified);
+    return YES;
+  };
+
+  return [GREYActionBlock actionWithName:action_name
+                             constraints:webViewInWebState(state)
+                            performBlock:verified_tap];
+}
+
+id<GREYAction> webViewLongPressElementForContextMenu(
+    WebState* state,
+    const std::string& element_id,
+    bool triggers_context_menu) {
+  CGRect rect = web::test::GetBoundingRectOfElementWithId(state, element_id);
+  // Check if |rect| is empty; if it is, return an action that just throws an
+  // error.
+  if (CGRectIsEmpty(rect)) {
+    NSString* description = [NSString
+        stringWithFormat:@"Couldn't locate a bounding rect for element_id %s; "
+                         @"either it isn't there or it has no area.",
+                         element_id.c_str()];
+    GREYPerformBlock throw_error = ^BOOL(id /* element */,
+                                         __strong NSError** error) {
+      NSDictionary* user_info = @{NSLocalizedDescriptionKey : description};
+      *error = [NSError errorWithDomain:kGREYInteractionErrorDomain
+                                   code:kGREYInteractionActionFailedErrorCode
+                               userInfo:user_info];
+      return NO;
+    };
+    return [GREYActionBlock actionWithName:@"Locate element bounds"
+                              performBlock:throw_error];
+  }
+
+  // If there's a usable rect, long-press in the center.
+  CGPoint point = CGPointMake(CGRectGetMidX(rect), CGRectGetMidY(rect));
+
+  id<GREYAction> longpress =
+      grey_longPressAtPointWithDuration(point, kContextMenuLongPressDuration);
+  id<GREYAction> action = longpress;
+
+  if (!triggers_context_menu) {
+    action = webViewVerifiedActionOnElement(state, longpress, element_id);
+  }
+
+  return action;
+}
+
+}  // namespace web

diff --git a/ios/web/public/test/earl_grey/web_view_matchers.h b/ios/web/public/test/earl_grey/web_view_matchers.h
index 70e05e5b..3a58b08 100644
--- a/ios/web/public/test/earl_grey/web_view_matchers.h
+++ b/ios/web/public/test/earl_grey/web_view_matchers.h

@@ -2,7 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import <string>
+#ifndef IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_MATCHERS_H_
+#define IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_MATCHERS_H_
+
+#include <string>
 
 #import <EarlGrey/EarlGrey.h>
 
@@ -29,3 +32,5 @@
 id<GREYMatcher> webViewScrollView(WebState* web_state);
 
 }  // namespace web
+
+#endif  // IOS_WEB_PUBLIC_TEST_EARL_GREY_WEB_VIEW_MATCHERS_H_

diff --git a/ios/web/public/test/earl_grey/web_view_matchers.mm b/ios/web/public/test/earl_grey/web_view_matchers.mm
index 24504095..e0202a0 100644
--- a/ios/web/public/test/earl_grey/web_view_matchers.mm
+++ b/ios/web/public/test/earl_grey/web_view_matchers.mm

@@ -4,8 +4,6 @@
 
 #import "ios/web/public/test/earl_grey/web_view_matchers.h"
 
-#include <memory>
-
 #import <WebKit/WebKit.h>
 
 #include "base/mac/bind_objc_block.h"
@@ -15,6 +13,9 @@
 #include "base/test/ios/wait_util.h"
 #include "base/values.h"
 #include "ios/testing/earl_grey/wait_util.h"
+#import "ios/web/public/test/web_view_interaction_test_util.h"
+
+using web::test::ExecuteJavaScript;
 
 namespace {
 
@@ -24,34 +25,6 @@
 // Script that tests presence of css selector.
 char kTestCssSelectorJavaScriptTemplate[] = "!!document.querySelector(\"%s\");";
 
-// Synchronously returns the result of executed JavaScript.
-std::unique_ptr<base::Value> ExecuteScript(web::WebState* web_state,
-                                           const std::string& script) {
-  __block std::unique_ptr<base::Value> result;
-  __block bool did_finish = false;
-  web_state->ExecuteJavaScript(base::UTF8ToUTF16(script),
-                               base::BindBlock(^(const base::Value* value) {
-                                 if (value)
-                                   result = value->CreateDeepCopy();
-                                 did_finish = true;
-                               }));
-
-  testing::WaitUntilCondition(testing::kWaitForJSCompletionTimeout, ^{
-    return did_finish;
-  });
-
-  // As result is marked __block, this return call does a copy and not a move
-  // (marking the variable as __block mean it is allocated in the block object
-  // and not the stack). Since the "return std::move()" pattern is discouraged
-  // use a local variable.
-  //
-  // Fixes the following compilation failure:
-  //   ../web_view_matchers.mm:ll:cc: error: call to implicitly-deleted copy
-  //       constructor of 'std::unique_ptr<base::Value>'
-  std::unique_ptr<base::Value> stack_result = std::move(result);
-  return stack_result;
-}
-
 }  // namespace
 
 namespace web {
@@ -79,7 +52,7 @@
     while (([[NSDate date] compare:deadline] != NSOrderedDescending) &&
            !did_succeed) {
       std::unique_ptr<base::Value> value =
-          ExecuteScript(web_state, kGetDocumentBodyJavaScript);
+          ExecuteJavaScript(web_state, kGetDocumentBodyJavaScript);
       std::string body;
       if (value && value->GetAsString(&body)) {
         did_succeed = body.find(text) != std::string::npos;
@@ -120,7 +93,7 @@
                            @"  width:imageWidth"
                            @"});",
                            base::SysUTF8ToNSString(image_id)];
-      std::unique_ptr<base::Value> value = ExecuteScript(
+      std::unique_ptr<base::Value> value = ExecuteJavaScript(
           web_state, base::SysNSStringToUTF8(kGetElementAttributesScript));
       std::string result;
       if (value && value->GetAsString(&result)) {
@@ -163,7 +136,7 @@
         [NSDate dateWithTimeIntervalSinceNow:testing::kWaitForUIElementTimeout];
     while (([[NSDate date] compare:deadline] != NSOrderedDescending) &&
            !did_succeed) {
-      std::unique_ptr<base::Value> value = ExecuteScript(web_state, script);
+      std::unique_ptr<base::Value> value = ExecuteJavaScript(web_state, script);
       if (value)
         value->GetAsBoolean(&did_succeed);
       base::test::ios::SpinRunLoopWithMaxDelay(

diff --git a/ios/web/public/test/web_view_interaction_test_util.h b/ios/web/public/test/web_view_interaction_test_util.h
index 2981ecc..2aa64f5 100644
--- a/ios/web/public/test/web_view_interaction_test_util.h
+++ b/ios/web/public/test/web_view_interaction_test_util.h

@@ -2,13 +2,30 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import "ios/web/public/web_state/web_state.h"
+#import <UIKit/UIKit.h>
 
 #include <string>
 
+#include "base/ios/block_types.h"
+#include "base/values.h"
+
+#import "ios/web/public/web_state/web_state.h"
+
 namespace web {
 namespace test {
 
+// Synchronously returns the result of executed JavaScript.
+std::unique_ptr<base::Value> ExecuteJavaScript(web::WebState* web_state,
+                                               const std::string& script);
+
+// Returns the CGRect, in the coordinate system of web_state's view, that
+// encloses the element with |element_id| in |web_state|'s webview.
+// There is no guarantee that the CGRect returned is inside the current window;
+// callers should check and act accordingly (scrolling the webview, perhaps).
+// Returns CGRectNull if no element could be found.
+CGRect GetBoundingRectOfElementWithId(web::WebState* web_state,
+                                      const std::string& element_id);
+
 // Returns whether the element with |element_id| in the passed |web_state| has
 // been tapped using a JavaScript click() event.
 bool TapWebViewElementWithId(web::WebState* web_state,

diff --git a/ios/web/public/test/web_view_interaction_test_util.mm b/ios/web/public/test/web_view_interaction_test_util.mm
index 0892593..24f4b8c 100644
--- a/ios/web/public/test/web_view_interaction_test_util.mm
+++ b/ios/web/public/test/web_view_interaction_test_util.mm

@@ -4,9 +4,13 @@
 
 #import "ios/web/public/test/web_view_interaction_test_util.h"
 
-#import <Foundation/Foundation.h>
-
+#include "base/mac/bind_objc_block.h"
+#include "base/strings/stringprintf.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/test/ios/wait_util.h"
 #include "ios/testing/earl_grey/wait_util.h"
+#import "ios/web/public/web_state/crw_web_view_scroll_view_proxy.h"
+#import "ios/web/web_state/crw_web_view_proxy_impl.h"
 #import "ios/web/web_state/ui/crw_web_controller.h"
 #include "ios/web/web_state/web_state_impl.h"
 
@@ -21,6 +25,97 @@
   ELEMENT_ACTION_SUBMIT
 };
 
+std::unique_ptr<base::Value> ExecuteJavaScript(web::WebState* web_state,
+                                               const std::string& script) {
+  __block std::unique_ptr<base::Value> result;
+  __block bool did_finish = false;
+  web_state->ExecuteJavaScript(base::UTF8ToUTF16(script),
+                               base::BindBlock(^(const base::Value* value) {
+                                 if (value)
+                                   result = value->CreateDeepCopy();
+                                 did_finish = true;
+                               }));
+
+  testing::WaitUntilCondition(testing::kWaitForJSCompletionTimeout, ^{
+    return did_finish;
+  });
+
+  // As result is marked __block, this return call does a copy and not a move
+  // (marking the variable as __block mean it is allocated in the block object
+  // and not the stack). Since the "return std::move()" pattern is discouraged
+  // use a local variable.
+  //
+  // Fixes the following compilation failure:
+  //   ../web_view_matchers.mm:ll:cc: error: call to implicitly-deleted copy
+  //       constructor of 'std::unique_ptr<base::Value>'
+  std::unique_ptr<base::Value> stack_result = std::move(result);
+  return stack_result;
+}
+
+CGRect GetBoundingRectOfElementWithId(web::WebState* web_state,
+                                      const std::string& element_id) {
+  std::string kGetBoundsScript =
+      "(function() {"
+      "  var element = document.getElementById('" +
+      element_id +
+      "');"
+      "  if (!element)"
+      "    return {'error': 'Element " +
+      element_id +
+      " not found'};"
+      "  var rect = element.getBoundingClientRect();"
+      "  var top = rect.top + document.body.scrollTop;"
+      "  var bottom = rect.bottom + document.body.scrollTop;"
+      "  var left = rect.left + document.body.scrollLeft;"
+      "  var right = rect.right + document.body.scrollLeft;"
+      "  return {"
+      "      'left': left,"
+      "      'top': top,"
+      "      'width': right - left,"
+      "      'height': bottom - top,"
+      "      'document_width' : document.documentElement.scrollWidth,"
+      "      'document_height' : document.documentElement.scrollHeight,"
+      "    };"
+      "})();";
+
+  base::DictionaryValue const* rect = nullptr;
+  bool found = false;
+  NSDate* deadline =
+      [NSDate dateWithTimeIntervalSinceNow:testing::kWaitForUIElementTimeout];
+  while (([[NSDate date] compare:deadline] != NSOrderedDescending) && !found) {
+    std::unique_ptr<base::Value> value =
+        ExecuteJavaScript(web_state, kGetBoundsScript);
+    base::DictionaryValue* dictionary = nullptr;
+    if (value && value->GetAsDictionary(&dictionary)) {
+      std::string error;
+      if (dictionary->GetString("error", &error)) {
+        DLOG(ERROR) << "Error getting rect: " << error << ", retrying..";
+      } else {
+        rect = dictionary->DeepCopy();
+        found = true;
+      }
+    }
+    base::test::ios::SpinRunLoopWithMaxDelay(
+        base::TimeDelta::FromSecondsD(testing::kSpinDelaySeconds));
+  }
+
+  if (!found)
+    return CGRectNull;
+
+  double left, top, width, height, document_width, document_height;
+  if (!(rect->GetDouble("left", &left) && rect->GetDouble("top", &top) &&
+        rect->GetDouble("width", &width) &&
+        rect->GetDouble("height", &height) &&
+        rect->GetDouble("document_width", &document_width) &&
+        rect->GetDouble("document_height", &document_height))) {
+    return CGRectNull;
+  }
+
+  CGFloat scale = [[web_state->GetWebViewProxy() scrollViewProxy] zoomScale];
+
+  return CGRectMake(left * scale, top * scale, width * scale, height * scale);
+}
+
 // Returns whether the Javascript action specified by |action| ran on
 // |element_id| in the passed |web_state|.
 bool RunActionOnWebViewElementWithId(web::WebState* web_state,

diff --git a/ios/web/shell/test/BUILD.gn b/ios/web/shell/test/BUILD.gn
index c9b547d..9e0258d 100644
--- a/ios/web/shell/test/BUILD.gn
+++ b/ios/web/shell/test/BUILD.gn

@@ -7,6 +7,7 @@
 
 ios_eg_test("ios_web_shell_test") {
   sources = [
+    "context_menu_egtest.mm",
     "meta_tags_egtest.mm",
     "navigation_egtest.mm",
     "page_state_egtest.mm",
@@ -64,6 +65,8 @@
     "app/web_shell_test_util.mm",
     "app/web_view_interaction_test_util.h",
     "app/web_view_interaction_test_util.mm",
+    "earl_grey/shell_actions.h",
+    "earl_grey/shell_actions.mm",
     "earl_grey/shell_base_test_case.h",
     "earl_grey/shell_base_test_case.mm",
     "earl_grey/shell_matchers.h",

diff --git a/ios/web/shell/test/context_menu_egtest.mm b/ios/web/shell/test/context_menu_egtest.mm
new file mode 100644
index 0000000..7404d04
--- /dev/null
+++ b/ios/web/shell/test/context_menu_egtest.mm

@@ -0,0 +1,172 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import <EarlGrey/EarlGrey.h>
+#import <UIKit/UIKit.h>
+#import <WebKit/WebKit.h>
+#import <XCTest/XCTest.h>
+
+#include "base/ios/block_types.h"
+#include "base/strings/sys_string_conversions.h"
+#import "ios/testing/earl_grey/matchers.h"
+#import "ios/web/public/test/http_server.h"
+#include "ios/web/public/test/http_server_util.h"
+#import "ios/web/public/test/web_view_interaction_test_util.h"
+#include "ios/web/shell/test/app/navigation_test_util.h"
+#import "ios/web/shell/test/app/web_shell_test_util.h"
+#include "ios/web/shell/test/app/web_view_interaction_test_util.h"
+#import "ios/web/shell/test/earl_grey/shell_base_test_case.h"
+#import "ios/web/shell/test/earl_grey/shell_actions.h"
+#import "ios/web/shell/test/earl_grey/shell_matchers.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+using testing::contextMenuItemWithText;
+using testing::elementToDismissContextMenu;
+
+// Context menu test cases for the web shell.
+@interface ContextMenuTestCase : ShellBaseTestCase
+@end
+
+@implementation ContextMenuTestCase
+
+// Tests context menu appears on a regular link.
+- (void)testContextMenu {
+  // Create map of canned responses and set up the test HTML server.
+  std::map<GURL, std::string> responses;
+  GURL initialURL = web::test::HttpServer::MakeUrl("http://contextMenuOpen");
+  GURL destinationURL = web::test::HttpServer::MakeUrl("http://destination");
+  // The initial page contains a link to the destination URL.
+  std::string linkID = "link";
+  responses[initialURL] =
+      "<body>"
+      "<a href='" +
+      destinationURL.spec() + "' id='" + linkID +
+      "'>link for context menu</a>"
+      "</span></body>";
+
+  web::test::SetUpSimpleHttpServer(responses);
+  web::shell_test_util::LoadUrl(initialURL);
+
+  [[EarlGrey selectElementWithMatcher:web::webView()]
+      performAction:web::longPressElementForContextMenu(
+                        linkID, true /* menu should appear */)];
+
+  id<GREYMatcher> copyItem = contextMenuItemWithText(@"Copy Link");
+
+  // Context menu should have a "copy link" item.
+  [[EarlGrey selectElementWithMatcher:copyItem]
+      assertWithMatcher:grey_notNil()];
+
+  // Dismiss the context menu.
+  [[EarlGrey selectElementWithMatcher:elementToDismissContextMenu(@"Cancel")]
+      performAction:grey_tap()];
+
+  // Context menu should go away after the tap.
+  [[EarlGrey selectElementWithMatcher:copyItem] assertWithMatcher:grey_nil()];
+}
+
+// Tests context menu on element that has WebkitTouchCallout set to none.
+- (void)testContextMenuWebkitTouchCalloutNone {
+  // Create map of canned responses and set up the test HTML server.
+  std::map<GURL, std::string> responses;
+  GURL initialURL =
+      web::test::HttpServer::MakeUrl("http://contextMenuDisabledByWebkit");
+  GURL destinationURL = web::test::HttpServer::MakeUrl("http://destination");
+  // The initial page contains a link to the destination URL that has an
+  // ancestor that disables the context menu via -webkit-touch-callout.
+  std::string linkID = "link";
+  responses[initialURL] = "<body><a href='" + destinationURL.spec() +
+                          "' style='-webkit-touch-callout: none' id='" +
+                          linkID +
+                          "'>no-callout link</a>"
+                          "</body>";
+
+  web::test::SetUpSimpleHttpServer(responses);
+  web::shell_test_util::LoadUrl(initialURL);
+
+  [[EarlGrey selectElementWithMatcher:web::webView()]
+      performAction:web::longPressElementForContextMenu(
+                        linkID, false /* menu shouldn't appear */)];
+
+  id<GREYMatcher> copyItem = contextMenuItemWithText(@"Copy Link");
+
+  // Verify no context menu.
+  [[EarlGrey selectElementWithMatcher:copyItem] assertWithMatcher:grey_nil()];
+}
+
+// Tests context menu on element that has WebkitTouchCallout set to none from an
+// ancestor.
+- (void)testContextMenuWebkitTouchCalloutNoneFromAncestor {
+  // Create map of canned responses and set up the test HTML server.
+  std::map<GURL, std::string> responses;
+  GURL initialURL =
+      web::test::HttpServer::MakeUrl("http://contextMenuDisabledByWebkit");
+  GURL destinationURL = web::test::HttpServer::MakeUrl("http://destination");
+  // The initial page contains a link to the destination URL that has an
+  // ancestor that disables the context menu via -webkit-touch-callout.
+  std::string linkID = "link";
+  responses[initialURL] =
+      "<body style='-webkit-touch-callout: none'>"
+      "<a href='" +
+      destinationURL.spec() + "' id='" + linkID +
+      "'>ancestor no-callout link</a>"
+      "</body>";
+
+  web::test::SetUpSimpleHttpServer(responses);
+  web::shell_test_util::LoadUrl(initialURL);
+
+  [[EarlGrey selectElementWithMatcher:web::webView()]
+      performAction:web::longPressElementForContextMenu(
+                        linkID, false /* menu shouldn't appear */)];
+
+  id<GREYMatcher> copyItem = contextMenuItemWithText(@"Copy Link");
+
+  // Verify no context menu.
+  [[EarlGrey selectElementWithMatcher:copyItem] assertWithMatcher:grey_nil()];
+}
+
+// Tests context menu on element that has WebkitTouchCallout set to none from an
+// ancestor and overridden.
+- (void)testContextMenuWebkitTouchCalloutOverride {
+  // Create map of canned responses and set up the test HTML server.
+  std::map<GURL, std::string> responses;
+  GURL initialURL =
+      web::test::HttpServer::MakeUrl("http://contextMenuDisabledByWebkit");
+  GURL destinationURL = web::test::HttpServer::MakeUrl("http://destination");
+  // The initial page contains a link to the destination URL that has an
+  // ancestor that disables the context menu via -webkit-touch-callout.
+  std::string linkID = "link";
+  responses[initialURL] =
+      "<body style='-webkit-touch-callout: none'>"
+      "<a href='" +
+      destinationURL.spec() + "' style='-webkit-touch-callout: default' id='" +
+      linkID +
+      "'>override no-callout link</a>"
+      "</body>";
+
+  web::test::SetUpSimpleHttpServer(responses);
+  web::shell_test_util::LoadUrl(initialURL);
+
+  [[EarlGrey selectElementWithMatcher:web::webView()]
+      performAction:web::longPressElementForContextMenu(
+                        linkID, true /* menu should appear */)];
+
+  id<GREYMatcher> copyItem = contextMenuItemWithText(@"Copy Link");
+
+  // Context menu should have a "copy link" item.
+  [[EarlGrey selectElementWithMatcher:copyItem]
+      assertWithMatcher:grey_notNil()];
+
+  // Dismiss the context menu.
+  [[EarlGrey selectElementWithMatcher:elementToDismissContextMenu(@"Cancel")]
+      performAction:grey_tap()];
+
+  // Context menu should go away after the tap.
+  [[EarlGrey selectElementWithMatcher:copyItem] assertWithMatcher:grey_nil()];
+}
+
+@end

diff --git a/ios/web/shell/test/earl_grey/shell_actions.h b/ios/web/shell/test/earl_grey/shell_actions.h
new file mode 100644
index 0000000..8eaadf9
--- /dev/null
+++ b/ios/web/shell/test/earl_grey/shell_actions.h

@@ -0,0 +1,25 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_ACTIONS_H_
+#define IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_ACTIONS_H_
+
+#include <string>
+
+#import <EarlGrey/EarlGrey.h>
+
+namespace web {
+
+// Action to longpress on element |element_id| in the shell's webview.
+// If |triggers_context_menu| is true, this gesture is expected to
+// cause the context menu to appear, and is not expected to trigger events
+// in the webview. If |triggers_context_menu| is false, the converse is true.
+// This action doesn't fail if the context menu isn't displayed; calling code
+// should check for that separately with a matcher.
+id<GREYAction> longPressElementForContextMenu(const std::string& element_id,
+                                              bool triggers_context_menu);
+
+}  // namespace web
+
+#endif  // IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_ACTIONS_H_

diff --git a/ios/web/shell/test/earl_grey/shell_actions.mm b/ios/web/shell/test/earl_grey/shell_actions.mm
new file mode 100644
index 0000000..ebcb7c7
--- /dev/null
+++ b/ios/web/shell/test/earl_grey/shell_actions.mm

@@ -0,0 +1,18 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web/shell/test/earl_grey/shell_actions.h"
+
+#import "ios/web/public/test/earl_grey/web_view_actions.h"
+#import "ios/web/shell/test/app/web_shell_test_util.h"
+
+namespace web {
+
+id<GREYAction> longPressElementForContextMenu(const std::string& element_id,
+                                              bool triggers_context_menu) {
+  return webViewLongPressElementForContextMenu(
+      shell_test_util::GetCurrentWebState(), element_id, triggers_context_menu);
+}
+
+}  // namespace web

diff --git a/ios/web/shell/test/earl_grey/shell_matchers.h b/ios/web/shell/test/earl_grey/shell_matchers.h
index f458b8c6..e366dd0d 100644
--- a/ios/web/shell/test/earl_grey/shell_matchers.h
+++ b/ios/web/shell/test/earl_grey/shell_matchers.h

@@ -2,17 +2,23 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import <string>
+#ifndef IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_MATCHERS_H_
+#define IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_MATCHERS_H_
+
+#include <string>
 
 #import <EarlGrey/EarlGrey.h>
 
 namespace web {
 
 // Matcher for WKWebView containing |text|.
-id<GREYMatcher> webViewContainingText(std::string text);
+id<GREYMatcher> webViewContainingText(const std::string& text);
 
 // Matcher for WKWebView containing an html element which matches |selector|.
-id<GREYMatcher> webViewCssSelector(std::string selector);
+id<GREYMatcher> webViewCssSelector(const std::string& selector);
+
+// Matcher for the WKWebView.
+id<GREYMatcher> webView();
 
 // Matcher for WKWebView's scroll view.
 id<GREYMatcher> webViewScrollView();
@@ -30,3 +36,5 @@
 id<GREYMatcher> addressField();
 
 }  // namespace web
+
+#endif  // IOS_WEB_SHELL_TEST_EARL_GREY_SHELL_MATCHERS_H_

diff --git a/ios/web/shell/test/earl_grey/shell_matchers.mm b/ios/web/shell/test/earl_grey/shell_matchers.mm
index 88e6e12..5e71d58 100644
--- a/ios/web/shell/test/earl_grey/shell_matchers.mm
+++ b/ios/web/shell/test/earl_grey/shell_matchers.mm

@@ -6,6 +6,7 @@
 
 #import "base/mac/foundation_util.h"
 #include "base/strings/sys_string_conversions.h"
+#import "ios/testing/earl_grey/matchers.h"
 #include "ios/testing/earl_grey/wait_util.h"
 #import "ios/web/public/web_state/web_state.h"
 #import "ios/web/public/test/earl_grey/web_view_matchers.h"
@@ -14,16 +15,20 @@
 
 namespace web {
 
-id<GREYMatcher> webViewContainingText(std::string text) {
+id<GREYMatcher> webViewContainingText(const std::string& text) {
   WebState* web_state = shell_test_util::GetCurrentWebState();
   return webViewContainingText(std::move(text), web_state);
 }
 
-id<GREYMatcher> webViewCssSelector(std::string selector) {
+id<GREYMatcher> webViewCssSelector(const std::string& selector) {
   WebState* web_state = shell_test_util::GetCurrentWebState();
   return webViewCssSelector(std::move(selector), web_state);
 }
 
+id<GREYMatcher> webView() {
+  return webViewInWebState(shell_test_util::GetCurrentWebState());
+}
+
 id<GREYMatcher> webViewScrollView() {
   return webViewScrollView(shell_test_util::GetCurrentWebState());
 }

diff --git a/ios/web/shell/view_controller.mm b/ios/web/shell/view_controller.mm
index 418fd15..d49cb54 100644
--- a/ios/web/shell/view_controller.mm
+++ b/ios/web/shell/view_controller.mm

@@ -313,7 +313,7 @@
     };
     [[UIPasteboard generalPasteboard] setItems:@[ item ]];
   };
-  [alert addAction:[UIAlertAction actionWithTitle:@"Copy"
+  [alert addAction:[UIAlertAction actionWithTitle:@"Copy Link"
                                             style:UIAlertActionStyleDefault
                                           handler:handler]];
 

diff --git a/mash/package/BUILD.gn b/mash/package/BUILD.gn
index 28502bf..9cbc786b 100644
--- a/mash/package/BUILD.gn
+++ b/mash/package/BUILD.gn

@@ -19,6 +19,7 @@
     "//services/shell/public/cpp",
     "//services/shell/public/interfaces",
     "//services/ui:lib",
+    "//services/ui/ime/test_ime_driver:lib",
   ]
 
   if (is_linux && !is_android) {

diff --git a/mash/package/DEPS b/mash/package/DEPS
index df843309..fd9c8be7 100644
--- a/mash/package/DEPS
+++ b/mash/package/DEPS

@@ -2,5 +2,6 @@
   "+ash/mus",
   "+ash/touch_hud",
   "+components/font_service",
+  "+services/ui/ime/test_ime_driver",
   "+services/ui/service.h",
 ]

diff --git a/mash/package/mash_packaged_service.cc b/mash/package/mash_packaged_service.cc
index 9e903e4..0cb24c03 100644
--- a/mash/package/mash_packaged_service.cc
+++ b/mash/package/mash_packaged_service.cc

@@ -11,6 +11,7 @@
 #include "mash/session/session.h"
 #include "mash/task_viewer/task_viewer.h"
 #include "services/shell/public/cpp/service_context.h"
+#include "services/ui/ime/test_ime_driver/test_ime_application.h"
 #include "services/ui/service.h"
 
 #if defined(OS_LINUX)
@@ -65,6 +66,8 @@
     return base::WrapUnique(new mash::quick_launch::QuickLaunch);
   if (name == "mojo:task_viewer")
     return base::WrapUnique(new mash::task_viewer::TaskViewer);
+  if (name == "mojo:test_ime_driver")
+    return base::WrapUnique(new ui::test::TestIMEApplication);
 #if defined(OS_LINUX)
   if (name == "mojo:font_service")
     return base::WrapUnique(new font_service::FontServiceApp);

diff --git a/media/midi/midi_manager_winrt.cc b/media/midi/midi_manager_winrt.cc
index 11841cb..0cc93adc 100644
--- a/media/midi/midi_manager_winrt.cc
+++ b/media/midi/midi_manager_winrt.cc

@@ -118,6 +118,18 @@
   return S_OK;
 }
 
+// Checks if given DeviceInformation represent a Microsoft GS Wavetable Synth
+// instance.
+bool IsMicrosoftSynthesizer(IDeviceInformation* info) {
+  auto midi_synthesizer_statics =
+      WrlStaticsFactory<IMidiSynthesizerStatics,
+                        RuntimeClass_Windows_Devices_Midi_MidiSynthesizer>();
+  boolean result = FALSE;
+  HRESULT hr = midi_synthesizer_statics->IsSynthesizer(info, &result);
+  VLOG_IF(1, FAILED(hr)) << "IsSynthesizer failed: " << PrintHr(hr);
+  return result != FALSE;
+}
+
 // Tokens with value = 0 are considered invalid (as in <wrl/event.h>).
 const int64_t kInvalidTokenValue = 0;
 
@@ -189,6 +201,11 @@
         WRL::Callback<ITypedEventHandler<DeviceWatcher*, DeviceInformation*>>(
             [weak_ptr, task_runner](IDeviceWatcher* watcher,
                                     IDeviceInformation* info) {
+              // Disable Microsoft GS Wavetable Synth due to security reasons.
+              // http://crbug.com/499279
+              if (IsMicrosoftSynthesizer(info))
+                return S_OK;
+
               std::string dev_id = GetIdString(info),
                           dev_name = GetNameString(info);
 
@@ -356,9 +373,6 @@
     DCHECK(thread_checker_.CalledOnValidThread());
     CHECK(is_initialized_);
 
-    // TODO(shaochuan): Disable Microsoft GS Wavetable Synth due to security
-    // reasons. http://crbug.com/499279
-
     port_names_[dev_id] = dev_name;
 
     WRL::Wrappers::HString dev_id_hstring;
@@ -423,6 +437,8 @@
     DCHECK(thread_checker_.CalledOnValidThread());
     CHECK(is_initialized_);
 
+    // Note: in case Microsoft GS Wavetable Synth triggers this event for some
+    // reason, it will be ignored here with log emitted.
     MidiPort<InterfaceType>* port = GetPortByDeviceId(dev_id);
     if (!port) {
       VLOG(1) << "Removing non-existent port " << dev_id;

diff --git a/net/android/cert_verify_result_android.cc b/net/android/cert_verify_result_android.cc
index 327a1e0..925e71b 100644
--- a/net/android/cert_verify_result_android.cc
+++ b/net/android/cert_verify_result_android.cc

@@ -10,12 +10,13 @@
 
 using base::android::AttachCurrentThread;
 using base::android::JavaArrayOfByteArrayToStringVector;
+using base::android::JavaRef;
 using base::android::ScopedJavaLocalRef;
 
 namespace net {
 namespace android {
 
-void ExtractCertVerifyResult(jobject result,
+void ExtractCertVerifyResult(const JavaRef<jobject>& result,
                              CertVerifyStatusAndroid* status,
                              bool* is_issued_by_known_root,
                              std::vector<std::string>* verified_chain) {

diff --git a/net/android/cert_verify_result_android.h b/net/android/cert_verify_result_android.h
index d074758..96c61e4 100644
--- a/net/android/cert_verify_result_android.h
+++ b/net/android/cert_verify_result_android.h

@@ -10,6 +10,8 @@
 #include <string>
 #include <vector>
 
+#include "base/android/scoped_java_ref.h"
+
 namespace net {
 
 namespace android {
@@ -39,7 +41,7 @@
 };
 
 // Extract parameters out of an AndroidCertVerifyResult object.
-void ExtractCertVerifyResult(jobject result,
+void ExtractCertVerifyResult(const base::android::JavaRef<jobject>& result,
                              CertVerifyStatusAndroid* status,
                              bool* is_issued_by_known_root,
                              std::vector<std::string>* verified_chain);

diff --git a/net/android/keystore.cc b/net/android/keystore.cc
index cb17900..d224610 100644
--- a/net/android/keystore.cc
+++ b/net/android/keystore.cc

@@ -13,15 +13,17 @@
 
 using base::android::AttachCurrentThread;
 using base::android::HasException;
+using base::android::JavaArrayOfByteArrayToStringVector;
 using base::android::JavaByteArrayToByteVector;
+using base::android::JavaRef;
 using base::android::ScopedJavaLocalRef;
 using base::android::ToJavaByteArray;
-using base::android::JavaArrayOfByteArrayToStringVector;
 
 namespace net {
 namespace android {
 
-bool GetRSAKeyModulus(jobject private_key_ref, std::vector<uint8_t>* result) {
+bool GetRSAKeyModulus(const JavaRef<jobject>& private_key_ref,
+                      std::vector<uint8_t>* result) {
   JNIEnv* env = AttachCurrentThread();
 
   ScopedJavaLocalRef<jbyteArray> modulus_ref =
@@ -33,7 +35,8 @@
   return true;
 }
 
-bool GetECKeyOrder(jobject private_key_ref, std::vector<uint8_t>* result) {
+bool GetECKeyOrder(const JavaRef<jobject>& private_key_ref,
+                   std::vector<uint8_t>* result) {
   JNIEnv* env = AttachCurrentThread();
 
   ScopedJavaLocalRef<jbyteArray> order_ref =
@@ -46,7 +49,7 @@
   return true;
 }
 
-bool RawSignDigestWithPrivateKey(jobject private_key_ref,
+bool RawSignDigestWithPrivateKey(const JavaRef<jobject>& private_key_ref,
                                  const base::StringPiece& digest,
                                  std::vector<uint8_t>* signature) {
   JNIEnv* env = AttachCurrentThread();
@@ -68,13 +71,14 @@
   return true;
 }
 
-PrivateKeyType GetPrivateKeyType(jobject private_key_ref) {
+PrivateKeyType GetPrivateKeyType(const JavaRef<jobject>& private_key_ref) {
   JNIEnv* env = AttachCurrentThread();
   int type = Java_AndroidKeyStore_getPrivateKeyType(env, private_key_ref);
   return static_cast<PrivateKeyType>(type);
 }
 
-AndroidEVP_PKEY* GetOpenSSLSystemHandleForPrivateKey(jobject private_key_ref) {
+AndroidEVP_PKEY* GetOpenSSLSystemHandleForPrivateKey(
+    const JavaRef<jobject>& private_key_ref) {
   JNIEnv* env = AttachCurrentThread();
   // Note: the pointer is passed as a jint here because that's how it
   // is stored in the Java object. Java doesn't have a primitive type
@@ -90,7 +94,7 @@
 }
 
 ScopedJavaLocalRef<jobject> GetOpenSSLEngineForPrivateKey(
-    jobject private_key_ref) {
+    const JavaRef<jobject>& private_key_ref) {
   JNIEnv* env = AttachCurrentThread();
   ScopedJavaLocalRef<jobject> engine =
       Java_AndroidKeyStore_getOpenSSLEngineForPrivateKey(env, private_key_ref);

diff --git a/net/android/keystore.h b/net/android/keystore.h
index aec5107..7691c262 100644
--- a/net/android/keystore.h
+++ b/net/android/keystore.h

@@ -47,8 +47,9 @@
 // |modulus| will receive the modulus bytes on success.
 // Returns true on success, or false on failure (e.g. if the key
 // is not RSA).
-NET_EXPORT bool GetRSAKeyModulus(jobject private_key,
-                                 std::vector<uint8_t>* modulus);
+NET_EXPORT bool GetRSAKeyModulus(
+    const base::android::JavaRef<jobject>& private_key,
+    std::vector<uint8_t>* modulus);
 
 // Returns the order parameter of a given ECPrivateKey platform object,
 // as a series of bytes, in big-endian representation. This can be used
@@ -57,7 +58,8 @@
 // |order| will receive the result bytes on success.
 // Returns true on success, or false on failure (e.g. if the key is
 // not EC).
-bool GetECKeyOrder(jobject private_key, std::vector<uint8_t>* order);
+bool GetECKeyOrder(const base::android::JavaRef<jobject>& private_key,
+                   std::vector<uint8_t>* order);
 
 // Compute the signature of a given message, which is actually a hash,
 // using a private key. For more details, please read the comments for the
@@ -68,15 +70,17 @@
 // |signature| will receive the signature on success.
 // Returns true on success, false on failure.
 //
-NET_EXPORT bool RawSignDigestWithPrivateKey(jobject private_key,
-                                            const base::StringPiece& digest,
-                                            std::vector<uint8_t>* signature);
+NET_EXPORT bool RawSignDigestWithPrivateKey(
+    const base::android::JavaRef<jobject>& private_key,
+    const base::StringPiece& digest,
+    std::vector<uint8_t>* signature);
 
 // Return the PrivateKeyType of a given private key.
 // |private_key| is a JNI reference for the private key.
 // Returns a PrivateKeyType, while will be CLIENT_CERT_INVALID_TYPE
 // on error.
-NET_EXPORT PrivateKeyType GetPrivateKeyType(jobject private_key);
+NET_EXPORT PrivateKeyType
+GetPrivateKeyType(const base::android::JavaRef<jobject>& private_key);
 
 // Returns a handle to the system AndroidEVP_PKEY object used to back a given
 // private_key object. This must *only* be used for RSA private keys on Android
@@ -91,7 +95,8 @@
 //       anything about OpenSSL, it just type-casts a system pointer that
 //       is passed as an int through JNI. As such, it never increments
 //       the returned key's reference count.
-AndroidEVP_PKEY* GetOpenSSLSystemHandleForPrivateKey(jobject private_key);
+AndroidEVP_PKEY* GetOpenSSLSystemHandleForPrivateKey(
+    const base::android::JavaRef<jobject>& private_key);
 
 // Returns a JNI reference to the OpenSSLEngine object which is used to back a
 // given private_key object. This must *only* be used for RSA private keys on
@@ -99,7 +104,7 @@
 // image contains a vanilla implementation of the Java API frameworks based on
 // Harmony + OpenSSL.
 base::android::ScopedJavaLocalRef<jobject> GetOpenSSLEngineForPrivateKey(
-    jobject private_key);
+    const base::android::JavaRef<jobject>& private_key);
 
 }  // namespace android
 }  // namespace net

diff --git a/net/android/keystore_openssl.cc b/net/android/keystore_openssl.cc
index fd07440..baf7f16 100644
--- a/net/android/keystore_openssl.cc
+++ b/net/android/keystore_openssl.cc

@@ -58,6 +58,7 @@
 // methods are called. This is done by storing it in a |KeyExData| structure
 // that's referenced by the key using |EX_DATA|.
 
+using base::android::JavaRef;
 using base::android::ScopedJavaGlobalRef;
 using base::android::ScopedJavaLocalRef;
 
@@ -229,8 +230,7 @@
   std::vector<uint8_t> result;
   // For RSA keys, this function behaves as RSA_private_encrypt with
   // PKCS#1 padding.
-  if (!RawSignDigestWithPrivateKey(ex_data->private_key.obj(), from_piece,
-                                   &result)) {
+  if (!RawSignDigestWithPrivateKey(ex_data->private_key, from_piece, &result)) {
     LOG(WARNING) << "Could not sign message in RsaMethodSignRaw!";
     OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
     return 0;
@@ -317,7 +317,7 @@
 // that is owned by and destroyed with the EVP_PKEY. I.e. caller can
 // free |private_key| after the call.
 crypto::ScopedEVP_PKEY CreateRsaPkeyWrapper(
-    jobject private_key,
+    const JavaRef<jobject>& private_key,
     AndroidRSA* legacy_rsa,
     const crypto::OpenSSLErrStackTracer& tracer) {
   crypto::ScopedRSA rsa(RSA_new_method(global_boringssl_engine.Get().engine()));
@@ -329,7 +329,7 @@
   }
 
   std::unique_ptr<KeyExData> ex_data(new KeyExData);
-  ex_data->private_key.Reset(nullptr, private_key);
+  ex_data->private_key.Reset(private_key);
   if (ex_data->private_key.is_null()) {
     LOG(ERROR) << "Could not create global JNI reference";
     return nullptr;
@@ -360,7 +360,7 @@
  public:
   KeystoreEngineWorkaround() {}
 
-  void LeakEngine(jobject private_key) {
+  void LeakEngine(const JavaRef<jobject>& private_key) {
     if (!engine_.is_null())
       return;
     ScopedJavaLocalRef<jobject> engine =
@@ -376,7 +376,7 @@
   ScopedJavaGlobalRef<jobject> engine_;
 };
 
-void LeakEngine(jobject private_key) {
+void LeakEngine(const JavaRef<jobject>& private_key) {
   static base::LazyInstance<KeystoreEngineWorkaround>::Leaky s_instance =
       LAZY_INSTANCE_INITIALIZER;
   s_instance.Get().LeakEngine(private_key);
@@ -384,7 +384,7 @@
 
 // Creates an EVP_PKEY wrapper corresponding to the RSA key
 // |private_key|. Returns nullptr on failure.
-crypto::ScopedEVP_PKEY GetRsaPkeyWrapper(jobject private_key) {
+crypto::ScopedEVP_PKEY GetRsaPkeyWrapper(const JavaRef<jobject>& private_key) {
   const int kAndroid42ApiLevel = 17;
   crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
 
@@ -423,10 +423,10 @@
 // Note that for now, only signing through ECDSA_sign() is really supported.
 // all other method pointers are either stubs returning errors, or no-ops.
 
-jobject EcKeyGetKey(const EC_KEY* ec_key) {
+const JavaRef<jobject>& EcKeyGetKey(const EC_KEY* ec_key) {
   KeyExData* ex_data = reinterpret_cast<KeyExData*>(EC_KEY_get_ex_data(
       ec_key, global_boringssl_engine.Get().ec_key_ex_index()));
-  return ex_data->private_key.obj();
+  return ex_data->private_key;
 }
 
 size_t EcdsaMethodGroupOrderSize(const EC_KEY* ec_key) {
@@ -441,8 +441,8 @@
                     unsigned int* sig_len,
                     EC_KEY* ec_key) {
   // Retrieve private key JNI reference.
-  jobject private_key = EcKeyGetKey(ec_key);
-  if (!private_key) {
+  const JavaRef<jobject>& private_key = EcKeyGetKey(ec_key);
+  if (private_key.is_null()) {
     LOG(WARNING) << "Null JNI reference passed to EcdsaMethodSign!";
     return 0;
   }
@@ -485,7 +485,8 @@
 // On success, this creates a global JNI reference to the object that
 // is owned by and destroyed with the EVP_PKEY. I.e. the caller shall
 // always free |private_key| after the call.
-crypto::ScopedEVP_PKEY GetEcdsaPkeyWrapper(jobject private_key) {
+crypto::ScopedEVP_PKEY GetEcdsaPkeyWrapper(
+    const JavaRef<jobject>& private_key) {
   crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
   crypto::ScopedEC_KEY ec_key(
       EC_KEY_new_method(global_boringssl_engine.Get().engine()));
@@ -497,7 +498,7 @@
   }
 
   std::unique_ptr<KeyExData> ex_data(new KeyExData);
-  ex_data->private_key.Reset(nullptr, private_key);
+  ex_data->private_key.Reset(private_key);
   if (ex_data->private_key.is_null()) {
     LOG(ERROR) << "Can't create global JNI reference";
     return nullptr;
@@ -531,7 +532,8 @@
 
 }  // namespace
 
-crypto::ScopedEVP_PKEY GetOpenSSLPrivateKeyWrapper(jobject private_key) {
+crypto::ScopedEVP_PKEY GetOpenSSLPrivateKeyWrapper(
+    const JavaRef<jobject>& private_key) {
   // Create sub key type, depending on private key's algorithm type.
   PrivateKeyType key_type = GetPrivateKeyType(private_key);
   switch (key_type) {

diff --git a/net/android/keystore_openssl.h b/net/android/keystore_openssl.h
index 72f3994..e2d21bc 100644
--- a/net/android/keystore_openssl.h
+++ b/net/android/keystore_openssl.h

@@ -8,6 +8,7 @@
 #include <jni.h>
 #include <openssl/evp.h>
 
+#include "base/android/scoped_java_ref.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/net_export.h"
 
@@ -41,7 +42,7 @@
 //   during the OpenSSL handshake. Anything else will result in undefined
 //   behaviour.
 NET_EXPORT crypto::ScopedEVP_PKEY GetOpenSSLPrivateKeyWrapper(
-    jobject private_key);
+    const base::android::JavaRef<jobject>& private_key);
 
 }  // namespace android
 }  // namespace net

diff --git a/net/android/keystore_unittest.cc b/net/android/keystore_unittest.cc
index 32137314..677e59a 100644
--- a/net/android/keystore_unittest.cc
+++ b/net/android/keystore_unittest.cc

@@ -51,6 +51,8 @@
 // Finally, it also checks that using the EVP_PKEY generated with
 // GetOpenSSLPrivateKeyWrapper() works correctly.
 
+using base::android::JavaRef;
+
 namespace net {
 namespace android {
 
@@ -355,7 +357,7 @@
 // same key content.
 // |message| is a message.
 // |result| will receive the result.
-void DoKeySigning(jobject android_key,
+void DoKeySigning(const JavaRef<jobject>& android_key,
                   EVP_PKEY* openssl_key,
                   const base::StringPiece& message,
                   std::string* result) {
@@ -413,7 +415,7 @@
 
   // Retrieve the corresponding modulus through JNI
   std::vector<uint8_t> modulus_java;
-  ASSERT_TRUE(GetRSAKeyModulus(key_java.obj(), &modulus_java));
+  ASSERT_TRUE(GetRSAKeyModulus(key_java, &modulus_java));
 
   // Create an OpenSSL BIGNUM from it.
   crypto::ScopedBIGNUM bn(
@@ -434,8 +436,7 @@
 
   ScopedJava rsa_key = GetRSATestKeyJava();
   ASSERT_FALSE(rsa_key.is_null());
-  EXPECT_EQ(PRIVATE_KEY_TYPE_RSA,
-            GetPrivateKeyType(rsa_key.obj()));
+  EXPECT_EQ(PRIVATE_KEY_TYPE_RSA, GetPrivateKeyType(rsa_key));
 }
 
 TEST(AndroidKeyStore,SignWithPrivateKeyRSA) {
@@ -454,7 +455,7 @@
   ASSERT_EQ(36U, message.size());
 
   std::string signature;
-  DoKeySigning(rsa_key.obj(), openssl_key.get(), message, &signature);
+  DoKeySigning(rsa_key, openssl_key.get(), message, &signature);
   ASSERT_TRUE(
       CompareSignatureWithOpenSSL(message, signature, openssl_key.get()));
   // All good.
@@ -466,8 +467,7 @@
   ScopedJava rsa_key = GetRSATestKeyJava();
   ASSERT_FALSE(rsa_key.is_null());
 
-  crypto::ScopedEVP_PKEY wrapper_key(
-      GetOpenSSLPrivateKeyWrapper(rsa_key.obj()));
+  crypto::ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(rsa_key));
   ASSERT_TRUE(wrapper_key.get() != NULL);
 
   crypto::ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestRsaKeyFile));
@@ -496,8 +496,7 @@
 
   ScopedJava ecdsa_key = GetECDSATestKeyJava();
   ASSERT_FALSE(ecdsa_key.is_null());
-  EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA,
-            GetPrivateKeyType(ecdsa_key.obj()));
+  EXPECT_EQ(PRIVATE_KEY_TYPE_ECDSA, GetPrivateKeyType(ecdsa_key));
 }
 
 TEST(AndroidKeyStore,SignWithPrivateKeyECDSA) {
@@ -509,7 +508,7 @@
 
   std::string message = kTestEcdsaHash;
   std::string signature;
-  DoKeySigning(ecdsa_key.obj(), openssl_key.get(), message, &signature);
+  DoKeySigning(ecdsa_key, openssl_key.get(), message, &signature);
   ASSERT_TRUE(VerifyTestECDSASignature(message, signature));
 }
 
@@ -519,8 +518,7 @@
   ScopedJava ecdsa_key = GetECDSATestKeyJava();
   ASSERT_FALSE(ecdsa_key.is_null());
 
-  crypto::ScopedEVP_PKEY wrapper_key(
-      GetOpenSSLPrivateKeyWrapper(ecdsa_key.obj()));
+  crypto::ScopedEVP_PKEY wrapper_key(GetOpenSSLPrivateKeyWrapper(ecdsa_key));
   ASSERT_TRUE(wrapper_key.get());
 
   crypto::ScopedEVP_PKEY openssl_key(ImportPrivateKeyFile(kTestEcdsaKeyFile));

diff --git a/net/android/network_library.cc b/net/android/network_library.cc
index da62b79..54847e08 100644
--- a/net/android/network_library.cc
+++ b/net/android/network_library.cc

@@ -47,8 +47,8 @@
       Java_AndroidNetworkLibrary_verifyServerCertificates(
           env, chain_byte_array, auth_string, host_string);
 
-  ExtractCertVerifyResult(result.obj(),
-                          status, is_issued_by_known_root, verified_chain);
+  ExtractCertVerifyResult(result, status, is_issued_by_known_root,
+                          verified_chain);
 }
 
 void AddTestRootCertificate(const uint8_t* cert, size_t len) {

diff --git a/net/dns/host_cache.cc b/net/dns/host_cache.cc
index 7556e7e..881f514 100644
--- a/net/dns/host_cache.cc
+++ b/net/dns/host_cache.cc

@@ -198,6 +198,28 @@
   entries_.clear();
 }
 
+void HostCache::ClearForHosts(
+    const base::Callback<bool(const std::string&)>& host_filter) {
+  DCHECK(CalledOnValidThread());
+
+  if (host_filter.is_null()) {
+    clear();
+    return;
+  }
+
+  base::TimeTicks now = base::TimeTicks::Now();
+  for (EntryMap::iterator it = entries_.begin(); it != entries_.end();) {
+    EntryMap::iterator next_it = std::next(it);
+
+    if (host_filter.Run(it->first.hostname)) {
+      RecordErase(ERASE_CLEAR, now, it->second);
+      entries_.erase(it);
+    }
+
+    it = next_it;
+  }
+}
+
 size_t HostCache::size() const {
   DCHECK(CalledOnValidThread());
   return entries_.size();

diff --git a/net/dns/host_cache.h b/net/dns/host_cache.h
index 7b3d350..ccda0eb 100644
--- a/net/dns/host_cache.h
+++ b/net/dns/host_cache.h

@@ -146,9 +146,13 @@
     eviction_callback_ = callback;
   }
 
-  // Empties the cache
+  // Empties the cache.
   void clear();
 
+  // Clears hosts matching |host_filter| from the cache.
+  void ClearForHosts(
+      const base::Callback<bool(const std::string&)>& host_filter);
+
   // Returns the number of entries in the cache.
   size_t size() const;
 

diff --git a/net/dns/host_cache_unittest.cc b/net/dns/host_cache_unittest.cc
index 00ec782..30efd2d 100644
--- a/net/dns/host_cache_unittest.cc
+++ b/net/dns/host_cache_unittest.cc

@@ -4,6 +4,10 @@
 
 #include "net/dns/host_cache.h"
 
+#include <string>
+
+#include "base/bind.h"
+#include "base/callback.h"
 #include "base/format_macros.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
@@ -22,6 +26,10 @@
   return HostCache::Key(hostname, ADDRESS_FAMILY_UNSPECIFIED, 0);
 }
 
+bool FoobarIndexIsOdd(const std::string& foobarx_com) {
+  return (foobarx_com[6] - '0') % 2 == 1;
+}
+
 }  // namespace
 
 TEST(HostCacheTest, Basic) {
@@ -296,6 +304,40 @@
   EXPECT_EQ(0u, cache.size());
 }
 
+TEST(HostCacheTest, ClearForHosts) {
+  const base::TimeDelta kTTL = base::TimeDelta::FromSeconds(10);
+
+  HostCache cache(kMaxCacheEntries);
+
+  // Set t=0.
+  base::TimeTicks now;
+
+  HostCache::Entry entry = HostCache::Entry(OK, AddressList());
+
+  EXPECT_EQ(0u, cache.size());
+
+  // Add several entries.
+  cache.Set(Key("foobar1.com"), entry, now, kTTL);
+  cache.Set(Key("foobar2.com"), entry, now, kTTL);
+  cache.Set(Key("foobar3.com"), entry, now, kTTL);
+  cache.Set(Key("foobar4.com"), entry, now, kTTL);
+  cache.Set(Key("foobar5.com"), entry, now, kTTL);
+
+  EXPECT_EQ(5u, cache.size());
+
+  // Clear the hosts matching a certain predicate, such as the number being odd.
+  cache.ClearForHosts(base::Bind(&FoobarIndexIsOdd));
+
+  EXPECT_EQ(2u, cache.size());
+  EXPECT_TRUE(cache.Lookup(Key("foobar2.com"), now));
+  EXPECT_TRUE(cache.Lookup(Key("foobar4.com"), now));
+
+  // Passing null callback will delete all hosts.
+  cache.ClearForHosts(base::Callback<bool(const std::string&)>());
+
+  EXPECT_EQ(0u, cache.size());
+}
+
 // Try to add too many entries to cache; it should evict the one with the oldest
 // expiration time.
 TEST(HostCacheTest, Evict) {

diff --git a/net/test/embedded_test_server/android/embedded_test_server_android.cc b/net/test/embedded_test_server/android/embedded_test_server_android.cc
index e7ab0009..0b25220c 100644
--- a/net/test/embedded_test_server/android/embedded_test_server_android.cc
+++ b/net/test/embedded_test_server/android/embedded_test_server_android.cc

@@ -13,11 +13,14 @@
 #include "net/test/jni/EmbeddedTestServerImpl_jni.h"
 
 using base::android::JavaParamRef;
+using base::android::JavaRef;
 
 namespace net {
 namespace test_server {
 
-EmbeddedTestServerAndroid::EmbeddedTestServerAndroid(JNIEnv* env, jobject jobj)
+EmbeddedTestServerAndroid::EmbeddedTestServerAndroid(
+    JNIEnv* env,
+    const JavaRef<jobject>& jobj)
     : weak_java_server_(env, jobj), test_server_() {
   Java_EmbeddedTestServerImpl_setNativePtr(env, jobj,
                                            reinterpret_cast<intptr_t>(this));

diff --git a/net/test/embedded_test_server/android/embedded_test_server_android.h b/net/test/embedded_test_server/android/embedded_test_server_android.h
index c0d1cec..1b730829 100644
--- a/net/test/embedded_test_server/android/embedded_test_server_android.h
+++ b/net/test/embedded_test_server/android/embedded_test_server_android.h

@@ -20,7 +20,8 @@
 // The C++ side of the Java EmbeddedTestServer.
 class EmbeddedTestServerAndroid {
  public:
-  EmbeddedTestServerAndroid(JNIEnv* env, jobject obj);
+  EmbeddedTestServerAndroid(JNIEnv* env,
+                            const base::android::JavaRef<jobject>& obj);
   ~EmbeddedTestServerAndroid();
 
   void Destroy(JNIEnv* env, const base::android::JavaParamRef<jobject>& obj);

diff --git a/services/ui/ime/ime_server_impl.cc b/services/ui/ime/ime_server_impl.cc
index b295f401..c5895a2d 100644
--- a/services/ui/ime/ime_server_impl.cc
+++ b/services/ui/ime/ime_server_impl.cc

@@ -4,6 +4,7 @@
 
 #include "services/ui/ime/ime_server_impl.h"
 
+#include "services/shell/public/cpp/connector.h"
 #include "services/ui/ime/ime_registrar_impl.h"
 
 namespace ui {
@@ -12,6 +13,12 @@
 
 IMEServerImpl::~IMEServerImpl() {}
 
+void IMEServerImpl::Init(shell::Connector* connector) {
+  // TODO(moshayedi): crbug.com/641041. Look up the driver from the mojo:catalog
+  // service.
+  connector->Connect("mojo:test_ime_driver");
+}
+
 void IMEServerImpl::AddBinding(mojom::IMEServerRequest request) {
   bindings_.AddBinding(this, std::move(request));
 }

diff --git a/services/ui/ime/ime_server_impl.h b/services/ui/ime/ime_server_impl.h
index 0b4c9f9..5f3c854 100644
--- a/services/ui/ime/ime_server_impl.h
+++ b/services/ui/ime/ime_server_impl.h

@@ -10,6 +10,10 @@
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "services/ui/public/interfaces/ime.mojom.h"
 
+namespace shell {
+class Connector;
+}
+
 namespace ui {
 
 class IMEServerImpl : public mojom::IMEServer {
@@ -17,6 +21,7 @@
   IMEServerImpl();
   ~IMEServerImpl() override;
 
+  void Init(shell::Connector* connector);
   void AddBinding(mojom::IMEServerRequest request);
   void OnDriverChanged(mojom::IMEDriverPtr driver);
 

diff --git a/services/ui/ime/ime_unittest.cc b/services/ui/ime/ime_unittest.cc
index a7754d1..651300c 100644
--- a/services/ui/ime/ime_unittest.cc
+++ b/services/ui/ime/ime_unittest.cc

@@ -18,7 +18,7 @@
   explicit TestTextInputClient(ui::mojom::TextInputClientRequest request)
       : binding_(this, std::move(request)) {}
 
-  ui::mojom::CompositionEventPtr ReceiveCompositionEvent() {
+  ui::mojom::CompositionEventPtr WaitUntilCompositionEvent() {
     run_loop_.reset(new base::RunLoop);
     run_loop_->Run();
     run_loop_.reset();
@@ -26,15 +26,28 @@
     return std::move(receieved_composition_event_);
   }
 
+  ui::Event* WaitUntilUnhandledEvent() {
+    run_loop_.reset(new base::RunLoop);
+    run_loop_->Run();
+    run_loop_.reset();
+
+    return unhandled_event_.get();
+  }
+
  private:
   void OnCompositionEvent(ui::mojom::CompositionEventPtr event) override {
     receieved_composition_event_ = std::move(event);
     run_loop_->Quit();
   }
+  void OnUnhandledEvent(std::unique_ptr<ui::Event> char_event) override {
+    unhandled_event_ = std::move(char_event);
+    run_loop_->Quit();
+  }
 
   mojo::Binding<ui::mojom::TextInputClient> binding_;
   std::unique_ptr<base::RunLoop> run_loop_;
   ui::mojom::CompositionEventPtr receieved_composition_event_;
+  std::unique_ptr<ui::Event> unhandled_event_;
 
   DISALLOW_COPY_AND_ASSIGN(TestTextInputClient);
 };
@@ -67,19 +80,32 @@
   ui::mojom::InputMethodPtr input_method;
   ime_server_->StartSession(std::move(client_ptr), GetProxy(&input_method));
 
-  ui::KeyEvent key_event(ui::ET_KEY_PRESSED, ui::VKEY_A, 0);
-
-  input_method->ProcessKeyEvent(ui::Event::Clone(key_event));
+  // Send character key event.
+  ui::KeyEvent char_event('A', ui::VKEY_A, 0);
+  input_method->ProcessKeyEvent(ui::Event::Clone(char_event));
 
   ui::mojom::CompositionEventPtr composition_event =
-      client.ReceiveCompositionEvent();
-  ASSERT_EQ(ui::mojom::CompositionEventType::INSERT_CHAR,
+      client.WaitUntilCompositionEvent();
+  EXPECT_EQ(ui::mojom::CompositionEventType::INSERT_CHAR,
             composition_event->type);
-  ASSERT_TRUE(composition_event->key_event);
-  ASSERT_TRUE(composition_event->key_event.value()->IsKeyEvent());
+  EXPECT_TRUE(composition_event->key_event);
+  EXPECT_TRUE(composition_event->key_event.value()->IsKeyEvent());
 
   ui::KeyEvent* received_key_event =
       composition_event->key_event.value()->AsKeyEvent();
-  ASSERT_EQ(ui::ET_KEY_PRESSED, received_key_event->type());
-  ASSERT_EQ(key_event.GetCharacter(), received_key_event->GetCharacter());
+  EXPECT_EQ(ui::ET_KEY_PRESSED, received_key_event->type());
+  EXPECT_TRUE(received_key_event->is_char());
+  EXPECT_EQ(char_event.GetCharacter(), received_key_event->GetCharacter());
+
+  // Send non-character key event.
+  ui::KeyEvent nonchar_event(ui::ET_KEY_PRESSED, ui::VKEY_LEFT, 0);
+  input_method->ProcessKeyEvent(ui::Event::Clone(nonchar_event));
+
+  ui::Event* unhandled_event = client.WaitUntilUnhandledEvent();
+  EXPECT_TRUE(unhandled_event);
+  EXPECT_TRUE(unhandled_event->IsKeyEvent());
+  EXPECT_FALSE(unhandled_event->AsKeyEvent()->is_char());
+  EXPECT_EQ(ui::ET_KEY_PRESSED, unhandled_event->type());
+  EXPECT_EQ(nonchar_event.key_code(),
+            unhandled_event->AsKeyEvent()->key_code());
 }

diff --git a/services/ui/ime/test_ime_driver/BUILD.gn b/services/ui/ime/test_ime_driver/BUILD.gn
index b772076c..f1a880aa 100644
--- a/services/ui/ime/test_ime_driver/BUILD.gn
+++ b/services/ui/ime/test_ime_driver/BUILD.gn

@@ -6,9 +6,10 @@
 import("//services/shell/public/service_manifest.gni")
 import("//testing/test.gni")
 
-service("test_ime_driver") {
+source_set("lib") {
   sources = [
-    "main.cc",
+    "test_ime_application.cc",
+    "test_ime_application.h",
     "test_ime_driver.cc",
     "test_ime_driver.h",
   ]
@@ -18,7 +19,20 @@
     "//services/shell/public/cpp",
     "//services/ui/public/cpp",
     "//services/ui/public/interfaces",
-    "//ui/gfx/geometry/mojo",
+  ]
+}
+
+service("test_ime_driver") {
+  sources = [
+    "main.cc",
+  ]
+
+  deps = [
+    ":lib",
+    "//base",
+    "//services/shell/public/cpp",
+    "//services/ui/public/cpp",
+    "//services/ui/public/interfaces",
   ]
 
   data_deps = [

diff --git a/services/ui/ime/test_ime_driver/main.cc b/services/ui/ime/test_ime_driver/main.cc
index 795119fa..67a3812 100644
--- a/services/ui/ime/test_ime_driver/main.cc
+++ b/services/ui/ime/test_ime_driver/main.cc

@@ -3,37 +3,10 @@
 // found in the LICENSE file.
 
 #include "services/shell/public/c/main.h"
-#include "services/shell/public/cpp/connector.h"
-#include "services/shell/public/cpp/service.h"
 #include "services/shell/public/cpp/service_runner.h"
-#include "services/ui/ime/test_ime_driver/test_ime_driver.h"
-
-namespace ui {
-namespace test {
-
-class TestIME : public shell::Service {
- public:
-  TestIME() {}
-  ~TestIME() override {}
-
- private:
-  // shell::Service:
-  void OnStart(const shell::Identity& identity) override {
-    mojom::IMEDriverPtr ime_driver_ptr;
-    new TestIMEDriver(GetProxy(&ime_driver_ptr));
-
-    ui::mojom::IMERegistrarPtr ime_registrar;
-    connector()->ConnectToInterface("mojo:ui", &ime_registrar);
-    ime_registrar->RegisterDriver(std::move(ime_driver_ptr));
-  }
-
-  DISALLOW_COPY_AND_ASSIGN(TestIME);
-};
-
-}  // namespace test
-}  // namespace ui
+#include "services/ui/ime/test_ime_driver/test_ime_application.h"
 
 MojoResult ServiceMain(MojoHandle service_request_handle) {
-  shell::ServiceRunner runner(new ui::test::TestIME);
+  shell::ServiceRunner runner(new ui::test::TestIMEApplication);
   return runner.Run(service_request_handle);
 }

diff --git a/services/ui/ime/test_ime_driver/test_ime_application.cc b/services/ui/ime/test_ime_driver/test_ime_application.cc
new file mode 100644
index 0000000..a0b067e
--- /dev/null
+++ b/services/ui/ime/test_ime_driver/test_ime_application.cc

@@ -0,0 +1,33 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/ui/ime/test_ime_driver/test_ime_application.h"
+
+#include "services/shell/public/cpp/connector.h"
+#include "services/ui/ime/test_ime_driver/test_ime_driver.h"
+#include "services/ui/public/interfaces/ime.mojom.h"
+
+namespace ui {
+namespace test {
+
+TestIMEApplication::TestIMEApplication() {}
+
+TestIMEApplication::~TestIMEApplication() {}
+
+bool TestIMEApplication::OnConnect(const shell::Identity& remote_identity,
+                                   shell::InterfaceRegistry* registry) {
+  return true;
+}
+
+void TestIMEApplication::OnStart(const shell::Identity& identity) {
+  mojom::IMEDriverPtr ime_driver_ptr;
+  new TestIMEDriver(GetProxy(&ime_driver_ptr));
+
+  ui::mojom::IMERegistrarPtr ime_registrar;
+  connector()->ConnectToInterface("mojo:ui", &ime_registrar);
+  ime_registrar->RegisterDriver(std::move(ime_driver_ptr));
+}
+
+}  // namespace test
+}  // namespace ui

diff --git a/services/ui/ime/test_ime_driver/test_ime_application.h b/services/ui/ime/test_ime_driver/test_ime_application.h
new file mode 100644
index 0000000..6c8b970
--- /dev/null
+++ b/services/ui/ime/test_ime_driver/test_ime_application.h

@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_UI_IME_TEST_IME_DRIVER_TEST_IME_APPLICATION_H_
+#define SERVICES_UI_IME_TEST_IME_DRIVER_TEST_IME_APPLICATION_H_
+
+#include "services/shell/public/cpp/service.h"
+
+namespace ui {
+namespace test {
+
+class TestIMEApplication : public shell::Service {
+ public:
+  TestIMEApplication();
+  ~TestIMEApplication() override;
+
+ private:
+  // shell::Service:
+  bool OnConnect(const shell::Identity& remote_identity,
+                 shell::InterfaceRegistry* registry) override;
+  void OnStart(const shell::Identity& identity) override;
+
+  DISALLOW_COPY_AND_ASSIGN(TestIMEApplication);
+};
+
+}  // namespace test
+}  // namespace ui
+
+#endif  // SERVICES_UI_IME_TEST_IME_DRIVER_TEST_IME_APPLICATION_H_

diff --git a/services/ui/ime/test_ime_driver/test_ime_driver.cc b/services/ui/ime/test_ime_driver/test_ime_driver.cc
index 370ea5f..dbf01ef 100644
--- a/services/ui/ime/test_ime_driver/test_ime_driver.cc
+++ b/services/ui/ime/test_ime_driver/test_ime_driver.cc

@@ -22,12 +22,16 @@
   void OnCaretBoundsChanged(const gfx::Rect& caret_bounds) override {}
   void ProcessKeyEvent(std::unique_ptr<Event> key_event) override {
     DCHECK(key_event->IsKeyEvent());
-    mojom::CompositionEventPtr composition_event =
-        mojom::CompositionEvent::New();
-    composition_event->type = mojom::CompositionEventType::INSERT_CHAR;
-    composition_event->key_event = std::move(key_event);
 
-    client_->OnCompositionEvent(std::move(composition_event));
+    if (key_event->AsKeyEvent()->is_char()) {
+      mojom::CompositionEventPtr composition_event =
+          mojom::CompositionEvent::New();
+      composition_event->type = mojom::CompositionEventType::INSERT_CHAR;
+      composition_event->key_event = std::move(key_event);
+      client_->OnCompositionEvent(std::move(composition_event));
+    } else {
+      client_->OnUnhandledEvent(std::move(key_event));
+    }
   };
   void CancelComposition() override {}
 

diff --git a/services/ui/public/interfaces/ime.mojom b/services/ui/public/interfaces/ime.mojom
index ed1f56d..17d9107 100644
--- a/services/ui/public/interfaces/ime.mojom
+++ b/services/ui/public/interfaces/ime.mojom

@@ -93,15 +93,24 @@
   // Mus translates it to global coordinates and sends it to IME app.
   OnCaretBoundsChanged(gfx.mojom.Rect caret_bounds);
 
+  // Called to process a key event. If InputMethod handles the event, it will
+  // notify the client of the resulting composition events (there might be none)
+  // by calling TextInputClient::OnCompositionEvent(). If the event is not
+  // handled by InputMethod, TextInputClient::OnUnhandledEvent() is called.
   ProcessKeyEvent(ui.mojom.Event key_event);
+
   CancelComposition();
 };
 
 // IME drivers send updates to clients using the TextInputClient interface.
 interface TextInputClient {
   // Corresponds to "input method result" functions of ui::TextInputClient.
+  // See comments for InputMethod::ProcessKeyEvent() for when this is called.
   OnCompositionEvent(CompositionEvent event);
 
+  // See comments for InputMethod::ProcessKeyEvent() for when this is called.
+  OnUnhandledEvent(ui.mojom.Event key_event);
+
   // TODO(moshayedi): Add functions corresponding to ui::TextInputClient for:
   // - Input text confirmation
   // - Document content operations

diff --git a/services/ui/service.cc b/services/ui/service.cc
index da48c64..025112d 100644
--- a/services/ui/service.cc
+++ b/services/ui/service.cc

@@ -187,6 +187,8 @@
   if (ui::DeviceDataManager::HasInstance())
     touch_controller_.reset(
         new ws::TouchController(window_server_->display_manager()));
+
+  ime_server_.Init(connector());
 }
 
 bool Service::OnConnect(const shell::Identity& remote_identity,

diff --git a/testing/buildbot/OWNERS b/testing/buildbot/OWNERS
index e5cd6b33..566b0dd 100644
--- a/testing/buildbot/OWNERS
+++ b/testing/buildbot/OWNERS

@@ -18,6 +18,7 @@
 per-file chromium.fyi.json=creis@chromium.org
 per-file chromium.fyi.json=nick@chromium.org
 
+per-file *chromium.perf*.json=dtu@chromium.org
 per-file chromium.perf.json=eakuefner@chromium.org
 per-file chromium.perf.json=fmeawad@chromium.org
 per-file chromium.perf.json=simonhatch@chromium.org

diff --git a/testing/libfuzzer/fuzzers/BUILD.gn b/testing/libfuzzer/fuzzers/BUILD.gn
index 985c0e4a..9954a98 100644
--- a/testing/libfuzzer/fuzzers/BUILD.gn
+++ b/testing/libfuzzer/fuzzers/BUILD.gn

@@ -245,8 +245,6 @@
   deps = [
     "//v8:wasm_code_fuzzer",
   ]
-  dict = "dicts/v8_wasm.dict"
-  seed_corpus = "//v8/test/fuzzer/wasm_code/"
   libfuzzer_options = [ "max_len=500" ]
 }
 

diff --git a/testing/variations/fieldtrial_testing_config_android.json b/testing/variations/fieldtrial_testing_config_android.json
index a952f51..b64448e2 100644
--- a/testing/variations/fieldtrial_testing_config_android.json
+++ b/testing/variations/fieldtrial_testing_config_android.json

@@ -38,6 +38,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/testing/variations/fieldtrial_testing_config_chromeos.json b/testing/variations/fieldtrial_testing_config_chromeos.json
index b28aa73c..f6fa7ae 100644
--- a/testing/variations/fieldtrial_testing_config_chromeos.json
+++ b/testing/variations/fieldtrial_testing_config_chromeos.json

@@ -9,6 +9,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/testing/variations/fieldtrial_testing_config_ios.json b/testing/variations/fieldtrial_testing_config_ios.json
index 95c1922..8623f75 100644
--- a/testing/variations/fieldtrial_testing_config_ios.json
+++ b/testing/variations/fieldtrial_testing_config_ios.json

@@ -4,6 +4,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/testing/variations/fieldtrial_testing_config_linux.json b/testing/variations/fieldtrial_testing_config_linux.json
index 81555c9..9da7fa83 100644
--- a/testing/variations/fieldtrial_testing_config_linux.json
+++ b/testing/variations/fieldtrial_testing_config_linux.json

@@ -14,6 +14,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/testing/variations/fieldtrial_testing_config_mac.json b/testing/variations/fieldtrial_testing_config_mac.json
index 76321ae3..ef32eac 100644
--- a/testing/variations/fieldtrial_testing_config_mac.json
+++ b/testing/variations/fieldtrial_testing_config_mac.json

@@ -9,6 +9,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/testing/variations/fieldtrial_testing_config_win.json b/testing/variations/fieldtrial_testing_config_win.json
index 5a812481..a3fca15e 100644
--- a/testing/variations/fieldtrial_testing_config_win.json
+++ b/testing/variations/fieldtrial_testing_config_win.json

@@ -9,6 +9,14 @@
             "group_name": "Enabled"
         }
     ],
+    "AutofillProfileCleanup": [
+        {
+            "enable_features": [
+                "AutofillProfileCleanup"
+            ],
+            "group_name": "Enabled"
+        }
+    ],
     "AutofillProfileOrderByFrecency": [
         {
             "group_name": "EnabledLimitTo3",

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index addfd8b..f6c64d3a3 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -61,6 +61,9 @@
 
 crbug.com/601669 [ Win ] svg/as-image/svg-nested.html [ Crash Pass ]
 
+# Fails consistently on WebKit Mac10.10, WebKit Mac10.11 (retina) and mac10.10_blink_rel tryserver, but not on other Mac bots.
+crbug.com/614910 [ Mac ] virtual/gpu-rasterization/fast/images/pixel-crack-image-background-webkit-transform-scale.html [ Pass Failure ]
+
 crbug.com/619103 fast/repaint/background-resize-width.html [ Failure ]
 crbug.com/619103 fast/repaint/hover-invalidation-table.html [ Failure ]
 crbug.com/619103 fast/repaint/selected-replaced.html [ Failure ]
@@ -86,11 +89,6 @@
 
 crbug.com/630615 [ Win7 ] fast/images/color-profile-background-image-space.html [ Skip ]
 
-crbug.com/638293 [ Linux ] virtual/gpu-rasterization/fast/images/color-profile-reflection.html [ Failure ]
-
-# Fails consistently on WebKit Mac10.10, WebKit Mac10.11 (retina) and mac10.10_blink_rel tryserver, but not on other Mac bots.
-crbug.com/614910 [ Mac ] virtual/gpu-rasterization/fast/images/pixel-crack-image-background-webkit-transform-scale.html [ Pass Failure ]
-
 crbug.com/630967 [ Linux Debug ] svg/parser/whitespace-length-invalid-1.html [ Skip ]
 crbug.com/630967 [ Linux Debug ] svg/parser/whitespace-length-invalid-2.html [ Skip ]
 crbug.com/630967 [ Linux Debug ] svg/parser/whitespace-angle.html [ Skip ]
@@ -107,6 +105,8 @@
 crbug.com/636271 [ Linux ] fast/repaint/resize-iframe-text.html [ Pass Failure ]
 crbug.com/636271 [ Win ] fast/repaint/resize-iframe-text.html [ Pass Failure ]
 
+crbug.com/638293 [ Linux ] virtual/gpu-rasterization/fast/images/color-profile-reflection.html [ Failure ]
+
 crbug.com/639147 svg/wicd/test-rightsizing-b.xhtml [ Failure Pass ]
 
 # ====== Paint team owned tests to here ======
@@ -114,6 +114,26 @@
 # Run these tests with under virtual/scalefactor... only.
 crbug.com/567837 fast/hidpi/static [ Skip ]
 
+crbug.com/262679 fast/block/basic/fieldset-stretch-to-legend.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/borders/fieldsetBorderRadius.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/css/fieldset-display-row.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/css/invalidation/fieldset-disabled.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/006.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/007.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/fieldset/fieldset-align.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/fieldset/fieldset-with-float.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/fieldset/float-before-fieldset.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/fieldset/validation-in-fieldset.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/focus-selection-input.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/focus-selection-textarea.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/forms/validity-property.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/ruby/rubyDOM-remove-text2.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/text/whitespace/normal-after-nowrap-breaking.html [ NeedsManualRebaseline ]
+crbug.com/262679 fast/writing-mode/fieldsets.html [ NeedsManualRebaseline ]
+crbug.com/262679 paint/masks/fieldset-mask.html [ NeedsManualRebaseline ]
+crbug.com/262679 svg/custom/inline-svg-in-xhtml.xml [ NeedsManualRebaseline ]
+
 # TODO(yosin): We should convert following tests to use asynchronous spell checker.scroll-in
 crbug.com/563265 editing/spelling/context-menu-suggestions.html [ Skip ]
 crbug.com/563265 editing/spelling/spellcheck-editable-on-focus-multiframe.html [ Skip ]

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-at-paragraph-boundaries-009.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-at-paragraph-boundaries-009.html
deleted file mode 100644
index 5f01499..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-at-paragraph-boundaries-009.html
+++ /dev/null

@@ -1,65 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    font-size: 24px; 
-}
-.explanation { 
-    border: 2px solid blue; 
-    padding: 12px; 
-    font-size: 24px; 
-    margin-bottom: 24px;
-}
-.scenario { margin-bottom: 16px;}
-.scenario:first-line { font-weight: bold; margin-bottom: 16px;}
-.expected-results:first-line { font-weight: bold }
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    moveSelectionForwardByLineCommand();
-    extendSelectionForwardByLineCommand();
-	for (i = 0; i < 3; i++)
-		extendSelectionForwardByCharacterCommand();    
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-
-<div class="explanation">
-<div class="scenario">
-Tests: 
-<br>
-Deleting when a selection starts at the beginning of a
-paragraph preceded by a text element and extends into the middle of a following paragraph. 
-</div>
-<div class="expected-results">
-Expected Results:
-<br>
-Should see the three lines in the red box. First line should be "one". Next one should be "ee".  Next one should be "four". Insertion point should be blinking at the start of the second line.
-</div>
-</div>
-
-<div contenteditable id="root" style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space;">
-<div id="test" class="editing">
-one
-<p style="margin-top: 0; margin-bottom: 0">two</p>
-<p style="margin-top: 0; margin-bottom: 0">three</p>
-<p style="margin-top: 0; margin-bottom: 0">four</p>
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete_at_paragraph_boundaries.html b/third_party/WebKit/LayoutTests/editing/deleting/delete_at_paragraph_boundaries.html
index 4bd4b6c7..9c12b63 100644
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete_at_paragraph_boundaries.html
+++ b/third_party/WebKit/LayoutTests/editing/deleting/delete_at_paragraph_boundaries.html

@@ -137,4 +137,22 @@
             '</div>',
         ].join('')),
         'Deleting when a selection starts in the middle of the last paragraph and extends to the end of that paragraph');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>',
+                    'one<p>^two</p><p>thr|ee</p><p>four</p>',
+                '</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                // TODO(yosin): We should revise "delete" command not have BR
+                // after "four".
+                'one<p>|ee</p><p>four<br></p>',
+            '</div>',
+        ].join('')),
+        'Deleting when a selection starts at the beginning of a paragraph preceded by a text element and extends into the middle of a following paragraph.');
 </script>

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline-expected.txt b/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline-expected.txt
deleted file mode 100644
index 6d9245f4..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline-expected.txt
+++ /dev/null

@@ -1,82 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-This tests for a bug where deleting a paragraph in preserveNewline text would introduce an extra line.  You should see '\nbar' below.
-
-initial state:
-| <pre>
-|   "foo
-bar"
-
-on mac:
-| <pre>
-|   "<#selection-caret>
-bar"
-
-after undo on mac:
-| <pre>
-|   "<#selection-anchor>foo<#selection-focus>
-bar"
-
-on win:
-| <pre>
-|   "<#selection-caret>
-bar"
-
-after undo on win:
-| <pre>
-|   "<#selection-anchor>foo<#selection-focus>
-bar"
-
-on unix:
-| <pre>
-|   "<#selection-caret>
-bar"
-
-after undo on unix:
-| <pre>
-|   "<#selection-anchor>foo<#selection-focus>
-bar"
-
-on android:
-| <pre>
-|   "<#selection-caret>
-bar"
-
-after undo on android:
-| <pre>
-|   "<#selection-anchor>foo<#selection-focus>
-bar"

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline.html b/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline.html
index ee7465f..ee28d8a 100644
--- a/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline.html
+++ b/third_party/WebKit/LayoutTests/editing/deleting/paragraph-in-preserveNewline.html

@@ -1,37 +1,27 @@
-<!DOCTYPE html>
-<html>
-<body>
-<p id="description">This tests for a bug where deleting a paragraph in preserveNewline text would introduce an extra line.  You should see '\nbar' below.</p>
-<div id="test" contenteditable="true"><pre>foo
-bar</pre></div>
-
-<script src="../../resources/dump-as-markup.js"></script>
+<!doctype html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
 <script>
-function runTestsOn(platform) {
-    var sel = window.getSelection();
-    var e = document.getElementById("test");
-    
-    if (window.internals)
-        internals.settings.setEditingBehavior(platform);
+    test(() => {
+        assert_not_equals(window.internals, undefined,
+            'This test requires window.internals');
+        ['mac', 'win', 'unix', 'android'].forEach(platform => {
+            internals.settings.setEditingBehavior(platform);
+            assert_selection(
+                '<div contenteditable><pre>^foo|\n</pre></div>',
+                'delete',
+                '<div contenteditable><pre>|\n</pre></div>',
+                `${platform}: Delete a paragraph in preserving newline`);
 
-    sel.collapse(e, 0);
-    sel.modify("extend", "forward", "character");
-    sel.modify("extend", "forward", "character");
-    sel.modify("extend", "forward", "character");
-    document.execCommand("Delete");
-    Markup.dump("test", "on " + platform);
-    document.execCommand("undo");
-    Markup.dump("test", "after undo on " + platform);
-}
-
-if (window.testRunner)
-     testRunner.dumpEditingCallbacks();
-Markup.description(description.textContent);
-Markup.dump("test", "initial state");
-runTestsOn("mac");
-runTestsOn("win");
-runTestsOn("unix");
-runTestsOn("android");
+            assert_selection(
+                '<div contenteditable><pre>^foo|\n</pre></div>',
+                selection => {
+                    selection.document.execCommand('delete');
+                    selection.document.execCommand('undo');
+                },
+                '<div contenteditable><pre>^foo|\n</pre></div>',
+                '${platform}: Undo after delete a paragraph in preserving newline');
+        });
+    });
 </script>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001-expected.txt b/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001-expected.txt
deleted file mode 100644
index a59a47c..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001-expected.txt
+++ /dev/null

@@ -1,14 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-This test tests whether or not we can prevent a cursor from moving after a virama sign.
-
-If this test succeeds, you can see a string "succeeded" below.
-
-क्ष
-Succeeded.

diff --git a/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001.html b/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001.html
index dd67c18d..47ed691 100644
--- a/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001.html
+++ b/third_party/WebKit/LayoutTests/editing/deleting/skip-virama-001.html

@@ -1,44 +1,15 @@
-<html>
-<head>
-<title>Editing Test (Skipping a virama sign)</title>
-<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
-<script src="../editing.js" language="javascript" type="text/javascript"></script>
-<script language="javascript" type="text/javascript">
-function log(str) {
-    var li = document.createElement("li");
-    li.appendChild(document.createTextNode(str));
-    var console = document.getElementById("console");
-    console.appendChild(li);
-}
-function sendBackwardDeleteKey() {
-    if (window.eventSender)
-        eventSender.keyDown("Backspace", null);
-}
-function editingTest() {
-    if (window.testRunner)
-        testRunner.dumpAsText();
-    var testarea = document.getElementById("test");
-    testarea.focus();
-    typeCharacterCommand(String.fromCharCode(0x0915));
-    typeCharacterCommand(String.fromCharCode(0x094D));
-    typeCharacterCommand(String.fromCharCode(0x0937));
-    moveSelectionBackwardByCharacterCommand();
-    sendBackwardDeleteKey();
-    var expected_result = "\u0915\u094D\u0937";
-    if (testarea.textContent == expected_result)
-        log("Succeeded.");
-    else
-        log("Failed. Actual: \"" + testarea.textContent + "\", Expected: \"" + expected_result + "\".");
-}
+<!doctype html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
+<script>
+    test(() => assert_selection(
+        '<div contenteditable>|\u0915\u094D\u0937</div>',
+        selection => {
+            assert_not_equals(window.eventSender, undefined,
+                'This test requires eventSender');
+            eventSender.keyDown('Backspace', null);
+        },
+        '<div contenteditable>|\u0915\u094D\u0937</div>'),
+        'prevent a cursor from moving after a virama sign');
 </script>
-</head>
-<body>
-<p>This test tests whether or not we can prevent a cursor from moving after a virama sign.</p>
-<p>If this test succeeds, you can see a string "succeeded" below.</p>
-<div contenteditable id="test"></div>
-<ul id="console"></ul>
-<script language="javascript" type="text/javascript">
-runEditingTest();
-</script>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/editing/execCommand/find-after-replace.html b/third_party/WebKit/LayoutTests/editing/execCommand/find-after-replace.html
index 461827c8..07d62cdef 100644
--- a/third_party/WebKit/LayoutTests/editing/execCommand/find-after-replace.html
+++ b/third_party/WebKit/LayoutTests/editing/execCommand/find-after-replace.html

@@ -1,26 +1,19 @@
-<body onload="runTest()">
+<!doctype html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
 <script>
-if (window.testRunner)
-     testRunner.dumpEditingCallbacks();
+    test(() => {
+        assert_not_equals(window.internals, undefined,
+            'This test requires window.internals to access clipboard');
+        assert_selection(
+            '<div contenteditable>|a b a</div>',
+            selection => {
+                selection.document.execCommand('findString', false, 'a b');
+                selection.document.execCommand('copy');
+                selection.document.execCommand('findString', false, 'a');
+                selection.document.execCommand('paste');
+            },
+            '<div contenteditable>a b a b|</div>');
+    }, 'simulate find and replace');
 </script>
-<p>This tests find and replace inside an editable iframe.  You should see 'A B A B' below. With bug 4462420, you would see 'A B B A'.</p>
-<iframe src="../resources/contenteditable-iframe-src.html"></iframe>
-
-<script>
-function runTest() {
-    document.body.offsetTop;
-
-    var frame = frames[0];
-    var sel = frame.getSelection();
-    var doc = frame.document;
-
-    sel.collapse(doc.body, 0);
-    doc.execCommand("InsertText", false, "A B A");
-    sel.collapse(doc.body, 0);
-    doc.execCommand("FindString", false, "A B");
-    doc.execCommand("Copy");
-    doc.execCommand("FindString", false, "A");
-    doc.execCommand("Paste");
-}
-</script>
-</body>

diff --git a/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.png b/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.png
index ee125215..7ffb5082 100644
--- a/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.txt
index 99ab8b1..e26a960d 100644
--- a/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/block/basic/quirk-percent-height-table-cell-expected.txt

@@ -6,12 +6,12 @@
       LayoutTable {TABLE} at (0,0) size 120x426 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 118x424
           LayoutTableRow {TR} at (0,2) size 118x420
-            LayoutTableCell {TD} at (2,2) size 114x420 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+            LayoutTableCell {TD} at (2,-48) size 114x520 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
               LayoutBlockFlow {DIV} at (2,2) size 20x100 [bgcolor=#FFFF00]
-              LayoutTable {TABLE} at (2,102) size 110x316 [border: (1px outset #808080)]
-                LayoutTableSection {TBODY} at (1,1) size 108x314
-                  LayoutTableRow {TR} at (0,2) size 108x310
-                    LayoutTableCell {TD} at (2,2) size 104x310 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,102) size 110x416 [border: (1px outset #808080)]
+                LayoutTableSection {TBODY} at (1,1) size 108x414
+                  LayoutTableRow {TR} at (0,2) size 108x410
+                    LayoutTableCell {TD} at (2,52) size 104x310 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
                       LayoutBlockFlow {DIV} at (2,2) size 100x6
                         LayoutBlockFlow {DIV} at (0,0) size 100x6 [border: (3px solid #0000FF)]
                       LayoutBlockFlow {DIV} at (2,8) size 100x300 [bgcolor=#008000]

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns-expected.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns-expected.html
new file mode 100644
index 0000000..132aade3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns-expected.html

@@ -0,0 +1,346 @@
+<!DOCTYPE html>
+<link href="resources/grid.css" rel="stylesheet">
+<style>
+.grid {
+    justify-content: start;
+    width: 100px;
+    position: relative;
+    padding-top: 10px;
+    margin-bottom: 5px;
+    grid-column-gap: 5px;
+}
+
+.fc0 { grid-template-columns: minmax(auto, 0px);}
+.fc40 { grid-template-columns: minmax(auto, 40px); }
+.fc80 { grid-template-columns: minmax(auto, 80px); }
+.fc110 { grid-template-columns: auto; }
+
+.fc0x2 { grid-template-columns: repeat(2, minmax(auto, 0px));}
+.fc40x2 { grid-template-columns: repeat(2, minmax(auto, 40px)); }
+.fc80x2 { grid-template-columns: repeat(2, minmax(auto, 80px)); }
+.fc110x2 { grid-template-columns: auto auto; }
+
+.fc0p { grid-template-columns: minmax(auto, 0%); }
+.fc30p { grid-template-columns: minmax(auto, 30%); }
+.fc90p { grid-template-columns: minmax(auto, 90%); }
+.fc110p { grid-template-columns: auto; }
+
+.fc0px2 { grid-template-columns: repeat(2, minmax(auto, 0%)); }
+.fc30px2 { grid-template-columns: repeat(2, minmax(auto, 30%)); }
+.fc90px2 { grid-template-columns: repeat(2, minmax(auto, 90%)); }
+.fc110px2 { grid-template-columns: auto auto; }
+
+.item {
+    font: 10px/1 Ahem;
+    background: cyan;
+}
+
+.spanningItem {
+    font: 10px/1 Ahem;
+    grid-column: 1 / -1;
+    grid-row: 2;
+    background: salmon;
+}
+
+.test {
+    position: absolute;
+    left: 0; right: 0; top: 0;
+    height: 5px;
+    background: purple;
+}
+.test:nth-child(2n) { background: orange; }
+
+.floatLeft {
+    float: left;
+    width: 190px;
+}
+
+h3 { font-size: 1em; }
+</style>
+
+<p>This test checks that 'fit-content()' works as expected, i.e., it's similar to 'auto' ('minmax(auto, max-content)') except that the growth limit is clamped at the argument of 'fit-content' (if greater that the 'auto' minimum).</p>
+
+<div class="floatLeft">
+    <h3>Only fit-content() and with fixed size tracks.</h3>
+    <div class="grid fc0">
+	<div class="item">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc0x2">
+	<div class="item">XXX</div>
+	<div class="spanningItem">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc40">
+	<div class="item">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto auto;">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 40px) auto;">
+	<div class="item">XXX XXX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc80">
+	<div class="item">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc80x2">
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto minmax(auto, 80px)">
+	<div class="item autoRowSecondColumn">XXX XXX XXX</div>
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 20px) 50%;">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(10px, 40px) minmax(auto, 40px);">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto minmax(10%, 200px);">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+</div>
+
+<div class="floatLeft">
+    <h3>fit-content() with other content-sized tracks.</h3>
+    <div class="grid" style="grid-template-columns: minmax(auto, 40px) max-content;">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 40px) max-content;">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 40px) max-content;">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content minmax(auto, 40px);">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content minmax(auto, 40px);">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content minmax(auto, 40px);">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 30px) min-content max-content">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content minmax(auto, 30px) max-content">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content max-content minmax(auto, 30px)">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(auto, 30px) min-content max-content">
+	<div class="item" style="grid-column: 1">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content minmax(auto, 30px) max-content">
+	<div class="item" style="grid-column: 1">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content max-content minmax(auto, 30px)">
+	<div class="item" style="grid-column: 2">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+</div>
+
+<div class="floatLeft">
+    <h3>fit-content() with percentage arguments.</h3>
+    <div class="grid fc0p">
+	<div class="item">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc0px2">
+	<div class="item">XXX</div>
+	<div class="spanningItem">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc30p">
+	<div class="item">XX XX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc30px2">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc30px2">
+	<div class="item autoRowSecondColumn">X X X</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc90p">
+	<div class="item">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc90px2">
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto minmax(auto, 90%)">
+	<div class="item autoRowSecondColumn">XXX XXX XXX</div>
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+</div>
+
+<div class="floatLeft">
+    <h3>max-content < fit-content() argument.</h3>
+
+    <div class="grid fc110">
+	<div class="item">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc110x2">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc110x2">
+	<div class="item">XXX XXX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto auto;">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto auto;">
+	<div class="item autoRowSecondColumn">XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: max-content auto;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto min-content;">
+        <div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: max-content auto max-content;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content auto min-content;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto auto auto;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns.html
new file mode 100644
index 0000000..95f65f07
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-columns.html

@@ -0,0 +1,347 @@
+<!DOCTYPE html>
+<link href="resources/grid.css" rel="stylesheet">
+<style>
+.grid {
+    justify-content: start;
+    width: 100px;
+    position: relative;
+    padding-top: 10px;
+    margin-bottom: 5px;
+    grid-column-gap: 5px;
+}
+
+.fc0 { grid-template-columns: fit-content(0px);}
+.fc40 { grid-template-columns: fit-content(40px); }
+.fc80 { grid-template-columns: fit-content(80px); }
+.fc110 { grid-template-columns: fit-content(110px); }
+
+.fc0x2 { grid-template-columns: repeat(2, fit-content(0px));}
+.fc40x2 { grid-template-columns: repeat(2, fit-content(40px)); }
+.fc80x2 { grid-template-columns: repeat(2, fit-content(80px)); }
+.fc110x2 { grid-template-columns: repeat(2, fit-content(110px)); }
+
+.fc0p { grid-template-columns: fit-content(0%); }
+.fc30p { grid-template-columns: fit-content(30%); }
+.fc90p { grid-template-columns: fit-content(90%); }
+.fc110p { grid-template-columns: fit-content(110%); }
+
+.fc0px2 { grid-template-columns: repeat(2, fit-content(0%)); }
+.fc30px2 { grid-template-columns: repeat(2, fit-content(30%)); }
+.fc90px2 { grid-template-columns: repeat(2, fit-content(90%)); }
+.fc110px2 { grid-template-columns: repeat(2, fit-content(110%)); }
+
+.item {
+    font: 10px/1 Ahem;
+    background: cyan;
+}
+
+.spanningItem {
+    font: 10px/1 Ahem;
+    grid-column: 1 / -1;
+    grid-row: 2;
+    background: salmon;
+}
+
+.test {
+    position: absolute;
+    left: 0; right: 0; top: 0;
+    height: 5px;
+    background: purple;
+}
+.test:nth-child(2n) { background: orange; }
+
+.floatLeft {
+    float: left;
+    width: 190px;
+}
+
+h3 { font-size: 1em; }
+
+</style>
+
+<p>This test checks that 'fit-content()' works as expected, i.e., it's similar to 'auto' ('minmax(auto, max-content)') except that the growth limit is clamped at the argument of 'fit-content' (if greater that the 'auto' minimum).</p>
+
+<div class="floatLeft">
+    <h3>Only fit-content() and with fixed size tracks.</h3>
+    <div class="grid fc0">
+	<div class="item">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc0x2">
+	<div class="item">XXX</div>
+	<div class="spanningItem">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc40">
+	<div class="item">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc40x2">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc40x2">
+	<div class="item">XXX XXX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc80">
+	<div class="item">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc80x2">
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc80x2">
+	<div class="item autoRowSecondColumn">XXX XXX XXX</div>
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(20px) 50%;">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: minmax(10px, 40px) fit-content(40px);">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(40px) minmax(10%, 200px);">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+</div>
+
+<div class="floatLeft">
+    <h3>fit-content() with other content-sized tracks.</h3>
+    <div class="grid" style="grid-template-columns: fit-content(40px) max-content;">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(40px) max-content;">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(40px) max-content;">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(40px);">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(40px);">
+	<div class="item">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(40px);">
+	<div class="item autoRowSecondColumn">XXXXX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(30px) min-content max-content">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(30px) max-content">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content max-content fit-content(30px)">
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(30px) min-content max-content">
+	<div class="item" style="grid-column: 1">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(30px) max-content">
+	<div class="item" style="grid-column: 1">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content max-content fit-content(30px)">
+	<div class="item" style="grid-column: 2">XXX XX</div>
+	<div class="spanningItem">XXX XX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+	<div class="test autoRowThirdColumn"></div>
+    </div>
+</div>
+
+<div class="floatLeft">
+    <h3>fit-content() with percentage arguments.</h3>
+    <div class="grid fc0p">
+	<div class="item">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc0px2">
+	<div class="item">XXX</div>
+	<div class="spanningItem">XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc30p">
+	<div class="item">XX XX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc30px2">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc30px2">
+	<div class="item autoRowSecondColumn">X X X</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc90p">
+	<div class="item">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc90px2">
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc90px2">
+	<div class="item autoRowSecondColumn">XXX XXX XXX</div>
+	<div class="spanningItem">XXX XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+</div>
+
+<div class="floatLeft">
+    <h3>max-content < fit-content() argument.</h3>
+
+    <div class="grid fc110">
+	<div class="item">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+    </div>
+
+    <div class="grid fc110x2">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid fc110x2">
+	<div class="item">XXX XXX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(110px) fit-content(40px);">
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(110px) fit-content(40px);">
+	<div class="item autoRowSecondColumn">XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: max-content fit-content(110px);">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: fit-content(110px) min-content;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: max-content fit-content(110px) max-content;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: min-content fit-content(110px) min-content;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+    <div class="grid" style="grid-template-columns: auto fit-content(110px) auto;">
+	<div class="spanningItem" style="grid-row: 1;">XX XX XX XX</div>
+	<div class="spanningItem">XXX XXX</div>
+	<div class="test autoRowFirstColumn"></div>
+	<div class="test autoRowSecondColumn"></div>
+        <div class="test autoRowThirdColumn"></div>
+    </div>
+
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows-expected.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows-expected.html
new file mode 100644
index 0000000..8f6ec70e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows-expected.html

@@ -0,0 +1,343 @@
+<!DOCTYPE html>
+<link href="resources/grid.css" rel="stylesheet">
+<style>
+.grid {
+    justify-content: start;
+    align-content: start;
+    height: 100px;
+    width: 40px;
+    position: relative;
+    padding-left: 10px;
+    margin-right: 5px;
+    grid-row-gap: 5px;
+    float: left;
+}
+
+.fc0 { grid-template-rows: minmax(auto, 0px);}
+.fc40 { grid-template-rows: minmax(auto, 40px); }
+.fc80 { grid-template-rows: minmax(auto, 80px); }
+.fc110 { grid-template-rows: auto; }
+
+.fc0x2 { grid-template-rows: repeat(2, minmax(auto, 0px));}
+.fc40x2 { grid-template-rows: repeat(2, minmax(auto, 40px)); }
+.fc80x2 { grid-template-rows: repeat(2, minmax(auto, 80px)); }
+.fc110x2 { grid-template-rows: auto auto; }
+
+.fc0p { grid-template-rows: minmax(auto, 0%); }
+.fc30p { grid-template-rows: minmax(auto, 30px); }
+.fc90p { grid-template-rows: minmax(auto, 90px); }
+.fc110p { grid-template-rows: auto; }
+
+.fc0px2 { grid-template-rows: repeat(2, minmax(auto, 0%)); }
+.fc30px2 { grid-template-rows: repeat(2, minmax(auto, 30px)); }
+.fc90px2 { grid-template-rows: repeat(2, minmax(auto, 90px)); }
+.fc110px2 { grid-template-rows: auto auto; }
+
+.item {
+    font: 10px/1 Ahem;
+    background: cyan;
+}
+
+.spanningItem {
+    font: 10px/1 Ahem;
+    grid-row: 1 / -1;
+    grid-column: 2;
+    background: salmon;
+}
+
+.test {
+    position: absolute;
+    left: 0; top: 0; bottom: 0;
+    width: 5px;
+    background: purple;
+}
+.test:nth-child(2n) { background: orange; }
+
+.firstRow { grid-row: 1 / 2; }
+.secondRow { grid-row: 2 / 3; }
+.thirdRow { grid-row: 3 / 4; }
+
+div.grid > div { writing-mode: vertical-lr; }
+
+</style>
+
+<p>This test checks that 'fit-content()' works as expected, i.e., it's similar to 'auto' ('minmax(auto, max-content)') except that the growth limit is clamped at the argument of 'fit-content' (if greater that the 'auto' minimum).</p>
+
+<div class="grid fc0">
+    <div class="item">XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc0x2">
+    <div class="item">XXX</div>
+    <div class="spanningItem">XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc40">
+    <div class="item">XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto auto;">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 40px) auto;">
+    <div class="item">XXX XXX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc80">
+    <div class="item">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc80x2">
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto minmax(auto, 80px)">
+    <div class="item secondRow">XXX XXX XXX</div>
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 20px) 50%;">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(10px, 40px) minmax(auto, 40px);">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto minmax(10%, 200px);">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<br clear="all">
+<br clear="all">
+
+<div class="grid" style="grid-template-rows: minmax(auto, 40px) max-content;">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 40px) max-content;">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 40px) max-content;">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content minmax(auto, 40px);">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content minmax(auto, 40px);">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content minmax(auto, 40px);">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 30px) min-content max-content">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content minmax(auto, 30px) max-content">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content max-content minmax(auto, 30px)">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(auto, 30px) min-content max-content">
+    <div class="item" style="grid-row: 1">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content minmax(auto, 30px) max-content">
+    <div class="item" style="grid-row: 1">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content max-content minmax(auto, 30px)">
+    <div class="item" style="grid-row: 2">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<br clear="all">
+<br clear="all">
+
+<div class="grid fc0p">
+    <div class="item">XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc0px2">
+    <div class="item">XXX</div>
+    <div class="spanningItem">XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc30p">
+    <div class="item">XX XX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc30px2">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc30px2">
+    <div class="item secondRow">X X X</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc90p">
+    <div class="item">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc90px2">
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto minmax(auto, 90px)">
+    <div class="item secondRow">XXX XXX XXX</div>
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<br clear="all">
+<br clear="all">
+
+<div class="grid fc110">
+    <div class="item">XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc110x2">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc110x2">
+    <div class="item">XXX XXX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto auto;">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto auto;">
+    <div class="item secondRow">XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: max-content auto;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto min-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: max-content auto max-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content auto min-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto auto auto;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows.html
new file mode 100644
index 0000000..a8813b1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/fit-content-rows.html

@@ -0,0 +1,347 @@
+<!DOCTYPE html>
+<link href="resources/grid.css" rel="stylesheet">
+<style>
+.grid {
+    justify-content: start;
+    align-content: start;
+    height: 100px;
+    width: 40px;
+    position: relative;
+    padding-left: 10px;
+    margin-right: 5px;
+    grid-row-gap: 5px;
+    float: left;
+}
+
+.fc0 { grid-template-rows: fit-content(0px);}
+.fc40 { grid-template-rows: fit-content(40px); }
+.fc80 { grid-template-rows: fit-content(80px); }
+.fc110 { grid-template-rows: fit-content(110px); }
+
+.fc0x2 { grid-template-rows: repeat(2, fit-content(0px));}
+.fc40x2 { grid-template-rows: repeat(2, fit-content(40px)); }
+.fc80x2 { grid-template-rows: repeat(2, fit-content(80px)); }
+.fc110x2 { grid-template-rows: repeat(2, fit-content(110px)); }
+
+.fc0p { grid-template-rows: fit-content(0%); }
+.fc30p { grid-template-rows: fit-content(30%); }
+.fc90p { grid-template-rows: fit-content(90%); }
+.fc110p { grid-template-rows: fit-content(110%); }
+
+.fc0px2 { grid-template-rows: repeat(2, fit-content(0%)); }
+.fc30px2 { grid-template-rows: repeat(2, fit-content(30%)); }
+.fc90px2 { grid-template-rows: repeat(2, fit-content(90%)); }
+.fc110px2 { grid-template-rows: repeat(2, fit-content(110%)); }
+
+div.grid > div { writing-mode: vertical-lr; }
+
+.item {
+    font: 10px/1 Ahem;
+    background: cyan;
+}
+
+.spanningItem {
+    font: 10px/1 Ahem;
+    grid-row: 1 / -1;
+    grid-column: 2;
+    background: salmon;
+}
+
+.test {
+    position: absolute;
+    left: 0; bottom: 0; top: 0;
+    width: 5px;
+    background: purple;
+}
+.test:nth-child(2n) { background: orange; }
+
+.firstRow { grid-row: 1 / 2; }
+.secondRow { grid-row: 2 / 3; }
+.thirdRow { grid-row: 3 / 4; }
+
+h3 { font-size: 1em; }
+.container { float: left; height: 110px;}
+
+</style>
+
+<p>This test checks that 'fit-content()' works as expected, i.e., it's similar to 'auto' ('minmax(auto, max-content)') except that the growth limit is clamped at the argument of 'fit-content' (if greater that the 'auto' minimum).</p>
+
+<div class="grid fc0">
+    <div class="item">XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc0x2">
+    <div class="item">XXX</div>
+    <div class="spanningItem">XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc40">
+    <div class="item">XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc40x2">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc40x2">
+    <div class="item">XXX XXX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc80">
+    <div class="item">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc80x2">
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc80x2">
+    <div class="item secondRow">XXX XXX XXX</div>
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(20px) 50%;">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: minmax(10px, 40px) fit-content(40px);">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(40px) minmax(10%, 200px);">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+</div>
+
+<br clear ="all">
+<br clear ="all">
+
+<div class="grid" style="grid-template-rows: fit-content(40px) max-content;">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(40px) max-content;">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(40px) max-content;">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(40px);">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(40px);">
+    <div class="item">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(40px);">
+    <div class="item secondRow">XXXXX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(30px) min-content max-content">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(30px) max-content">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content max-content fit-content(30px)">
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(30px) min-content max-content">
+    <div class="item" style="grid-row: 1">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(30px) max-content">
+    <div class="item" style="grid-row: 1">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content max-content fit-content(30px)">
+    <div class="item" style="grid-row: 2">XXX XX</div>
+    <div class="spanningItem">XXX XX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<br clear="all">
+<br clear="all">
+
+<div class="grid fc0p">
+    <div class="item">XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc0px2">
+    <div class="item">XXX</div>
+    <div class="spanningItem">XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc30p">
+    <div class="item">XX XX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc30px2">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc30px2">
+    <div class="item secondRow">X X X</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc90p">
+    <div class="item">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc90px2">
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc90px2">
+    <div class="item secondRow">XXX XXX XXX</div>
+    <div class="spanningItem">XXX XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<br clear="all">
+<br clear="all">
+
+<div class="grid fc110">
+    <div class="item">XXX XXX</div>
+    <div class="test firstRow"></div>
+</div>
+
+<div class="grid fc110x2">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid fc110x2">
+    <div class="item">XXX XXX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(110px) fit-content(40px);">
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(110px) fit-content(40px);">
+    <div class="item secondRow">XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: max-content fit-content(110px);">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: fit-content(110px) min-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: max-content fit-content(110px) max-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: min-content fit-content(110px) min-content;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>
+
+<div class="grid" style="grid-template-rows: auto fit-content(110px) auto;">
+    <div class="spanningItem" style="grid-column: 1;">XX XX XX XX</div>
+    <div class="spanningItem">XXX XXX</div>
+    <div class="test firstRow"></div>
+    <div class="test secondRow"></div>
+    <div class="test thirdRow"></div>
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt
index 04901236..82f004b 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt

@@ -12,6 +12,8 @@
 PASS window.getComputedStyle(gridAutoMinMaxContent, '').getPropertyValue('grid-auto-columns') is "max-content"
 PASS window.getComputedStyle(gridAutoAutoInMinMax, '').getPropertyValue('grid-auto-rows') is "minmax(auto, 48px)"
 PASS window.getComputedStyle(gridAutoAutoInMinMax, '').getPropertyValue('grid-auto-columns') is "minmax(80px, auto)"
+PASS window.getComputedStyle(gridAutoFitContent, '').getPropertyValue('grid-auto-rows') is "fit-content(50%)"
+PASS window.getComputedStyle(gridAutoFitContent, '').getPropertyValue('grid-auto-columns') is "fit-content(30px)"
 
 Test that getting grid-template-columns and grid-template-rows set through CSS lists every track listed whether implicitly or explicitly created
 PASS window.getComputedStyle(gridAutoFixedFixedWithChildren, '').getPropertyValue('grid-auto-rows') is "30px"
@@ -48,6 +50,8 @@
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "minmax(max-content, min-content)"
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is "minmax(min-content, 10px) 48px 5%"
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "auto 30px minmax(10%, 60%)"
+PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is "fit-content(10px) fit-content(30%)"
+PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "fit-content(5%) fit-content(40px)"
 
 Test setting grid-auto-columns and grid-auto-rows to bad minmax value through JS
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is "auto"
@@ -62,6 +66,8 @@
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "auto"
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is "auto"
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "auto"
+PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is "auto"
+PASS getComputedStyle(element, '').getPropertyValue('grid-auto-rows') is "auto"
 
 Test setting grid-auto-columns and grid-auto-rows to 'inherit' through JS
 PASS getComputedStyle(element, '').getPropertyValue('grid-auto-columns') is '50px'

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set.html
index 6491c20..ba33311 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set.html
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-auto-columns-rows-get-set.html

@@ -37,6 +37,12 @@
     grid-auto-columns: 25px 50px 100px;
 }
 
+.gridAutoFitContent {
+    height: 50px;
+    grid-auto-columns: fit-content(30px);
+    grid-auto-rows: fit-content(50%);
+}
+
 </style>
 <script src="../../resources/js-test.js"></script>
 <script src="resources/grid-definitions-parsing-utils.js"></script>
@@ -65,6 +71,7 @@
     <div style="grid-column: -4; grid-row: -4"></div>
     <div style="grid-column: -5; grid-row: -5"></div>
 </div>
+<div class="grid gridAutoFitContent" id="gridAutoFitContent"></div>
 
 <script>
 description('Test that setting and getting grid-auto-columns and grid-auto-rows works as expected');
@@ -74,6 +81,7 @@
 testGridAutoDefinitionsValues(document.getElementById("gridAutoMinMax"), "minmax(10%, 15px)", "minmax(30%, 100px)");
 testGridAutoDefinitionsValues(document.getElementById("gridAutoMinMaxContent"), "min-content", "max-content");
 testGridAutoDefinitionsValues(document.getElementById("gridAutoAutoInMinMax"), "minmax(auto, 48px)", "minmax(80px, auto)");
+testGridAutoDefinitionsValues(document.getElementById("gridAutoFitContent"), "fit-content(50%)", "fit-content(30px)");
 
 debug("");
 debug("Test that getting grid-template-columns and grid-template-rows set through CSS lists every track listed whether implicitly or explicitly created");
@@ -113,6 +121,7 @@
 testAutoValues("minmax(min-content, 8vh)", "minmax(10vw, min-content)", "minmax(min-content, 48px)", "minmax(80px, min-content)");
 testAutoValues("minmax(min-content, max-content)", "minmax(max-content, min-content)");
 testAutoValues("minmax(min-content, 10px) 48px 5%", "auto 30px minmax(10%, 60%)");
+testAutoValues("fit-content(10px) fit-content(30%)", "fit-content(5%) fit-content(calc(20px + 2em))", "fit-content(10px) fit-content(30%)", "fit-content(5%) fit-content(40px)");
 
 debug("");
 debug("Test setting grid-auto-columns and grid-auto-rows to bad minmax value through JS");
@@ -122,6 +131,7 @@
 testAutoValues("none", "none", "auto", "auto");
 testAutoValues("10px [a] 20px", "[z] auto [y] min-content", "auto", "auto");
 testAutoValues("repeat(2, 10px [a] 20px)", "[z] repeat(auto-fit, 100px)", "auto", "auto");
+testAutoValues("fit-content(min-content) fit-content(auto)", "fit-content(fit-content(3%)) fit-content(minmax(2px, 30px))", "auto", "auto");
 
 function testInherit()
 {

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set-expected.txt b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set-expected.txt
index 4b7f2038..06a8843 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set-expected.txt

@@ -46,6 +46,8 @@
 PASS window.getComputedStyle(gridWithCalcComplexInsideMinMaxElement, '').getPropertyValue('grid-template-rows') is "300px"
 PASS window.getComputedStyle(gridWithAutoInsideMinMaxElement, '').getPropertyValue('grid-template-columns') is "20px"
 PASS window.getComputedStyle(gridWithAutoInsideMinMaxElement, '').getPropertyValue('grid-template-rows') is "11px"
+PASS window.getComputedStyle(gridWithFitContentFunctionElement, '').getPropertyValue('grid-template-columns') is "7px"
+PASS window.getComputedStyle(gridWithFitContentFunctionElement, '').getPropertyValue('grid-template-rows') is "11px"
 
 Test getting wrong values for grid-template-columns and grid-template-rows through CSS (they should resolve to the default: 'none')
 PASS window.getComputedStyle(gridWithFitContentElement, '').getPropertyValue('grid-template-columns') is "none"
@@ -84,6 +86,10 @@
 PASS element.style.gridTemplateColumns is "max-content"
 PASS getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "0px"
 PASS element.style.gridTemplateRows is "max-content"
+PASS getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "0px"
+PASS element.style.gridTemplateColumns is "fit-content(100px)"
+PASS getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "0px"
+PASS element.style.gridTemplateRows is "fit-content(25%)"
 
 Test getting and setting grid-template-columns and grid-template-rows to minmax() values through JS
 PASS getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "440px"
@@ -180,6 +186,20 @@
 PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
 PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
 PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "none"
+PASS window.getComputedStyle(element, '').getPropertyValue('grid-template-rows') is "none"
 
 Test setting grid-template-columns and grid-template-rows back to 'none' through JS
 PASS getComputedStyle(element, '').getPropertyValue('grid-template-columns') is "18px"

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set.html
index 9ecd605..ab7647e 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set.html
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-columns-rows-get-set.html

@@ -91,6 +91,10 @@
     grid-template-columns: minmax(auto, 20px);
     grid-template-rows: minmax(max-content, auto);
 }
+.gridWithFitContentFunction {
+    grid-template-columns: fit-content(30%);
+    grid-template-rows: fit-content(20px):
+}
 </style>
 <script src="../../resources/js-test.js"></script>
 </head>
@@ -130,6 +134,9 @@
 <div class="grid definite gridWithAutoInsideMinMax contentStart" id="gridWithAutoInsideMinMaxElement">
     <div class="gridItem"></div>
 </div>
+<div class="grid definite gridWithFitContentFunction contentStart" id="gridWithFitContentFunctionElement">
+    <div class="gridItem"></div>
+</div>
 <script src="resources/grid-definitions-parsing-utils.js"></script>
 <script src="resources/grid-columns-rows-get-set.js"></script>
 </body>

diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/resources/grid-columns-rows-get-set.js b/third_party/WebKit/LayoutTests/fast/css-grid-layout/resources/grid-columns-rows-get-set.js
index 15c9f61..e9a2d0f 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/resources/grid-columns-rows-get-set.js
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/resources/grid-columns-rows-get-set.js

@@ -22,6 +22,7 @@
 testGridDefinitionsValues(document.getElementById("gridWithCalcInsideMinMaxElement"), "80px", "300px");
 testGridDefinitionsValues(document.getElementById("gridWithCalcComplexInsideMinMaxElement"), "415px", "300px");
 testGridDefinitionsValues(document.getElementById("gridWithAutoInsideMinMaxElement"), "20px", "11px");
+testGridDefinitionsValues(document.getElementById("gridWithFitContentFunctionElement"), "7px", "11px");
 
 debug("");
 debug("Test getting wrong values for grid-template-columns and grid-template-rows through CSS (they should resolve to the default: 'none')");
@@ -47,6 +48,7 @@
 testGridDefinitionsSetJSValues("10vw", "25vh", "80px", "150px");
 testGridDefinitionsSetJSValues("min-content", "min-content", "0px", "0px");
 testGridDefinitionsSetJSValues("max-content", "max-content", "0px", "0px");
+testGridDefinitionsSetJSValues("fit-content(100px)", "fit-content(25%)", "0px", "0px");
 
 debug("");
 debug("Test getting and setting grid-template-columns and grid-template-rows to minmax() values through JS");
@@ -98,6 +100,13 @@
 // Flexible lengths are invalid on the min slot of minmax().
 testGridDefinitionsSetBadJSValues("minmax(0fr, 100px)", "minmax(.0fr, 200px)");
 testGridDefinitionsSetBadJSValues("minmax(1fr, 100px)", "minmax(2.5fr, 200px)");
+testGridDefinitionsSetBadJSValues("fit-content(-10em)", "fit-content(-2px)");
+testGridDefinitionsSetBadJSValues("fit-content(10px 2%)", "fit-content(5% 10em)");
+testGridDefinitionsSetBadJSValues("fit-content(max-content)", "fit-content(min-content)");
+testGridDefinitionsSetBadJSValues("fit-content(auto)", "fit-content(3fr)");
+testGridDefinitionsSetBadJSValues("fit-content(repeat(2, 100px))", "fit-content(repeat(auto-fit), 1%)");
+testGridDefinitionsSetBadJSValues("fit-content(fit-content(10px))", "fit-content(fit-content(30%))");
+testGridDefinitionsSetBadJSValues("fit-content([a] 100px)", "fit-content(30px [b c])");
 
 debug("");
 debug("Test setting grid-template-columns and grid-template-rows back to 'none' through JS");

diff --git a/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange-expected.txt
deleted file mode 100644
index e2fbd1b3..0000000
--- a/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange-expected.txt
+++ /dev/null

@@ -1,9 +0,0 @@
-Tests that document.createEvent() works with orientationChange if enabled
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS successfullyParsed is true
-
-TEST COMPLETE
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange.html b/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange.html
deleted file mode 100644
index c991bde3..0000000
--- a/third_party/WebKit/LayoutTests/fast/dom/Orientation/create-event-orientationchange.html
+++ /dev/null

@@ -1,11 +0,0 @@
-<html>
-<head>
-<script src="../../../resources/js-test.js"></script>
-</head>
-<body>
-<p id="description"></p>
-<div id="console"></div>
-<div id="result"></div>
-<script src="script-tests/create-event-orientationchange.js"></script>
-</body>
-</html>

diff --git a/third_party/WebKit/LayoutTests/fast/dom/Orientation/script-tests/create-event-orientationchange.js b/third_party/WebKit/LayoutTests/fast/dom/Orientation/script-tests/create-event-orientationchange.js
deleted file mode 100644
index 59b356ae..0000000
--- a/third_party/WebKit/LayoutTests/fast/dom/Orientation/script-tests/create-event-orientationchange.js
+++ /dev/null

@@ -1,20 +0,0 @@
-description('Tests that document.createEvent() works with orientationChange if enabled')
-
-function handleTestResult()
-{
-    document.getElementById('result').innerHTML = "PASS";
-}
-
-if (window.internals && internals.runtimeFlags.orientationEventEnabled) {
-    window.addEventListener('orientationchange', handleTestResult, false);
-
-    try {
-        var event = document.createEvent("OrientationEvent");
-        event.initEvent("orientationchange", false, false);
-        window.dispatchEvent(event);
-    } catch(e) {
-        document.getElementById('result').innerHTML = "FAIL... orientationChange event doesn't appear to be enabled or implemented.";
-    }
-} else {
-    handleTestResult();
-}

diff --git a/third_party/WebKit/LayoutTests/fast/events/event-creation.html b/third_party/WebKit/LayoutTests/fast/events/event-creation.html
index 7b43650..1a2c028 100644
--- a/third_party/WebKit/LayoutTests/fast/events/event-creation.html
+++ b/third_party/WebKit/LayoutTests/fast/events/event-creation.html

@@ -173,23 +173,6 @@
 
     // The following are here for completeness, but won't until there is more widespread support for them.
 
-    // #if ENABLE(WEB_AUDIO)
-    // AudioProcessingEvent
-    // shouldBeTrue("document.createEvent('AudioProcessingEvent') instanceof window.AudioProcessingEvent");
-    // shouldBeTrue("document.createEvent('AudioProcessingEvent') instanceof window.Event");
-    // shouldBeTrue("document.createEvent('AudioProcessingEvent').constructor === window.AudioProcessingEvent");
-
-    // #if ENABLE(WEB_AUDIO)
-    // OfflineAudioCompletionEvent
-    // shouldBeTrue("document.createEvent('OfflineAudioCompletionEvent') instanceof window.OfflineAudioCompletionEvent");
-    // shouldBeTrue("document.createEvent('OfflineAudioCompletionEvent') instanceof window.Event");
-    // shouldBeTrue("document.createEvent('OfflineAudioCompletionEvent').constructor === window.OfflineAudioCompletionEvent");
-
-    // MediaStreamEvent
-    // shouldBeTrue("document.createEvent('MediaStreamEvent') instanceof window.MediaStreamEvent");
-    // shouldBeTrue("document.createEvent('MediaStreamEvent') instanceof window.Event");
-    // shouldBeTrue("document.createEvent('MediaStreamEvent').constructor === window.MediaStreamEvent");
-
     // #if ENABLE(WEBGL)
     // WebGLContextEvent
     // shouldBeTrue("document.createEvent('WebGLContextEvent') instanceof window.WebGLContextEvent");
@@ -211,10 +194,6 @@
     // shouldBeTrue("document.createEvent('DeviceOrientationEvent') instanceof window.Event");
     // shouldBeTrue("document.createEvent('DeviceOrientationEvent').constructor === window.DeviceOrientationEvent");
 
-    // OrientationEvent (Event alternative)
-    // shouldBeTrue("document.createEvent('OrientationEvent') instanceof window.Event");
-    // shouldBeTrue("document.createEvent('OrientationEvent').constructor === window.Event");
-
     // We test both a hard coded set and the automated set below (using enumeration) to ensure that a constructor being removed
     // from the window is caught a regression.
 

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex-expected.html
new file mode 100644
index 0000000..93ee9c6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex-expected.html

@@ -0,0 +1,105 @@
+<!DOCTYPE html>
+<style>
+.flex-container {
+  background: #333;
+  border: 0px;
+  display: flex;
+  margin: 0px;
+  padding: 0px;
+}
+
+.flex-container.flex-direction-row {
+  flex-direction : row;
+}
+
+.flex-container.flex-direction-row-reverse {
+  flex-direction : row-reverse;
+}
+
+.flex-container.flex-direction-column {
+  flex-direction : column;
+}
+
+.flex-container.flex-direction-column-reverse {
+  flex-direction : column-reverse;
+}
+
+.flex-container.flex-direction-column-reverse {
+  flex-direction : column-reverse;
+}
+
+.flex-container.justify-content-center {
+  justify-content: center;
+}
+
+.flex-container.justify-content-space-around {
+  justify-content: space-around;
+}
+
+.flex-container.justify-content-space-between {
+  justify-content: space-between;
+}
+
+.flex-item {
+  width:50px;
+  height:50px;
+  margin:20px;
+  background: #eee;
+  line-height: 50px;
+  text-align: center;
+}
+</style>
+
+<fieldset>
+  <legend>Fieldset with display: flex</legend>
+  <div>these fieldsshouldn't bestacked vertically</div>
+</fieldset>
+
+<h1>flex-direction: row</h1>
+<div class="flex-container flex-direction-row">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>flex-direction: row-reverse</h1>
+<div class="flex-container flex-direction-row-reverse">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>flex-direction: column</h1>
+<div class="flex-container flex-direction-column">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>flex-direction: column-reverse</h1>
+<div class="flex-container flex-direction-column-reverse">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>justify-content: center</h1>
+<div class="flex-container justify-content-center">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>justify-content: space-around</h1>
+<div class="flex-container justify-content-space-around">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>
+
+<h1>justify-content: space-between</h1>
+<div class="flex-container justify-content-space-between">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex.html
new file mode 100644
index 0000000..280ac837
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-flex.html

@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<style>
+.flex-container {
+  background: #333;
+  border: 0px;
+  display: flex;
+  margin: 0px;
+  padding: 0px;
+}
+
+.flex-container.flex-direction-row {
+  flex-direction : row;
+}
+
+.flex-container.flex-direction-row-reverse {
+  flex-direction : row-reverse;
+}
+
+.flex-container.flex-direction-column {
+  flex-direction : column;
+}
+
+.flex-container.flex-direction-column-reverse {
+  flex-direction : column-reverse;
+}
+
+.flex-container.flex-direction-column-reverse {
+  flex-direction : column-reverse;
+}
+
+.flex-container.justify-content-center {
+  justify-content: center;
+}
+
+.flex-container.justify-content-space-around {
+  justify-content: space-around;
+}
+
+.flex-container.justify-content-space-between {
+  justify-content: space-between;
+}
+
+.flex-item {
+  width:50px;
+  height:50px;
+  margin:20px;
+  background: #eee;
+  line-height: 50px;
+  text-align: center;
+}
+</style>
+
+<fieldset style="display: flex;">
+  <legend>Fieldset with display: flex</legend>
+  <div>these fields</div>
+  <div>shouldn't be</div>
+  <div>stacked vertically</div>
+</fieldset>
+
+<h1>flex-direction: row</h1>
+<fieldset class="flex-container flex-direction-row">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>flex-direction: row-reverse</h1>
+<fieldset class="flex-container flex-direction-row-reverse">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>flex-direction: column</h1>
+<fieldset class="flex-container flex-direction-column">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>flex-direction: column-reverse</h1>
+<fieldset class="flex-container flex-direction-column-reverse">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>justify-content: center</h1>
+<fieldset class="flex-container justify-content-center">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>justify-content: space-around</h1>
+<fieldset class="flex-container justify-content-space-around">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>
+
+<h1>justify-content: space-between</h1>
+<fieldset class="flex-container justify-content-space-between">
+  <div class="flex-item">1</div>
+  <div class="flex-item">2</div>
+  <div class="flex-item">3</div>
+</fieldset>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid-expected.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid-expected.html
new file mode 100644
index 0000000..6dc5132
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid-expected.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<style>
+.grid > div {
+  border: 1px solid;
+}
+.grid {
+  border: 0px;
+  display: grid;
+  height: 500px;
+  padding: 0px;
+  width: 500px;
+}
+</style>
+
+This should be displayed as a 4x4 grid.
+
+<div class="grid">
+  <div style="grid-column: 1; grid-row: 1;">row/column: 1/1</div>
+  <div style="grid-column: 2; grid-row: 1;">row/column: 1/2</div>
+  <div style="grid-column: 1: grid-row: 2;">row/column: 2/1</div>
+  <div style="grid-column: 2; grid-row: 2;">row/column: 2/2</div>
+</div>
+

diff --git a/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid.html b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid.html
new file mode 100644
index 0000000..b07a31b8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/fieldset/fieldset-display-grid.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<style>
+.grid > div {
+  border: 1px solid;
+}
+.grid {
+  border: 0px;
+  display: grid;
+  height: 500px;
+  margin: 0px;
+  padding: 0px;
+  width: 500px;
+}
+</style>
+
+This should be displayed as a 4x4 grid.
+
+<fieldset class="grid">
+  <div style="grid-column: 1; grid-row: 1;">row/column: 1/1</div>
+  <div style="grid-column: 2; grid-row: 1;">row/column: 1/2</div>
+  <div style="grid-column: 1: grid-row: 2;">row/column: 2/1</div>
+  <div style="grid-column: 2; grid-row: 2;">row/column: 2/2</div>
+</fieldset>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll-expected.html b/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll-expected.html
new file mode 100644
index 0000000..3bec2cf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll-expected.html

@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<p>select() should not scroll containers.</p>
+<div style="overflow:scroll; width:100px; height:24px;">
+<div>line1</div>
+<input value="A quick brown fox jumps over the lazy dog. " size=20>
+</div>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll.html b/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll.html
new file mode 100644
index 0000000..8917d22
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/text/text-select-noscroll.html

@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<p>select() should not scroll containers.</p>
+<div style="overflow:scroll; width:100px; height:24px;">
+<div>line1</div>
+<input value="A quick brown fox jumps over the lazy dog. " size=20>
+</div>
+<script>
+document.querySelector('input').select();
+</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/031-expected.png b/third_party/WebKit/LayoutTests/fast/table/031-expected.png
index 38288d84..4683aeb 100644
--- a/third_party/WebKit/LayoutTests/fast/table/031-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/table/031-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/fast/table/031-expected.txt b/third_party/WebKit/LayoutTests/fast/table/031-expected.txt
index 6155b1c..2dc2fb92 100644
--- a/third_party/WebKit/LayoutTests/fast/table/031-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/table/031-expected.txt

@@ -3,11 +3,11 @@
 layer at (0,0) size 800x600
   LayoutBlockFlow {HTML} at (0,0) size 800x600
     LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutTable {TABLE} at (0,0) size 306x306
-        LayoutTableSection {TBODY} at (0,0) size 306x306
-          LayoutTableRow {TR} at (0,2) size 306x302
-            LayoutTableCell {TD} at (2,2) size 302x302 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (1,1) size 6x300
-                LayoutTableSection {TBODY} at (0,0) size 6x300
-                  LayoutTableRow {TR} at (0,2) size 6x296
-                    LayoutTableCell {TD} at (2,149) size 2x2 [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,0) size 306x304
+        LayoutTableSection {TBODY} at (0,0) size 306x304
+          LayoutTableRow {TR} at (0,2) size 306x300
+            LayoutTableCell {TD} at (2,2) size 302x300 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (1,1) size 6x298
+                LayoutTableSection {TBODY} at (0,0) size 6x298
+                  LayoutTableRow {TR} at (0,2) size 6x294
+                    LayoutTableCell {TD} at (2,148) size 2x2 [r=0 c=0 rs=1 cs=1]

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-expected.txt
deleted file mode 100644
index 4e92a29..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/627305: Percent height content in a border-box sized cell with border and a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-expected.txt
deleted file mode 100644
index eb892716..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/627305: Percent height content in a border-box sized cell with a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table-expected.txt
deleted file mode 100644
index eb892716..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/627305: Percent height content in a border-box sized cell with a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table.html
deleted file mode 100644
index 9c65373f..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border-on-table.html
+++ /dev/null

@@ -1,23 +0,0 @@
-<!DOCTYPE html>
-<style>
-td {
-    width: 50px;
-    height: 50px;
-    padding: 0px;
-    box-sizing: border-box;
-}
-#div {
-    height: 100%;
-}
-</style>
-<table style="border-collapse:collapse; border: 18px solid lightblue;" id="table" data-expected-height=68 data-expected-width=68>
-    <tr id="row">
-        <td><div id="div" style="background:black" data-expected-height=32 data-expected-width=32></div></td>
-    </tr>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/627305: Percent height content in a border-box sized cell with a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('#table', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border.html
deleted file mode 100644
index 25cedee..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border.html
+++ /dev/null

@@ -1,23 +0,0 @@
-<!DOCTYPE html>
-<style>
-td {
-    width: 50px;
-    height: 50px;
-    padding: 0px;
-    box-sizing: border-box;
-}
-#div {
-    height: 100%;
-}
-</style>
-<table style="border-collapse:collapse" id="table" data-expected-height=68 data-expected-width=68>
-    <tr style="border:18px solid lightblue" id="row">
-        <td><div id="div" style="background:black" data-expected-height=32 data-expected-width=32></div></td>
-    </tr>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/627305: Percent height content in a border-box sized cell with a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('#table', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding-expected.txt
deleted file mode 100644
index 4e92a29..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/627305: Percent height content in a border-box sized cell with border and a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding.html
deleted file mode 100644
index 40541ef8..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-padding.html
+++ /dev/null

@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<style>
-td {
-    width: 50px;
-    height: 50px;
-    padding: 9px;
-    box-sizing: border-box;
-    border: 9px solid lightblue;
-}
-#div {
-    height: 100%;
-}
-</style>
-<table style="border-collapse:collapse" id="table" data-expected-height=59 data-expected-width=59>
-    <tr id="row">
-        <td><div id="div" style="background:black" data-expected-height=23 data-expected-width=23></div></td>
-    </tr>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/627305: Percent height content in a border-box sized cell with border and a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('#table', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell.html
deleted file mode 100644
index e2d09615..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-border-box-sized-cell.html
+++ /dev/null

@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<style>
-td {
-    width: 50px;
-    height: 50px;
-    padding: 0px;
-    box-sizing: border-box;
-    border: 18px solid lightblue;
-}
-#div {
-    height: 100%;
-}
-</style>
-<table style="border-collapse:collapse" id="table" data-expected-height=68 data-expected-width=68>
-    <tr id="row">
-        <td><div id="div" style="background:black" data-expected-height=32 data-expected-width=32></div></td>
-    </tr>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/627305: Percent height content in a border-box sized cell with border and a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('#table', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell-expected.txt
deleted file mode 100644
index da89e694..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/465096: Percent height content in a cell with a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell.html
deleted file mode 100644
index 0333e6f..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-cell.html
+++ /dev/null

@@ -1,38 +0,0 @@
-<!DOCTYPE html>
-<style>
-table {
-    width: 250px;
-}
-
-td {
-    width: 242px;
-}
-
-.cell-specified-height {
-    height: 202px;
-}
-
-.container {
-    height: 100%;
-    overflow-y: hidden;
-    border: 1px solid #ccc;
-}
-.content {
-    background-color: black;
-    height: 2000px;
-    width: 225px;
-}
-</style>
-<table>
-    <td class="cell-specified-height">
-        <div class="container" data-expected-height=204>
-            <div class="content"></div>
-        </div>
-    </td>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/465096: Percent height content in a cell with a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('.container', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell-expected.txt
deleted file mode 100644
index 7ffbe3d5..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell-expected.txt
+++ /dev/null

@@ -1,3 +0,0 @@
-crbug.com/627305: Percent height content in a content-box sized cell with a computed height should use the height of the cell.
-
-PASS

diff --git a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell.html b/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell.html
deleted file mode 100644
index 1d3a3ba7..0000000
--- a/third_party/WebKit/LayoutTests/fast/table/percent-height-content-in-fixed-height-content-box-sized-cell.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<style>
-td {
-    width: 50px;
-    height: 50px;
-    padding: 0px;
-}
-#div {
-    height: 100%;
-}
-</style>
-<table style="border-collapse:collapse" id="table" data-expected-height=86 data-expected-width=86>
-    <tr style="border:18px solid lightblue" id="row">
-        <td><div id="div" style="background:black" data-expected-height=50 data-expected-width=50></div></td>
-    </tr>
-</table>
-<script src="../../resources/check-layout.js"></script>
-<p> crbug.com/627305: Percent height content in a content-box sized cell with a computed height should use the height of the cell. </p>
-<div id="output"></div>
-<script>
-checkLayout('#table', output);
-</script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/nonces/script-enforce-blocked.php b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/nonces/script-enforce-blocked.php
index de270a14..11ce01d8 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/nonces/script-enforce-blocked.php
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/nonces/script-enforce-blocked.php

@@ -6,17 +6,52 @@
 <script src="/resources/testharnessreport.js"></script>
 <script nonce="abc">
     async_test(t => {
-        var watcher = new EventWatcher(t, document, ['securitypolicyviolation','securitypolicyviolation']);
+        var watcher = new EventWatcher(t, document, ['securitypolicyviolation', 'securitypolicyviolation','securitypolicyviolation', 'securitypolicyviolation','securitypolicyviolation','securitypolicyviolation', 'securitypolicyviolation', 'securitypolicyviolation']);
         watcher
             .wait_for('securitypolicyviolation')
             .then(t.step_func(e => {
                 assert_equals(e.blockedURI, "inline");
-                assert_equals(e.lineNumber, 23);
+                assert_equals(e.lineNumber, 58);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "inline");
+                assert_equals(e.lineNumber, 61);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "inline");
+                assert_equals(e.lineNumber, 64);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "inline");
+                assert_equals(e.lineNumber, 67);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "inline");
+                assert_equals(e.lineNumber, 70);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "https://evil.example.test/yay1.js");
+                assert_equals(e.lineNumber, 0);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "https://evil.example.test/yay2.js");
+                assert_equals(e.lineNumber, 0);
+                return watcher.wait_for('securitypolicyviolation');
+            }))
+            .then(t.step_func(e => {
+                assert_equals(e.blockedURI, "https://evil.example.test/yay3.js");
+                assert_equals(e.lineNumber, 0);
                 return watcher.wait_for('securitypolicyviolation');
             }))
             .then(t.step_func_done(e => {
-                assert_equals(e.blockedURI, "inline");
-                assert_equals(e.lineNumber, 26);
+                assert_equals(e.blockedURI, "https://evil.example.test/yay4.js");
+                assert_equals(e.lineNumber, 0);
             }));
     }, "Unnonced script blocks generate reports.");
 
@@ -29,6 +64,27 @@
 <script nonce="xyz">
     unexecuted_test.assert_unreached("This code block should not execute.");
 </script>
+<script <script nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</script>
+<script attribute<script nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</script>
+<script attribute=<script nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</script>
+<script src=https://evil.example.test/yay1.js <script nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</script>
+<script src=https://evil.example.test/yay2.js attribute=<script nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</script>
+<script src=https://evil.example.test/yay3.js <style nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</style></script>
+<script src=https://evil.example.test/yay4.js attribute=<style nonce="abc">
+    unexecuted_test.assert_unreached("This code block should not execute.");
+</style></script>
 <script nonce="abc">
     executed_test.done();
     unexecuted_test.done();

diff --git a/third_party/WebKit/LayoutTests/imported/wpt/dom/nodes/Document-createEvent-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/dom/nodes/Document-createEvent-expected.txt
index 5a2c53a..5c8d081c 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/dom/nodes/Document-createEvent-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/dom/nodes/Document-createEvent-expected.txt

@@ -232,27 +232,17 @@
 PASS Should throw NOT_SUPPORTED_ERR for unrecognized arguments 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "AnimationPlayerEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "AnimationPlayerEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ApplicationCacheErrorEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ApplicationCacheErrorEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ApplicationCacheErrorEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "AudioProcessingEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "AudioProcessingEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "AudioProcessingEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "AutocompleteErrorEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "AutocompleteErrorEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "BeforeInstallPromptEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "BeforeInstallPromptEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "BeforeInstallPromptEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "BlobEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "BlobEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "BlobEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ClipboardEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ClipboardEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ClipboardEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "CommandEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "CommandEvents" 
@@ -260,25 +250,15 @@
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "DataContainerEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "DeviceLightEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "DeviceLightEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ExtendableEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ExtendableEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ExtendableEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ExtendableMessageEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ExtendableMessageEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ExtendableMessageEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "FetchEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "FetchEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "FetchEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "FontFaceSetLoadEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "FontFaceSetLoadEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "FontFaceSetLoadEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "GamepadEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "GamepadEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "GamepadEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "GeofencingEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "GeofencingEvents" 
@@ -286,35 +266,21 @@
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "InstallEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "KeyEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "KeyEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MIDIConnectionEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MIDIConnectionEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MIDIConnectionEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MIDIMessageEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MIDIMessageEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MIDIMessageEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaEncryptedEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaEncryptedEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaEncryptedEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaKeyEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaKeyEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaKeyMessageEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaKeyMessageEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaKeyMessageEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaQueryListEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaQueryListEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaQueryListEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaStreamEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaStreamEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaStreamEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaStreamTrackEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MediaStreamTrackEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MediaStreamTrackEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "MouseScrollEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MouseScrollEvents" 
@@ -324,15 +290,11 @@
 FAIL Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "MutationEvents" assert_throws: function "function () {
         var evt = document.createEvent(eventInterface + "s");
       }" did not throw
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "NotificationEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "NotificationEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "NotificationEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "NotifyPaintEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "NotifyPaintEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "OfflineAudioCompletionEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "OfflineAudioCompletionEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "OfflineAudioCompletionEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "OrientationEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "OrientationEvents" 
@@ -342,70 +304,42 @@
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PointerEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PopUpEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PopUpEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PresentationConnectionAvailableEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PresentationConnectionAvailableEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PresentationConnectionAvailableEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PresentationConnectionCloseEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PresentationConnectionCloseEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PresentationConnectionCloseEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PromiseRejectionEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PromiseRejectionEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PromiseRejectionEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PushEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "PushEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "PushEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCDTMFToneChangeEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCDTMFToneChangeEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "RTCDTMFToneChangeEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCDataChannelEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCDataChannelEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "RTCDataChannelEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCIceCandidateEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RTCIceCandidateEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "RTCIceCandidateEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "RelatedEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "RelatedEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ResourceProgressEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ResourceProgressEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ResourceProgressEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SVGEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ScrollAreaEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ScrollAreaEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SecurityPolicyViolationEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SecurityPolicyViolationEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SecurityPolicyViolationEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ServicePortConnectEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ServicePortConnectEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ServiceWorkerMessageEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "ServiceWorkerMessageEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "ServiceWorkerMessageEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SimpleGestureEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SimpleGestureEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechRecognitionError" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechRecognitionError" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SpeechRecognitionErrors" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechRecognitionEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechRecognitionEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SpeechRecognitionEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechSynthesisEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SpeechSynthesisEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SpeechSynthesisEvents" 
-FAIL Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SyncEvent" assert_throws: function "function () {
-        var evt = document.createEvent(eventInterface);
-      }" did not throw
+PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "SyncEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "SyncEvents" 
 PASS Should throw NOT_SUPPORTED_ERR for non-legacy event interface "TimeEvent" 
 PASS Should throw NOT_SUPPORTED_ERR for pluralized non-legacy event interface "TimeEvents" 

diff --git a/third_party/WebKit/LayoutTests/platform/android/editing/execCommand/find-after-replace-expected.png b/third_party/WebKit/LayoutTests/platform/android/editing/execCommand/find-after-replace-expected.png
deleted file mode 100644
index cda5290..0000000
--- a/third_party/WebKit/LayoutTests/platform/android/editing/execCommand/find-after-replace-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
deleted file mode 100644
index 6764f87d..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
deleted file mode 100644
index 79f30ff..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
+++ /dev/null

@@ -1,43 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x238 [border: (2px solid #0000FF)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x83
-          LayoutText {#text} at (0,0) size 64x26
-            text run at (0,0) width 64: "Tests: "
-          LayoutBR {BR} at (0,0) size 0x0
-          LayoutText {#text} at (0,27) size 749x55
-            text run at (0,27) width 749: "Deleting when a selection starts at the beginning of a paragraph preceded by a"
-            text run at (0,55) width 637: "text element and extends into the middle of a following paragraph."
-        LayoutBlockFlow {DIV} at (14,113) size 756x111
-          LayoutText {#text} at (0,0) size 189x26
-            text run at (0,0) width 189: "Expected Results: "
-          LayoutBR {BR} at (189,21) size 0x0
-          LayoutText {#text} at (0,27) size 738x83
-            text run at (0,27) width 738: "Should see the three lines in the red box. First line should be \"one\". Next one"
-            text run at (0,55) width 152: "should be \"ee\". "
-            text run at (152,55) width 585: "Next one should be \"four\". Insertion point should be blinking"
-            text run at (0,83) width 284: "at the start of the second line."
-      LayoutBlockFlow {DIV} at (0,262) size 784x88
-        LayoutBlockFlow {DIV} at (0,0) size 784x88 [border: (2px solid #FF0000)]
-          LayoutBlockFlow (anonymous) at (2,2) size 780x28
-            LayoutText {#text} at (0,0) size 35x27
-              text run at (0,0) width 35: "one"
-          LayoutBlockFlow {P} at (2,30) size 780x28
-            LayoutText {#text} at (0,0) size 22x27
-              text run at (0,0) width 22: "ee"
-          LayoutBlockFlow {P} at (2,58) size 780x28
-            LayoutText {#text} at (0,0) size 40x27
-              text run at (0,0) width 40: "four"
-caret: position 0 of child 0 {#text} of child 1 {P} of child 1 {DIV} of child 3 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.png
deleted file mode 100644
index c154cfc..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.txt
deleted file mode 100644
index 2d6e234..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/execCommand/find-after-replace-expected.txt
+++ /dev/null

@@ -1,32 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 771x39
-          text run at (0,0) width 312: "This tests find and replace inside an editable iframe. "
-          text run at (312,0) width 459: "You should see 'A B A B' below. With bug 4462420, you would see 'A B B"
-          text run at (0,20) width 18: "A'."
-      LayoutBlockFlow (anonymous) at (0,56) size 784x154
-        LayoutText {#text} at (0,0) size 0x0
-        LayoutText {#text} at (0,0) size 0x0
-layer at (8,64) size 304x154
-  LayoutIFrame {IFRAME} at (0,0) size 304x154 [border: (2px inset #EEEEEE)]
-    layer at (0,0) size 300x150
-      LayoutView at (0,0) size 300x150
-    layer at (0,0) size 300x150
-      LayoutBlockFlow {HTML} at (0,0) size 300x150
-        LayoutBlockFlow {BODY} at (8,8) size 284x134 [bgcolor=#FFFFE0]
-          LayoutText {#text} at (0,0) size 54x19
-            text run at (0,0) width 54: "A B A B"

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.png
index a1b61c0..c41efd8 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.txt
index 9da9347..84a4fc5 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/table/dynamic-descendant-percentage-height-expected.txt

@@ -6,17 +6,17 @@
       LayoutBlockFlow {P} at (0,0) size 784x20
         LayoutText {#text} at (0,0) size 327x19
           text run at (0,0) width 327: "The following two green rectangles should be identical:"
-      LayoutTable {TABLE} at (0,36) size 266x112
-        LayoutTableSection {TBODY} at (0,0) size 266x112
-          LayoutTableRow {TR} at (0,2) size 266x108
-            LayoutTableCell {TD} at (2,2) size 262x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 260x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,36) size 266x104
+        LayoutTableSection {TBODY} at (0,0) size 266x104
+          LayoutTableRow {TR} at (0,2) size 266x100
+            LayoutTableCell {TD} at (2,2) size 262x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 260x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 254x19
                   text run at (3,3) width 254: "This text should have a green background."
-      LayoutTable {TABLE} at (0,148) size 266x112
-        LayoutTableSection {TBODY} at (0,0) size 266x112
-          LayoutTableRow {TR} at (0,2) size 266x108
-            LayoutTableCell {TD} at (2,2) size 262x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 260x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,140) size 266x104
+        LayoutTableSection {TBODY} at (0,0) size 266x104
+          LayoutTableRow {TR} at (0,2) size 266x100
+            LayoutTableCell {TD} at (2,2) size 262x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 260x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 254x19
                   text run at (3,3) width 254: "This text should have a green background."

diff --git a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.png b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.png
index 9b2db36..ae6994ee 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.txt
index 6f6cf08..a577c04 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla/core/cell_heights-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4370
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4366
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x4370 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x4370
-    LayoutBlockFlow {BODY} at (8,8) size 769x4354
+layer at (0,0) size 785x4366 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x4366
+    LayoutBlockFlow {BODY} at (8,8) size 769x4350
       LayoutTable {TABLE} at (0,0) size 39x584 [bgcolor=#0000FF] [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 37x582
           LayoutTableRow {TR} at (0,2) size 37x114
@@ -159,13 +159,13 @@
                 text run at (2,2) width 26: "auto"
       LayoutBlockFlow (anonymous) at (0,3924) size 769x20
         LayoutBR {BR} at (0,0) size 0x19
-      LayoutTable {TABLE} at (0,3944) size 53x410 [bgcolor=#FFA500] [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 51x408
-          LayoutTableRow {TR} at (0,2) size 51x404
-            LayoutTableCell {TD} at (2,2) size 47x404 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 43x400 [bgcolor=#0000FF]
-                LayoutTableSection {TBODY} at (0,0) size 43x400
-                  LayoutTableRow {TR} at (0,2) size 43x396
-                    LayoutTableCell {TD} at (2,189) size 39x22 [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,3944) size 53x406 [bgcolor=#FFA500] [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 51x404
+          LayoutTableRow {TR} at (0,2) size 51x400
+            LayoutTableCell {TD} at (2,2) size 47x400 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 43x396 [bgcolor=#0000FF]
+                LayoutTableSection {TBODY} at (0,0) size 43x396
+                  LayoutTableRow {TR} at (0,2) size 43x392
+                    LayoutTableCell {TD} at (2,187) size 39x22 [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (1,1) size 37x19
                         text run at (1,1) width 37: "100%"

diff --git a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
index 9c8882c6..508888f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
index 083f3491..79eb0f30 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 852
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 848
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x852 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x852
-    LayoutBlockFlow {BODY} at (8,8) size 769x836
+layer at (0,0) size 785x848 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x848
+    LayoutBlockFlow {BODY} at (8,8) size 769x832
       LayoutBlockFlow (anonymous) at (0,0) size 769x100
         LayoutText {#text} at (0,0) size 296x19
           text run at (0,0) width 296: "The following three examples are 2 nested tables."
@@ -39,19 +39,19 @@
                         text run at (2,2) width 219: "outer table has height:200px on <tr>"
       LayoutBlockFlow (anonymous) at (0,526) size 769x20
         LayoutBR {BR} at (0,0) size 0x19
-      LayoutTable {TABLE} at (0,546) size 242x210 [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 240x208
-          LayoutTableRow {TR} at (0,2) size 240x204
-            LayoutTableCell {TD} at (2,2) size 236x204 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 232x200 [border: (1px outset #808080)]
-                LayoutTableSection {TBODY} at (1,1) size 230x198
-                  LayoutTableRow {TR} at (0,2) size 230x194
-                    LayoutTableCell {TD} at (2,87) size 226x24 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,546) size 242x206 [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 240x204
+          LayoutTableRow {TR} at (0,2) size 240x200
+            LayoutTableCell {TD} at (2,2) size 236x200 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 232x196 [border: (1px outset #808080)]
+                LayoutTableSection {TBODY} at (1,1) size 230x194
+                  LayoutTableRow {TR} at (0,2) size 230x190
+                    LayoutTableCell {TD} at (2,85) size 226x24 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (2,2) size 222x19
                         text run at (2,2) width 222: "outer table has height:200px on <td>"
-      LayoutBlockFlow (anonymous) at (0,756) size 769x20
+      LayoutBlockFlow (anonymous) at (0,752) size 769x20
         LayoutBR {BR} at (0,0) size 0x19
-      LayoutTable {TABLE} at (0,776) size 595x60 [border: (1px outset #808080)]
+      LayoutTable {TABLE} at (0,772) size 595x60 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 593x58
           LayoutTableRow {TR} at (0,2) size 593x54
             LayoutTableCell {TD} at (2,2) size 589x54 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]

diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
index 93b8ad5..7f89f19 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
deleted file mode 100644
index 09d3c24..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
deleted file mode 100644
index 9ad3007..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
+++ /dev/null

@@ -1,43 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x240 [border: (2px solid #0000FF)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutText {#text} at (0,0) size 66x28
-            text run at (0,0) width 66: "Tests: "
-          LayoutBR {BR} at (0,0) size 0x0
-          LayoutText {#text} at (0,28) size 750x56
-            text run at (0,28) width 750: "Deleting when a selection starts at the beginning of a paragraph preceded by a"
-            text run at (0,56) width 640: "text element and extends into the middle of a following paragraph."
-        LayoutBlockFlow {DIV} at (14,114) size 756x112
-          LayoutText {#text} at (0,0) size 190x28
-            text run at (0,0) width 190: "Expected Results: "
-          LayoutBR {BR} at (189,22) size 1x0
-          LayoutText {#text} at (0,28) size 741x84
-            text run at (0,28) width 741: "Should see the three lines in the red box. First line should be \"one\". Next one"
-            text run at (0,56) width 152: "should be \"ee\". "
-            text run at (151,56) width 590: "Next one should be \"four\". Insertion point should be blinking"
-            text run at (0,84) width 282: "at the start of the second line."
-      LayoutBlockFlow {DIV} at (0,264) size 784x88
-        LayoutBlockFlow {DIV} at (0,0) size 784x88 [border: (2px solid #FF0000)]
-          LayoutBlockFlow (anonymous) at (2,2) size 780x28
-            LayoutText {#text} at (0,0) size 35x28
-              text run at (0,0) width 35: "one"
-          LayoutBlockFlow {P} at (2,30) size 780x28
-            LayoutText {#text} at (0,0) size 22x28
-              text run at (0,0) width 22: "ee"
-          LayoutBlockFlow {P} at (2,58) size 780x28
-            LayoutText {#text} at (0,0) size 40x28
-              text run at (0,0) width 40: "four"
-caret: position 0 of child 0 {#text} of child 1 {P} of child 1 {DIV} of child 3 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.png
deleted file mode 100644
index 3004fa45..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.txt
deleted file mode 100644
index 27eca14..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/execCommand/find-after-replace-expected.txt
+++ /dev/null

@@ -1,32 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x36
-        LayoutText {#text} at (0,0) size 770x36
-          text run at (0,0) width 337: "This tests find and replace inside an editable iframe. "
-          text run at (336,0) width 434: "You should see 'A B A B' below. With bug 4462420, you would see"
-          text run at (0,18) width 67: "'A B B A'."
-      LayoutBlockFlow (anonymous) at (0,52) size 784x154
-        LayoutText {#text} at (0,0) size 0x0
-        LayoutText {#text} at (0,0) size 0x0
-layer at (8,60) size 304x154
-  LayoutIFrame {IFRAME} at (0,0) size 304x154 [border: (2px inset #EEEEEE)]
-    layer at (0,0) size 300x150
-      LayoutView at (0,0) size 300x150
-    layer at (0,0) size 300x150
-      LayoutBlockFlow {HTML} at (0,0) size 300x150
-        LayoutBlockFlow {BODY} at (8,8) size 284x134 [bgcolor=#FFFFE0]
-          LayoutText {#text} at (0,0) size 57x18
-            text run at (0,0) width 57: "A B A B"

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.png
index 9993267d..d3e14130 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.txt
index 1e01614..d09565c0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/table/dynamic-descendant-percentage-height-expected.txt

@@ -6,17 +6,17 @@
       LayoutBlockFlow {P} at (0,0) size 784x18
         LayoutText {#text} at (0,0) size 357x18
           text run at (0,0) width 357: "The following two green rectangles should be identical:"
-      LayoutTable {TABLE} at (0,34) size 284x112
-        LayoutTableSection {TBODY} at (0,0) size 284x112
-          LayoutTableRow {TR} at (0,2) size 284x108
-            LayoutTableCell {TD} at (2,2) size 280x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 278x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,34) size 284x104
+        LayoutTableSection {TBODY} at (0,0) size 284x104
+          LayoutTableRow {TR} at (0,2) size 284x100
+            LayoutTableCell {TD} at (2,2) size 280x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 278x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 272x18
                   text run at (3,3) width 272: "This text should have a green background."
-      LayoutTable {TABLE} at (0,146) size 284x112
-        LayoutTableSection {TBODY} at (0,0) size 284x112
-          LayoutTableRow {TR} at (0,2) size 284x108
-            LayoutTableCell {TD} at (2,2) size 280x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 278x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,138) size 284x104
+        LayoutTableSection {TBODY} at (0,0) size 284x104
+          LayoutTableRow {TR} at (0,2) size 284x100
+            LayoutTableCell {TD} at (2,2) size 280x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 278x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 272x18
                   text run at (3,3) width 272: "This text should have a green background."

diff --git a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla/core/cell_heights-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla/core/cell_heights-expected.txt
index a0d0a65..5c68755 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla/core/cell_heights-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla/core/cell_heights-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4340
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4336
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x4340 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x4340
-    LayoutBlockFlow {BODY} at (8,8) size 769x4324
+layer at (0,0) size 785x4336 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x4336
+    LayoutBlockFlow {BODY} at (8,8) size 769x4320
       LayoutTable {TABLE} at (0,0) size 40x584 [bgcolor=#0000FF] [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 38x582
           LayoutTableRow {TR} at (0,2) size 38x114
@@ -159,13 +159,13 @@
                 text run at (2,2) width 28: "auto"
       LayoutBlockFlow (anonymous) at (0,3896) size 769x18
         LayoutBR {BR} at (0,0) size 0x18
-      LayoutTable {TABLE} at (0,3914) size 54x410 [bgcolor=#FFA500] [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 52x408
-          LayoutTableRow {TR} at (0,2) size 52x404
-            LayoutTableCell {TD} at (2,2) size 48x404 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 44x400 [bgcolor=#0000FF]
-                LayoutTableSection {TBODY} at (0,0) size 44x400
-                  LayoutTableRow {TR} at (0,2) size 44x396
-                    LayoutTableCell {TD} at (2,190) size 40x20 [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,3914) size 54x406 [bgcolor=#FFA500] [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 52x404
+          LayoutTableRow {TR} at (0,2) size 52x400
+            LayoutTableCell {TD} at (2,2) size 48x400 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 44x396 [bgcolor=#0000FF]
+                LayoutTableSection {TBODY} at (0,0) size 44x396
+                  LayoutTableRow {TR} at (0,2) size 44x392
+                    LayoutTableCell {TD} at (2,188) size 40x20 [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (1,1) size 38x18
                         text run at (1,1) width 38: "100%"

diff --git a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
index f9bf626..3c91c1f 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
index ee3ef21..ed71dd32 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 850
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 846
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x850 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x850
-    LayoutBlockFlow {BODY} at (8,8) size 769x834
+layer at (0,0) size 785x846 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x846
+    LayoutBlockFlow {BODY} at (8,8) size 769x830
       LayoutBlockFlow (anonymous) at (0,0) size 769x108
         LayoutText {#text} at (0,0) size 318x18
           text run at (0,0) width 318: "The following three examples are 2 nested tables."
@@ -40,19 +40,19 @@
                         text run at (2,2) width 234: "outer table has height:200px on <tr>"
       LayoutBlockFlow (anonymous) at (0,532) size 769x18
         LayoutBR {BR} at (0,0) size 0x18
-      LayoutTable {TABLE} at (0,550) size 257x210 [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 255x208
-          LayoutTableRow {TR} at (0,2) size 255x204
-            LayoutTableCell {TD} at (2,2) size 251x204 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 247x200 [border: (1px outset #808080)]
-                LayoutTableSection {TBODY} at (1,1) size 245x198
-                  LayoutTableRow {TR} at (0,2) size 245x194
-                    LayoutTableCell {TD} at (2,88) size 241x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,550) size 257x206 [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 255x204
+          LayoutTableRow {TR} at (0,2) size 255x200
+            LayoutTableCell {TD} at (2,2) size 251x200 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 247x196 [border: (1px outset #808080)]
+                LayoutTableSection {TBODY} at (1,1) size 245x194
+                  LayoutTableRow {TR} at (0,2) size 245x190
+                    LayoutTableCell {TD} at (2,86) size 241x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (2,2) size 237x18
                         text run at (2,2) width 237: "outer table has height:200px on <td>"
-      LayoutBlockFlow (anonymous) at (0,760) size 769x18
+      LayoutBlockFlow (anonymous) at (0,756) size 769x18
         LayoutBR {BR} at (0,0) size 0x18
-      LayoutTable {TABLE} at (0,778) size 630x56 [border: (1px outset #808080)]
+      LayoutTable {TABLE} at (0,774) size 630x56 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 628x54
           LayoutTableRow {TR} at (0,2) size 628x50
             LayoutTableCell {TD} at (2,2) size 624x50 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
deleted file mode 100644
index 423e06f1..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
deleted file mode 100644
index d6dc0a4c..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-at-paragraph-boundaries-009-expected.txt
+++ /dev/null

@@ -1,43 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x233 [border: (2px solid #0000FF)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x81
-          LayoutText {#text} at (0,0) size 66x26
-            text run at (0,0) width 66: "Tests: "
-          LayoutBR {BR} at (0,0) size 0x0
-          LayoutText {#text} at (0,27) size 750x53
-            text run at (0,27) width 750: "Deleting when a selection starts at the beginning of a paragraph preceded by a"
-            text run at (0,54) width 640: "text element and extends into the middle of a following paragraph."
-        LayoutBlockFlow {DIV} at (14,111) size 756x108
-          LayoutText {#text} at (0,0) size 190x26
-            text run at (0,0) width 190: "Expected Results: "
-          LayoutBR {BR} at (189,21) size 1x0
-          LayoutText {#text} at (0,27) size 741x80
-            text run at (0,27) width 741: "Should see the three lines in the red box. First line should be \"one\". Next one"
-            text run at (0,54) width 152: "should be \"ee\". "
-            text run at (151,54) width 590: "Next one should be \"four\". Insertion point should be blinking"
-            text run at (0,81) width 282: "at the start of the second line."
-      LayoutBlockFlow {DIV} at (0,257) size 784x85
-        LayoutBlockFlow {DIV} at (0,0) size 784x85 [border: (2px solid #FF0000)]
-          LayoutBlockFlow (anonymous) at (2,2) size 780x27
-            LayoutText {#text} at (0,0) size 35x26
-              text run at (0,0) width 35: "one"
-          LayoutBlockFlow {P} at (2,29) size 780x27
-            LayoutText {#text} at (0,0) size 22x26
-              text run at (0,0) width 22: "ee"
-          LayoutBlockFlow {P} at (2,56) size 780x27
-            LayoutText {#text} at (0,0) size 40x26
-              text run at (0,0) width 40: "four"
-caret: position 0 of child 0 {#text} of child 1 {P} of child 1 {DIV} of child 3 {DIV} of body

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.png
deleted file mode 100644
index f91e6d37a..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.txt
deleted file mode 100644
index 358af17f..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/execCommand/find-after-replace-expected.txt
+++ /dev/null

@@ -1,32 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x36
-        LayoutText {#text} at (0,0) size 771x35
-          text run at (0,0) width 338: "This tests find and replace inside an editable iframe. "
-          text run at (337,0) width 434: "You should see 'A B A B' below. With bug 4462420, you would see"
-          text run at (0,18) width 67: "'A B B A'."
-      LayoutBlockFlow (anonymous) at (0,52) size 784x154
-        LayoutText {#text} at (0,0) size 0x0
-        LayoutText {#text} at (0,0) size 0x0
-layer at (8,60) size 304x154
-  LayoutIFrame {IFRAME} at (0,0) size 304x154 [border: (2px inset #EEEEEE)]
-    layer at (0,0) size 300x150
-      LayoutView at (0,0) size 300x150
-    layer at (0,0) size 300x150
-      LayoutBlockFlow {HTML} at (0,0) size 300x150
-        LayoutBlockFlow {BODY} at (8,8) size 284x134 [bgcolor=#FFFFE0]
-          LayoutText {#text} at (0,0) size 57x17
-            text run at (0,0) width 57: "A B A B"

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.png
index 0bbc754..7da0775f 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.txt
index c07dded..8287aa6a 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/table/dynamic-descendant-percentage-height-expected.txt

@@ -6,17 +6,17 @@
       LayoutBlockFlow {P} at (0,0) size 784x18
         LayoutText {#text} at (0,0) size 357x17
           text run at (0,0) width 357: "The following two green rectangles should be identical:"
-      LayoutTable {TABLE} at (0,34) size 284x112
-        LayoutTableSection {TBODY} at (0,0) size 284x112
-          LayoutTableRow {TR} at (0,2) size 284x108
-            LayoutTableCell {TD} at (2,2) size 280x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 278x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,34) size 284x104
+        LayoutTableSection {TBODY} at (0,0) size 284x104
+          LayoutTableRow {TR} at (0,2) size 284x100
+            LayoutTableCell {TD} at (2,2) size 280x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 278x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 272x17
                   text run at (3,3) width 272: "This text should have a green background."
-      LayoutTable {TABLE} at (0,146) size 284x112
-        LayoutTableSection {TBODY} at (0,0) size 284x112
-          LayoutTableRow {TR} at (0,2) size 284x108
-            LayoutTableCell {TD} at (2,2) size 280x108 [r=0 c=0 rs=1 cs=1]
-              LayoutBlockFlow {DIV} at (1,1) size 278x106 [bgcolor=#008000] [border: (3px solid #000000)]
+      LayoutTable {TABLE} at (0,138) size 284x104
+        LayoutTableSection {TBODY} at (0,0) size 284x104
+          LayoutTableRow {TR} at (0,2) size 284x100
+            LayoutTableCell {TD} at (2,2) size 280x100 [r=0 c=0 rs=1 cs=1]
+              LayoutBlockFlow {DIV} at (1,1) size 278x98 [bgcolor=#008000] [border: (3px solid #000000)]
                 LayoutText {#text} at (3,3) size 272x17
                   text run at (3,3) width 272: "This text should have a green background."

diff --git a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla/core/cell_heights-expected.txt b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla/core/cell_heights-expected.txt
index 6d2016e..190228b 100644
--- a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla/core/cell_heights-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla/core/cell_heights-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4340
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 4336
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x4340 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x4340
-    LayoutBlockFlow {BODY} at (8,8) size 769x4324
+layer at (0,0) size 785x4336 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x4336
+    LayoutBlockFlow {BODY} at (8,8) size 769x4320
       LayoutTable {TABLE} at (0,0) size 40x584 [bgcolor=#0000FF] [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 38x582
           LayoutTableRow {TR} at (0,2) size 38x114
@@ -159,13 +159,13 @@
                 text run at (2,2) width 28: "auto"
       LayoutBlockFlow (anonymous) at (0,3896) size 769x18
         LayoutBR {BR} at (0,0) size 0x17
-      LayoutTable {TABLE} at (0,3914) size 54x410 [bgcolor=#FFA500] [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 52x408
-          LayoutTableRow {TR} at (0,2) size 52x404
-            LayoutTableCell {TD} at (2,2) size 48x404 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 44x400 [bgcolor=#0000FF]
-                LayoutTableSection {TBODY} at (0,0) size 44x400
-                  LayoutTableRow {TR} at (0,2) size 44x396
-                    LayoutTableCell {TD} at (2,190) size 40x20 [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,3914) size 54x406 [bgcolor=#FFA500] [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 52x404
+          LayoutTableRow {TR} at (0,2) size 52x400
+            LayoutTableCell {TD} at (2,2) size 48x400 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 44x396 [bgcolor=#0000FF]
+                LayoutTableSection {TBODY} at (0,0) size 44x396
+                  LayoutTableRow {TR} at (0,2) size 44x392
+                    LayoutTableCell {TD} at (2,188) size 40x20 [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (1,1) size 38x17
                         text run at (1,1) width 38: "100%"

diff --git a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
index b9fafb7..1418ebbd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
index cbec6e7..116efe49 100644
--- a/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/tables/mozilla_expected_failures/bugs/bug32205-1-expected.txt

@@ -1,8 +1,8 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 850
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 846
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x850 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutBlockFlow {HTML} at (0,0) size 785x850
-    LayoutBlockFlow {BODY} at (8,8) size 769x834
+layer at (0,0) size 785x846 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x846
+    LayoutBlockFlow {BODY} at (8,8) size 769x830
       LayoutBlockFlow (anonymous) at (0,0) size 769x108
         LayoutText {#text} at (0,0) size 318x17
           text run at (0,0) width 318: "The following three examples are 2 nested tables."
@@ -40,19 +40,19 @@
                         text run at (2,2) width 234: "outer table has height:200px on <tr>"
       LayoutBlockFlow (anonymous) at (0,532) size 769x18
         LayoutBR {BR} at (0,0) size 0x17
-      LayoutTable {TABLE} at (0,550) size 257x210 [border: (1px outset #808080)]
-        LayoutTableSection {TBODY} at (1,1) size 255x208
-          LayoutTableRow {TR} at (0,2) size 255x204
-            LayoutTableCell {TD} at (2,2) size 251x204 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
-              LayoutTable {TABLE} at (2,2) size 247x200 [border: (1px outset #808080)]
-                LayoutTableSection {TBODY} at (1,1) size 245x198
-                  LayoutTableRow {TR} at (0,2) size 245x194
-                    LayoutTableCell {TD} at (2,88) size 241x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+      LayoutTable {TABLE} at (0,550) size 257x206 [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 255x204
+          LayoutTableRow {TR} at (0,2) size 255x200
+            LayoutTableCell {TD} at (2,2) size 251x200 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
+              LayoutTable {TABLE} at (2,2) size 247x196 [border: (1px outset #808080)]
+                LayoutTableSection {TBODY} at (1,1) size 245x194
+                  LayoutTableRow {TR} at (0,2) size 245x190
+                    LayoutTableCell {TD} at (2,86) size 241x22 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]
                       LayoutText {#text} at (2,2) size 237x17
                         text run at (2,2) width 237: "outer table has height:200px on <td>"
-      LayoutBlockFlow (anonymous) at (0,760) size 769x18
+      LayoutBlockFlow (anonymous) at (0,756) size 769x18
         LayoutBR {BR} at (0,0) size 0x17
-      LayoutTable {TABLE} at (0,778) size 630x56 [border: (1px outset #808080)]
+      LayoutTable {TABLE} at (0,774) size 630x56 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 628x54
           LayoutTableRow {TR} at (0,2) size 628x50
             LayoutTableCell {TD} at (2,2) size 624x50 [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=1]

diff --git a/third_party/WebKit/LayoutTests/printing/overflow-auto-expected.html b/third_party/WebKit/LayoutTests/printing/overflow-auto-expected.html
new file mode 100644
index 0000000..71d8d53
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/printing/overflow-auto-expected.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+    testRunner.setPrinting();
+</script>
+<p>There should be some text below this paragraph, on this page. The text should flow nicely into
+    the next page. The number of pages should be 6.</p>
+<div style="font-size:4em; height:510vh; orphans:1; widows:1;">
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+</div>

diff --git a/third_party/WebKit/LayoutTests/printing/overflow-auto.html b/third_party/WebKit/LayoutTests/printing/overflow-auto.html
new file mode 100644
index 0000000..a7d1680
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/printing/overflow-auto.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+    testRunner.setPrinting();
+</script>
+<p>There should be some text below this paragraph, on this page. The text should flow nicely into
+    the next page. The number of pages should be 6.</p>
+<div style="overflow:auto; font-size:4em; height:510vh; orphans:1; widows:1;">
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+    Line of text.<br>
+</div>

diff --git a/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-collapse.html b/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-collapse.html
index f53b3f8b..a6034c51 100644
--- a/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-collapse.html
+++ b/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-collapse.html

@@ -15,7 +15,7 @@
 function run() {
   var test = new LineLayoutPerfTest(container);
   test.spanCount = 0;
-  test.lineCount = 800;
+  test.lineCount = 10000;
   test.wordSeparator = '  '; // Make all word separators collapsible.
   test.run('Measures performance of "white-space: nowrap" with collapsible spaces.');
 }

diff --git a/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-spans-collapse.html b/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-spans-collapse.html
index a7cbe69..6178ab2 100644
--- a/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-spans-collapse.html
+++ b/third_party/WebKit/PerformanceTests/Layout/long-line-nowrap-spans-collapse.html

@@ -15,7 +15,7 @@
 function run() {
   var test = new LineLayoutPerfTest(container);
   test.spanCount = 10;
-  test.lineCount = 80;
+  test.lineCount = 1000;
   test.wordSeparator = '  '; // Make all word separators collapsible.
   test.run('Measures performance of "white-space: nowrap" with multiple spans and collapsible spaces.');
 }

diff --git a/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h b/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h
index af758ce3..98153cfe 100644
--- a/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h
+++ b/third_party/WebKit/Source/bindings/core/v8/CallbackPromiseAdapter.h

@@ -36,6 +36,7 @@
 #include "wtf/PtrUtil.h"
 #include "wtf/TypeTraits.h"
 #include <memory>
+#include <utility>
 
 namespace blink {
 
@@ -92,9 +93,7 @@
 //
 // In order to implement the above exceptions, we have template classes below.
 // OnSuccess and OnError provide onSuccess and onError implementation, and there
-// are utility templates that provide
-//  - std::unique_ptr - WebPassOwnPtr translation ([Web]PassType[Impl], adopt, pass),
-//  - trivial WebType holder (TrivialWebTypeHolder).
+// are utility templates that provide the trivial WebType holder.
 
 namespace internal {
 
@@ -116,11 +115,6 @@
     template <typename T> static CallbackPromiseAdapterTrivialWebTypeHolder<T> webTypeHolderMatcher(...);
     template <typename T> using WebTypeHolder = decltype(webTypeHolderMatcher<T>(nullptr));
 
-    template <typename T> static T& adopt(T& x) { return x; }
-    template <typename T> static std::unique_ptr<T> adopt(std::unique_ptr<T>& x) { return std::move(x); }
-    template <typename T> static T pass(T& x) { return x; }
-    template <typename T> static std::unique_ptr<T> pass(std::unique_ptr<T>& x) { return std::move(x); }
-
     template <typename S, typename T>
     class Base : public WebCallbacks<typename S::WebType, typename T::WebType> {
     public:
@@ -135,13 +129,12 @@
     class OnSuccess : public Base<S, T> {
     public:
         explicit OnSuccess(ScriptPromiseResolver* resolver) : Base<S, T>(resolver) {}
-        void onSuccess(typename S::WebType r) override
+        void onSuccess(typename S::WebType result) override
         {
-            typename S::WebType result(adopt(r));
             ScriptPromiseResolver* resolver = this->resolver();
             if (!resolver->getExecutionContext() || resolver->getExecutionContext()->activeDOMObjectsAreStopped())
                 return;
-            resolver->resolve(S::take(resolver, pass(result)));
+            resolver->resolve(S::take(resolver, std::move(result)));
         }
     };
     template <typename T>
@@ -162,12 +155,11 @@
         explicit OnError(ScriptPromiseResolver* resolver) : OnSuccess<S, T>(resolver) {}
         void onError(typename T::WebType e) override
         {
-            typename T::WebType result(adopt(e));
             ScriptPromiseResolver* resolver = this->resolver();
             if (!resolver->getExecutionContext() || resolver->getExecutionContext()->activeDOMObjectsAreStopped())
                 return;
             ScriptState::Scope scope(resolver->getScriptState());
-            resolver->reject(T::take(resolver, pass(result)));
+            resolver->reject(T::take(resolver, std::move(e)));
         }
     };
     template <typename S>

diff --git a/third_party/WebKit/Source/bindings/core/v8/ExceptionState.h b/third_party/WebKit/Source/bindings/core/v8/ExceptionState.h
index e7858a49d..c28703fe 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ExceptionState.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ExceptionState.h

@@ -158,8 +158,8 @@
         : ExceptionState(nullptr, ExceptionState::UnknownContext, nullptr, nullptr) { }
 
     void throwDOMException(const ExceptionCode&, const String& message) override;
-    void throwTypeError(const String& message = String()) override;
-    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String()) override;
+    void throwTypeError(const String& message) override;
+    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage) override;
     void throwRangeError(const String& message) override;
     void rethrowV8Exception(v8::Local<v8::Value>) override;
 };
@@ -180,8 +180,8 @@
     }
 
     void throwDOMException(const ExceptionCode&, const String& message) override;
-    void throwTypeError(const String& message = String()) override;
-    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String()) override;
+    void throwTypeError(const String& message) override;
+    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage) override;
     void throwRangeError(const String& message) override;
     void rethrowV8Exception(v8::Local<v8::Value>) override;
 };

diff --git a/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.cpp b/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.cpp
index c510a128..8b20f57 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.cpp

@@ -35,7 +35,7 @@
 #if ENABLE(ASSERT)
 
 NoExceptionStateAssertionChecker::NoExceptionStateAssertionChecker(const char* file, int line)
-    : ExceptionState(ExceptionState::UnknownContext, 0, 0, v8::Local<v8::Object>(), 0)
+    : ExceptionState(nullptr, ExceptionState::UnknownContext, nullptr, nullptr)
     , m_file(file)
     , m_line(line) { }
 
@@ -44,9 +44,9 @@
     DCHECK_AT(false, m_file, m_line) << "DOMExeption should not be thrown.";
 }
 
-void NoExceptionStateAssertionChecker::throwTypeError(const String&)
+void NoExceptionStateAssertionChecker::throwRangeError(const String& message)
 {
-    DCHECK_AT(false, m_file, m_line) << "TypeError should not be thrown.";
+    DCHECK_AT(false, m_file, m_line) << "RangeError should not be thrown.";
 }
 
 void NoExceptionStateAssertionChecker::throwSecurityError(const String&, const String&)
@@ -54,6 +54,16 @@
     DCHECK_AT(false, m_file, m_line) << "SecurityError should not be thrown.";
 }
 
+void NoExceptionStateAssertionChecker::throwTypeError(const String&)
+{
+    DCHECK_AT(false, m_file, m_line) << "TypeError should not be thrown.";
+}
+
+void NoExceptionStateAssertionChecker::rethrowV8Exception(v8::Local<v8::Value>)
+{
+    DCHECK_AT(false, m_file, m_line) << "An exception should not be rethrown.";
+}
+
 #endif
 
 } // namespace blink

diff --git a/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.h b/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.h
index db0be64..413b0a87 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ExceptionStatePlaceholder.h

@@ -35,22 +35,22 @@
 #include "core/CoreExport.h"
 #include "wtf/Assertions.h"
 #include "wtf/text/WTFString.h"
-#include <v8.h>
 
 namespace blink {
 
-class ExceptionState;
-
-typedef int ExceptionCode;
-
 class IgnorableExceptionState final : public ExceptionState {
     WTF_MAKE_NONCOPYABLE(IgnorableExceptionState);
 public:
-    IgnorableExceptionState(): ExceptionState(ExceptionState::UnknownContext, 0, 0, v8::Local<v8::Object>(), 0) { }
+    IgnorableExceptionState()
+        : ExceptionState(nullptr, ExceptionState::UnknownContext, nullptr, nullptr) { }
+
     ExceptionState& returnThis() { return *this; }
-    void throwDOMException(const ExceptionCode&, const String& message = String()) override { }
-    void throwTypeError(const String& message = String()) override { }
-    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String()) override { }
+
+    void throwDOMException(const ExceptionCode&, const String& message) override { }
+    void throwRangeError(const String& message) override { };
+    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage) override { }
+    void throwTypeError(const String& message) override { }
+    void rethrowV8Exception(v8::Local<v8::Value>) override { };
 };
 
 #define IGNORE_EXCEPTION (::blink::IgnorableExceptionState().returnThis())
@@ -61,14 +61,18 @@
     WTF_MAKE_NONCOPYABLE(NoExceptionStateAssertionChecker);
 public:
     NoExceptionStateAssertionChecker(const char* file, int line);
+
     ExceptionState& returnThis() { return *this; }
-    void throwDOMException(const ExceptionCode&, const String& message = String()) override;
-    void throwTypeError(const String& message = String()) override;
-    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage = String()) override;
+
+    void throwDOMException(const ExceptionCode&, const String& message) override;
+    void throwRangeError(const String& message) override;
+    void throwSecurityError(const String& sanitizedMessage, const String& unsanitizedMessage) override;
+    void throwTypeError(const String& message) override;
+    void rethrowV8Exception(v8::Local<v8::Value>) override;
 
 private:
     const char* m_file;
-    int m_line;
+    const int m_line;
 };
 
 #define ASSERT_NO_EXCEPTION (::blink::NoExceptionStateAssertionChecker(__FILE__, __LINE__).returnThis())

diff --git a/third_party/WebKit/Source/build/scripts/make_event_factory.py b/third_party/WebKit/Source/build/scripts/make_event_factory.py
index a6ae1858..370452a 100755
--- a/third_party/WebKit/Source/build/scripts/make_event_factory.py
+++ b/third_party/WebKit/Source/build/scripts/make_event_factory.py

@@ -71,58 +71,24 @@
 # or be deprecated/removed. https://crbug.com/569690
 def create_event_legacy_whitelist(name):
     return (name == 'AnimationEvent'
-            or name == 'ApplicationCacheErrorEvent'
-            or name == 'AudioProcessingEvent'
-            or name == 'BeforeInstallPromptEvent'
             or name == 'BeforeUnloadEvent'
-            or name == 'BlobEvent'
-            or name == 'ClipboardEvent'
             or name == 'CloseEvent'
             or name == 'CompositionEvent'
             or name == 'DeviceMotionEvent'
             or name == 'DeviceOrientationEvent'
             or name == 'DragEvent'
             or name == 'ErrorEvent'
-            or name == 'ExtendableEvent'
-            or name == 'ExtendableMessageEvent'
-            or name == 'FetchEvent'
             or name == 'FocusEvent'
-            or name == 'FontFaceSetLoadEvent'
-            or name == 'GamepadEvent'
             or name == 'HashChangeEvent'
             or name == 'IDBVersionChangeEvent'
             or name == 'KeyboardEvents'
-            or name == 'MediaEncryptedEvent'
-            or name == 'MediaKeyMessageEvent'
-            or name == 'MediaQueryListEvent'
-            or name == 'MediaStreamEvent'
-            or name == 'MediaStreamTrackEvent'
-            or name == 'MIDIConnectionEvent'
-            or name == 'MIDIMessageEvent'
             or name == 'MutationEvent'
             or name == 'MutationEvents'
-            or name == 'NotificationEvent'
-            or name == 'OfflineAudioCompletionEvent'
-            or name == 'OrientationEvent'
             or name == 'PageTransitionEvent'
             or name == 'PopStateEvent'
-            or name == 'PresentationConnectionAvailableEvent'
-            or name == 'PresentationConnectionCloseEvent'
             or name == 'ProgressEvent'
-            or name == 'PromiseRejectionEvent'
-            or name == 'PushEvent'
-            or name == 'ResourceProgressEvent'
-            or name == 'RTCDataChannelEvent'
-            or name == 'RTCDTMFToneChangeEvent'
-            or name == 'RTCIceCandidateEvent'
-            or name == 'SecurityPolicyViolationEvent'
-            or name == 'ServiceWorkerMessageEvent'
-            or name == 'SpeechRecognitionError'
-            or name == 'SpeechRecognitionEvent'
-            or name == 'SpeechSynthesisEvent'
             or name == 'StorageEvent'
             or name == 'SVGEvents'
-            or name == 'SyncEvent'
             or name == 'TextEvent'
             or name == 'TrackEvent'
             or name == 'TransitionEvent'

diff --git a/third_party/WebKit/Source/core/BUILD.gn b/third_party/WebKit/Source/core/BUILD.gn
index 8462827..b5e5d5e7 100644
--- a/third_party/WebKit/Source/core/BUILD.gn
+++ b/third_party/WebKit/Source/core/BUILD.gn

@@ -1425,3 +1425,16 @@
     "//testing/gtest",
   ]
 }
+
+# Fuzzer for blink::StyleSheetContents
+fuzzer_test("stylesheet_contents_fuzzer") {
+  sources = [
+    "css/StyleSheetContentsFuzzer.cpp",
+  ]
+  deps = [
+    ":core",
+    "../platform:blink_fuzzer_test_support",
+  ]
+  seed_corpus = "//third_party/WebKit/LayoutTests/fast/css/resources"
+  libfuzzer_options = [ "max_len=2048" ]
+}

diff --git a/third_party/WebKit/Source/core/OWNERS b/third_party/WebKit/Source/core/OWNERS
index 5038ea8..5774dc0 100644
--- a/third_party/WebKit/Source/core/OWNERS
+++ b/third_party/WebKit/Source/core/OWNERS

@@ -38,7 +38,6 @@
 kinuko@chromium.org
 kouhei@chromium.org
 mkwst@chromium.org
-morrita@chromium.org
 mstensho@opera.com
 ojan@chromium.org
 # pdr reviews many svg and text autosizing patches.

diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index 25e1bc4..6f4d7cd 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi

@@ -1733,8 +1733,6 @@
             'fetch/ResourceLoader.cpp',
             'fetch/ResourceLoader.h',
             'fetch/ResourceLoaderOptions.h',
-            'fetch/ResourceLoaderSet.cpp',
-            'fetch/ResourceLoaderSet.h',
             'fetch/ResourceLoadingLog.h',
             'fetch/ScriptResource.cpp',
             'fetch/ScriptResource.h',

diff --git a/third_party/WebKit/Source/core/css/CSSImageValue.cpp b/third_party/WebKit/Source/core/css/CSSImageValue.cpp
index 059d746..1fcf9aa 100644
--- a/third_party/WebKit/Source/core/css/CSSImageValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSImageValue.cpp

@@ -39,7 +39,6 @@
     : CSSValue(ImageClass)
     , m_relativeURL(rawValue)
     , m_absoluteURL(url.getString())
-    , m_isCachePending(!image)
     , m_cachedImage(image)
 {
 }
@@ -48,7 +47,6 @@
     : CSSValue(ImageClass)
     , m_relativeURL(absoluteURL)
     , m_absoluteURL(absoluteURL)
-    , m_isCachePending(true)
 {
 }
 
@@ -60,9 +58,7 @@
 {
     ASSERT(document);
 
-    if (m_isCachePending) {
-        m_isCachePending = false;
-
+    if (!m_cachedImage) {
         FetchRequest request(ResourceRequest(m_absoluteURL), m_initiatorName.isEmpty() ? FetchInitiatorTypeNames::css : m_initiatorName);
         request.mutableResourceRequest().setHTTPReferrer(SecurityPolicy::generateReferrer(m_referrer.referrerPolicy, request.url(), m_referrer.referrer));
 
@@ -80,7 +76,7 @@
 
 void CSSImageValue::restoreCachedResourceIfNeeded(Document& document) const
 {
-    if (m_isCachePending || !m_cachedImage || !document.fetcher() || m_absoluteURL.isNull())
+    if (!m_cachedImage || !document.fetcher() || m_absoluteURL.isNull())
         return;
     if (document.fetcher()->cachedResource(KURL(ParsedURLString, m_absoluteURL)))
         return;
@@ -133,7 +129,6 @@
     if (urlString == m_absoluteURL)
         return;
     m_absoluteURL = urlString;
-    m_isCachePending = true;
     m_cachedImage.clear();
 }
 

diff --git a/third_party/WebKit/Source/core/css/CSSImageValue.h b/third_party/WebKit/Source/core/css/CSSImageValue.h
index 1d3deb8..6c6e404 100644
--- a/third_party/WebKit/Source/core/css/CSSImageValue.h
+++ b/third_party/WebKit/Source/core/css/CSSImageValue.h

@@ -54,7 +54,7 @@
     }
     ~CSSImageValue();
 
-    bool isCachePending() const { return m_isCachePending; }
+    bool isCachePending() const { return !m_cachedImage; }
     StyleImage* cachedImage() const { ASSERT(!isCachePending()); return m_cachedImage.get(); }
     StyleImage* cacheImage(Document*, CrossOriginAttributeValue = CrossOriginAttributeNotSet);
 
@@ -93,7 +93,6 @@
 
     // Cached image data.
     mutable AtomicString m_absoluteURL;
-    mutable bool m_isCachePending;
     mutable Member<StyleImage> m_cachedImage;
 };
 

diff --git a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
index ef1ab3cf..bb03aff 100644
--- a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
+++ b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp

@@ -720,11 +720,16 @@
     switch (trackSize.type()) {
     case LengthTrackSizing:
         return specifiedValueForGridTrackBreadth(trackSize.length(), style);
-    case MinMaxTrackSizing:
-        CSSFunctionValue* minMaxTrackBreadths = CSSFunctionValue::create(CSSValueMinmax);
+    case MinMaxTrackSizing: {
+        auto* minMaxTrackBreadths = CSSFunctionValue::create(CSSValueMinmax);
         minMaxTrackBreadths->append(*specifiedValueForGridTrackBreadth(trackSize.minTrackBreadth(), style));
         minMaxTrackBreadths->append(*specifiedValueForGridTrackBreadth(trackSize.maxTrackBreadth(), style));
         return minMaxTrackBreadths;
+    } case FitContentTrackSizing: {
+        auto* fitContentTrackBreadth = CSSFunctionValue::create(CSSValueFitContent);
+        fitContentTrackBreadth->append(*specifiedValueForGridTrackBreadth(trackSize.length(), style));
+        return fitContentTrackBreadth;
+    }
     }
     ASSERT_NOT_REACHED();
     return nullptr;

diff --git a/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.cpp b/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.cpp
index 16d087c5..91f7e123 100644
--- a/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.cpp
+++ b/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.cpp

@@ -32,10 +32,6 @@
 
 namespace blink {
 
-FontFaceSetLoadEvent::FontFaceSetLoadEvent()
-{
-}
-
 FontFaceSetLoadEvent::FontFaceSetLoadEvent(const AtomicString& type, const FontFaceArray& fontfaces)
     : Event(type, false, false)
     , m_fontfaces(fontfaces)

diff --git a/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.h b/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.h
index da74072..0f8b94e1 100644
--- a/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.h
+++ b/third_party/WebKit/Source/core/css/FontFaceSetLoadEvent.h

@@ -43,11 +43,6 @@
 class FontFaceSetLoadEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static FontFaceSetLoadEvent* create()
-    {
-        return new FontFaceSetLoadEvent();
-    }
-
     static FontFaceSetLoadEvent* create(const AtomicString& type, const FontFaceSetLoadEventInit& initializer)
     {
         return new FontFaceSetLoadEvent(type, initializer);
@@ -67,7 +62,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    FontFaceSetLoadEvent();
     FontFaceSetLoadEvent(const AtomicString&, const FontFaceArray&);
     FontFaceSetLoadEvent(const AtomicString&, const FontFaceSetLoadEventInit&);
 

diff --git a/third_party/WebKit/Source/core/css/MediaQueryListEvent.h b/third_party/WebKit/Source/core/css/MediaQueryListEvent.h
index 6924bbff..c5cb8b5 100644
--- a/third_party/WebKit/Source/core/css/MediaQueryListEvent.h
+++ b/third_party/WebKit/Source/core/css/MediaQueryListEvent.h

@@ -14,11 +14,6 @@
 class MediaQueryListEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static MediaQueryListEvent* create()
-    {
-        return new MediaQueryListEvent;
-    }
-
     static MediaQueryListEvent* create(MediaQueryList* list)
     {
         return new MediaQueryListEvent(list);
@@ -46,9 +41,6 @@
     }
 
 private:
-    MediaQueryListEvent()
-        : m_matches(false) { }
-
     MediaQueryListEvent(const String& media, bool matches)
         : Event(EventTypeNames::change, false, false)
         , m_media(media)

diff --git a/third_party/WebKit/Source/core/css/StyleSheetContentsFuzzer.cpp b/third_party/WebKit/Source/core/css/StyleSheetContentsFuzzer.cpp
new file mode 100644
index 0000000..df91a60d5
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/StyleSheetContentsFuzzer.cpp

@@ -0,0 +1,22 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/css/StyleSheetContents.h"
+
+#include "platform/testing/BlinkFuzzerTestSupport.h"
+#include "wtf/text/WTFString.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    blink::CSSParserContext context(blink::HTMLStandardMode, nullptr);
+    blink::StyleSheetContents* styleSheet = blink::StyleSheetContents::create(context);
+    styleSheet->parseString(String::fromUTF8WithLatin1Fallback(reinterpret_cast<const char*>(data), size));
+    return 0;
+}
+
+extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
+{
+    blink::InitializeBlinkFuzzTest(argc, argv);
+    return 0;
+}

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 7f1007f0..f6dd6e04f 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

@@ -2710,6 +2710,19 @@
     return consumeSelfPositionOverflowPosition(range);
 }
 
+static CSSValue* consumeFitContent(CSSParserTokenRange& range, CSSParserMode cssParserMode)
+{
+    CSSParserTokenRange rangeCopy = range;
+    CSSParserTokenRange args = consumeFunction(rangeCopy);
+    CSSPrimitiveValue* length = consumeLengthOrPercent(args, cssParserMode, ValueRangeNonNegative, UnitlessQuirk::Allow);
+    if (!length || !args.atEnd())
+        return nullptr;
+    range = rangeCopy;
+    CSSFunctionValue* result = CSSFunctionValue::create(CSSValueFitContent);
+    result->append(*length);
+    return result;
+}
+
 static CSSCustomIdentValue* consumeCustomIdentForGridLine(CSSParserTokenRange& range)
 {
     if (range.peek().id() == CSSValueAuto || range.peek().id() == CSSValueSpan)
@@ -2780,8 +2793,13 @@
     if (value.isPrimitiveValue())
         return isGridTrackFixedSized(toCSSPrimitiveValue(value));
 
-    const CSSPrimitiveValue& minPrimitiveValue = toCSSPrimitiveValue(toCSSFunctionValue(value).item(0));
-    const CSSPrimitiveValue& maxPrimitiveValue = toCSSPrimitiveValue(toCSSFunctionValue(value).item(1));
+    DCHECK(value.isFunctionValue());
+    auto& function = toCSSFunctionValue(value);
+    if (function.functionType() == CSSValueFitContent)
+        return false;
+
+    const CSSPrimitiveValue& minPrimitiveValue = toCSSPrimitiveValue(function.item(0));
+    const CSSPrimitiveValue& maxPrimitiveValue = toCSSPrimitiveValue(function.item(1));
     return isGridTrackFixedSized(minPrimitiveValue) || isGridTrackFixedSized(maxPrimitiveValue);
 }
 
@@ -2913,6 +2931,10 @@
         result->append(*maxTrackBreadth);
         return result;
     }
+
+    if (token.functionId() == CSSValueFitContent)
+        return consumeFitContent(range, cssParserMode);
+
     return consumeGridBreadth(range, cssParserMode);
 }
 

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
index f5fd517e..9b7ad5e89 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp

@@ -539,10 +539,15 @@
     if (value.isPrimitiveValue())
         return GridTrackSize(convertGridTrackBreadth(state, toCSSPrimitiveValue(value)));
 
-    const CSSFunctionValue& minmaxFunction = toCSSFunctionValue(value);
-    ASSERT_WITH_SECURITY_IMPLICATION(minmaxFunction.length() == 2);
-    GridLength minTrackBreadth(convertGridTrackBreadth(state, toCSSPrimitiveValue(minmaxFunction.item(0))));
-    GridLength maxTrackBreadth(convertGridTrackBreadth(state, toCSSPrimitiveValue(minmaxFunction.item(1))));
+    auto& function = toCSSFunctionValue(value);
+    if (function.functionType() == CSSValueFitContent) {
+        SECURITY_DCHECK(function.length() == 1);
+        return GridTrackSize(convertGridTrackBreadth(state, toCSSPrimitiveValue(function.item(0))), FitContentTrackSizing);
+    }
+
+    SECURITY_DCHECK(function.length() == 2);
+    GridLength minTrackBreadth(convertGridTrackBreadth(state, toCSSPrimitiveValue(function.item(0))));
+    GridLength maxTrackBreadth(convertGridTrackBreadth(state, toCSSPrimitiveValue(function.item(1))));
     return GridTrackSize(minTrackBreadth, maxTrackBreadth);
 }
 

diff --git a/third_party/WebKit/Source/core/dom/SandboxFlags.cpp b/third_party/WebKit/Source/core/dom/SandboxFlags.cpp
index af4191a..717345d 100644
--- a/third_party/WebKit/Source/core/dom/SandboxFlags.cpp
+++ b/third_party/WebKit/Source/core/dom/SandboxFlags.cpp

@@ -61,7 +61,7 @@
             flags &= ~SandboxOrientationLock;
         } else if (equalIgnoringCase(sandboxToken, "allow-popups-to-escape-sandbox") && RuntimeEnabledFeatures::unsandboxedAuxiliaryEnabled()) {
             flags &= ~SandboxPropagatesToAuxiliaryBrowsingContexts;
-        } else if (equalIgnoringCase(sandboxToken, "allow-modals") && RuntimeEnabledFeatures::sandboxBlocksModalsEnabled()) {
+        } else if (equalIgnoringCase(sandboxToken, "allow-modals")) {
             flags &= ~SandboxModals;
         } else if (equalIgnoringCase(sandboxToken, "allow-presentation")) {
             flags &= ~SandboxPresentation;

diff --git a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
index 471a724..ed5c0f3 100644
--- a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp

@@ -302,7 +302,8 @@
         // Skip fetch-related CSP checks if dynamically injected script is whitelisted and this script is not parser-inserted.
         bool scriptPassesCSPDynamic = (!isParserInserted() && elementDocument->contentSecurityPolicy()->allowDynamic());
 
-        request.setContentSecurityPolicyNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));
+        if (ContentSecurityPolicy::isNonceableElement(m_element.get()))
+            request.setContentSecurityPolicyNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));
 
         if (scriptPassesCSPDynamic) {
             UseCounter::count(elementDocument->frame(), UseCounter::ScriptPassesCSPDynamic);
@@ -373,7 +374,8 @@
         || csp->allowScriptWithHash(sourceCode.source(), ContentSecurityPolicy::InlineType::Block)
         || (!isParserInserted() && csp->allowDynamic());
 
-    if (!m_isExternalScript && (!shouldBypassMainWorldCSP && !csp->allowInlineScript(elementDocument->url(), m_element->fastGetAttribute(HTMLNames::nonceAttr), m_startLineNumber, sourceCode.source()))) {
+    AtomicString nonce = ContentSecurityPolicy::isNonceableElement(m_element.get()) ? m_element->fastGetAttribute(HTMLNames::nonceAttr) : AtomicString();
+    if (!m_isExternalScript && (!shouldBypassMainWorldCSP && !csp->allowInlineScript(elementDocument->url(), nonce, m_startLineNumber, sourceCode.source()))) {
         return false;
     }
 

diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index 308f084b..74496ba 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp

@@ -1375,7 +1375,7 @@
     if (sel)
         sel->showTreeForThis();
     else
-        fprintf(stderr, "Cannot showTree for (nil) FrameSelection.\n");
+        LOG(INFO) << "Cannot showTree for <null> FrameSelection.";
 }
 
 #endif

diff --git a/third_party/WebKit/Source/core/editing/Position.cpp b/third_party/WebKit/Source/core/editing/Position.cpp
index c7c0a81a..706160bd 100644
--- a/third_party/WebKit/Source/core/editing/Position.cpp
+++ b/third_party/WebKit/Source/core/editing/Position.cpp

@@ -574,34 +574,32 @@
     }
 }
 
-#ifndef NDEBUG
-
 template <typename Strategy>
 String PositionTemplate<Strategy>::toAnchorTypeAndOffsetString() const
 {
-    StringBuilder builder;
     switch (anchorType()) {
-    case PositionAnchorType::OffsetInAnchor:
-        builder.append("offset");
-        break;
-    case PositionAnchorType::BeforeChildren:
-        builder.append("beforeChildren");
-        break;
-    case PositionAnchorType::AfterChildren:
-        builder.append("afterChildren");
-        break;
-    case PositionAnchorType::BeforeAnchor:
-        builder.append("before");
-        break;
-    case PositionAnchorType::AfterAnchor:
-        builder.append("after");
-        break;
+    case PositionAnchorType::OffsetInAnchor: {
+        StringBuilder builder;
+        builder.append("offsetInAnchor[");
+        builder.append(m_offset);
+        builder.append("]");
+        return builder.toString();
     }
-    builder.append(", offset:");
-    builder.append(m_offset);
-    return builder.toString();
+    case PositionAnchorType::BeforeChildren:
+        return "beforeChildren";
+    case PositionAnchorType::AfterChildren:
+        return "afterChildren";
+    case PositionAnchorType::BeforeAnchor:
+        return "beforeAnchor";
+    case PositionAnchorType::AfterAnchor:
+        return "afterAnchor";
+    }
+    NOTREACHED();
+    return emptyString();
 }
 
+#ifndef NDEBUG
+
 template <typename Strategy>
 void PositionTemplate<Strategy>::showTreeForThis() const
 {
@@ -629,10 +627,7 @@
 {
     if (position.isNull())
         return ostream << "null";
-    ostream << position.anchorNode() << "@";
-    if (position.isOffsetInAnchor())
-        return ostream << position.offsetInContainerNode();
-    return ostream << position.anchorType();
+    return ostream << position.anchorNode() << "@" << position.toAnchorTypeAndOffsetString().utf8().data();
 }
 
 std::ostream& operator<<(std::ostream& ostream, PositionAnchorType anchorType)
@@ -680,7 +675,7 @@
     if (pos)
         pos->showTreeForThis();
     else
-        fprintf(stderr, "Cannot showTree for (nil)\n");
+        LOG(INFO) << "Cannot showTree for <null>";
 }
 
 #endif

diff --git a/third_party/WebKit/Source/core/editing/Position.h b/third_party/WebKit/Source/core/editing/Position.h
index c64206d..6690063 100644
--- a/third_party/WebKit/Source/core/editing/Position.h
+++ b/third_party/WebKit/Source/core/editing/Position.h

@@ -173,8 +173,8 @@
     static PositionTemplate<Strategy> firstPositionInOrBeforeNode(Node* anchorNode);
     static PositionTemplate<Strategy> lastPositionInOrAfterNode(Node* anchorNode);
 
-#ifndef NDEBUG
     String toAnchorTypeAndOffsetString() const;
+#ifndef NDEBUG
     void showTreeForThis() const;
     void showTreeForThisInFlatTree() const;
 #endif

diff --git a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
index 5d6cc728..b4bb237 100644
--- a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
+++ b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp

@@ -746,22 +746,30 @@
 #ifndef NDEBUG
 void DocumentMarkerController::showMarkers() const
 {
-    fprintf(stderr, "%d nodes have markers:\n", m_markers.size());
+    StringBuilder builder;
     MarkerMap::const_iterator end = m_markers.end();
     for (MarkerMap::const_iterator nodeIterator = m_markers.begin(); nodeIterator != end; ++nodeIterator) {
         const Node* node = nodeIterator->key;
-        fprintf(stderr, "%p", node);
+        builder.append(String::format("%p", node));
         MarkerLists* markers = m_markers.get(node);
         for (size_t markerListIndex = 0; markerListIndex < DocumentMarker::MarkerTypeIndexesCount; ++markerListIndex) {
             Member<MarkerList>& list = (*markers)[markerListIndex];
             for (unsigned markerIndex = 0; list.get() && markerIndex < list->size(); ++markerIndex) {
                 DocumentMarker* marker = list->at(markerIndex).get();
-                fprintf(stderr, " %d:[%d:%d](%d)", marker->type(), marker->startOffset(), marker->endOffset(), marker->activeMatch());
+                builder.append(" ");
+                builder.appendNumber(marker->type());
+                builder.append(":[");
+                builder.appendNumber(marker->startOffset());
+                builder.append(":");
+                builder.appendNumber(marker->endOffset());
+                builder.append("](");
+                builder.appendNumber(marker->activeMatch());
+                builder.append(")");
             }
         }
-
-        fprintf(stderr, "\n");
+        builder.append("\n");
     }
+    LOG(INFO) << m_markers.size() << " nodes have markers:\n" << builder.toString().utf8().data();
 }
 #endif
 

diff --git a/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.cpp b/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.cpp
index e0784d6..57d17a7 100644
--- a/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.cpp
+++ b/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.cpp

@@ -39,10 +39,6 @@
     return emptyString();
 }
 
-ApplicationCacheErrorEvent::ApplicationCacheErrorEvent()
-{
-}
-
 ApplicationCacheErrorEvent::ApplicationCacheErrorEvent(WebApplicationCacheHost::ErrorReason reason, const String& url, int status, const String& message)
     : Event(EventTypeNames::error, false, false)
     , m_reason(errorReasonToString(reason))

diff --git a/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.h b/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.h
index 786619c4..83ac4f98 100644
--- a/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.h
+++ b/third_party/WebKit/Source/core/events/ApplicationCacheErrorEvent.h

@@ -17,11 +17,6 @@
 public:
     ~ApplicationCacheErrorEvent() override;
 
-    static ApplicationCacheErrorEvent* create()
-    {
-        return new ApplicationCacheErrorEvent;
-    }
-
     static ApplicationCacheErrorEvent* create(WebApplicationCacheHost::ErrorReason reason, const String& url, int status, const String& message)
     {
         return new ApplicationCacheErrorEvent(reason, url, status, message);
@@ -42,7 +37,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    ApplicationCacheErrorEvent();
     ApplicationCacheErrorEvent(WebApplicationCacheHost::ErrorReason, const String& url, int status, const String& message);
     ApplicationCacheErrorEvent(const AtomicString& eventType, const ApplicationCacheErrorEventInit& initializer);
 

diff --git a/third_party/WebKit/Source/core/events/ClipboardEvent.cpp b/third_party/WebKit/Source/core/events/ClipboardEvent.cpp
index 4b0b8f3..7f677c28 100644
--- a/third_party/WebKit/Source/core/events/ClipboardEvent.cpp
+++ b/third_party/WebKit/Source/core/events/ClipboardEvent.cpp

@@ -24,10 +24,6 @@
 
 namespace blink {
 
-ClipboardEvent::ClipboardEvent()
-{
-}
-
 ClipboardEvent::ClipboardEvent(const AtomicString& eventType, bool canBubble, bool cancelable, DataTransfer* clipboardData)
     : Event(eventType, canBubble, cancelable), m_clipboardData(clipboardData)
 {

diff --git a/third_party/WebKit/Source/core/events/ClipboardEvent.h b/third_party/WebKit/Source/core/events/ClipboardEvent.h
index 144428de..a399a34a 100644
--- a/third_party/WebKit/Source/core/events/ClipboardEvent.h
+++ b/third_party/WebKit/Source/core/events/ClipboardEvent.h

@@ -33,10 +33,6 @@
     DEFINE_WRAPPERTYPEINFO();
 public:
     ~ClipboardEvent() override;
-    static ClipboardEvent* create()
-    {
-        return new ClipboardEvent();
-    }
 
     static ClipboardEvent* create(const AtomicString& type, bool canBubble, bool cancelable, DataTransfer* dataTransfer)
     {
@@ -48,7 +44,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    ClipboardEvent();
     ClipboardEvent(const AtomicString& type, bool canBubble, bool cancelable, DataTransfer* clipboardData);
 
     const AtomicString& interfaceName() const override;

diff --git a/third_party/WebKit/Source/core/events/EventAliases.in b/third_party/WebKit/Source/core/events/EventAliases.in
index 6b7c454..a4b56298 100644
--- a/third_party/WebKit/Source/core/events/EventAliases.in
+++ b/third_party/WebKit/Source/core/events/EventAliases.in

@@ -5,7 +5,6 @@
 KeyboardEvents ImplementedAs=KeyboardEvent
 MouseEvents ImplementedAs=MouseEvent
 MutationEvents ImplementedAs=MutationEvent
-OrientationEvent ImplementedAs=Event, RuntimeEnabled=OrientationEventEnabled
 SVGEvents ImplementedAs=Event
 UIEvents ImplementedAs=UIEvent
 WebKitTransitionEvent ImplementedAs=TransitionEvent

diff --git a/third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp b/third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp
index 8dd136e..90fd03e 100644
--- a/third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp
+++ b/third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp

@@ -9,10 +9,6 @@
 
 namespace blink {
 
-PromiseRejectionEvent::PromiseRejectionEvent()
-{
-}
-
 PromiseRejectionEvent::PromiseRejectionEvent(ScriptState* state, const AtomicString& type, const PromiseRejectionEventInit& initializer)
     : Event(type, initializer)
     , m_scriptState(state)

diff --git a/third_party/WebKit/Source/core/events/PromiseRejectionEvent.h b/third_party/WebKit/Source/core/events/PromiseRejectionEvent.h
index ba47ddaa..7c111d4c 100644
--- a/third_party/WebKit/Source/core/events/PromiseRejectionEvent.h
+++ b/third_party/WebKit/Source/core/events/PromiseRejectionEvent.h

@@ -20,10 +20,6 @@
     DEFINE_WRAPPERTYPEINFO();
     USING_PRE_FINALIZER(PromiseRejectionEvent, dispose);
 public:
-    static PromiseRejectionEvent* create()
-    {
-        return new PromiseRejectionEvent;
-    }
     static PromiseRejectionEvent* create(ScriptState* state, const AtomicString& type, const PromiseRejectionEventInit& initializer)
     {
         return new PromiseRejectionEvent(state, type, initializer);
@@ -45,7 +41,6 @@
     DECLARE_VIRTUAL_TRACE_WRAPPERS();
 
 private:
-    PromiseRejectionEvent();
     PromiseRejectionEvent(ScriptState*, const AtomicString&, const PromiseRejectionEventInit&);
     ~PromiseRejectionEvent() override;
     void dispose();

diff --git a/third_party/WebKit/Source/core/events/ResourceProgressEvent.cpp b/third_party/WebKit/Source/core/events/ResourceProgressEvent.cpp
index ac3a094..c95ab7c 100644
--- a/third_party/WebKit/Source/core/events/ResourceProgressEvent.cpp
+++ b/third_party/WebKit/Source/core/events/ResourceProgressEvent.cpp

@@ -28,10 +28,6 @@
 
 namespace blink {
 
-ResourceProgressEvent::ResourceProgressEvent()
-{
-}
-
 ResourceProgressEvent::ResourceProgressEvent(const AtomicString& type, bool lengthComputable, unsigned long long loaded, unsigned long long total, const String& url)
     : ProgressEvent(type, lengthComputable, loaded, total)
     , m_url(url)

diff --git a/third_party/WebKit/Source/core/events/ResourceProgressEvent.h b/third_party/WebKit/Source/core/events/ResourceProgressEvent.h
index b6b41ce..b9f727c 100644
--- a/third_party/WebKit/Source/core/events/ResourceProgressEvent.h
+++ b/third_party/WebKit/Source/core/events/ResourceProgressEvent.h

@@ -46,10 +46,6 @@
 class CORE_EXPORT ResourceProgressEvent final : public ProgressEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static ResourceProgressEvent* create()
-    {
-        return new ResourceProgressEvent;
-    }
     static ResourceProgressEvent* create(const AtomicString& type, bool lengthComputable, unsigned long long loaded, unsigned long long total, const String& url)
     {
         return new ResourceProgressEvent(type, lengthComputable, loaded, total, url);
@@ -62,7 +58,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 protected:
-    ResourceProgressEvent();
     ResourceProgressEvent(const AtomicString& type, bool lengthComputable, unsigned long long loaded, unsigned long long total, const String& url);
 
 private:

diff --git a/third_party/WebKit/Source/core/events/SecurityPolicyViolationEvent.h b/third_party/WebKit/Source/core/events/SecurityPolicyViolationEvent.h
index dd1595e..4524324 100644
--- a/third_party/WebKit/Source/core/events/SecurityPolicyViolationEvent.h
+++ b/third_party/WebKit/Source/core/events/SecurityPolicyViolationEvent.h

@@ -33,11 +33,6 @@
 class SecurityPolicyViolationEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static SecurityPolicyViolationEvent* create()
-    {
-        return new SecurityPolicyViolationEvent();
-    }
-
     static SecurityPolicyViolationEvent* create(const AtomicString& type, const SecurityPolicyViolationEventInit& initializer)
     {
         return new SecurityPolicyViolationEvent(type, initializer);
@@ -59,8 +54,6 @@
     DEFINE_INLINE_VIRTUAL_TRACE() { Event::trace(visitor); }
 
 private:
-    SecurityPolicyViolationEvent() { }
-
     SecurityPolicyViolationEvent(const AtomicString& type, const SecurityPolicyViolationEventInit& initializer)
         : Event(type, initializer)
         , m_lineNumber(0)

diff --git a/third_party/WebKit/Source/core/fetch/MemoryCache.cpp b/third_party/WebKit/Source/core/fetch/MemoryCache.cpp
index fdb74af..04e01b3 100644
--- a/third_party/WebKit/Source/core/fetch/MemoryCache.cpp
+++ b/third_party/WebKit/Source/core/fetch/MemoryCache.cpp

@@ -751,23 +751,23 @@
 void MemoryCache::dumpStats(TimerBase*)
 {
     Statistics s = getStatistics();
-    printf("%-13s %-13s %-13s %-13s %-13s %-13s %-13s\n", "", "Count", "Size", "LiveSize", "DecodedSize", "PurgeableSize", "PurgedSize");
-    printf("%-13s %-13s %-13s %-13s %-13s %-13s %-13s\n", "-------------", "-------------", "-------------", "-------------", "-------------", "-------------", "-------------");
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "Images", s.images.count, s.images.size, s.images.liveSize, s.images.decodedSize, s.images.purgeableSize, s.images.purgedSize);
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "CSS", s.cssStyleSheets.count, s.cssStyleSheets.size, s.cssStyleSheets.liveSize, s.cssStyleSheets.decodedSize, s.cssStyleSheets.purgeableSize, s.cssStyleSheets.purgedSize);
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "XSL", s.xslStyleSheets.count, s.xslStyleSheets.size, s.xslStyleSheets.liveSize, s.xslStyleSheets.decodedSize, s.xslStyleSheets.purgeableSize, s.xslStyleSheets.purgedSize);
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "JavaScript", s.scripts.count, s.scripts.size, s.scripts.liveSize, s.scripts.decodedSize, s.scripts.purgeableSize, s.scripts.purgedSize);
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "Fonts", s.fonts.count, s.fonts.size, s.fonts.liveSize, s.fonts.decodedSize, s.fonts.purgeableSize, s.fonts.purgedSize);
-    printf("%-13s %13d %13d %13d %13d %13d %13d\n", "Other", s.other.count, s.other.size, s.other.liveSize, s.other.decodedSize, s.other.purgeableSize, s.other.purgedSize);
-    printf("%-13s %-13s %-13s %-13s %-13s %-13s %-13s\n\n", "-------------", "-------------", "-------------", "-------------", "-------------", "-------------", "-------------");
+    printf("%-13s %-13s %-13s %-13s %-13s\n", "", "Count", "Size", "LiveSize", "DecodedSize");
+    printf("%-13s %-13s %-13s %-13s %-13s\n", "-------------", "-------------", "-------------", "-------------", "-------------");
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "Images", s.images.count, s.images.size, s.images.liveSize, s.images.decodedSize);
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "CSS", s.cssStyleSheets.count, s.cssStyleSheets.size, s.cssStyleSheets.liveSize, s.cssStyleSheets.decodedSize);
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "XSL", s.xslStyleSheets.count, s.xslStyleSheets.size, s.xslStyleSheets.liveSize, s.xslStyleSheets.decodedSize);
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "JavaScript", s.scripts.count, s.scripts.size, s.scripts.liveSize, s.scripts.decodedSize);
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "Fonts", s.fonts.count, s.fonts.size, s.fonts.liveSize, s.fonts.decodedSize);
+    printf("%-13s %13zu %13zu %13zu %13zu\n", "Other", s.other.count, s.other.size, s.other.liveSize, s.other.decodedSize);
+    printf("%-13s %-13s %-13s %-13s %-13s\n\n", "-------------", "-------------", "-------------", "-------------", "-------------");
 
     printf("Duplication of encoded data from data URLs\n");
-    printf("%-13s %13d of %13d\n", "Images",     s.images.encodedSizeDuplicatedInDataURLs,         s.images.encodedSize);
-    printf("%-13s %13d of %13d\n", "CSS",        s.cssStyleSheets.encodedSizeDuplicatedInDataURLs, s.cssStyleSheets.encodedSize);
-    printf("%-13s %13d of %13d\n", "XSL",        s.xslStyleSheets.encodedSizeDuplicatedInDataURLs, s.xslStyleSheets.encodedSize);
-    printf("%-13s %13d of %13d\n", "JavaScript", s.scripts.encodedSizeDuplicatedInDataURLs,        s.scripts.encodedSize);
-    printf("%-13s %13d of %13d\n", "Fonts",      s.fonts.encodedSizeDuplicatedInDataURLs,          s.fonts.encodedSize);
-    printf("%-13s %13d of %13d\n", "Other",      s.other.encodedSizeDuplicatedInDataURLs,          s.other.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "Images",     s.images.encodedSizeDuplicatedInDataURLs,         s.images.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "CSS",        s.cssStyleSheets.encodedSizeDuplicatedInDataURLs, s.cssStyleSheets.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "XSL",        s.xslStyleSheets.encodedSizeDuplicatedInDataURLs, s.xslStyleSheets.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "JavaScript", s.scripts.encodedSizeDuplicatedInDataURLs,        s.scripts.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "Fonts",      s.fonts.encodedSizeDuplicatedInDataURLs,          s.fonts.encodedSize);
+    printf("%-13s %13zu of %13zu\n", "Other",      s.other.encodedSizeDuplicatedInDataURLs,          s.other.encodedSize);
 }
 
 void MemoryCache::dumpLRULists(bool includeLive) const

diff --git a/third_party/WebKit/Source/core/fetch/MemoryCache.h b/third_party/WebKit/Source/core/fetch/MemoryCache.h
index 8e562bd..7027b9e 100644
--- a/third_party/WebKit/Source/core/fetch/MemoryCache.h
+++ b/third_party/WebKit/Source/core/fetch/MemoryCache.h

@@ -139,8 +139,6 @@
         size_t decodedSize;
         size_t encodedSize;
         size_t encodedSizeDuplicatedInDataURLs;
-        size_t purgeableSize;
-        size_t purgedSize;
 
         TypeStatistic()
             : count(0)
@@ -149,8 +147,6 @@
             , decodedSize(0)
             , encodedSize(0)
             , encodedSizeDuplicatedInDataURLs(0)
-            , purgeableSize(0)
-            , purgedSize(0)
         {
         }
 

diff --git a/third_party/WebKit/Source/core/fetch/OWNERS b/third_party/WebKit/Source/core/fetch/OWNERS
index b2b13f6..f8c53d1 100644
--- a/third_party/WebKit/Source/core/fetch/OWNERS
+++ b/third_party/WebKit/Source/core/fetch/OWNERS

@@ -1,3 +1,2 @@
 japhet@chromium.org
 mkwst@chromium.org
-morrita@chromium.org

diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 9b449c34..143bb107 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

@@ -33,7 +33,6 @@
 #include "core/fetch/ImageResource.h"
 #include "core/fetch/MemoryCache.h"
 #include "core/fetch/ResourceLoader.h"
-#include "core/fetch/ResourceLoaderSet.h"
 #include "core/fetch/ResourceLoadingLog.h"
 #include "core/fetch/UniqueIdentifier.h"
 #include "platform/Histogram.h"
@@ -1057,8 +1056,16 @@
 
 void ResourceFetcher::stopFetching()
 {
-    m_nonBlockingLoaders.cancelAll();
-    m_loaders.cancelAll();
+    HeapVector<Member<ResourceLoader>> loadersToCancel;
+    for (const auto& loader : m_nonBlockingLoaders)
+        loadersToCancel.append(loader);
+    for (const auto& loader : m_loaders)
+        loadersToCancel.append(loader);
+
+    for (const auto& loader : loadersToCancel) {
+        if (m_loaders.contains(loader) || m_nonBlockingLoaders.contains(loader))
+            loader->cancel();
+    }
 }
 
 bool ResourceFetcher::isFetching() const
@@ -1068,8 +1075,10 @@
 
 void ResourceFetcher::setDefersLoading(bool defers)
 {
-    m_loaders.setAllDefersLoading(defers);
-    m_nonBlockingLoaders.setAllDefersLoading(defers);
+    for (const auto& loader : m_nonBlockingLoaders)
+        loader->setDefersLoading(defers);
+    for (const auto& loader : m_loaders)
+        loader->setDefersLoading(defers);
 }
 
 bool ResourceFetcher::defersLoading() const

diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.h b/third_party/WebKit/Source/core/fetch/ResourceFetcher.h
index 32e4f390..847ce9e 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.h
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.h

@@ -33,7 +33,6 @@
 #include "core/fetch/FetchRequest.h"
 #include "core/fetch/Resource.h"
 #include "core/fetch/ResourceLoaderOptions.h"
-#include "core/fetch/ResourceLoaderSet.h"
 #include "core/fetch/SubstituteData.h"
 #include "platform/Timer.h"
 #include "platform/network/ResourceError.h"
@@ -190,8 +189,8 @@
 
     Vector<std::unique_ptr<ResourceTimingInfo>> m_scheduledResourceTimingReports;
 
-    ResourceLoaderSet m_loaders;
-    ResourceLoaderSet m_nonBlockingLoaders;
+    HeapHashSet<Member<ResourceLoader>> m_loaders;
+    HeapHashSet<Member<ResourceLoader>> m_nonBlockingLoaders;
 
     // Used in hit rate histograms.
     class DeadResourceStatsRecorder {

diff --git a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp b/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
deleted file mode 100644
index b8352069..0000000
--- a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.cpp
+++ /dev/null

@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "core/fetch/ResourceLoaderSet.h"
-
-#include "wtf/Vector.h"
-
-namespace blink {
-
-DEFINE_TRACE(ResourceLoaderSet)
-{
-    visitor->trace(m_set);
-}
-
-void ResourceLoaderSet::cancelAll()
-{
-    HeapVector<Member<ResourceLoader>> loadersCopy;
-    copyToVector(m_set, loadersCopy);
-    for (const auto& loader : loadersCopy) {
-        // cancelAll() can reenter. Don't cancel the same ResourceLoader twice.
-        if (m_set.contains(loader))
-            loader->cancel();
-    }
-}
-
-void ResourceLoaderSet::setAllDefersLoading(bool defers)
-{
-    HeapVector<Member<ResourceLoader>> loadersCopy;
-    copyToVector(m_set, loadersCopy);
-    for (const auto& loader : loadersCopy)
-        loader->setDefersLoading(defers);
-}
-
-} // namespace blink

diff --git a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.h b/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.h
deleted file mode 100644
index 436b578..0000000
--- a/third_party/WebKit/Source/core/fetch/ResourceLoaderSet.h
+++ /dev/null

@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ResourceLoaderSet_h
-#define ResourceLoaderSet_h
-
-#include "core/fetch/ResourceLoader.h"
-#include "wtf/HashSet.h"
-#include "wtf/Noncopyable.h"
-
-namespace blink {
-
-class ResourceLoaderSet final {
-    DISALLOW_NEW();
-    WTF_MAKE_NONCOPYABLE(ResourceLoaderSet);
-public:
-    ResourceLoaderSet()
-    {
-    }
-
-    using SetType = HeapHashSet<Member<ResourceLoader>>;
-
-    DECLARE_TRACE();
-
-    void add(ResourceLoader* loader) { m_set.add(loader); }
-    void remove(ResourceLoader* loader) { m_set.remove(loader); }
-    bool isEmpty() const { return m_set.isEmpty(); }
-    bool contains(ResourceLoader* loader) const { return m_set.contains(loader); }
-    void cancelAll();
-    void setAllDefersLoading(bool);
-    int size() const { return m_set.size(); }
-
-private:
-    SetType m_set;
-};
-
-} // namespace blink
-
-#endif

diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 4bd251c..28f16070 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp

@@ -1832,8 +1832,7 @@
 
 void FrameView::addOrthogonalWritingModeRoot(LayoutBox& root)
 {
-    DCHECK(!root.isLayoutFullScreen() && !root.isLayoutFullScreenPlaceholder()
-        && !root.isLayoutScrollbarPart());
+    DCHECK(!root.isLayoutScrollbarPart());
     m_orthogonalWritingModeRootList.add(root);
 }
 

diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
index 39cd651..41c0aec7 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

@@ -732,10 +732,8 @@
 
     if (document()->isSandboxed(SandboxModals)) {
         UseCounter::count(document(), UseCounter::DialogInSandboxedContext);
-        if (RuntimeEnabledFeatures::sandboxBlocksModalsEnabled()) {
-            frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'print()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
-            return;
-        }
+        frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'print()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
+        return;
     }
 
     if (scriptState && v8::MicrotasksScope::IsRunningMicrotasks(scriptState->isolate())) {
@@ -767,10 +765,8 @@
 
     if (document()->isSandboxed(SandboxModals)) {
         UseCounter::count(document(), UseCounter::DialogInSandboxedContext);
-        if (RuntimeEnabledFeatures::sandboxBlocksModalsEnabled()) {
-            frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'alert()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
-            return;
-        }
+        frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'alert()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
+        return;
     }
 
     if (v8::MicrotasksScope::IsRunningMicrotasks(scriptState->isolate())) {
@@ -795,10 +791,8 @@
 
     if (document()->isSandboxed(SandboxModals)) {
         UseCounter::count(document(), UseCounter::DialogInSandboxedContext);
-        if (RuntimeEnabledFeatures::sandboxBlocksModalsEnabled()) {
-            frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'confirm()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
-            return false;
-        }
+        frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'confirm()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
+        return false;
     }
 
     if (v8::MicrotasksScope::IsRunningMicrotasks(scriptState->isolate())) {
@@ -823,10 +817,8 @@
 
     if (document()->isSandboxed(SandboxModals)) {
         UseCounter::count(document(), UseCounter::DialogInSandboxedContext);
-        if (RuntimeEnabledFeatures::sandboxBlocksModalsEnabled()) {
-            frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'prompt()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
-            return String();
-        }
+        frameConsole()->addMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Ignored call to 'prompt()'. The document is sandboxed, and the 'allow-modals' keyword is not set."));
+        return String();
     }
 
     if (v8::MicrotasksScope::IsRunningMicrotasks(scriptState->isolate())) {

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index 42d80f42..36fd422 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h

@@ -948,12 +948,8 @@
         PresentationConnectionConnectEventListener = 1157,
         PresentationConnectionCloseEventListener = 1158,
         PresentationConnectionTerminateEventListener = 1159,
-        DocumentCreateEventFontFaceSetLoadEvent = 1160,
-        DocumentCreateEventMediaQueryListEvent = 1161,
         DocumentCreateEventAnimationEvent = 1162,
-        DocumentCreateEventApplicationCacheErrorEvent = 1164,
         DocumentCreateEventBeforeUnloadEvent = 1166,
-        DocumentCreateEventClipboardEvent = 1167,
         DocumentCreateEventCompositionEvent = 1168,
         DocumentCreateEventDragEvent = 1169,
         DocumentCreateEventErrorEvent = 1170,
@@ -963,49 +959,19 @@
         DocumentCreateEventPageTransitionEvent = 1174,
         DocumentCreateEventPopStateEvent = 1176,
         DocumentCreateEventProgressEvent = 1177,
-        DocumentCreateEventPromiseRejectionEvent = 1178,
-        DocumentCreateEventResourceProgressEvent = 1180,
-        DocumentCreateEventSecurityPolicyViolationEvent = 1181,
         DocumentCreateEventTextEvent = 1182,
         DocumentCreateEventTransitionEvent = 1183,
         DocumentCreateEventWheelEvent = 1184,
         DocumentCreateEventTrackEvent = 1186,
         DocumentCreateEventWebKitAnimationEvent = 1187,
         DocumentCreateEventMutationEvents = 1188,
-        DocumentCreateEventOrientationEvent = 1189,
         DocumentCreateEventSVGEvents = 1190,
         DocumentCreateEventWebKitTransitionEvent = 1191,
-        DocumentCreateEventBeforeInstallPromptEvent = 1192,
-        DocumentCreateEventSyncEvent = 1193,
         DocumentCreateEventDeviceMotionEvent = 1195,
         DocumentCreateEventDeviceOrientationEvent = 1196,
-        DocumentCreateEventMediaEncryptedEvent = 1197,
-        DocumentCreateEventMediaKeyMessageEvent = 1198,
-        DocumentCreateEventGamepadEvent = 1199,
         DocumentCreateEventIDBVersionChangeEvent = 1201,
-        DocumentCreateEventBlobEvent = 1202,
-        DocumentCreateEventMediaStreamEvent = 1203,
-        DocumentCreateEventMediaStreamTrackEvent = 1204,
-        DocumentCreateEventRTCDTMFToneChangeEvent = 1205,
-        DocumentCreateEventRTCDataChannelEvent = 1206,
-        DocumentCreateEventRTCIceCandidateEvent = 1207,
-        DocumentCreateEventNotificationEvent = 1209,
-        DocumentCreateEventPresentationConnectionAvailableEvent = 1210,
-        DocumentCreateEventPresentationConnectionCloseEvent = 1211,
-        DocumentCreateEventPushEvent = 1212,
-        DocumentCreateEventExtendableEvent = 1213,
-        DocumentCreateEventExtendableMessageEvent = 1214,
-        DocumentCreateEventFetchEvent = 1215,
-        DocumentCreateEventServiceWorkerMessageEvent = 1217,
-        DocumentCreateEventSpeechRecognitionError = 1218,
-        DocumentCreateEventSpeechRecognitionEvent = 1219,
-        DocumentCreateEventSpeechSynthesisEvent = 1220,
         DocumentCreateEventStorageEvent = 1221,
-        DocumentCreateEventAudioProcessingEvent = 1222,
-        DocumentCreateEventOfflineAudioCompletionEvent = 1223,
         DocumentCreateEventWebGLContextEvent = 1224,
-        DocumentCreateEventMIDIConnectionEvent = 1225,
-        DocumentCreateEventMIDIMessageEvent = 1226,
         DocumentCreateEventCloseEvent = 1227,
         DocumentCreateEventKeyboardEvents = 1228,
         HTMLMediaElement = 1229,
@@ -1307,6 +1273,8 @@
         PointerEnterLeaveFiredWhileCaptured = 1537,
         PointerOverOutFiredWhileCaptured = 1538,
         DraggableAttribute = 1539,
+        CleanScriptElementWithNonce = 1540,
+        PotentiallyInjectedScriptElementWithNonce = 1541,
 
         // Add new features immediately above this line. Don't change assigned
         // numbers of any item, and don't reuse removed slots.

diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 92920a3..492e745 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

@@ -29,6 +29,7 @@
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/DOMStringList.h"
 #include "core/dom/Document.h"
+#include "core/dom/Element.h"
 #include "core/dom/SandboxFlags.h"
 #include "core/events/SecurityPolicyViolationEvent.h"
 #include "core/fetch/IntegrityMetadata.h"
@@ -60,6 +61,7 @@
 #include "public/platform/Platform.h"
 #include "public/platform/WebAddressSpace.h"
 #include "public/platform/WebURLRequest.h"
+#include "wtf/NotFound.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/StringHasher.h"
 #include "wtf/text/ParsingUtilities.h"
@@ -135,6 +137,38 @@
         || equalIgnoringCase(name, RequireSRIFor));
 }
 
+bool ContentSecurityPolicy::isNonceableElement(const Element* element)
+{
+    if (!element->fastHasAttribute(HTMLNames::nonceAttr))
+        return false;
+
+    bool nonceable = true;
+
+    // To prevent an attacker from hijacking an existing nonce via a dangling markup injection,
+    // we walk through the attributes of each nonced script element: if their names or values
+    // contain "<script" or "<style", we won't apply the nonce when loading script.
+    //
+    // See http://blog.innerht.ml/csp-2015/#danglingmarkupinjection for an example of the kind
+    // of attack this is aimed at mitigating.
+    DEFINE_STATIC_LOCAL(AtomicString, scriptString, ("<script"));
+    DEFINE_STATIC_LOCAL(AtomicString, styleString, ("<style"));
+    for (const Attribute& attr : element->attributes()) {
+        AtomicString name = attr.localName().lowerASCII();
+        AtomicString value = attr.value().lowerASCII();
+        if (name.find(scriptString) != WTF::kNotFound || name.find(styleString) != WTF::kNotFound
+            || value.find(scriptString) != WTF::kNotFound || value.find(styleString) != WTF::kNotFound) {
+            nonceable = false;
+            break;
+        }
+    }
+
+    UseCounter::count(element->document(), nonceable ? UseCounter::CleanScriptElementWithNonce : UseCounter::PotentiallyInjectedScriptElementWithNonce);
+
+    // This behavior is locked behind the experimental flag for the moment; if we
+    // decide to ship it, drop this check. https://crbug.com/639293
+    return !RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled() || nonceable;
+}
+
 static UseCounter::Feature getUseCounterType(ContentSecurityPolicyHeaderType type)
 {
     switch (type) {

diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
index bc89a13..24141d29 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

@@ -57,6 +57,7 @@
 class CSPDirectiveList;
 class CSPSource;
 class Document;
+class Element;
 class FrameLoaderClient;
 class KURL;
 class ResourceRequest;
@@ -280,6 +281,8 @@
 
     static bool isDirectiveName(const String&);
 
+    static bool isNonceableElement(const Element*);
+
     Document* document() const;
 
 private:

diff --git a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
index f8125195..1d64b3d 100644
--- a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp

@@ -190,7 +190,10 @@
 void HTMLTextFormControlElement::select()
 {
     setSelectionRangeForBinding(0, std::numeric_limits<int>::max());
-    focus();
+    // Avoid SelectionBehaviorOnFocus::Restore, which scrolls containers to show
+    // the selection.
+    focus(FocusParams(SelectionBehaviorOnFocus::None, WebFocusTypeNone, nullptr));
+    restoreCachedSelection();
 }
 
 bool HTMLTextFormControlElement::shouldDispatchFormControlChangeEvent(String& oldValue, String& newValue)

diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 846d7cd..de0d5baf 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp

@@ -332,6 +332,9 @@
     if (child->continuation())
         return;
 
+    if (isFieldset())
+        return;
+
     // Promote all the leftover anonymous block's children (to become children of this block
     // instead). We still want to keep the leftover block in the tree for a moment, for notification
     // purposes done further below (flow threads and grids).
@@ -1740,6 +1743,9 @@
     if (display == FLEX || display == INLINE_FLEX) {
         newBox = LayoutFlexibleBox::createAnonymous(&parent->document());
         newDisplay = FLEX;
+    } else if (display == GRID || display == INLINE_GRID) {
+        newBox = LayoutGrid::createAnonymous(&parent->document());
+        newDisplay = GRID;
     } else {
         newBox = LayoutBlockFlow::createAnonymous(&parent->document());
         newDisplay = BLOCK;
@@ -1901,8 +1907,7 @@
         availableHeight = overrideLogicalContentHeight();
     } else if (style.logicalHeight().isFixed()) {
         LayoutUnit contentBoxHeight = adjustContentBoxLogicalHeightForBoxSizing(style.logicalHeight().value());
-        availableHeight = constrainContentBoxLogicalHeightByMinMax(
-            contentBoxHeight - scrollbarLogicalHeight(), LayoutUnit(-1)).clampNegativeToZero();
+        availableHeight = std::max(LayoutUnit(), constrainContentBoxLogicalHeightByMinMax(contentBoxHeight - scrollbarLogicalHeight(), LayoutUnit(-1)));
     } else if (style.logicalHeight().hasPercent() && !isOutOfFlowPositionedWithSpecifiedHeight) {
         LayoutUnit heightWithScrollbar = computePercentageLogicalHeight(style.logicalHeight());
         if (heightWithScrollbar != -1) {

diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index 5f76247..cb2ddbe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

@@ -1161,9 +1161,6 @@
     BlockChildrenLayoutInfo layoutInfo(this, beforeEdge, afterEdge);
     MarginInfo& marginInfo = layoutInfo.marginInfo();
 
-    // Fieldsets need to find their legend and position it inside the border of the object.
-    // The legend then gets skipped during normal layout. The same is true for ruby text.
-    // It doesn't get included in the normal layout process but is instead skipped.
     LayoutObject* childToExclude = layoutSpecialExcludedChild(relayoutChildren, layoutScope);
 
     LayoutBox* next = firstChildBox();
@@ -1176,7 +1173,7 @@
         child->setMayNeedPaintInvalidation();
 
         if (childToExclude == child)
-            continue; // Skip this child, since it will be positioned by the specialized subclass (fieldsets and ruby runs).
+            continue; // Skip this child, since it will be positioned by the specialized subclass (ruby runs).
 
         updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, *child);
 
@@ -2408,7 +2405,7 @@
     // that isn't sufficient for us, and can only cause trouble at this point.
     LayoutBox::addChild(newChild, beforeChild);
 
-    if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isLayoutBlock()) {
+    if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isLayoutBlock() && !parent()->createsAnonymousWrapper()) {
         toLayoutBlock(parent())->removeLeftoverAnonymousBlock(this);
         // |this| may be dead now.
     }
@@ -3486,11 +3483,6 @@
     if (isRuby())
         return;
 
-    // Fieldsets look for a legend special child (layoutSpecialExcludedChild()). We currently only
-    // support one special child per layout object, and the flow thread would make for a second one.
-    if (isFieldset())
-        return;
-
     // Form controls are replaced content, and are therefore not supposed to support multicol.
     if (isFileUploadControl() || isTextControl() || isListBox())
         return;

diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
index 8238bf2b..495ccd5 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp

@@ -427,8 +427,39 @@
     setMarginEndForChild(*layoutRubyRun, LayoutUnit(-endOverhang));
 }
 
+static inline size_t findWordMeasurement(LineLayoutText layoutText, int offset,
+    WordMeasurements& wordMeasurements, size_t lastIndex)
+{
+    // In LTR, lastIndex should match since the order of BidiRun (visual) and
+    // WordMeasurement (logical) are the same.
+    size_t size = wordMeasurements.size();
+    if (lastIndex < size) {
+        const WordMeasurement& wordMeasurement = wordMeasurements[lastIndex];
+        if (wordMeasurement.layoutText == layoutText && wordMeasurement.startOffset == offset)
+            return lastIndex;
+    }
+
+    // In RTL, scan the whole array because they are not the same.
+    for (size_t i = 0; i < size; ++i) {
+        const WordMeasurement& wordMeasurement = wordMeasurements[i];
+        if (wordMeasurement.layoutText != layoutText)
+            continue;
+        if (wordMeasurement.startOffset == offset)
+            return i;
+        if (wordMeasurement.startOffset > offset)
+            break;
+    }
+
+    // In RTL with space collpasing or in LTR/RTL mixed lines, there can be no
+    // matches because spaces are handled differently in BidiRun and
+    // WordMeasurement. This can cause slight performance hit and slight
+    // differences in glyph positions since we re-measure the whole run.
+    return size;
+}
+
 static inline void setLogicalWidthForTextRun(RootInlineBox* lineBox, BidiRun* run, LineLayoutText layoutText, LayoutUnit xPos, const LineInfo& lineInfo,
-    GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache, WordMeasurements& wordMeasurements)
+    GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache, WordMeasurements& wordMeasurements,
+    size_t& wordMeasurementsIndex)
 {
     HashSet<const SimpleFontData*> fallbackFonts;
     GlyphOverflow glyphOverflow;
@@ -454,12 +485,13 @@
 
     if (canUseCachedWordMeasurements) {
         int lastEndOffset = run->m_start;
-        for (size_t i = 0, size = wordMeasurements.size(); i < size && lastEndOffset < run->m_stop; ++i) {
+        size_t i = findWordMeasurement(layoutText, lastEndOffset, wordMeasurements, wordMeasurementsIndex);
+        for (size_t size = wordMeasurements.size(); i < size && lastEndOffset < run->m_stop; ++i) {
             const WordMeasurement& wordMeasurement = wordMeasurements[i];
             if (wordMeasurement.startOffset == wordMeasurement.endOffset)
                 continue;
             if (wordMeasurement.layoutText != layoutText || wordMeasurement.startOffset != lastEndOffset || wordMeasurement.endOffset > run->m_stop)
-                continue;
+                break;
 
             lastEndOffset = wordMeasurement.endOffset;
             if (kerningIsEnabled && lastEndOffset == run->m_stop) {
@@ -479,6 +511,7 @@
                     fallbackFonts.add(*it);
             }
         }
+        wordMeasurementsIndex = i;
         if (lastEndOffset != run->m_stop) {
             // If we don't have enough cached data, we'll measure the run again.
             canUseCachedWordMeasurements = false;
@@ -620,6 +653,7 @@
     TextJustify textJustify = style()->getTextJustify();
 
     BidiRun* r = firstRun;
+    size_t wordMeasurementsIndex = 0;
     for (; r; r = r->next()) {
         if (!r->m_box || r->m_lineLayoutItem.isOutOfFlowPositioned() || r->m_box->isLineBreak()) {
             continue; // Positioned objects are only participating to figure out their
@@ -640,7 +674,7 @@
                 needsWordSpacing = !isSpaceOrNewline(rt.characterAt(r->m_stop - 1));
             }
 
-            setLogicalWidthForTextRun(lineBox, r, rt, totalLogicalWidth, lineInfo, textBoxDataMap, verticalPositionCache, wordMeasurements);
+            setLogicalWidthForTextRun(lineBox, r, rt, totalLogicalWidth, lineInfo, textBoxDataMap, verticalPositionCache, wordMeasurements, wordMeasurementsIndex);
         } else {
             isAfterExpansion = false;
             if (!r->m_lineLayoutItem.isLayoutInline()) {

diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 34be0596..7b7ec95a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp

@@ -1266,21 +1266,9 @@
         gExtraBlockOffsetMap->remove(this);
 }
 
-static LayoutUnit borderPaddingWidthForBoxSizing(const LayoutBox* box)
-{
-    // This excludes intrinsic padding on cells. It includes width from collapsed borders.
-    return box->computedCSSPaddingStart() + box->computedCSSPaddingEnd() + box->borderStart() + box->borderEnd();
-}
-
-static LayoutUnit borderPaddingHeightForBoxSizing(const LayoutBox* box)
-{
-    // This excludes intrinsic padding on cells. It includes height from collapsed borders.
-    return box->computedCSSPaddingBefore() + box->computedCSSPaddingAfter() + box->borderBefore() + box->borderAfter();
-}
-
 LayoutUnit LayoutBox::adjustBorderBoxLogicalWidthForBoxSizing(float width) const
 {
-    LayoutUnit bordersPlusPadding = borderPaddingWidthForBoxSizing(this);
+    LayoutUnit bordersPlusPadding = borderAndPaddingLogicalWidth();
     LayoutUnit result(width);
     if (style()->boxSizing() == BoxSizingContentBox)
         return result + bordersPlusPadding;
@@ -1289,7 +1277,7 @@
 
 LayoutUnit LayoutBox::adjustBorderBoxLogicalHeightForBoxSizing(float height) const
 {
-    LayoutUnit bordersPlusPadding = borderPaddingHeightForBoxSizing(this);
+    LayoutUnit bordersPlusPadding = borderAndPaddingLogicalHeight();
     LayoutUnit result(height);
     if (style()->boxSizing() == BoxSizingContentBox)
         return result + bordersPlusPadding;
@@ -1300,7 +1288,7 @@
 {
     LayoutUnit result(width);
     if (style()->boxSizing() == BoxSizingBorderBox)
-        result -= borderPaddingWidthForBoxSizing(this);
+        result -= borderAndPaddingLogicalWidth();
     return std::max(LayoutUnit(), result);
 }
 
@@ -1308,7 +1296,7 @@
 {
     LayoutUnit result(height);
     if (style()->boxSizing() == BoxSizingBorderBox)
-        result -= borderPaddingHeightForBoxSizing(this);
+        result -= borderAndPaddingLogicalHeight();
     return std::max(LayoutUnit(), result);
 }
 
@@ -2833,7 +2821,7 @@
         availableHeight = containingBlockChild->containingBlockLogicalWidthForContent();
     } else if (hasOverrideContainingBlockLogicalHeight()) {
         availableHeight = overrideContainingBlockContentLogicalHeight();
-    } else if (!cb->styleRef().logicalHeight().isFixed() && cb->isTableCell()) {
+    } else if (cb->isTableCell()) {
         if (!skippedAutoHeightContainingBlock) {
             // Table cells violate what the CSS spec says to do with heights. Basically we
             // don't care if the cell specified a height or not. We just always make ourselves
@@ -2867,11 +2855,13 @@
 
     LayoutUnit result = valueForLength(height, availableHeight);
     bool includeBorderPadding = isTable()
-        || (cb->isTableCell() && !cb->styleRef().logicalHeight().isFixed() && !skippedAutoHeightContainingBlock && cb->hasOverrideLogicalContentHeight());
+        || (cb->isTableCell() && !skippedAutoHeightContainingBlock && cb->hasOverrideLogicalContentHeight());
 
     if (includeBorderPadding) {
-        // TODO(rhogan) crbug.com/467378: Doing this for content inside tables cells is wrong, it should fill
-        // whatever height the cell makes available.
+        // FIXME: Table cells should default to box-sizing: border-box so we can avoid this hack.
+        // It is necessary to use the border-box to match WinIE's broken
+        // box model. This is essential for sizing inside
+        // table cells using percentage heights.
         result -= borderAndPaddingLogicalHeight();
         return std::max(LayoutUnit(), result);
     }
@@ -4230,6 +4220,12 @@
     if ((isHorizontal && !scrollsOverflowY()) || (!isHorizontal && !scrollsOverflowX()))
         return false;
 
+    // Fragmenting scrollbars is only problematic in interactive media, e.g. multicol on a
+    // screen. If we're printing, which is non-interactive media, we should allow objects with
+    // non-visible overflow to be paginated as normally.
+    if (document().printing())
+        return false;
+
     // We do have overflow. We'll still be willing to paginate as long as the block
     // has auto logical height, auto or undefined max-logical-height and a zero or auto min-logical-height.
     // Note this is just a heuristic, and it's still possible to have overflow under these

diff --git a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
index 93b43a8..be509a6a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp

@@ -25,6 +25,7 @@
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
+#include "core/dom/AXObjectCache.h"
 #include "core/html/HTMLLegendElement.h"
 #include "core/paint/FieldsetPainter.h"
 
@@ -34,27 +35,83 @@
 
 using namespace HTMLNames;
 
+namespace {
+
+void setInnerBlockPadding(bool isHorizontalWritingMode, const LayoutObject* innerBlock, const LayoutUnit& padding)
+{
+    if (isHorizontalWritingMode)
+        innerBlock->mutableStyleRef().setPaddingTop(Length(padding, Fixed));
+    else
+        innerBlock->mutableStyleRef().setPaddingLeft(Length(padding, Fixed));
+}
+
+void resetInnerBlockPadding(bool isHorizontalWritingMode, const LayoutObject* innerBlock)
+{
+    if (isHorizontalWritingMode)
+        innerBlock->mutableStyleRef().setPaddingTop(Length(0, Fixed));
+    else
+        innerBlock->mutableStyleRef().setPaddingLeft(Length(0, Fixed));
+}
+
+} // namespace
+
 LayoutFieldset::LayoutFieldset(Element* element)
-    : LayoutBlockFlow(element)
+    : LayoutFlexibleBox(element)
+    , m_innerBlock(nullptr)
 {
 }
 
-void LayoutFieldset::computePreferredLogicalWidths()
+int LayoutFieldset::baselinePosition(FontBaseline baseline, bool firstLine, LineDirectionMode direction, LinePositionMode position) const
 {
-    LayoutBlockFlow::computePreferredLogicalWidths();
-    if (LayoutBox* legend = findInFlowLegend()) {
-        int legendMinWidth = legend->minPreferredLogicalWidth().toInt();
+    return LayoutBlock::baselinePosition(baseline, firstLine, direction, position);
+}
 
-        Length legendMarginLeft = legend->style()->marginLeft();
-        Length legendMarginRight = legend->style()->marginRight();
+void LayoutFieldset::computeIntrinsicLogicalWidths(LayoutUnit& minLogicalWidth, LayoutUnit& maxLogicalWidth) const
+{
+    for (LayoutBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        if (child->isOutOfFlowPositioned())
+            continue;
 
-        if (legendMarginLeft.isFixed())
-            legendMinWidth += legendMarginLeft.value();
+        LayoutUnit margin = marginIntrinsicLogicalWidthForChild(*child);
 
-        if (legendMarginRight.isFixed())
-            legendMinWidth += legendMarginRight.value();
+        LayoutUnit minPreferredLogicalWidth;
+        LayoutUnit maxPreferredLogicalWidth;
+        computeChildPreferredLogicalWidths(*child, minPreferredLogicalWidth, maxPreferredLogicalWidth);
+        DCHECK_GE(minPreferredLogicalWidth, LayoutUnit());
+        DCHECK_GE(maxPreferredLogicalWidth, LayoutUnit());
+        minPreferredLogicalWidth += margin;
+        maxPreferredLogicalWidth += margin;
+        minLogicalWidth = std::max(minPreferredLogicalWidth, minLogicalWidth);
+        maxLogicalWidth = std::max(maxPreferredLogicalWidth, maxLogicalWidth);
+    }
 
-        m_minPreferredLogicalWidth = max(m_minPreferredLogicalWidth, legendMinWidth + borderAndPaddingWidth());
+    maxLogicalWidth = std::max(minLogicalWidth, maxLogicalWidth);
+
+    // Due to negative margins, it is possible that we calculated a negative intrinsic width. Make sure that we
+    // never return a negative width.
+    minLogicalWidth = std::max(LayoutUnit(), minLogicalWidth);
+    maxLogicalWidth = std::max(LayoutUnit(), maxLogicalWidth);
+
+    LayoutUnit scrollbarWidth(scrollbarLogicalWidth());
+    maxLogicalWidth += scrollbarWidth;
+    minLogicalWidth += scrollbarWidth;
+}
+
+void LayoutFieldset::setLogicalLeftForChild(LayoutBox& child, LayoutUnit logicalLeft)
+{
+    if (isHorizontalWritingMode()) {
+        child.setX(logicalLeft);
+    } else {
+        child.setY(logicalLeft);
+    }
+}
+
+void LayoutFieldset::setLogicalTopForChild(LayoutBox& child, LayoutUnit logicalTop)
+{
+    if (isHorizontalWritingMode()) {
+        child.setY(logicalTop);
+    } else {
+        child.setX(logicalTop);
     }
 }
 
@@ -106,6 +163,7 @@
 
         LayoutUnit legendLogicalTop;
         LayoutUnit collapsedLegendExtent;
+        LayoutUnit innerBlockPadding;
         // FIXME: We need to account for the legend's margin before too.
         if (fieldsetBorderBefore > legendLogicalHeight) {
             // The <legend> is smaller than the associated fieldset before border
@@ -114,16 +172,22 @@
             // Firefox completely ignores the margins in this case which seems wrong.
             legendLogicalTop = (fieldsetBorderBefore - legendLogicalHeight) / 2;
             collapsedLegendExtent = max<LayoutUnit>(fieldsetBorderBefore, legendLogicalTop + legendLogicalHeight + marginAfterForChild(*legend));
+            innerBlockPadding = marginAfterForChild(*legend) ? marginAfterForChild(*legend) - legendLogicalTop : LayoutUnit();
         } else {
             collapsedLegendExtent = legendLogicalHeight + marginAfterForChild(*legend);
+            innerBlockPadding = legendLogicalHeight - borderAfter() + marginAfterForChild(*legend);
         }
 
+        if (m_innerBlock)
+            setInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock, innerBlockPadding);
         setLogicalTopForChild(*legend, legendLogicalTop);
         setLogicalHeight(paddingBefore() + collapsedLegendExtent);
 
         if (legend->frameRect() != oldLegendFrameRect) {
             // We need to invalidate the fieldset border if the legend's frame changed.
             setShouldDoFullPaintInvalidation();
+            if (m_innerBlock)
+                m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged, MarkOnlyThis);
         }
     }
     return legend;
@@ -153,4 +217,68 @@
     FieldsetPainter(*this).paintMask(paintInfo, paintOffset);
 }
 
+void LayoutFieldset::updateAnonymousChildStyle(const LayoutObject& child, ComputedStyle& childStyle) const
+{
+    childStyle.setFlexShrink(1.0f);
+    childStyle.setFlexGrow(1.0f);
+    // min-width: 0; is needed for correct shrinking.
+    childStyle.setMinWidth(Length(0, Fixed));
+    childStyle.setFlexDirection(style()->flexDirection());
+    childStyle.setJustifyContent(style()->justifyContent());
+    childStyle.setFlexWrap(style()->flexWrap());
+    childStyle.setAlignItems(style()->alignItems());
+    childStyle.setAlignContent(style()->alignContent());
+    // Let anonymous block to be the 1st for correct layout positioning.
+    childStyle.setOrder(1);
+}
+
+void LayoutFieldset::addChild(LayoutObject* newChild, LayoutObject* beforeChild)
+{
+    if (!m_innerBlock)
+        createInnerBlock();
+
+    if (isHTMLLegendElement(newChild->node())) {
+        // Let legend block to be the 2nd for correct layout positioning.
+        newChild->mutableStyle()->setOrder(2);
+        LayoutFlexibleBox::addChild(newChild, m_innerBlock);
+    } else {
+        if (beforeChild && isHTMLLegendElement(beforeChild->node())) {
+            m_innerBlock->addChild(newChild);
+        } else {
+            m_innerBlock->addChild(newChild, beforeChild);
+        }
+        if (AXObjectCache* cache = document().existingAXObjectCache())
+            cache->childrenChanged(this);
+    }
+}
+
+void LayoutFieldset::createInnerBlock()
+{
+    if (m_innerBlock) {
+        DCHECK(firstChild() == m_innerBlock);
+        return;
+    }
+    m_innerBlock = createAnonymousBlock(style()->display());
+    LayoutFlexibleBox::addChild(m_innerBlock);
+}
+
+void LayoutFieldset::removeChild(LayoutObject* oldChild)
+{
+    if (isHTMLLegendElement(oldChild->node())) {
+        LayoutFlexibleBox::removeChild(oldChild);
+        if (m_innerBlock) {
+            resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
+            m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged, MarkOnlyThis);
+        }
+        setShouldDoFullPaintInvalidation();
+    } else if (oldChild == m_innerBlock) {
+        LayoutFlexibleBox::removeChild(oldChild);
+        m_innerBlock = nullptr;
+    } else if (oldChild->parent() == this) {
+        LayoutFlexibleBox::removeChild(oldChild);
+    } else if (m_innerBlock) {
+        m_innerBlock->removeChild(oldChild);
+    }
+}
+
 } // namespace blink

diff --git a/third_party/WebKit/Source/core/layout/LayoutFieldset.h b/third_party/WebKit/Source/core/layout/LayoutFieldset.h
index d00d1682..bdb7570 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFieldset.h
+++ b/third_party/WebKit/Source/core/layout/LayoutFieldset.h

@@ -24,11 +24,11 @@
 #ifndef LayoutFieldset_h
 #define LayoutFieldset_h
 
-#include "core/layout/LayoutBlockFlow.h"
+#include "core/layout/LayoutFlexibleBox.h"
 
 namespace blink {
 
-class LayoutFieldset final : public LayoutBlockFlow {
+class LayoutFieldset final : public LayoutFlexibleBox {
 public:
     explicit LayoutFieldset(Element*);
 
@@ -37,15 +37,27 @@
     const char* name() const override { return "LayoutFieldset"; }
 
 private:
-    bool isOfType(LayoutObjectType type) const override { return type == LayoutObjectFieldset || LayoutBlockFlow::isOfType(type); }
-
-    LayoutObject* layoutSpecialExcludedChild(bool relayoutChildren, SubtreeLayoutScope&) override;
-
-    void computePreferredLogicalWidths() override;
+    void addChild(LayoutObject* newChild, LayoutObject* beforeChild = nullptr) override;
     bool avoidsFloats() const override { return true; }
 
+    // We override the two baseline functions because we want our baseline to be the bottom of our margin box.
+    int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode) const override;
+    int inlineBlockBaseline(LineDirectionMode) const override { return -1; }
+
+    void computeIntrinsicLogicalWidths(LayoutUnit& minLogicalWidth, LayoutUnit& maxLogicalWidth) const override;
+    bool createsAnonymousWrapper() const override { return true; }
+    bool isOfType(LayoutObjectType type) const override { return type == LayoutObjectFieldset || LayoutFlexibleBox::isOfType(type); }
+    LayoutObject* layoutSpecialExcludedChild(bool relayoutChildren, SubtreeLayoutScope&) override;
     void paintBoxDecorationBackground(const PaintInfo&, const LayoutPoint&) const override;
     void paintMask(const PaintInfo&, const LayoutPoint&) const override;
+    void updateAnonymousChildStyle(const LayoutObject& child, ComputedStyle& childStyle) const override;
+
+    void createInnerBlock();
+    void setLogicalLeftForChild(LayoutBox& child, LayoutUnit logicalLeft);
+    void setLogicalTopForChild(LayoutBox& child, LayoutUnit logicalTop);
+    void removeChild(LayoutObject*) override;
+
+    LayoutBlock* m_innerBlock;
 };
 
 DEFINE_LAYOUT_OBJECT_TYPE_CASTS(LayoutFieldset, isFieldset());

diff --git a/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp b/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
index db7c5754..4fc5844 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.cpp

@@ -410,12 +410,12 @@
     BlockPainter::paintChildrenOfFlexibleBox(*this, paintInfo, paintOffset);
 }
 
-void LayoutFlexibleBox::repositionLogicalHeightDependentFlexItems(Vector<LineContext>& lineContexts)
+void LayoutFlexibleBox::repositionLogicalHeightDependentFlexItems(Vector<LineContext>& lineContexts, LayoutObject* childToExclude)
 {
     LayoutUnit crossAxisStartEdge = lineContexts.isEmpty() ? LayoutUnit() : lineContexts[0].crossAxisOffset;
     alignFlexLines(lineContexts);
 
-    alignChildren(lineContexts);
+    alignChildren(lineContexts, childToExclude);
 
     if (style()->flexWrap() == FlexWrapReverse)
         flipForWrapReverse(lineContexts, crossAxisStartEdge);
@@ -900,9 +900,14 @@
 
     PaintLayerScrollableArea::PreventRelayoutScope preventRelayoutScope(layoutScope);
 
+    // Fieldsets need to find their legend and position it inside the border of the object.
+    // The legend then gets skipped during normal layout.
+    // It doesn't get included in the normal layout process but is instead skipped.
+    LayoutObject* childToExclude = layoutSpecialExcludedChild(relayoutChildren, layoutScope);
+
     m_orderIterator.first();
     LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
-    while (computeNextFlexLine(orderedChildren, sumFlexBaseSize, totalFlexGrow, totalFlexShrink, totalWeightedFlexShrink, sumHypotheticalMainSize, relayoutChildren)) {
+    while (computeNextFlexLine(orderedChildren, sumFlexBaseSize, totalFlexGrow, totalFlexShrink, totalWeightedFlexShrink, sumHypotheticalMainSize, relayoutChildren, childToExclude)) {
         LayoutUnit containerMainInnerSize = mainAxisContentExtent(sumHypotheticalMainSize);
         // availableFreeSpace is the initial amount of free space in this flexbox.
         // remainingFreeSpace starts out at the same value but as we place and lay out
@@ -940,7 +945,7 @@
     }
 
     updateLogicalHeight();
-    repositionLogicalHeightDependentFlexItems(lineContexts);
+    repositionLogicalHeightDependentFlexItems(lineContexts, childToExclude);
 }
 
 LayoutUnit LayoutFlexibleBox::autoMarginOffsetInMainAxis(const OrderedFlexItemList& children, LayoutUnit& availableFreeSpace)
@@ -1229,7 +1234,7 @@
     return FlexItem(&child, childInnerFlexBaseSize, childMinMaxAppliedMainAxisExtent, borderAndPadding, margin);
 }
 
-bool LayoutFlexibleBox::computeNextFlexLine(OrderedFlexItemList& orderedChildren, LayoutUnit& sumFlexBaseSize, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink, LayoutUnit& sumHypotheticalMainSize, bool relayoutChildren)
+bool LayoutFlexibleBox::computeNextFlexLine(OrderedFlexItemList& orderedChildren, LayoutUnit& sumFlexBaseSize, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink, LayoutUnit& sumHypotheticalMainSize, bool relayoutChildren, LayoutObject* childToExclude)
 {
     orderedChildren.clear();
     sumFlexBaseSize = LayoutUnit();
@@ -1244,6 +1249,10 @@
     bool lineHasInFlowItem = false;
 
     for (LayoutBox* child = m_orderIterator.currentChild(); child; child = m_orderIterator.next()) {
+
+        if (childToExclude == child)
+            continue; // Skip this child, since it will be positioned by the specialized subclass (fieldsets runs).
+
         if (child->isOutOfFlowPositioned()) {
             orderedChildren.append(FlexItem(child));
             continue;
@@ -1816,7 +1825,7 @@
     setFlowAwareLocationForChild(child, flowAwareLocationForChild(child) + LayoutSize(LayoutUnit(), delta));
 }
 
-void LayoutFlexibleBox::alignChildren(const Vector<LineContext>& lineContexts)
+void LayoutFlexibleBox::alignChildren(const Vector<LineContext>& lineContexts, LayoutObject* childToExclude)
 {
     // Keep track of the space between the baseline edge and the after edge of the box for each line.
     Vector<LayoutUnit> minMarginAfterBaselines;
@@ -1829,6 +1838,8 @@
 
         for (size_t childNumber = 0; childNumber < lineContexts[lineNumber].numberOfChildren; ++childNumber, child = m_orderIterator.next()) {
             DCHECK(child);
+            if (child == childToExclude)
+                continue;
             if (child->isOutOfFlowPositioned()) {
                 if (style()->flexWrap() == FlexWrapReverse)
                     adjustAlignmentForChild(*child, lineCrossAxisExtent);

diff --git a/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h b/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h
index e247165..84fab81 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h
+++ b/third_party/WebKit/Source/core/layout/LayoutFlexibleBox.h

@@ -59,6 +59,7 @@
     void paintChildren(const PaintInfo&, const LayoutPoint&) const final;
 
     bool isHorizontalFlow() const;
+    virtual LayoutObject* layoutSpecialExcludedChild(bool relayoutChildren, SubtreeLayoutScope&) { return nullptr; }
 
     const OrderIterator& orderIterator() const { return m_orderIterator; }
 
@@ -162,7 +163,7 @@
     void updateAutoMarginsInMainAxis(LayoutBox& child, LayoutUnit autoMarginOffset);
     bool hasAutoMarginsInCrossAxis(const LayoutBox& child) const;
     bool updateAutoMarginsInCrossAxis(LayoutBox& child, LayoutUnit availableAlignmentSpace);
-    void repositionLogicalHeightDependentFlexItems(Vector<LineContext>&);
+    void repositionLogicalHeightDependentFlexItems(Vector<LineContext>&, LayoutObject* childToExclude);
     LayoutUnit clientLogicalBottomAfterRepositioning();
 
     LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, const LayoutBox& child);
@@ -175,7 +176,7 @@
     LayoutUnit adjustChildSizeForAspectRatioCrossAxisMinAndMax(const LayoutBox& child, LayoutUnit childSize);
     FlexItem constructFlexItem(LayoutBox& child, ChildLayoutType);
     // The hypothetical main size of an item is the flex base size clamped according to its min and max main size properties
-    bool computeNextFlexLine(OrderedFlexItemList& orderedChildren, LayoutUnit& sumFlexBaseSize, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink, LayoutUnit& sumHypotheticalMainSize, bool relayoutChildren);
+    bool computeNextFlexLine(OrderedFlexItemList& orderedChildren, LayoutUnit& sumFlexBaseSize, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink, LayoutUnit& sumHypotheticalMainSize, bool relayoutChildren, LayoutObject* childToExclude);
 
     void freezeInflexibleItems(FlexSign, OrderedFlexItemList& children, LayoutUnit& remainingFreeSpace, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink);
     bool resolveFlexibleLengths(FlexSign, OrderedFlexItemList&, LayoutUnit initialFreeSpace, LayoutUnit& remainingFreeSpace, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink);
@@ -188,7 +189,7 @@
     void layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList&, LayoutUnit availableFreeSpace, bool relayoutChildren, SubtreeLayoutScope&, Vector<LineContext>&);
     void layoutColumnReverse(const OrderedFlexItemList&, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace);
     void alignFlexLines(Vector<LineContext>&);
-    void alignChildren(const Vector<LineContext>&);
+    void alignChildren(const Vector<LineContext>&, LayoutObject* childToExclude);
     void applyStretchAlignmentToChild(LayoutBox& child, LayoutUnit lineCrossAxisExtent);
     void flipForRightToLeftColumn();
     void flipForWrapReverse(const Vector<LineContext>&, LayoutUnit crossAxisStartEdge);

diff --git a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
index 144d3bc9..0a0a80b 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGrid.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutGrid.cpp

@@ -49,15 +49,16 @@
     {
     }
 
-    const LayoutUnit& baseSize() const
+    LayoutUnit baseSize() const
     {
-        ASSERT(isGrowthLimitBiggerThanBaseSize());
+        DCHECK(isGrowthLimitBiggerThanBaseSize());
         return m_baseSize;
     }
 
-    const LayoutUnit& growthLimit() const
+    LayoutUnit growthLimit() const
     {
-        ASSERT(isGrowthLimitBiggerThanBaseSize());
+        DCHECK(isGrowthLimitBiggerThanBaseSize());
+        DCHECK(!m_growthLimitCap || m_growthLimitCap.value() >= m_growthLimit || m_baseSize >= m_growthLimitCap.value());
         return m_growthLimit;
     }
 
@@ -69,21 +70,13 @@
 
     void setGrowthLimit(LayoutUnit growthLimit)
     {
-        m_growthLimit = growthLimit;
+        m_growthLimit = growthLimit == infinity ? growthLimit : std::min(growthLimit, m_growthLimitCap.value_or(growthLimit));
         ensureGrowthLimitIsBiggerThanBaseSize();
     }
 
-    bool growthLimitIsInfinite() const
-    {
-        return m_growthLimit == infinity;
-    }
+    bool infiniteGrowthPotential() const { return growthLimitIsInfinite() || m_infinitelyGrowable; }
 
-    bool infiniteGrowthPotential() const
-    {
-        return growthLimitIsInfinite() || m_infinitelyGrowable;
-    }
-
-    const LayoutUnit& plannedSize() const { return m_plannedSize; }
+    LayoutUnit plannedSize() const { return m_plannedSize; }
 
     void setPlannedSize(const LayoutUnit& plannedSize)
     {
@@ -91,24 +84,34 @@
         m_plannedSize = plannedSize;
     }
 
-    const LayoutUnit& sizeDuringDistribution() { return m_sizeDuringDistribution; }
+    LayoutUnit sizeDuringDistribution() const { return m_sizeDuringDistribution; }
 
     void setSizeDuringDistribution(const LayoutUnit& sizeDuringDistribution)
     {
-        ASSERT(sizeDuringDistribution >= 0);
+        DCHECK_GE(sizeDuringDistribution, 0);
+        DCHECK(growthLimitIsInfinite() || growthLimit() >= sizeDuringDistribution);
         m_sizeDuringDistribution = sizeDuringDistribution;
     }
 
     void growSizeDuringDistribution(const LayoutUnit& sizeDuringDistribution)
     {
-        ASSERT(sizeDuringDistribution >= 0);
+        DCHECK_GE(sizeDuringDistribution, 0);
         m_sizeDuringDistribution += sizeDuringDistribution;
     }
 
     bool infinitelyGrowable() const { return m_infinitelyGrowable; }
     void setInfinitelyGrowable(bool infinitelyGrowable) { m_infinitelyGrowable = infinitelyGrowable; }
 
+    void setGrowthLimitCap(Optional<LayoutUnit> growthLimitCap)
+    {
+        DCHECK(!growthLimitCap || *growthLimitCap >= 0);
+        m_growthLimitCap = growthLimitCap;
+    }
+
+    Optional<LayoutUnit> growthLimitCap() const { return m_growthLimitCap; }
+
 private:
+    bool growthLimitIsInfinite() const { return m_growthLimit == infinity; }
     bool isGrowthLimitBiggerThanBaseSize() const { return growthLimitIsInfinite() || m_growthLimit >= m_baseSize; }
 
     void ensureGrowthLimitIsBiggerThanBaseSize()
@@ -121,6 +124,7 @@
     LayoutUnit m_growthLimit;
     LayoutUnit m_plannedSize;
     LayoutUnit m_sizeDuringDistribution;
+    Optional<LayoutUnit> m_growthLimitCap;
     bool m_infinitelyGrowable;
 };
 
@@ -250,7 +254,10 @@
     Vector<GridItemWithSpan> itemsSortedByIncreasingSpan;
     Vector<GridTrack*> growBeyondGrowthLimitsTracks;
 
-    LayoutUnit& freeSpaceForDirection(GridTrackSizingDirection direction) { return direction == ForColumns ? freeSpaceForColumns : freeSpaceForRows; }
+    LayoutUnit& freeSpace(GridTrackSizingDirection direction) { return direction == ForColumns ? freeSpaceForColumns : freeSpaceForRows; }
+
+    LayoutUnit availableSpace() const { return m_availableSpace; }
+    void setAvailableSpace(LayoutUnit availableSpace) { m_availableSpace = availableSpace; }
 
     SizingOperation sizingOperation { TrackSizing };
     enum SizingState { ColumnSizingFirstIteration, RowSizingFirstIteration, ColumnSizingSecondIteration, RowSizingSecondIteration};
@@ -290,6 +297,9 @@
 private:
     LayoutUnit freeSpaceForColumns { };
     LayoutUnit freeSpaceForRows { };
+    // No need to store one per direction as it will be only used for computations during each axis
+    // track sizing. It's cached here because we need it to compute relative sizes.
+    LayoutUnit m_availableSpace;
 };
 
 struct GridItemsSpanGroupRange {
@@ -309,6 +319,13 @@
 {
 }
 
+LayoutGrid* LayoutGrid::createAnonymous(Document* document)
+{
+    LayoutGrid* layoutGrid = new LayoutGrid(nullptr);
+    layoutGrid->setDocumentForAnonymous(document);
+    return layoutGrid;
+}
+
 void LayoutGrid::addChild(LayoutObject* newChild, LayoutObject* beforeChild)
 {
     LayoutBlock::addChild(newChild, beforeChild);
@@ -388,10 +405,11 @@
     return logicalHeight;
 }
 
-void LayoutGrid::computeTrackSizesForDirection(GridTrackSizingDirection direction, GridSizingData& sizingData, LayoutUnit freeSpace)
+void LayoutGrid::computeTrackSizesForDirection(GridTrackSizingDirection direction, GridSizingData& sizingData, LayoutUnit availableSpace)
 {
     DCHECK(sizingData.isValidTransition(direction));
-    sizingData.freeSpaceForDirection(direction) = freeSpace - guttersSize(direction, 0, direction == ForRows ? gridRowCount() : gridColumnCount());
+    sizingData.setAvailableSpace(availableSpace);
+    sizingData.freeSpace(direction) = availableSpace - guttersSize(direction, 0, direction == ForRows ? gridRowCount() : gridColumnCount());
     sizingData.sizingOperation = TrackSizing;
 
     LayoutUnit baseSizes, growthLimits;
@@ -577,7 +595,8 @@
     const_cast<LayoutGrid*>(this)->placeItemsOnGrid(IntrinsicSizeComputation);
 
     GridSizingData sizingData(gridColumnCount(), gridRowCount());
-    sizingData.freeSpaceForDirection(ForColumns) = LayoutUnit();
+    sizingData.setAvailableSpace(LayoutUnit());
+    sizingData.freeSpace(ForColumns) = LayoutUnit();
     sizingData.sizingOperation = IntrinsicSizeComputation;
     computeUsedBreadthOfGridTracks(ForColumns, sizingData, minLogicalWidth, maxLogicalWidth);
 
@@ -593,7 +612,8 @@
 void LayoutGrid::computeIntrinsicLogicalHeight(GridSizingData& sizingData)
 {
     ASSERT(tracksAreWiderThanMinTrackBreadth(ForColumns, sizingData));
-    sizingData.freeSpaceForDirection(ForRows) = LayoutUnit();
+    sizingData.setAvailableSpace(LayoutUnit());
+    sizingData.freeSpace(ForRows) = LayoutUnit();
     sizingData.sizingOperation = IntrinsicSizeComputation;
     computeUsedBreadthOfGridTracks(ForRows, sizingData, m_minContentHeight, m_maxContentHeight);
 
@@ -632,29 +652,31 @@
 
 void LayoutGrid::computeUsedBreadthOfGridTracks(GridTrackSizingDirection direction, GridSizingData& sizingData, LayoutUnit& baseSizesWithoutMaximization, LayoutUnit& growthLimitsWithoutMaximization) const
 {
-    LayoutUnit& freeSpace = sizingData.freeSpaceForDirection(direction);
+    LayoutUnit& freeSpace = sizingData.freeSpace(direction);
     const LayoutUnit initialFreeSpace = freeSpace;
     Vector<GridTrack>& tracks = (direction == ForColumns) ? sizingData.columnTracks : sizingData.rowTracks;
     Vector<size_t> flexibleSizedTracksIndex;
     sizingData.contentSizedTracksIndex.shrink(0);
 
-    LayoutUnit maxSize = std::max(LayoutUnit(), initialFreeSpace);
     // Grid gutters were removed from freeSpace by the caller, but we must use them to compute relative (i.e. percentages) sizes.
+    LayoutUnit maxSize = sizingData.availableSpace().clampNegativeToZero();
     bool hasDefiniteFreeSpace = sizingData.sizingOperation == TrackSizing;
-    if (hasDefiniteFreeSpace)
-        maxSize += guttersSize(direction, 0, direction == ForRows ? gridRowCount() : gridColumnCount());
 
     // 1. Initialize per Grid track variables.
     for (size_t i = 0; i < tracks.size(); ++i) {
         GridTrack& track = tracks[i];
         GridTrackSize trackSize = gridTrackSize(direction, i, sizingData.sizingOperation);
-        const GridLength& minTrackBreadth = trackSize.minTrackBreadth();
-        const GridLength& maxTrackBreadth = trackSize.maxTrackBreadth();
 
-        track.setBaseSize(computeUsedBreadthOfMinLength(minTrackBreadth, maxSize));
-        track.setGrowthLimit(computeUsedBreadthOfMaxLength(maxTrackBreadth, track.baseSize(), maxSize));
+        track.setBaseSize(computeUsedBreadthOfMinLength(trackSize, maxSize));
+        track.setGrowthLimit(computeUsedBreadthOfMaxLength(trackSize, track.baseSize(), maxSize));
         track.setInfinitelyGrowable(false);
 
+        if (trackSize.isFitContent()) {
+            GridLength gridLength = trackSize.length();
+            if (!gridLength.hasPercentage() || hasDefiniteFreeSpace)
+                track.setGrowthLimitCap(valueForLength(gridLength.length(), maxSize));
+        }
+
         if (trackSize.isContentSized())
             sizingData.contentSizedTracksIndex.append(i);
         if (trackSize.maxTrackBreadth().isFlex())
@@ -667,10 +689,13 @@
 
     baseSizesWithoutMaximization = growthLimitsWithoutMaximization = LayoutUnit();
 
-    for (const auto& track: tracks) {
+    for (auto& track: tracks) {
         ASSERT(!track.infiniteGrowthPotential());
         baseSizesWithoutMaximization += track.baseSize();
         growthLimitsWithoutMaximization += track.growthLimit();
+        // The growth limit caps must be cleared now in order to properly sort tracks by growth
+        // potential on an eventual "Maximize Tracks".
+        track.setGrowthLimitCap(WTF::nullopt);
     }
     freeSpace = initialFreeSpace - baseSizesWithoutMaximization;
 
@@ -737,8 +762,9 @@
     }
 }
 
-LayoutUnit LayoutGrid::computeUsedBreadthOfMinLength(const GridLength& gridLength, LayoutUnit maxSize) const
+LayoutUnit LayoutGrid::computeUsedBreadthOfMinLength(const GridTrackSize& trackSize, LayoutUnit maxSize) const
 {
+    const GridLength& gridLength = trackSize.minTrackBreadth();
     if (gridLength.isFlex())
         return LayoutUnit();
 
@@ -750,8 +776,9 @@
     return LayoutUnit();
 }
 
-LayoutUnit LayoutGrid::computeUsedBreadthOfMaxLength(const GridLength& gridLength, LayoutUnit usedBreadth, LayoutUnit maxSize) const
+LayoutUnit LayoutGrid::computeUsedBreadthOfMaxLength(const GridTrackSize& trackSize, LayoutUnit usedBreadth, LayoutUnit maxSize) const
 {
+    const GridLength& gridLength = trackSize.maxTrackBreadth();
     if (gridLength.isFlex())
         return usedBreadth;
 
@@ -881,13 +908,14 @@
 {
     // Collapse empty auto repeat tracks if auto-fit.
     if (hasAutoRepeatEmptyTracks(direction) && isEmptyAutoRepeatTrack(direction, translatedIndex))
-        return { Length(Fixed), Length(Fixed) };
+        return { Length(Fixed), LengthTrackSizing };
 
     const GridTrackSize& trackSize = rawGridTrackSize(direction, translatedIndex);
+    if (trackSize.isFitContent())
+        return trackSize;
 
     GridLength minTrackBreadth = trackSize.minTrackBreadth();
     GridLength maxTrackBreadth = trackSize.maxTrackBreadth();
-
     // If the logical width/height of the grid container is indefinite, percentage values are treated as <auto>.
     if (minTrackBreadth.hasPercentage() || maxTrackBreadth.hasPercentage()) {
         // For the inline axis this only happens when we're computing the intrinsic sizes (AvailableSpaceIndefinite).
@@ -1094,7 +1122,7 @@
 
     for (const auto& trackIndex : sizingData.contentSizedTracksIndex) {
         GridTrack& track = (direction == ForColumns) ? sizingData.columnTracks[trackIndex] : sizingData.rowTracks[trackIndex];
-        if (track.growthLimitIsInfinite())
+        if (track.growthLimit() == infinity)
             track.setGrowthLimit(track.baseSize());
     }
 }
@@ -1111,13 +1139,19 @@
     else if (trackSize.hasAutoMinTrackBreadth())
         track.setBaseSize(std::max(track.baseSize(), minSizeForChild(gridItem, direction, sizingData)));
 
-    if (trackSize.hasMinContentMaxTrackBreadth())
+    if (trackSize.hasMinContentMaxTrackBreadth()) {
         track.setGrowthLimit(std::max(track.growthLimit(), minContentForChild(gridItem, direction, sizingData)));
-    else if (trackSize.hasMaxContentOrAutoMaxTrackBreadth())
-        track.setGrowthLimit(std::max(track.growthLimit(), maxContentForChild(gridItem, direction, sizingData)));
+    } else if (trackSize.hasMaxContentOrAutoMaxTrackBreadth()) {
+        LayoutUnit growthLimit = maxContentForChild(gridItem, direction, sizingData);
+        if (trackSize.isFitContent()) {
+            DCHECK(trackSize.length().isLength());
+            growthLimit = std::min(growthLimit, valueForLength(trackSize.length().length(), sizingData.availableSpace()));
+        }
+        track.setGrowthLimit(std::max(track.growthLimit(), growthLimit));
+    }
 }
 
-static const LayoutUnit& trackSizeForTrackSizeComputationPhase(TrackSizeComputationPhase phase, const GridTrack& track, TrackSizeRestriction restriction)
+static LayoutUnit trackSizeForTrackSizeComputationPhase(TrackSizeComputationPhase phase, const GridTrack& track, TrackSizeRestriction restriction)
 {
     switch (phase) {
     case ResolveIntrinsicMinimums:
@@ -1294,17 +1328,34 @@
 {
     // This check ensures that we respect the irreflexivity property of the strict weak ordering required by std::sort
     // (forall x: NOT x < x).
-    if (track1->infiniteGrowthPotential() && track2->infiniteGrowthPotential())
+    bool track1HasInfiniteGrowthPotentialWithoutCap = track1->infiniteGrowthPotential() && !track1->growthLimitCap();
+    bool track2HasInfiniteGrowthPotentialWithoutCap = track2->infiniteGrowthPotential() && !track2->growthLimitCap();
+
+    if (track1HasInfiniteGrowthPotentialWithoutCap && track2HasInfiniteGrowthPotentialWithoutCap)
         return false;
 
-    if (track1->infiniteGrowthPotential() || track2->infiniteGrowthPotential())
-        return track2->infiniteGrowthPotential();
+    if (track1HasInfiniteGrowthPotentialWithoutCap || track2HasInfiniteGrowthPotentialWithoutCap)
+        return track2HasInfiniteGrowthPotentialWithoutCap;
 
-    return (track1->growthLimit() - track1->baseSize()) < (track2->growthLimit() - track2->baseSize());
+    LayoutUnit track1Limit = track1->growthLimitCap().value_or(track1->growthLimit());
+    LayoutUnit track2Limit = track2->growthLimitCap().value_or(track2->growthLimit());
+    return (track1Limit - track1->baseSize()) < (track2Limit - track2->baseSize());
+}
+
+static void clampGrowthShareIfNeeded(TrackSizeComputationPhase phase, const GridTrack& track, LayoutUnit& growthShare)
+{
+    if (phase != ResolveMaxContentMaximums || !track.growthLimitCap())
+        return;
+
+    LayoutUnit distanceToCap = track.growthLimitCap().value() - track.sizeDuringDistribution();
+    if (distanceToCap <= 0)
+        return;
+
+    growthShare = std::min(growthShare, distanceToCap);
 }
 
 template <TrackSizeComputationPhase phase>
-void LayoutGrid::distributeSpaceToTracks(Vector<GridTrack*>& tracks, const Vector<GridTrack*>* growBeyondGrowthLimitsTracks, GridSizingData& sizingData, LayoutUnit& availableLogicalSpace) const
+void LayoutGrid::distributeSpaceToTracks(Vector<GridTrack*>& tracks, Vector<GridTrack*>* growBeyondGrowthLimitsTracks, GridSizingData& sizingData, LayoutUnit& availableLogicalSpace) const
 {
     ASSERT(availableLogicalSpace >= 0);
 
@@ -1320,6 +1371,7 @@
             LayoutUnit availableLogicalSpaceShare = availableLogicalSpace / (tracksSize - i);
             const LayoutUnit& trackBreadth = trackSizeForTrackSizeComputationPhase(phase, track, ForbidInfinity);
             LayoutUnit growthShare = track.infiniteGrowthPotential() ? availableLogicalSpaceShare : std::min(availableLogicalSpaceShare, track.growthLimit() - trackBreadth);
+            clampGrowthShareIfNeeded(phase, track, growthShare);
             DCHECK_GE(growthShare, 0) << "We must never shrink any grid track or else we can't guarantee we abide by our min-sizing function.";
             track.growSizeDuringDistribution(growthShare);
             availableLogicalSpace -= growthShare;
@@ -1327,10 +1379,17 @@
     }
 
     if (availableLogicalSpace > 0 && growBeyondGrowthLimitsTracks) {
+        // We need to sort them because there might be tracks with growth limit caps (like the ones
+        // with fit-content()) which cannot indefinitely grow over the limits.
+        if (phase == ResolveMaxContentMaximums)
+            std::sort(growBeyondGrowthLimitsTracks->begin(), growBeyondGrowthLimitsTracks->end(), sortByGridTrackGrowthPotential);
+
         size_t tracksGrowingAboveMaxBreadthSize = growBeyondGrowthLimitsTracks->size();
         for (size_t i = 0; i < tracksGrowingAboveMaxBreadthSize; ++i) {
             GridTrack* track = growBeyondGrowthLimitsTracks->at(i);
             LayoutUnit growthShare = availableLogicalSpace / (tracksGrowingAboveMaxBreadthSize - i);
+            clampGrowthShareIfNeeded(phase, *track, growthShare);
+            DCHECK_GE(growthShare, 0) << "We must never shrink any grid track or else we can't guarantee we abide by our min-sizing function.";
             track->growSizeDuringDistribution(growthShare);
             availableLogicalSpace -= growthShare;
         }
@@ -1344,11 +1403,10 @@
 bool LayoutGrid::tracksAreWiderThanMinTrackBreadth(GridTrackSizingDirection direction, GridSizingData& sizingData)
 {
     const Vector<GridTrack>& tracks = (direction == ForColumns) ? sizingData.columnTracks : sizingData.rowTracks;
-    LayoutUnit& maxSize = sizingData.freeSpaceForDirection(direction);
+    LayoutUnit& maxSize = sizingData.freeSpace(direction);
     for (size_t i = 0; i < tracks.size(); ++i) {
         GridTrackSize trackSize = gridTrackSize(direction, i, sizingData.sizingOperation);
-        const GridLength& minTrackBreadth = trackSize.minTrackBreadth();
-        if (computeUsedBreadthOfMinLength(minTrackBreadth, maxSize) > tracks[i].baseSize())
+        if (computeUsedBreadthOfMinLength(trackSize, maxSize) > tracks[i].baseSize())
             return false;
     }
     return true;
@@ -1797,7 +1855,7 @@
 
 void LayoutGrid::applyStretchAlignmentToTracksIfNeeded(GridTrackSizingDirection direction, GridSizingData& sizingData)
 {
-    LayoutUnit& availableSpace = sizingData.freeSpaceForDirection(direction);
+    LayoutUnit& availableSpace = sizingData.freeSpace(direction);
     if (availableSpace <= 0
         || (direction == ForColumns && styleRef().resolvedJustifyContentDistribution(contentAlignmentNormalBehavior()) != ContentDistributionStretch)
         || (direction == ForRows && styleRef().resolvedAlignContentDistribution(contentAlignmentNormalBehavior()) != ContentDistributionStretch))
@@ -2082,7 +2140,7 @@
     size_t numberOfTracks = tracks.size();
     size_t numberOfLines = numberOfTracks + 1;
     size_t lastLine = numberOfLines - 1;
-    ContentAlignmentData offset = computeContentPositionAndDistributionOffset(direction, sizingData.freeSpaceForDirection(direction), numberOfTracks);
+    ContentAlignmentData offset = computeContentPositionAndDistributionOffset(direction, sizingData.freeSpace(direction), numberOfTracks);
     auto& positions = isRowAxis ? m_columnPositions : m_rowPositions;
     positions.resize(numberOfLines);
     auto borderAndPadding = isRowAxis ? borderAndPaddingLogicalLeft() : borderAndPaddingBefore();

diff --git a/third_party/WebKit/Source/core/layout/LayoutGrid.h b/third_party/WebKit/Source/core/layout/LayoutGrid.h
index 70cc1573..c8de593 100644
--- a/third_party/WebKit/Source/core/layout/LayoutGrid.h
+++ b/third_party/WebKit/Source/core/layout/LayoutGrid.h

@@ -53,6 +53,7 @@
     explicit LayoutGrid(Element*);
     ~LayoutGrid() override;
 
+    static LayoutGrid* createAnonymous(Document*);
     const char* name() const override { return "LayoutGrid"; }
 
     void layoutBlock(bool relayoutChildren) override;
@@ -117,8 +118,8 @@
     struct GridSizingData;
     enum SizingOperation { TrackSizing, IntrinsicSizeComputation };
     void computeUsedBreadthOfGridTracks(GridTrackSizingDirection, GridSizingData&, LayoutUnit& baseSizesWithoutMaximization, LayoutUnit& growthLimitsWithoutMaximization) const;
-    LayoutUnit computeUsedBreadthOfMinLength(const GridLength&, LayoutUnit maxBreadth) const;
-    LayoutUnit computeUsedBreadthOfMaxLength(const GridLength&, LayoutUnit usedBreadth, LayoutUnit maxBreadth) const;
+    LayoutUnit computeUsedBreadthOfMinLength(const GridTrackSize&, LayoutUnit maxBreadth) const;
+    LayoutUnit computeUsedBreadthOfMaxLength(const GridTrackSize&, LayoutUnit usedBreadth, LayoutUnit maxBreadth) const;
     void resolveContentBasedTrackSizingFunctions(GridTrackSizingDirection, GridSizingData&) const;
 
     void ensureGridSize(size_t maximumRowSize, size_t maximumColumnSize);
@@ -157,7 +158,7 @@
     LayoutUnit currentItemSizeForTrackSizeComputationPhase(TrackSizeComputationPhase, LayoutBox&, GridTrackSizingDirection, GridSizingData&) const;
     void resolveContentBasedTrackSizingFunctionsForNonSpanningItems(GridTrackSizingDirection, const GridSpan&, LayoutBox& gridItem, GridTrack&, GridSizingData&) const;
     template <TrackSizeComputationPhase> void resolveContentBasedTrackSizingFunctionsForItems(GridTrackSizingDirection, GridSizingData&, const GridItemsSpanGroupRange&) const;
-    template <TrackSizeComputationPhase> void distributeSpaceToTracks(Vector<GridTrack*>&, const Vector<GridTrack*>* growBeyondGrowthLimitsTracks, GridSizingData&, LayoutUnit& availableLogicalSpace) const;
+    template <TrackSizeComputationPhase> void distributeSpaceToTracks(Vector<GridTrack*>&, Vector<GridTrack*>* growBeyondGrowthLimitsTracks, GridSizingData&, LayoutUnit& availableLogicalSpace) const;
 
     typedef HashSet<size_t, DefaultHash<size_t>::Hash, WTF::UnsignedWithZeroKeyHashTraits<size_t>> TrackIndexSet;
     double computeFlexFactorUnitSize(const Vector<GridTrack>&, GridTrackSizingDirection, double flexFactorSum, LayoutUnit& leftOverSpace, const Vector<size_t, 8>& flexibleTracksIndexes, std::unique_ptr<TrackIndexSet> tracksToTreatAsInflexible = nullptr) const;

diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 5dbf8d8..9c37179 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp

@@ -2515,7 +2515,8 @@
     }
 
     LayoutObject* destroyRoot = this;
-    for (LayoutObject* destroyRootParent = destroyRoot->parent(); destroyRootParent && destroyRootParent->isAnonymous(); destroyRoot = destroyRootParent, destroyRootParent = destroyRootParent->parent()) {
+    for (LayoutObject* destroyRootParent = destroyRoot->parent(); destroyRootParent && destroyRootParent->isAnonymous() && !destroyRootParent->parent()->createsAnonymousWrapper(); destroyRoot = destroyRootParent, destroyRootParent = destroyRootParent->parent()) {
+
         // Anonymous block continuations are tracked and destroyed elsewhere (see the bottom of LayoutBlock::removeChild)
         if (destroyRootParent->isLayoutBlockFlow() && toLayoutBlockFlow(destroyRootParent)->isAnonymousBlockContinuation())
             break;

diff --git a/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp b/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp
index 2a2a696..fc3084c 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObjectChildList.cpp

@@ -84,6 +84,8 @@
         if (notifyLayoutObject) {
             LayoutCounter::layoutObjectSubtreeWillBeDetached(oldChild);
             oldChild->willBeRemovedFromTree();
+        } else if (oldChild->isBox() && toLayoutBox(oldChild)->isOrthogonalWritingModeRoot()) {
+            toLayoutBox(oldChild)->unmarkOrthogonalWritingModeRoot();
         }
     }
 

diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp
index 2d681e8..ecfa21d 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp

@@ -9,6 +9,9 @@
 #include "core/layout/LayoutView.h"
 #include "core/paint/ObjectPaintProperties.h"
 
+#include <iomanip>
+#include <sstream>
+
 #ifndef NDEBUG
 
 namespace blink {
@@ -189,7 +192,253 @@
     }
 };
 
-} // anonymous namespace
+class PaintPropertyTreeGraphBuilder {
+public:
+    PaintPropertyTreeGraphBuilder() { }
+
+    void generateTreeGraph(const FrameView& frameView, StringBuilder& stringBuilder)
+    {
+        m_layout.str("");
+        m_properties.str("");
+        m_ownerEdges.str("");
+        m_properties << std::setprecision(2) << std::setiosflags(std::ios_base::fixed);
+
+        writeFrameViewNode(frameView, nullptr);
+
+        stringBuilder.append("digraph {\n");
+        stringBuilder.append("graph [rankdir=BT];\n");
+        stringBuilder.append("subgraph cluster_layout {\n");
+        std::string layoutStr = m_layout.str();
+        stringBuilder.append(layoutStr.c_str(), layoutStr.length());
+        stringBuilder.append("}\n");
+        stringBuilder.append("subgraph cluster_properties {\n");
+        std::string propertiesStr = m_properties.str();
+        stringBuilder.append(propertiesStr.c_str(), propertiesStr.length());
+        stringBuilder.append("}\n");
+        std::string ownersStr = m_ownerEdges.str();
+        stringBuilder.append(ownersStr.c_str(), ownersStr.length());
+        stringBuilder.append("}\n");
+    }
+
+private:
+    static String getTagName(Node* n)
+    {
+        if (n->isDocumentNode())
+            return "";
+        if (n->getNodeType() == Node::kCommentNode)
+            return "COMMENT";
+        return n->nodeName();
+    }
+
+    static void writeParentEdge(const void* node, const void* parent, const char* color, std::ostream& os)
+    {
+        os << "n" << node << " -> " << "n" << parent;
+        if (color)
+            os << " [color=" << color << "]";
+        os << ";" << std::endl;
+    }
+
+    void writeOwnerEdge(const void* node, const void* owner)
+    {
+        std::ostream& os = m_ownerEdges;
+        os << "n" << owner << " -> " << "n" << node << " [color=" << s_layoutNodeColor << ", arrowhead=dot, constraint=false];" << std::endl;
+    }
+
+    void writeTransformEdge(const void* node, const void* transform)
+    {
+        std::ostream& os = m_properties;
+        os << "n" << node << " -> " << "n" << transform << " [color=" << s_transformNodeColor << "];" << std::endl;
+    }
+
+    void writePaintPropertyNode(const TransformPaintPropertyNode& node, const void* owner, const char* label)
+    {
+        std::ostream& os = m_properties;
+        os << "n" << &node
+            << " [color=" << s_transformNodeColor
+            << ", fontcolor=" << s_transformNodeColor
+            << ", shape=box, label=\"" << label << "\\n";
+
+        const FloatPoint3D& origin = node.origin();
+        os << "origin=(";
+        os << origin.x() << "," << origin.y() << "," << origin.z() << ")\\n";
+
+        os << "flattensInheritedTransform=" << (node.flattensInheritedTransform() ? "true" : "false") << "\\n";
+        os << "renderingContextID=" << node.renderingContextID() << "\\n";
+
+        const TransformationMatrix& matrix = node.matrix();
+        os << "[" << std::setw(8) << matrix.m11() << "," << std::setw(8) << matrix.m12() << "," << std::setw(8) << matrix.m13() << "," << std::setw(8) << matrix.m14() << "\\n";
+        os << std::setw(9) << matrix.m21() << "," << std::setw(8) << matrix.m22() << "," << std::setw(8) << matrix.m23() << "," << std::setw(8) << matrix.m24() << "\\n";
+        os << std::setw(9) << matrix.m31() << "," << std::setw(8) << matrix.m32() << "," << std::setw(8) << matrix.m33() << "," << std::setw(8) << matrix.m34() << "\\n";
+        os << std::setw(9) << matrix.m41() << "," << std::setw(8) << matrix.m42() << "," << std::setw(8) << matrix.m43() << "," << std::setw(8) << matrix.m44() << "]";
+
+        TransformationMatrix::DecomposedType decomposition;
+        if (!node.matrix().decompose(decomposition))
+            os << "\\n(degenerate)";
+
+        os << "\"];" << std::endl;
+
+        if (owner)
+            writeOwnerEdge(&node, owner);
+        if (node.parent())
+            writeParentEdge(&node, node.parent(), s_transformNodeColor, os);
+    }
+
+    void writePaintPropertyNode(const ClipPaintPropertyNode& node, const void* owner, const char* label)
+    {
+        std::ostream& os = m_properties;
+        os << "n" << &node
+            << " [color=" << s_clipNodeColor
+            << ", fontcolor=" << s_clipNodeColor
+            << ", shape=box, label=\"" << label << "\\n";
+
+        LayoutRect rect(node.clipRect().rect());
+        if (IntRect(rect) == LayoutRect::infiniteIntRect())
+            os << "(infinite)";
+        else
+            os << "(" << rect.x() << ", " << rect.y() << ", " << rect.width() << ", " << rect.height() << ")";
+        os << "\"];" << std::endl;
+
+        if (owner)
+            writeOwnerEdge(&node, owner);
+        if (node.parent())
+            writeParentEdge(&node, node.parent(), s_clipNodeColor, os);
+        if (node.localTransformSpace())
+            writeTransformEdge(&node, node.localTransformSpace());
+    }
+
+    void writePaintPropertyNode(const EffectPaintPropertyNode& node, const void* owner, const char* label)
+    {
+        std::ostream& os = m_properties;
+        os << "n" << &node << " [shape=diamond, label=\"" << label << "\\n";
+        os << "opacity=" << node.opacity() << "\"];" << std::endl;
+
+        if (owner)
+            writeOwnerEdge(&node, owner);
+        if (node.parent())
+            writeParentEdge(&node, node.parent(), s_effectNodeColor, os);
+    }
+
+    void writeObjectPaintPropertyNodes(const LayoutObject& object)
+    {
+        const ObjectPaintProperties* properties = object.objectPaintProperties();
+        if (!properties)
+            return;
+        const TransformPaintPropertyNode* paintOffset = properties->paintOffsetTranslation();
+        if (paintOffset)
+            writePaintPropertyNode(*paintOffset, &object, "paintOffset");
+        const TransformPaintPropertyNode* transform = properties->transform();
+        if (transform)
+            writePaintPropertyNode(*transform, &object, "transform");
+        const TransformPaintPropertyNode* perspective = properties->perspective();
+        if (perspective)
+            writePaintPropertyNode(*perspective, &object, "perspective");
+        const TransformPaintPropertyNode* svgLocalToBorderBox = properties->svgLocalToBorderBoxTransform();
+        if (svgLocalToBorderBox)
+            writePaintPropertyNode(*svgLocalToBorderBox, &object, "svgLocalToBorderBox");
+        const TransformPaintPropertyNode* scrollTranslation = properties->scrollTranslation();
+        if (scrollTranslation)
+            writePaintPropertyNode(*scrollTranslation, &object, "scrollTranslation");
+        const TransformPaintPropertyNode* scrollbarPaintOffset = properties->scrollbarPaintOffset();
+        if (scrollbarPaintOffset)
+            writePaintPropertyNode(*scrollbarPaintOffset, &object, "scrollbarPaintOffset");
+        const EffectPaintPropertyNode* effect = properties->effect();
+        if (effect)
+            writePaintPropertyNode(*effect, &object, "effect");
+        const ClipPaintPropertyNode* cssClip = properties->cssClip();
+        if (cssClip)
+            writePaintPropertyNode(*cssClip, &object, "cssClip");
+        const ClipPaintPropertyNode* cssClipFixedPosition = properties->cssClipFixedPosition();
+        if (cssClipFixedPosition)
+            writePaintPropertyNode(*cssClipFixedPosition, &object, "cssClipFixedPosition");
+        const ClipPaintPropertyNode* overflowClip = properties->overflowClip();
+        if (overflowClip) {
+            writePaintPropertyNode(*overflowClip, &object, "overflowClip");
+            if (object.isLayoutView() && overflowClip->parent())
+                writePaintPropertyNode(*overflowClip->parent(), nullptr, "rootClip");
+        }
+    }
+
+    void writeFrameViewPaintPropertyNodes(const FrameView& frameView)
+    {
+        TransformPaintPropertyNode* rootTransform = frameView.rootTransform();
+        if (rootTransform)
+            writePaintPropertyNode(*rootTransform, &frameView, "rootTransform");
+        ClipPaintPropertyNode* rootClip = frameView.rootClip();
+        if (rootClip)
+            writePaintPropertyNode(*rootClip, &frameView, "rootClip");
+        EffectPaintPropertyNode* rootEffect = frameView.rootEffect();
+        if (rootEffect)
+            writePaintPropertyNode(*rootEffect, &frameView, "rootEffect");
+        TransformPaintPropertyNode* preTranslation = frameView.preTranslation();
+        if (preTranslation)
+            writePaintPropertyNode(*preTranslation, &frameView, "preTranslation");
+        TransformPaintPropertyNode* scrollTranslation = frameView.scrollTranslation();
+        if (scrollTranslation)
+            writePaintPropertyNode(*scrollTranslation, &frameView, "scrollTranslation");
+        ClipPaintPropertyNode* contentClip = frameView.contentClip();
+        if (contentClip)
+            writePaintPropertyNode(*contentClip, &frameView, "contentClip");
+    }
+
+    void writeLayoutObjectNode(const LayoutObject& object)
+    {
+        std::ostream& os = m_layout;
+        os << "n" << &object
+            << " [color=" << s_layoutNodeColor
+            << ", fontcolor=" << s_layoutNodeColor
+            << ", label=\"" << object.name();
+        Node* node = object.node();
+        if (node) {
+            os << "\\n" << getTagName(node).utf8().data();
+            if (node->isElementNode() && toElement(node)->hasID())
+                os << "\\nid=" << toElement(node)->getIdAttribute().utf8().data();
+        }
+        os << "\"];" << std::endl;
+        const void* parent = object.isLayoutView() ? (const void*) toLayoutView(object).frameView() : (const void*) object.parent();
+        writeParentEdge(&object, parent, s_layoutNodeColor, os);
+        writeObjectPaintPropertyNodes(object);
+        for (const LayoutObject* child = object.slowFirstChild(); child; child = child->nextSibling())
+            writeLayoutObjectNode(*child);
+        if (object.isLayoutPart() && toLayoutPart(object).widget() && toLayoutPart(object).widget()->isFrameView()) {
+            FrameView* frameView = static_cast<FrameView*>(toLayoutPart(object).widget());
+            writeFrameViewNode(*frameView, &object);
+        }
+    }
+
+    void writeFrameViewNode(const FrameView& frameView, const void* parent)
+    {
+        std::ostream& os = m_layout;
+        os << "n" << &frameView
+            << " [color=" << s_layoutNodeColor
+            << ", fontcolor=" << s_layoutNodeColor
+            << ", shape=doublecircle"
+            << ", label=FrameView];" << std::endl;
+
+        writeFrameViewPaintPropertyNodes(frameView);
+        if (parent)
+            writeParentEdge(&frameView, parent, s_layoutNodeColor, os);
+        LayoutView* layoutView = frameView.layoutView();
+        if (layoutView)
+            writeLayoutObjectNode(*layoutView);
+    }
+
+private:
+    static const char* s_layoutNodeColor;
+    static const char* s_transformNodeColor;
+    static const char* s_clipNodeColor;
+    static const char* s_effectNodeColor;
+
+    std::ostringstream m_layout;
+    std::ostringstream m_properties;
+    std::ostringstream m_ownerEdges;
+};
+
+const char* PaintPropertyTreeGraphBuilder::s_layoutNodeColor = "black";
+const char* PaintPropertyTreeGraphBuilder::s_transformNodeColor = "green";
+const char* PaintPropertyTreeGraphBuilder::s_clipNodeColor = "blue";
+const char* PaintPropertyTreeGraphBuilder::s_effectNodeColor = "black";
+
+} // namespace {
 } // namespace blink
 
 void showTransformPropertyTree(const blink::FrameView& rootFrame)
@@ -222,4 +471,12 @@
     blink::PropertyTreePrinter<blink::EffectPaintPropertyNode>().showPath(node);
 }
 
+String paintPropertyTreeGraph(const blink::FrameView& frameView)
+{
+    blink::PaintPropertyTreeGraphBuilder builder;
+    StringBuilder stringBuilder;
+    builder.generateTreeGraph(frameView, stringBuilder);
+    return stringBuilder.toString();
+}
+
 #endif

diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.h b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.h
index e00e9b4..7be0fed 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.h
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.h

@@ -6,6 +6,7 @@
 #define PaintPropertyTreePrinter_h
 
 #include "core/CoreExport.h"
+#include "wtf/text/WTFString.h"
 
 #ifndef NDEBUG
 
@@ -25,6 +26,7 @@
 CORE_EXPORT void showPaintPropertyPath(const blink::TransformPaintPropertyNode*);
 CORE_EXPORT void showPaintPropertyPath(const blink::ClipPaintPropertyNode*);
 CORE_EXPORT void showPaintPropertyPath(const blink::EffectPaintPropertyNode*);
+CORE_EXPORT String paintPropertyTreeGraph(const blink::FrameView&);
 
 #endif // ifndef NDEBUG
 

diff --git a/third_party/WebKit/Source/core/style/GridTrackSize.h b/third_party/WebKit/Source/core/style/GridTrackSize.h
index 9cd61495..5005aed 100644
--- a/third_party/WebKit/Source/core/style/GridTrackSize.h
+++ b/third_party/WebKit/Source/core/style/GridTrackSize.h

@@ -38,19 +38,25 @@
 
 enum GridTrackSizeType {
     LengthTrackSizing,
-    MinMaxTrackSizing
+    MinMaxTrackSizing,
+    FitContentTrackSizing
 };
 
+// This class represents a <track-size> from the spec. Althought there are 3 different types of
+// <track-size> there is always an equivalent minmax() representation that could represent any of
+// them. The only special case is fit-content(argument) which is similar to minmax(auto, max-content)
+// except that the track size is clamped at argument if it is greater than the auto minimum. At the
+// GridTrackSize level we don't need to worry about clamping so we treat that case exactly as
+// minmax(auto, max-content) althought we store the argument for later use in m_maxTrackBreadth.
 class GridTrackSize {
     DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
 public:
-    GridTrackSize(const GridLength& length)
-        : m_type(LengthTrackSizing)
-        , m_minTrackBreadth(length)
+    GridTrackSize(const GridLength& length, GridTrackSizeType trackSizeType = LengthTrackSizing)
+        : m_type(trackSizeType)
+        , m_minTrackBreadth(trackSizeType == FitContentTrackSizing ? Length(Auto) : length)
         , m_maxTrackBreadth(length)
-        , m_minTrackBreadthIsMaxContent(false)
-        , m_maxTrackBreadthIsMaxContent(false)
     {
+        DCHECK(trackSizeType == LengthTrackSizing || trackSizeType == FitContentTrackSizing);
         cacheMinMaxTrackBreadthTypes();
     }
 
@@ -58,27 +64,24 @@
         : m_type(MinMaxTrackSizing)
         , m_minTrackBreadth(minTrackBreadth)
         , m_maxTrackBreadth(maxTrackBreadth)
-        , m_minTrackBreadthIsMaxContent(false)
-        , m_maxTrackBreadthIsMaxContent(false)
     {
         cacheMinMaxTrackBreadthTypes();
     }
 
-    const GridLength& length() const
+    GridLength length() const
     {
-        ASSERT(m_type == LengthTrackSizing);
-        ASSERT(m_minTrackBreadth == m_maxTrackBreadth);
-        const GridLength& minTrackBreadth = m_minTrackBreadth;
-        return minTrackBreadth;
+        DCHECK(m_type == LengthTrackSizing || m_type == FitContentTrackSizing);
+        DCHECK(m_minTrackBreadth == m_maxTrackBreadth || m_type == FitContentTrackSizing);
+        return m_maxTrackBreadth;
     }
 
-    const GridLength& minTrackBreadth() const { return m_minTrackBreadth; }
-
-    const GridLength& maxTrackBreadth() const { return m_maxTrackBreadth; }
+    GridLength minTrackBreadth() const { return m_minTrackBreadth; }
+    GridLength maxTrackBreadth() const { return isFitContent() ? GridLength(Length(MaxContent)) : m_maxTrackBreadth; }
 
     GridTrackSizeType type() const { return m_type; }
 
     bool isContentSized() const { return m_minTrackBreadth.isContentSized() || m_maxTrackBreadth.isContentSized(); }
+    bool isFitContent() const { return m_type == FitContentTrackSizing; }
 
     bool operator==(const GridTrackSize& other) const
     {

diff --git a/third_party/WebKit/Source/core/timing/PerformanceResourceTiming.h b/third_party/WebKit/Source/core/timing/PerformanceResourceTiming.h
index dc852d1f..b3a9cfa 100644
--- a/third_party/WebKit/Source/core/timing/PerformanceResourceTiming.h
+++ b/third_party/WebKit/Source/core/timing/PerformanceResourceTiming.h

@@ -44,14 +44,14 @@
 class PerformanceResourceTiming final : public PerformanceEntry {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static PerformanceResourceTiming* create(const ResourceTimingInfo& info, double timeOrigin, double startTime, double lastRedirectEndTime, bool m_allowTimingDetails, bool m_allowRedirectDetails)
+    static PerformanceResourceTiming* create(const ResourceTimingInfo& info, double timeOrigin, double startTime, double lastRedirectEndTime, bool allowTimingDetails, bool allowRedirectDetails)
     {
-        return new PerformanceResourceTiming(info, timeOrigin, startTime, lastRedirectEndTime, m_allowTimingDetails, m_allowRedirectDetails);
+        return new PerformanceResourceTiming(info, timeOrigin, startTime, lastRedirectEndTime, allowTimingDetails, allowRedirectDetails);
     }
 
-    static PerformanceResourceTiming* create(const ResourceTimingInfo& info, double timeOrigin, double startTime, bool m_allowTimingDetails)
+    static PerformanceResourceTiming* create(const ResourceTimingInfo& info, double timeOrigin, double startTime, bool allowTimingDetails)
     {
-        return new PerformanceResourceTiming(info, timeOrigin, startTime, 0.0, m_allowTimingDetails, false);
+        return new PerformanceResourceTiming(info, timeOrigin, startTime, 0.0, allowTimingDetails, false);
     }
 
     AtomicString initiatorType() const;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index 20e9f143..5497068 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

@@ -537,6 +537,10 @@
     if (isHTMLHRElement(*getNode()))
         return SplitterRole;
 
+    if (isFieldset()) {
+        return GroupRole;
+    }
+
     return UnknownRole;
 }
 

diff --git a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.cpp b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.cpp
index f8b979b..7e3f30d 100644
--- a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.cpp
+++ b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.cpp

@@ -14,10 +14,6 @@
 
 namespace blink {
 
-BeforeInstallPromptEvent::BeforeInstallPromptEvent()
-{
-}
-
 BeforeInstallPromptEvent::BeforeInstallPromptEvent(const AtomicString& name, ExecutionContext* executionContext, const Vector<String>& platforms, int requestId, WebAppBannerClient* client)
     : Event(name, false, true)
     , m_platforms(platforms)

diff --git a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h
index dcc5bbe..403349f6 100644
--- a/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h
+++ b/third_party/WebKit/Source/modules/app_banner/BeforeInstallPromptEvent.h

@@ -24,12 +24,6 @@
 public:
     ~BeforeInstallPromptEvent() override;
 
-    // For EventModules.cpp
-    static BeforeInstallPromptEvent* create()
-    {
-        return new BeforeInstallPromptEvent();
-    }
-
     static BeforeInstallPromptEvent* create(const AtomicString& name, ExecutionContext* executionContext, const Vector<String>& platforms, int requestId, WebAppBannerClient* client)
     {
         return new BeforeInstallPromptEvent(name, executionContext, platforms, requestId, client);
@@ -50,7 +44,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    BeforeInstallPromptEvent();
     BeforeInstallPromptEvent(const AtomicString& name, ExecutionContext*, const Vector<String>& platforms, int requestId, WebAppBannerClient*);
     BeforeInstallPromptEvent(const AtomicString& name, const BeforeInstallPromptEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/background_sync/SyncEvent.cpp b/third_party/WebKit/Source/modules/background_sync/SyncEvent.cpp
index 96358cc..d9f2fb8 100644
--- a/third_party/WebKit/Source/modules/background_sync/SyncEvent.cpp
+++ b/third_party/WebKit/Source/modules/background_sync/SyncEvent.cpp

@@ -6,10 +6,6 @@
 
 namespace blink {
 
-SyncEvent::SyncEvent()
-{
-}
-
 SyncEvent::SyncEvent(const AtomicString& type, const String& tag, bool lastChance, WaitUntilObserver* observer)
     : ExtendableEvent(type, ExtendableEventInit(), observer)
     , m_tag(tag)

diff --git a/third_party/WebKit/Source/modules/background_sync/SyncEvent.h b/third_party/WebKit/Source/modules/background_sync/SyncEvent.h
index 867e07b..0223909 100644
--- a/third_party/WebKit/Source/modules/background_sync/SyncEvent.h
+++ b/third_party/WebKit/Source/modules/background_sync/SyncEvent.h

@@ -17,10 +17,6 @@
 class MODULES_EXPORT SyncEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static SyncEvent* create()
-    {
-        return new SyncEvent;
-    }
     static SyncEvent* create(const AtomicString& type, const String& tag, bool lastChance, WaitUntilObserver* observer)
     {
         return new SyncEvent(type, tag, lastChance, observer);
@@ -40,7 +36,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    SyncEvent();
     SyncEvent(const AtomicString& type, const String&, bool, WaitUntilObserver*);
     SyncEvent(const AtomicString& type, const SyncEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.cpp
index 28ed516..aad0eb82c 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.cpp

@@ -29,10 +29,6 @@
 
 namespace blink {
 
-MediaEncryptedEvent::MediaEncryptedEvent()
-{
-}
-
 MediaEncryptedEvent::MediaEncryptedEvent(const AtomicString& type, const MediaEncryptedEventInit& initializer)
     : Event(type, initializer)
     , m_initDataType(initializer.initDataType())

diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h
index 9724160..c26b156 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaEncryptedEvent.h

@@ -36,11 +36,6 @@
 public:
     ~MediaEncryptedEvent() override;
 
-    static MediaEncryptedEvent* create()
-    {
-        return new MediaEncryptedEvent;
-    }
-
     static MediaEncryptedEvent* create(const AtomicString& type, const MediaEncryptedEventInit& initializer)
     {
         return new MediaEncryptedEvent(type, initializer);
@@ -54,7 +49,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    MediaEncryptedEvent();
     MediaEncryptedEvent(const AtomicString& type, const MediaEncryptedEventInit& initializer);
 
     String m_initDataType;

diff --git a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.cpp b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.cpp
index 97bdf21a..60742f2 100644
--- a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.cpp
+++ b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.cpp

@@ -6,10 +6,6 @@
 
 namespace blink {
 
-GamepadEvent::GamepadEvent()
-{
-}
-
 GamepadEvent::GamepadEvent(const AtomicString& type, bool canBubble, bool cancelable, Gamepad* gamepad)
     : Event(type, canBubble, cancelable)
     , m_gamepad(gamepad)

diff --git a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h
index 89a7e17..0787a73 100644
--- a/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h
+++ b/third_party/WebKit/Source/modules/gamepad/GamepadEvent.h

@@ -14,10 +14,6 @@
 class GamepadEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static GamepadEvent* create()
-    {
-        return new GamepadEvent;
-    }
     static GamepadEvent* create(const AtomicString& type, bool canBubble, bool cancelable, Gamepad* gamepad)
     {
         return new GamepadEvent(type, canBubble, cancelable, gamepad);
@@ -35,7 +31,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    GamepadEvent();
     GamepadEvent(const AtomicString& type, bool canBubble, bool cancelable, Gamepad*);
     GamepadEvent(const AtomicString&, const GamepadEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp
index c5363d0..40f14672 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.cpp

@@ -10,12 +10,6 @@
 namespace blink {
 
 // static
-BlobEvent* BlobEvent::create()
-{
-    return new BlobEvent;
-}
-
-// static
 BlobEvent* BlobEvent::create(const AtomicString& type, const BlobEventInit& initializer)
 {
     return new BlobEvent(type, initializer);

diff --git a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h
index be00c34..49b382d 100644
--- a/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h
+++ b/third_party/WebKit/Source/modules/mediarecorder/BlobEvent.h

@@ -20,7 +20,6 @@
 public:
     ~BlobEvent() override {}
 
-    static BlobEvent* create();
     static BlobEvent* create(const AtomicString& type, const BlobEventInit& initializer);
     static BlobEvent* create(const AtomicString& type, Blob*);
 
@@ -32,7 +31,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    BlobEvent() {}
     BlobEvent(const AtomicString& type, const BlobEventInit& initializer);
     BlobEvent(const AtomicString& type, Blob*);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp
index 59a69872..342a4e5a 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.cpp

@@ -26,11 +26,6 @@
 
 namespace blink {
 
-MediaStreamEvent* MediaStreamEvent::create()
-{
-    return new MediaStreamEvent;
-}
-
 MediaStreamEvent* MediaStreamEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream* stream)
 {
     return new MediaStreamEvent(type, canBubble, cancelable, stream);
@@ -41,10 +36,6 @@
     return new MediaStreamEvent(type, initializer);
 }
 
-MediaStreamEvent::MediaStreamEvent()
-{
-}
-
 MediaStreamEvent::MediaStreamEvent(const AtomicString& type, bool canBubble, bool cancelable, MediaStream* stream)
     : Event(type, canBubble, cancelable)
     , m_stream(stream)
@@ -85,4 +76,3 @@
 }
 
 } // namespace blink
-

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h
index e65a5ef7..ad1a580d 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamEvent.h

@@ -37,7 +37,6 @@
 public:
     ~MediaStreamEvent() override;
 
-    static MediaStreamEvent* create();
     static MediaStreamEvent* create(const AtomicString& type, bool canBubble, bool cancelable, MediaStream*);
     static MediaStreamEvent* create(const AtomicString& type, const MediaStreamEventInit& initializer);
 
@@ -49,7 +48,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    MediaStreamEvent();
     MediaStreamEvent(const AtomicString& type, bool canBubble, bool cancelable, MediaStream*);
     MediaStreamEvent(const AtomicString& type, const MediaStreamEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp
index 80d4094..d60f74048 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.cpp

@@ -28,21 +28,11 @@
 
 namespace blink {
 
-MediaStreamTrackEvent* MediaStreamTrackEvent::create()
-{
-    return new MediaStreamTrackEvent;
-}
-
 MediaStreamTrackEvent* MediaStreamTrackEvent::create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack* track)
 {
     return new MediaStreamTrackEvent(type, canBubble, cancelable, track);
 }
 
-
-MediaStreamTrackEvent::MediaStreamTrackEvent()
-{
-}
-
 MediaStreamTrackEvent::MediaStreamTrackEvent(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack* track)
     : Event(type, canBubble, cancelable)
     , m_track(track)

diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h
index 5913012..8d0e61e 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrackEvent.h

@@ -37,7 +37,6 @@
 public:
     ~MediaStreamTrackEvent() override;
 
-    static MediaStreamTrackEvent* create();
     static MediaStreamTrackEvent* create(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack*);
 
     MediaStreamTrack* track() const;
@@ -48,7 +47,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    MediaStreamTrackEvent();
     MediaStreamTrackEvent(const AtomicString& type, bool canBubble, bool cancelable, MediaStreamTrack*);
 
     Member<MediaStreamTrack> m_track;

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationEvent.cpp b/third_party/WebKit/Source/modules/notifications/NotificationEvent.cpp
index 3c51f12..e93968c 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationEvent.cpp
+++ b/third_party/WebKit/Source/modules/notifications/NotificationEvent.cpp

@@ -9,11 +9,6 @@
 
 namespace blink {
 
-NotificationEvent::NotificationEvent()
-    : m_action(emptyString())
-{
-}
-
 NotificationEvent::NotificationEvent(const AtomicString& type, const NotificationEventInit& initializer)
     : ExtendableEvent(type, initializer)
     , m_action(initializer.action())

diff --git a/third_party/WebKit/Source/modules/notifications/NotificationEvent.h b/third_party/WebKit/Source/modules/notifications/NotificationEvent.h
index 1d080142..d454b12 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationEvent.h
+++ b/third_party/WebKit/Source/modules/notifications/NotificationEvent.h

@@ -18,10 +18,6 @@
 class MODULES_EXPORT NotificationEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static NotificationEvent* create()
-    {
-        return new NotificationEvent;
-    }
     static NotificationEvent* create(const AtomicString& type, const NotificationEventInit& initializer)
     {
         return new NotificationEvent(type, initializer);
@@ -41,7 +37,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    NotificationEvent();
     NotificationEvent(const AtomicString& type, const NotificationEventInit&);
     NotificationEvent(const AtomicString& type, const NotificationEventInit&, WaitUntilObserver*);
 

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.cpp
index f0fdc10..994c8ba 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.cpp

@@ -27,11 +27,6 @@
 
 namespace blink {
 
-RTCDTMFToneChangeEvent* RTCDTMFToneChangeEvent::create()
-{
-    return new RTCDTMFToneChangeEvent;
-}
-
 RTCDTMFToneChangeEvent* RTCDTMFToneChangeEvent::create(const String& tone)
 {
     return new RTCDTMFToneChangeEvent(tone);
@@ -43,10 +38,6 @@
     return new RTCDTMFToneChangeEvent(initializer);
 }
 
-RTCDTMFToneChangeEvent::RTCDTMFToneChangeEvent()
-{
-}
-
 RTCDTMFToneChangeEvent::RTCDTMFToneChangeEvent(const String& tone)
     : Event(EventTypeNames::tonechange, false, false)
     , m_tone(tone)
@@ -80,4 +71,3 @@
 }
 
 } // namespace blink
-

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.h b/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.h
index bbaf72c..5c3f302 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.h
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCDTMFToneChangeEvent.h

@@ -37,7 +37,6 @@
 public:
     ~RTCDTMFToneChangeEvent() override;
 
-    static RTCDTMFToneChangeEvent* create();
     static RTCDTMFToneChangeEvent* create(const String& tone);
     static RTCDTMFToneChangeEvent* create(const AtomicString& type, const RTCDTMFToneChangeEventInit& initializer);
 
@@ -48,7 +47,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    RTCDTMFToneChangeEvent();
     explicit RTCDTMFToneChangeEvent(const String& tone);
     explicit RTCDTMFToneChangeEvent(const RTCDTMFToneChangeEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.cpp
index fb68707..ca78c27d 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.cpp

@@ -26,21 +26,11 @@
 
 namespace blink {
 
-RTCDataChannelEvent* RTCDataChannelEvent::create()
-{
-    return new RTCDataChannelEvent;
-}
-
 RTCDataChannelEvent* RTCDataChannelEvent::create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel* channel)
 {
     return new RTCDataChannelEvent(type, canBubble, cancelable, channel);
 }
 
-
-RTCDataChannelEvent::RTCDataChannelEvent()
-{
-}
-
 RTCDataChannelEvent::RTCDataChannelEvent(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel* channel)
     : Event(type, canBubble, cancelable)
     , m_channel(channel)

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.h b/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.h
index 1fe7f58..d3d1bea2 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.h
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCDataChannelEvent.h

@@ -36,7 +36,6 @@
 public:
     ~RTCDataChannelEvent() override;
 
-    static RTCDataChannelEvent* create();
     static RTCDataChannelEvent* create(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel*);
 
     RTCDataChannel* channel() const;
@@ -46,7 +45,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    RTCDataChannelEvent();
     RTCDataChannelEvent(const AtomicString& type, bool canBubble, bool cancelable, RTCDataChannel*);
 
     Member<RTCDataChannel> m_channel;

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.cpp
index 5555821..56ba455b9 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.cpp

@@ -28,20 +28,11 @@
 
 namespace blink {
 
-RTCIceCandidateEvent* RTCIceCandidateEvent::create()
-{
-    return new RTCIceCandidateEvent;
-}
-
 RTCIceCandidateEvent* RTCIceCandidateEvent::create(bool canBubble, bool cancelable, RTCIceCandidate* candidate)
 {
     return new RTCIceCandidateEvent(canBubble, cancelable, candidate);
 }
 
-RTCIceCandidateEvent::RTCIceCandidateEvent()
-{
-}
-
 RTCIceCandidateEvent::RTCIceCandidateEvent(bool canBubble, bool cancelable, RTCIceCandidate* candidate)
     : Event(EventTypeNames::icecandidate, canBubble, cancelable)
     , m_candidate(candidate)
@@ -69,4 +60,3 @@
 }
 
 } // namespace blink
-

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.h b/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.h
index c201ed7..70e01a7 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.h
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCIceCandidateEvent.h

@@ -36,7 +36,6 @@
 public:
     ~RTCIceCandidateEvent() override;
 
-    static RTCIceCandidateEvent* create();
     static RTCIceCandidateEvent* create(bool canBubble, bool cancelable, RTCIceCandidate*);
 
     RTCIceCandidate* candidate() const;
@@ -46,7 +45,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    RTCIceCandidateEvent();
     RTCIceCandidateEvent(bool canBubble, bool cancelable, RTCIceCandidate*);
 
     Member<RTCIceCandidate> m_candidate;

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.cpp b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.cpp
index a2a70e89..97b1e6a 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.cpp

@@ -12,10 +12,6 @@
 {
 }
 
-PresentationConnectionAvailableEvent::PresentationConnectionAvailableEvent()
-{
-}
-
 PresentationConnectionAvailableEvent::PresentationConnectionAvailableEvent(const AtomicString& eventType, PresentationConnection* connection)
     : Event(eventType, false /* canBubble */, false /* cancelable */)
     , m_connection(connection)

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h
index 33f9adf7..9e284a5 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionAvailableEvent.h

@@ -21,10 +21,6 @@
 public:
     ~PresentationConnectionAvailableEvent() override;
 
-    static PresentationConnectionAvailableEvent* create()
-    {
-        return new PresentationConnectionAvailableEvent;
-    }
     static PresentationConnectionAvailableEvent* create(const AtomicString& eventType, PresentationConnection* connection)
     {
         return new PresentationConnectionAvailableEvent(eventType, connection);
@@ -41,7 +37,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    PresentationConnectionAvailableEvent();
     PresentationConnectionAvailableEvent(const AtomicString& eventType, PresentationConnection*);
     PresentationConnectionAvailableEvent(const AtomicString& eventType, const PresentationConnectionAvailableEventInit& initializer);
 

diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h
index fcbc103..13623fb 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnectionCloseEvent.h

@@ -20,11 +20,6 @@
 public:
     ~PresentationConnectionCloseEvent() override = default;
 
-    static PresentationConnectionCloseEvent* create()
-    {
-        return new PresentationConnectionCloseEvent;
-    }
-
     static PresentationConnectionCloseEvent* create(const AtomicString& eventType, const String& reason, const String& message)
     {
         return new PresentationConnectionCloseEvent(eventType, reason, message);
@@ -43,7 +38,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    PresentationConnectionCloseEvent() = default;
     PresentationConnectionCloseEvent(const AtomicString& eventType, const String& reason, const String& message);
     PresentationConnectionCloseEvent(const AtomicString& eventType, const PresentationConnectionCloseEventInit& initializer);
 

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushEvent.cpp b/third_party/WebKit/Source/modules/push_messaging/PushEvent.cpp
index d0c05b3..f24b2c93 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushEvent.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushEvent.cpp

@@ -8,10 +8,6 @@
 
 namespace blink {
 
-PushEvent::PushEvent()
-{
-}
-
 PushEvent::PushEvent(const AtomicString& type, PushMessageData* data, WaitUntilObserver* observer)
     : ExtendableEvent(type, ExtendableEventInit(), observer)
     , m_data(data)

diff --git a/third_party/WebKit/Source/modules/push_messaging/PushEvent.h b/third_party/WebKit/Source/modules/push_messaging/PushEvent.h
index 1446a10..009db17 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushEvent.h
+++ b/third_party/WebKit/Source/modules/push_messaging/PushEvent.h

@@ -20,10 +20,6 @@
 class MODULES_EXPORT PushEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static PushEvent* create()
-    {
-        return new PushEvent;
-    }
     static PushEvent* create(const AtomicString& type, PushMessageData* data, WaitUntilObserver* observer)
     {
         return new PushEvent(type, data, observer);
@@ -42,7 +38,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    PushEvent();
     PushEvent(const AtomicString& type, PushMessageData*, WaitUntilObserver*);
     PushEvent(const AtomicString& type, const PushEventInit&);
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp
index 75412f1..b265bda 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.cpp

@@ -35,11 +35,6 @@
 
 namespace blink {
 
-ExtendableEvent* ExtendableEvent::create()
-{
-    return new ExtendableEvent();
-}
-
 ExtendableEvent* ExtendableEvent::create(const AtomicString& type, const ExtendableEventInit& eventInit)
 {
     return new ExtendableEvent(type, eventInit);
@@ -60,10 +55,6 @@
         m_observer->waitUntil(scriptState, scriptPromise, exceptionState);
 }
 
-ExtendableEvent::ExtendableEvent()
-{
-}
-
 ExtendableEvent::ExtendableEvent(const AtomicString& type, const ExtendableEventInit& initializer)
     : Event(type, initializer)
 {

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h
index 08d19ae..223a07deb 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableEvent.h

@@ -43,7 +43,6 @@
 class MODULES_EXPORT ExtendableEvent : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static ExtendableEvent* create();
     static ExtendableEvent* create(const AtomicString& type, const ExtendableEventInit&);
     static ExtendableEvent* create(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
 
@@ -55,7 +54,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 protected:
-    ExtendableEvent();
     ExtendableEvent(const AtomicString& type, const ExtendableEventInit&);
     ExtendableEvent(const AtomicString& type, const ExtendableEventInit&, WaitUntilObserver*);
 

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
index 4ede4d9..f5f7c55 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp

@@ -6,11 +6,6 @@
 
 namespace blink {
 
-ExtendableMessageEvent* ExtendableMessageEvent::create()
-{
-    return new ExtendableMessageEvent;
-}
-
 ExtendableMessageEvent* ExtendableMessageEvent::create(const AtomicString& type, const ExtendableMessageEventInit& initializer)
 {
     return new ExtendableMessageEvent(type, initializer);
@@ -86,10 +81,6 @@
     ExtendableEvent::trace(visitor);
 }
 
-ExtendableMessageEvent::ExtendableMessageEvent()
-{
-}
-
 ExtendableMessageEvent::ExtendableMessageEvent(const AtomicString& type, const ExtendableMessageEventInit& initializer)
     : ExtendableMessageEvent(type, initializer, nullptr)
 {

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h
index 9ecbc92..8fbe9fb 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.h

@@ -16,7 +16,6 @@
     DEFINE_WRAPPERTYPEINFO();
 
 public:
-    static ExtendableMessageEvent* create();
     static ExtendableMessageEvent* create(const AtomicString& type, const ExtendableMessageEventInit& initializer);
     static ExtendableMessageEvent* create(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver*);
     static ExtendableMessageEvent* create(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver*);
@@ -36,7 +35,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    ExtendableMessageEvent();
     ExtendableMessageEvent(const AtomicString& type, const ExtendableMessageEventInit& initializer);
     ExtendableMessageEvent(const AtomicString& type, const ExtendableMessageEventInit& initializer, WaitUntilObserver*);
     ExtendableMessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, MessagePortArray* ports, WaitUntilObserver*);

diff --git a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp
index 47bf72a9..3d7e5a7 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.cpp

@@ -12,11 +12,6 @@
 
 namespace blink {
 
-FetchEvent* FetchEvent::create()
-{
-    return new FetchEvent();
-}
-
 FetchEvent* FetchEvent::create(ScriptState* scriptState, const AtomicString& type, const FetchEventInit& initializer)
 {
     return new FetchEvent(scriptState, type, initializer, nullptr, nullptr);
@@ -54,11 +49,6 @@
     return EventNames::FetchEvent;
 }
 
-FetchEvent::FetchEvent()
-    : m_isReload(false)
-{
-}
-
 FetchEvent::FetchEvent(ScriptState* scriptState, const AtomicString& type, const FetchEventInit& initializer, RespondWithObserver* respondWithObserver, WaitUntilObserver* waitUntilObserver)
     : ExtendableEvent(type, initializer, waitUntilObserver)
     , m_observer(respondWithObserver)

diff --git a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h
index 74e7b964a..550b505 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/FetchEvent.h

@@ -27,7 +27,6 @@
 class MODULES_EXPORT FetchEvent final : public ExtendableEvent {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static FetchEvent* create();
     static FetchEvent* create(ScriptState*, const AtomicString& type, const FetchEventInit&);
     static FetchEvent* create(ScriptState*, const AtomicString& type, const FetchEventInit&, RespondWithObserver*, WaitUntilObserver*);
 
@@ -42,7 +41,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 protected:
-    FetchEvent();
     FetchEvent(ScriptState*, const AtomicString& type, const FetchEventInit&, RespondWithObserver*, WaitUntilObserver*);
 
 private:

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.cpp
index 5f7653c..e0c491c 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.cpp

@@ -6,10 +6,6 @@
 
 namespace blink {
 
-ServiceWorkerMessageEvent::ServiceWorkerMessageEvent()
-{
-}
-
 ServiceWorkerMessageEvent::ServiceWorkerMessageEvent(const AtomicString& type, const ServiceWorkerMessageEventInit& initializer)
     : Event(type, initializer)
 {

diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h
index d1744d2..f655578 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerMessageEvent.h

@@ -16,11 +16,6 @@
 class MODULES_EXPORT ServiceWorkerMessageEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static ServiceWorkerMessageEvent* create()
-    {
-        return new ServiceWorkerMessageEvent;
-    }
-
     static ServiceWorkerMessageEvent* create(const AtomicString& type, const ServiceWorkerMessageEventInit& initializer)
     {
         return new ServiceWorkerMessageEvent(type, initializer);
@@ -46,7 +41,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    ServiceWorkerMessageEvent();
     ServiceWorkerMessageEvent(const AtomicString& type, const ServiceWorkerMessageEventInit& initializer);
     ServiceWorkerMessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, ServiceWorker* source, MessagePortArray* ports);
 

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp
index 6831fbd0..7159e86f 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.cpp

@@ -59,11 +59,6 @@
     return new SpeechRecognitionError(ErrorCodeToString(code), message);
 }
 
-SpeechRecognitionError* SpeechRecognitionError::create()
-{
-    return new SpeechRecognitionError(emptyString(), emptyString());
-}
-
 SpeechRecognitionError* SpeechRecognitionError::create(const AtomicString& eventName, const SpeechRecognitionErrorInit& initializer)
 {
     return new SpeechRecognitionError(eventName, initializer);

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h
index d2ee32e..4dad769 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionError.h

@@ -51,7 +51,6 @@
     };
 
     static SpeechRecognitionError* create(ErrorCode, const String&);
-    static SpeechRecognitionError* create();
     static SpeechRecognitionError* create(const AtomicString&, const SpeechRecognitionErrorInit&);
 
     const String& error() { return m_error; }

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp
index 8343dec..645951b9 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.cpp

@@ -27,11 +27,6 @@
 
 namespace blink {
 
-SpeechRecognitionEvent* SpeechRecognitionEvent::create()
-{
-    return new SpeechRecognitionEvent;
-}
-
 SpeechRecognitionEvent* SpeechRecognitionEvent::create(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
 {
     return new SpeechRecognitionEvent(eventName, initializer);
@@ -58,11 +53,6 @@
     return EventNames::SpeechRecognitionEvent;
 }
 
-SpeechRecognitionEvent::SpeechRecognitionEvent()
-    : m_resultIndex(0)
-{
-}
-
 SpeechRecognitionEvent::SpeechRecognitionEvent(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
     : Event(eventName, initializer)
     , m_resultIndex(0)

diff --git a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h
index 3d1d217..5b50cc0 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechRecognitionEvent.h

@@ -39,7 +39,6 @@
 class SpeechRecognitionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static SpeechRecognitionEvent* create();
     static SpeechRecognitionEvent* create(const AtomicString&, const SpeechRecognitionEventInit&);
     ~SpeechRecognitionEvent() override;
 
@@ -59,7 +58,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    SpeechRecognitionEvent();
     SpeechRecognitionEvent(const AtomicString&, const SpeechRecognitionEventInit&);
     SpeechRecognitionEvent(const AtomicString& eventName, unsigned long resultIndex, SpeechRecognitionResultList* results);
 

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h b/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h
index 01457f2..55fdca1 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIConnectionEvent.h

@@ -41,11 +41,6 @@
 class MIDIConnectionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static MIDIConnectionEvent* create()
-    {
-        return new MIDIConnectionEvent();
-    }
-
     static MIDIConnectionEvent* create(MIDIPort* port)
     {
         return new MIDIConnectionEvent(port);
@@ -63,9 +58,6 @@
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    MIDIConnectionEvent()
-        : Event(EventTypeNames::statechange, false, false) { }
-
     MIDIConnectionEvent(MIDIPort* port)
         : Event(EventTypeNames::statechange, false, false)
         , m_port(port) { }

diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h b/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h
index dceb77c3..7be592c5 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIMessageEvent.h

@@ -42,11 +42,6 @@
 class MIDIMessageEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static MIDIMessageEvent* create()
-    {
-        return new MIDIMessageEvent();
-    }
-
     static MIDIMessageEvent* create(double receivedTime, DOMUint8Array* data)
     {
         return new MIDIMessageEvent(receivedTime, data);
@@ -69,9 +64,6 @@
     }
 
 private:
-    MIDIMessageEvent()
-        : m_receivedTime(0) { }
-
     MIDIMessageEvent(double receivedTime, DOMUint8Array* data)
         : Event(EventTypeNames::midimessage, true, false)
         , m_receivedTime(receivedTime)

diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index c7094af..2f14bbe 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn

@@ -668,6 +668,24 @@
   }
 }
 
+# This source set is used for fuzzers that need an environment similar to unit
+# tests.
+source_set("blink_fuzzer_test_support") {
+  testonly = true
+  visibility = []  # Allow re-assignment of list.
+  visibility = [ "*" ]
+  sources = [
+    "testing/BlinkFuzzerTestSupport.cpp",
+    "testing/BlinkFuzzerTestSupport.h",
+  ]
+  deps = [
+    ":platform",
+    ":test_support",
+    "//content/test:test_support",
+    "//mojo/edk/system:system",
+  ]
+}
+
 # Fuzzer for blink::MHTMLParser.
 fuzzer_test("mhtml_parser_fuzzer") {
   sources = [

diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 740abe8e..70874c6 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in

@@ -180,7 +180,6 @@
 // crbug.com/417782 tracks enabling this by default.
 RootLayerScrolling
 RTCPeerConnectionNewGetStats status=test
-SandboxBlocksModals status=stable
 ScriptedSpeech status=stable
 // Scrolls to compensate for layout movements (bit.ly/scroll-anchoring).
 ScrollAnchoring settable_from_internals=True

diff --git a/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.cpp b/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.cpp
new file mode 100644
index 0000000..eeb40124
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.cpp

@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/testing/BlinkFuzzerTestSupport.h"
+
+#include "base/at_exit.h"
+#include "base/command_line.h"
+#include "mojo/edk/embedder/embedder.h"
+#include "platform/weborigin/SchemeRegistry.h"
+#include <content/test/blink_test_environment.h>
+
+namespace blink {
+
+void InitializeBlinkFuzzTest(int* argc, char ***argv)
+{
+    // Note: we don't tear anything down here after an iteration of the fuzzer
+    // is complete, this is for efficiency. We rerun the fuzzer with the same
+    // environment as the previous iteration.
+    base::AtExitManager atExit;
+
+    mojo::edk::Init();
+    base::CommandLine::Init(*argc, *argv);
+
+    content::SetUpBlinkTestEnvironment();
+
+    blink::SchemeRegistry::initialize();
+}
+
+} // namespace blink

diff --git a/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.h b/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.h
new file mode 100644
index 0000000..d0cbc46f
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/BlinkFuzzerTestSupport.h

@@ -0,0 +1,16 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BlinkFuzzerTestSupport_h
+#define BlinkFuzzerTestSupport_h
+
+namespace blink {
+
+// InitializeBlinkFuzzTest will spin up an environment similar to
+// webkit_unit_tests. It should be called in LLVMFuzzerInitialize.
+void InitializeBlinkFuzzTest(int* argc, char*** argv);
+
+} // namespace blink
+
+#endif // BlinkFuzzerTestSupport_h

diff --git a/third_party/WebKit/Source/platform/testing/DEPS b/third_party/WebKit/Source/platform/testing/DEPS
index adb0cd4..c5e2cc8 100644
--- a/third_party/WebKit/Source/platform/testing/DEPS
+++ b/third_party/WebKit/Source/platform/testing/DEPS

@@ -1,6 +1,7 @@
 include_rules = [
     # To whitelist base/ stuff Blink is allowed to include, we list up all
     # directories and files instead of writing 'base/'.
+    "+base/at_exit.h",
     "+base/command_line.h",
     "+base/i18n/icu_util.h",
     "+base/path_service.h",

diff --git a/third_party/WebKit/Source/web/WebCache.cpp b/third_party/WebKit/Source/web/WebCache.cpp
index a3309ef..6bd089e 100644
--- a/third_party/WebKit/Source/web/WebCache.cpp
+++ b/third_party/WebKit/Source/web/WebCache.cpp

@@ -43,8 +43,6 @@
     to.size = from.size;
     to.liveSize = from.liveSize;
     to.decodedSize = from.decodedSize;
-    to.purgeableSize = from.purgeableSize;
-    to.purgedSize = from.purgedSize;
 }
 
 void WebCache::setCapacities(

diff --git a/third_party/WebKit/public/web/WebCache.h b/third_party/WebKit/public/web/WebCache.h
index 7ea39c9..5bf1178 100644
--- a/third_party/WebKit/public/web/WebCache.h
+++ b/third_party/WebKit/public/web/WebCache.h

@@ -54,8 +54,6 @@
         size_t size;
         size_t liveSize;
         size_t decodedSize;
-        size_t purgedSize;
-        size_t purgeableSize;
     };
 
     // A struct mirroring blink::MemoryCache::Statistics.

diff --git a/third_party/webrtc_overrides/webrtc/base/task_queue.cc b/third_party/webrtc_overrides/webrtc/base/task_queue.cc
new file mode 100644
index 0000000..583554d
--- /dev/null
+++ b/third_party/webrtc_overrides/webrtc/base/task_queue.cc

@@ -0,0 +1,135 @@
+/*
+ *  Copyright 2016 The WebRTC Project Authors. All rights reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "third_party/webrtc_overrides/webrtc/base/task_queue.h"
+
+#include "base/bind.h"
+#include "base/lazy_instance.h"
+#include "base/threading/thread.h"
+#include "base/threading/thread_local.h"
+
+namespace rtc {
+namespace {
+
+void RunTask(std::unique_ptr<QueuedTask> task) {
+  if (!task->Run())
+    task.release();
+}
+
+class PostAndReplyTask : public QueuedTask {
+ public:
+  PostAndReplyTask(
+      std::unique_ptr<QueuedTask> task,
+      std::unique_ptr<QueuedTask> reply,
+      const scoped_refptr<base::SingleThreadTaskRunner>& reply_task_runner)
+      : task_(std::move(task)),
+        reply_(std::move(reply)),
+        reply_task_runner_(reply_task_runner) {}
+
+  ~PostAndReplyTask() override {}
+
+ private:
+  bool Run() override {
+    if (!task_->Run())
+      task_.release();
+
+    reply_task_runner_->PostTask(FROM_HERE,
+                                 base::Bind(&RunTask, base::Passed(&reply_)));
+    return true;
+  }
+
+  std::unique_ptr<QueuedTask> task_;
+  std::unique_ptr<QueuedTask> reply_;
+  scoped_refptr<base::SingleThreadTaskRunner> reply_task_runner_;
+};
+
+// A lazily created thread local storage for quick access to a TaskQueue.
+base::LazyInstance<base::ThreadLocalPointer<TaskQueue>>::Leaky lazy_tls_ptr =
+    LAZY_INSTANCE_INITIALIZER;
+
+}  // namespace
+
+bool TaskQueue::IsCurrent() const {
+  return Current() == this;
+}
+
+class TaskQueue::WorkerThread : public base::Thread {
+ public:
+  WorkerThread(const char* queue_name, TaskQueue* queue);
+  ~WorkerThread() override;
+
+ private:
+  virtual void Init() override;
+
+  TaskQueue* const queue_;
+};
+
+TaskQueue::WorkerThread::WorkerThread(const char* queue_name, TaskQueue* queue)
+    : base::Thread(queue_name), queue_(queue) {}
+
+void TaskQueue::WorkerThread::Init() {
+  lazy_tls_ptr.Pointer()->Set(queue_);
+}
+
+TaskQueue::WorkerThread::~WorkerThread() {
+  DCHECK(!Thread::IsRunning());
+}
+
+TaskQueue::TaskQueue(const char* queue_name)
+    : thread_(
+          std::unique_ptr<WorkerThread>(new WorkerThread(queue_name, this))) {
+  DCHECK(queue_name);
+  bool result = thread_->Start();
+  CHECK(result);
+}
+
+TaskQueue::~TaskQueue() {
+  DCHECK(!IsCurrent());
+  thread_->Stop();
+}
+
+// static
+TaskQueue* TaskQueue::Current() {
+  return lazy_tls_ptr.Pointer()->Get();
+}
+
+// static
+bool TaskQueue::IsCurrent(const char* queue_name) {
+  TaskQueue* current = Current();
+  return current && current->thread_->thread_name().compare(queue_name) == 0;
+}
+
+void TaskQueue::PostTask(std::unique_ptr<QueuedTask> task) {
+  thread_->task_runner()->PostTask(FROM_HERE,
+                                   base::Bind(&RunTask, base::Passed(&task)));
+}
+
+void TaskQueue::PostDelayedTask(std::unique_ptr<QueuedTask> task,
+                                uint32_t milliseconds) {
+  thread_->task_runner()->PostDelayedTask(
+      FROM_HERE, base::Bind(&RunTask, base::Passed(&task)),
+      base::TimeDelta::FromMilliseconds(milliseconds));
+}
+
+void TaskQueue::PostTaskAndReply(std::unique_ptr<QueuedTask> task,
+                                 std::unique_ptr<QueuedTask> reply,
+                                 TaskQueue* reply_queue) {
+  PostTask(std::unique_ptr<QueuedTask>(new PostAndReplyTask(
+      std::move(task), std::move(reply), reply_queue->thread_->task_runner())));
+}
+
+void TaskQueue::PostTaskAndReply(std::unique_ptr<QueuedTask> task,
+                                 std::unique_ptr<QueuedTask> reply) {
+  thread_->task_runner()->PostTaskAndReply(
+      FROM_HERE, base::Bind(&RunTask, base::Passed(&task)),
+      base::Bind(&RunTask, base::Passed(&reply)));
+}
+
+}  // namespace rtc

diff --git a/third_party/webrtc_overrides/webrtc/base/task_queue.h b/third_party/webrtc_overrides/webrtc/base/task_queue.h
index f2841acc..1ecc754 100644
--- a/third_party/webrtc_overrides/webrtc/base/task_queue.h
+++ b/third_party/webrtc_overrides/webrtc/base/task_queue.h

@@ -11,25 +11,11 @@
 #ifndef WEBRTC_BASE_TASK_QUEUE_H_
 #define WEBRTC_BASE_TASK_QUEUE_H_
 
-#include <list>
 #include <memory>
-#include <unordered_map>
+#include <stdint.h>
 
-#if defined(WEBRTC_MAC) && !defined(WEBRTC_BUILD_LIBEVENT)
-#include <dispatch/dispatch.h>
-#endif
-
-#include "third_party/webrtc/base/constructormagic.h"
-#include "third_party/webrtc/base/criticalsection.h"
-
-#if defined(WEBRTC_WIN) || defined(WEBRTC_BUILD_LIBEVENT)
-#include "third_party/webrtc/base/platform_thread.h"
-#endif
-
-#if defined(WEBRTC_BUILD_LIBEVENT)
-struct event_base;
-struct event;
-#endif
+#include "base/macros.h"
+#include "third_party/webrtc/base/thread_annotations.h"
 
 namespace rtc {
 
@@ -49,7 +35,7 @@
   virtual bool Run() = 0;
 
  private:
-  RTC_DISALLOW_COPY_AND_ASSIGN(QueuedTask);
+  DISALLOW_COPY_AND_ASSIGN(QueuedTask);
 };
 
 // Simple implementation of QueuedTask for use with rtc::Bind and lambdas.
@@ -225,55 +211,10 @@
   }
 
  private:
-#if defined(WEBRTC_BUILD_LIBEVENT)
-  static bool ThreadMain(void* context);
-  static void OnWakeup(int socket, short flags, void* context);  // NOLINT
-  static void RunTask(int fd, short flags, void* context);       // NOLINT
-  static void RunTimer(int fd, short flags, void* context);      // NOLINT
+  class WorkerThread;
 
-  class PostAndReplyTask;
-  class SetTimerTask;
-
-  void PrepareReplyTask(PostAndReplyTask* reply_task);
-  void ReplyTaskDone(PostAndReplyTask* reply_task);
-
-  struct QueueContext;
-
-  int wakeup_pipe_in_ = -1;
-  int wakeup_pipe_out_ = -1;
-  event_base* event_base_;
-  std::unique_ptr<event> wakeup_event_;
-  PlatformThread thread_;
-  rtc::CriticalSection pending_lock_;
-  std::list<std::unique_ptr<QueuedTask>> pending_ GUARDED_BY(pending_lock_);
-  std::list<PostAndReplyTask*> pending_replies_ GUARDED_BY(pending_lock_);
-#elif defined(WEBRTC_MAC)
-  struct QueueContext;
-  struct TaskContext;
-  struct PostTaskAndReplyContext;
-  dispatch_queue_t queue_;
-  QueueContext* const context_;
-#elif defined(WEBRTC_WIN)
-  typedef std::unordered_map<UINT_PTR, std::unique_ptr<QueuedTask>>
-      DelayedTasks;
-  static bool ThreadMain(void* context);
-  static bool ProcessQueuedMessages(DelayedTasks* delayed_tasks);
-
-  class WorkerThread : public PlatformThread {
-   public:
-    WorkerThread(ThreadRunFunction func, void* obj, const char* thread_name)
-        : PlatformThread(func, obj, thread_name) {}
-
-    bool QueueAPC(PAPCFUNC apc_function, ULONG_PTR data) {
-      return PlatformThread::QueueAPC(apc_function, data);
-    }
-  };
-  WorkerThread thread_;
-#else
-#error not supported.
-#endif
-
-  RTC_DISALLOW_COPY_AND_ASSIGN(TaskQueue);
+  std::unique_ptr<WorkerThread> thread_;
+  DISALLOW_COPY_AND_ASSIGN(TaskQueue);
 };
 
 }  // namespace rtc

diff --git a/tools/clang/base_bind_rewriters/BaseBindRewriters.cpp b/tools/clang/base_bind_rewriters/BaseBindRewriters.cpp
new file mode 100644
index 0000000..55877c3
--- /dev/null
+++ b/tools/clang/base_bind_rewriters/BaseBindRewriters.cpp

@@ -0,0 +1,112 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// This file containts a clang tool to update base::Bind() callers:
+//  * Remove unneeded scoped_refptr<>::get() on method binding.
+
+#include <assert.h>
+#include <algorithm>
+#include <memory>
+#include <string>
+
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/ASTMatchers/ASTMatchersMacros.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/Basic/SourceManager.h"
+#include "clang/Frontend/FrontendActions.h"
+#include "clang/Lex/Lexer.h"
+#include "clang/Tooling/CommonOptionsParser.h"
+#include "clang/Tooling/Refactoring.h"
+#include "clang/Tooling/Tooling.h"
+#include "llvm/Support/CommandLine.h"
+#include "llvm/Support/TargetSelect.h"
+
+using namespace clang::ast_matchers;
+using clang::tooling::CommonOptionsParser;
+using Replacements = std::vector<clang::tooling::Replacement>;
+
+namespace {
+
+// Remove unneeded scoped_refptr<>::get on a receivers of method bind.
+// Example:
+//   // Before
+//   scoped_refptr<Foo> foo;
+//   base::Bind(&Foo::Bar, foo.get());
+//
+//   // After
+//   scoped_refptr<Foo> foo;
+//   base::Bind(&Foo::Bar, foo);
+//
+class ScopedRefptrGetRewriter : public MatchFinder::MatchCallback {
+ public:
+  explicit ScopedRefptrGetRewriter(Replacements* replacements)
+      : replacements_(replacements) {}
+
+  StatementMatcher GetMatcher() {
+    auto is_bind_call = callee(namedDecl(hasName("::base::Bind")));
+    auto is_method_bind = hasArgument(0, hasType(memberPointerType()));
+    auto is_raw_pointer_receiver = hasArgument(1, hasType(pointerType()));
+    auto is_scoped_refptr_get_call =
+        cxxMemberCallExpr(thisPointerType(namedDecl(hasName("scoped_refptr"))),
+                          callee(namedDecl(hasName("get"))));
+    return callExpr(is_bind_call, is_method_bind, is_raw_pointer_receiver,
+                    hasArgument(1, is_scoped_refptr_get_call),
+                    hasArgument(1, stmt().bind("target")));
+  }
+
+  void run(const MatchFinder::MatchResult& result) override {
+    auto* target = result.Nodes.getNodeAs<clang::CXXMemberCallExpr>("target");
+    auto* member = llvm::cast<clang::MemberExpr>(target->getCallee());
+    assert(target && member && "Unexpected match! No Expr captured!");
+    auto range = clang::CharSourceRange::getTokenRange(
+        result.SourceManager->getSpellingLoc(member->getOperatorLoc()),
+        result.SourceManager->getSpellingLoc(target->getLocEnd()));
+
+    replacements_->emplace_back(*result.SourceManager, range, "");
+  }
+
+ private:
+  Replacements* replacements_;
+};
+
+llvm::cl::extrahelp common_help(CommonOptionsParser::HelpMessage);
+
+}  // namespace.
+
+int main(int argc, const char* argv[]) {
+  llvm::InitializeNativeTarget();
+  llvm::InitializeNativeTargetAsmParser();
+  llvm::cl::OptionCategory category(
+      "Remove raw pointer on the receiver of Bind() target");
+  CommonOptionsParser options(argc, argv, category);
+  clang::tooling::ClangTool tool(options.getCompilations(),
+                                 options.getSourcePathList());
+
+  MatchFinder match_finder;
+  std::vector<clang::tooling::Replacement> replacements;
+
+
+  ScopedRefptrGetRewriter scoped_refptr_rewriter(&replacements);
+  match_finder.addMatcher(scoped_refptr_rewriter.GetMatcher(),
+                          &scoped_refptr_rewriter);
+
+  std::unique_ptr<clang::tooling::FrontendActionFactory> factory =
+      clang::tooling::newFrontendActionFactory(&match_finder);
+  int result = tool.run(factory.get());
+  if (result != 0)
+    return result;
+
+  // Serialization format is documented in tools/clang/scripts/run_tool.py
+  llvm::outs() << "==== BEGIN EDITS ====\n";
+  for (const auto& r : replacements) {
+    std::string replacement_text = r.getReplacementText().str();
+    std::replace(replacement_text.begin(), replacement_text.end(), '\n', '\0');
+    llvm::outs() << "r:::" << r.getFilePath() << ":::" << r.getOffset()
+                 << ":::" << r.getLength() << ":::" << replacement_text << "\n";
+  }
+  llvm::outs() << "==== END EDITS ====\n";
+
+  return 0;
+}

diff --git a/tools/clang/base_bind_rewriters/CMakeLists.txt b/tools/clang/base_bind_rewriters/CMakeLists.txt
new file mode 100644
index 0000000..2939061
--- /dev/null
+++ b/tools/clang/base_bind_rewriters/CMakeLists.txt

@@ -0,0 +1,28 @@
+set(LLVM_LINK_COMPONENTS
+  BitReader
+  MCParser
+  Option
+  X86AsmParser
+  X86CodeGen
+  )
+
+add_llvm_executable(base_bind_rewriters
+  BaseBindRewriters.cpp
+  )
+
+target_link_libraries(base_bind_rewriters
+  clangAST
+  clangASTMatchers
+  clangAnalysis
+  clangBasic
+  clangDriver
+  clangEdit
+  clangFrontend
+  clangLex
+  clangParse
+  clangSema
+  clangSerialization
+  clangTooling
+  )
+
+cr_install(TARGETS base_bind_rewriters RUNTIME DESTINATION bin)

diff --git a/tools/clang/base_bind_rewriters/tests/test-expected.cc b/tools/clang/base_bind_rewriters/tests/test-expected.cc
new file mode 100644
index 0000000..59a3b1c4
--- /dev/null
+++ b/tools/clang/base_bind_rewriters/tests/test-expected.cc

@@ -0,0 +1,35 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+template <typename>
+class scoped_refptr {
+ public:
+  void* get() { return 0; }
+};
+
+namespace base {
+
+template <typename Functor, typename... Args>
+void Bind(Functor&&, Args&&...) {}
+
+}  // namespace base
+
+struct Foo {
+  void Bar();
+  static void Baz();
+};
+
+void Test() {
+  using base::Bind;
+  scoped_refptr<int> foo;
+  base::Bind(&Foo::Bar, foo);
+  Bind(&Foo::Bar, foo);
+  base::Bind(&Foo::Bar, (&foo));
+  base::Bind(&Foo::Bar, foo);
+  base::Bind(&Foo::Bar, foo);
+  base::Bind(&Foo::Bar, foo, foo.get());
+  base::Bind(&Foo::Baz, foo.get());
+  base::Bind(&Foo::Bar, foo);
+  base::Bind(&Foo::Bar, (&foo));
+}

diff --git a/tools/clang/base_bind_rewriters/tests/test-original.cc b/tools/clang/base_bind_rewriters/tests/test-original.cc
new file mode 100644
index 0000000..89acfde
--- /dev/null
+++ b/tools/clang/base_bind_rewriters/tests/test-original.cc

@@ -0,0 +1,37 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+template <typename>
+class scoped_refptr {
+ public:
+  void* get() { return 0; }
+};
+
+namespace base {
+
+template <typename Functor, typename... Args>
+void Bind(Functor&&, Args&&...) {}
+
+}  // namespace base
+
+struct Foo {
+  void Bar();
+  static void Baz();
+};
+
+void Test() {
+  using base::Bind;
+  scoped_refptr<int> foo;
+  base::Bind(&Foo::Bar, foo.get());
+  Bind(&Foo::Bar, foo.get());
+  base::Bind(&Foo::Bar, (&foo)->get());
+  base::Bind(&Foo::Bar, foo.get(
+       ));
+  base::Bind(&Foo::Bar, foo
+       .get());
+  base::Bind(&Foo::Bar, foo.get(), foo.get());
+  base::Bind(&Foo::Baz, foo.get());
+  base::Bind(&Foo::Bar, foo.scoped_refptr<int>::get());
+  base::Bind(&Foo::Bar, (&foo)->scoped_refptr<int>::get());
+}

diff --git a/tools/mb/mb_config.pyl b/tools/mb/mb_config.pyl
index 38a10e1..e089b09 100644
--- a/tools/mb/mb_config.pyl
+++ b/tools/mb/mb_config.pyl

@@ -1230,7 +1230,7 @@
     ],
 
     'gn_debug_libfuzzer_asan': [
-      'gn', 'debug', 'libfuzzer', 'asan', 'chromeos_with_codecs', 'pdf_xfa',
+      'gn', 'debug', 'libfuzzer', 'asan', 'chromeos_codecs', 'pdf_xfa',
       'disable_nacl',
     ],
 
@@ -1311,7 +1311,7 @@
      ],
 
     'gn_release_afl_asan': [
-      'gn', 'release', 'afl', 'asan', 'chromeos_with_codecs', 'pdf_xfa',
+      'gn', 'release', 'afl', 'asan', 'chromeos_codecs', 'pdf_xfa',
       'disable_nacl',
     ],
 
@@ -1321,16 +1321,16 @@
     ],
 
     'gn_release_libfuzzer_asan': [
-      'gn', 'release', 'libfuzzer', 'asan', 'chromeos_with_codecs', 'pdf_xfa',
+      'gn', 'release', 'libfuzzer', 'asan', 'chromeos_codecs', 'pdf_xfa',
       'disable_nacl',
     ],
 
     'gn_release_libfuzzer_msan': [
-      'gn', 'release', 'libfuzzer', 'msan', 'chromeos_with_codecs', 'pdf_xfa',
+      'gn', 'release', 'libfuzzer', 'msan', 'chromeos_codecs', 'pdf_xfa',
       'disable_nacl',
     ],
     'gn_release_libfuzzer_ubsan': [
-      'gn', 'release', 'libfuzzer', 'ubsan_security', 'chromeos_with_codecs',
+      'gn', 'release', 'libfuzzer', 'ubsan_security', 'chromeos_codecs',
       'pdf_xfa', 'disable_nacl',
     ],
 

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index c839204d..bdd59a9 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -80275,6 +80275,8 @@
   <int value="1537" label="PointerEnterLeaveFiredWhileCaptured"/>
   <int value="1538" label="PointerOverOutFiredWhileCaptured"/>
   <int value="1539" label="DraggableAttribute"/>
+  <int value="1540" label="CleanScriptElementWithNonce"/>
+  <int value="1541" label="PotentiallyInjectedScriptElementWithNonce"/>
 </enum>
 
 <enum name="FetchRequestMode" type="int">

diff --git a/tools/perf/benchmarks/power.py b/tools/perf/benchmarks/power.py
index e1632e57..1d84778 100644
--- a/tools/perf/benchmarks/power.py
+++ b/tools/perf/benchmarks/power.py

@@ -190,3 +190,14 @@
   @classmethod
   def Name(cls):
     return 'power.trivial_pages'
+
+@benchmark.Enabled('mac')
+class PowerSteadyStatePages(perf_benchmark.PerfBenchmark):
+  """Measure power consumption for real web sites in steady state (no user
+  interactions)."""
+  test = power.QuiescentPower
+  page_set = page_sets.IdleAfterLoadingStories
+
+  @classmethod
+  def Name(cls):
+    return 'power.steady_state'

diff --git a/tools/perf/benchmarks/v8.py b/tools/perf/benchmarks/v8.py
index 061f4e5..4a543f1 100644
--- a/tools/perf/benchmarks/v8.py
+++ b/tools/perf/benchmarks/v8.py

@@ -152,8 +152,7 @@
 
 # Disabled on reference builds because they don't support the new
 # Tracing.requestMemoryDump DevTools API. See http://crbug.com/540022.
-# Windows: crbug.com/638724
-@benchmark.Disabled('win', 'reference')
+@benchmark.Disabled('reference')
 class V8InfiniteScroll(_InfiniteScrollBenchmark):
   """Measures V8 GC metrics and memory usage while scrolling the top web pages.
   http://www.chromium.org/developers/design-documents/rendering-benchmarks"""
@@ -167,8 +166,7 @@
 
 # Disabled on reference builds because they don't support the new
 # Tracing.requestMemoryDump DevTools API. See http://crbug.com/540022.
-# Windows: crbug.com/638724
-@benchmark.Disabled('win', 'reference')  # crbug.com/579546
+@benchmark.Disabled('reference')  # crbug.com/579546
 class V8InfiniteScrollIgnition(V8InfiniteScroll):
   """Measures V8 GC metrics using Ignition."""
 

diff --git a/tools/perf/page_sets/data/idle_after_loading_stories.json b/tools/perf/page_sets/data/idle_after_loading_stories.json
new file mode 100644
index 0000000..0a3e945
--- /dev/null
+++ b/tools/perf/page_sets/data/idle_after_loading_stories.json

@@ -0,0 +1,8 @@
+{
+    "archives": {
+        "idle_after_loading_stories_001.wpr": [
+            "http://www.labradortraininghq.com/labrador-training/how-to-crate-train-a-puppy/#How_Long_DoesIt_Take_To_Crate_Train_A_Puppy"
+        ]
+    },
+    "description": "Describes the Web Page Replay archives for a story set. Don't edit by hand! Use record_wpr for updating."
+}
\ No newline at end of file

diff --git a/tools/perf/page_sets/data/idle_after_loading_stories_001.wpr.sha1 b/tools/perf/page_sets/data/idle_after_loading_stories_001.wpr.sha1
new file mode 100644
index 0000000..831e6d94
--- /dev/null
+++ b/tools/perf/page_sets/data/idle_after_loading_stories_001.wpr.sha1

@@ -0,0 +1 @@
+ef8366d49d791d74c3bdd4467b442962140b9905
\ No newline at end of file

diff --git a/tools/perf/page_sets/idle_after_loading_stories.py b/tools/perf/page_sets/idle_after_loading_stories.py
new file mode 100644
index 0000000..35c5689
--- /dev/null
+++ b/tools/perf/page_sets/idle_after_loading_stories.py

@@ -0,0 +1,21 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+from telemetry.page import page as page_module
+from telemetry import story
+
+
+class IdleAfterLoadingStories(story.StorySet):
+  """Historically, Chrome has high CPU usage on these sites after the page has
+  loaded. These user stories let Chrome idle on the page."""
+
+  def __init__(self):
+    super(IdleAfterLoadingStories, self).__init__(
+        archive_data_file='data/idle_after_loading_stories.json',
+        cloud_storage_bucket=story.PARTNER_BUCKET)
+
+    # Chrome has high idle CPU usage on this site, even after its quiesced.
+    # https://crbug.com/638365.
+    self.AddStory(page_module.Page(
+        'http://www.labradortraininghq.com/labrador-training/how-to-crate-train'
+        '-a-puppy/#How_Long_DoesIt_Take_To_Crate_Train_A_Puppy', page_set=self))

diff --git a/tools/web_bluetooth/OWNERS b/tools/web_bluetooth/OWNERS
new file mode 100644
index 0000000..5a6a65e
--- /dev/null
+++ b/tools/web_bluetooth/OWNERS

@@ -0,0 +1,2 @@
+perja@opera.com
+scheib@chromium.org

diff --git a/tools/web_bluetooth/compact_blacklist.py b/tools/web_bluetooth/compact_blacklist.py
new file mode 100755
index 0000000..dae783f
--- /dev/null
+++ b/tools/web_bluetooth/compact_blacklist.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Script for converting the Web Bluetooth GATT blacklist into the format
+expected by ContentBrowserClient#GetWebBluetoothBlacklist.
+
+See:
+https://github.com/WebBluetoothCG/registries/blob/master/gatt_blacklist.txt
+content/public/browser/content_browser_client.h
+
+Usage:
+  compact_blacklist.py <gatt_blacklist.txt>
+"""
+
+import collections
+import string
+import sys
+
+UUID_LENGTH = 36
+UUID_BASE_POSTFIX = '-0000-1000-8000-00805f9b34fb'
+
+
+class BadLineException(Exception):
+  pass
+
+
+class InvalidUUIDException(Exception):
+  pass
+
+
+class DuplicateUUIDException(Exception):
+  pass
+
+
+class InvalidExclusionException(Exception):
+  pass
+
+
+def ValidUUID(uuid):
+  if len(uuid) != UUID_LENGTH:
+    return False
+  for i in range(UUID_LENGTH):
+    if i in [8, 13, 18, 23]:
+      if uuid[i] != '-':
+        return False
+    else:
+      if uuid[i] not in string.hexdigits:
+        return False
+  return True
+
+
+
+
+def ShortenUUID(uuid):
+  """Shorten a UUUD that use Bluetooth base UUID.
+
+  Note: this function shortens all UUIDs that use the Bluetooth base
+  UUID even though the specification states that only an assigned UUID
+  can be shortened. In this case it works fine, since the constructor in
+  bluetooth_uuid.cc also works the same way.
+  """
+
+  if uuid[8:] == UUID_BASE_POSTFIX:
+    new_uuid = '%x' % int(uuid[:8], 16)
+    if len(new_uuid) in [4, 8]:
+      uuid = new_uuid
+  return uuid
+
+
+def Process(line, blacklist):
+  line = line.strip().lower()
+  if not line or line.startswith('#'):
+    return
+  fields = line.split()
+  if len(fields) not in [1, 2]:
+    raise BadLineException('Badly formatted line: %s' % line)
+  uuid = fields[0]
+  if not ValidUUID(uuid):
+    raise InvalidUUIDException('Invalid UUID: %s' % line)
+  uuid = ShortenUUID(uuid)
+  if uuid in blacklist:
+    raise DuplicateUUIDException('Duplicate UUID: %s' % line)
+  if len(fields) == 1:
+    blacklist[uuid] = 'e'
+  elif fields[1] == 'exclude-writes':
+    blacklist[uuid] = 'w'
+  elif fields[1] == 'exclude-reads':
+    blacklist[uuid] = 'r'
+  else:
+    raise InvalidExclusionException('Invalid exclusion value: %s' % line)
+
+
+def main():
+  if len(sys.argv) != 2:
+    print('Usage: %s <gatt_blacklist.txt>' % sys.argv[0])
+    return 1
+
+  try:
+    blacklist = collections.OrderedDict()
+    with open(sys.argv[1]) as f:
+      for line in f:
+        Process(line, blacklist)
+    print(','.join('%s:%s' % (uuid, blacklist[uuid]) for uuid in blacklist))
+    return 0
+  except Exception as e:
+    print('Failed to compact blacklist. %s' % e)
+    return 1
+
+
+if __name__ == '__main__':
+  sys.exit(main())

diff --git a/tools/web_bluetooth/compact_blacklist_unittest.py b/tools/web_bluetooth/compact_blacklist_unittest.py
new file mode 100755
index 0000000..7df1140
--- /dev/null
+++ b/tools/web_bluetooth/compact_blacklist_unittest.py

@@ -0,0 +1,73 @@
+#!/usr/bin/env python
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import collections
+import compact_blacklist as cb
+import unittest
+
+
+class CompactBlacklistTest(unittest.TestCase):
+  def TestValidUUID(self):
+    self.assertTrue( cb.ValidUUID('00000000-0000-0000-0000-000000000000'))
+    self.assertTrue( cb.ValidUUID('01234567-89ab-cdef-0123-456789abcdef'))
+    self.assertTrue( cb.ValidUUID('00001812-0000-1000-8000-00805f9b34fb'))
+    self.assertFalse(cb.ValidUUID('g1234567-89ab-cdef-0123-456789abcdef'))
+    self.assertFalse(cb.ValidUUID('01234567-89ab-cdef-0123-456789abcdef0'))
+    self.assertFalse(cb.ValidUUID('0123456789abcdef0123456789abcdef'))
+    self.assertFalse(cb.ValidUUID('01234567089ab0cdef001230456789abcdef'))
+
+  def TestShortenUUID(self):
+    self.assertEqual(cb.ShortenUUID(
+      '00000000-0000-0000-0000-000000000000'),
+      '00000000-0000-0000-0000-000000000000')
+    self.assertEqual(cb.ShortenUUID(
+      '01234567-89ab-cdef-0123-456789abcdef'),
+      '01234567-89ab-cdef-0123-456789abcdef')
+    self.assertEqual(cb.ShortenUUID(
+      '00001812-0000-1000-8000-00805f9b34fb'),
+      '1812')
+    self.assertEqual(cb.ShortenUUID(
+      'g1234567-89ab-cdef-0123-456789abcdef'),
+      'g1234567-89ab-cdef-0123-456789abcdef')
+    self.assertEqual(cb.ShortenUUID(
+      '01234567-89ab-cdef-0123-456789abcdef0'),
+      '01234567-89ab-cdef-0123-456789abcdef0')
+    self.assertEqual(cb.ShortenUUID(
+      '0123456789abcdef0123456789abcdef'),
+      '0123456789abcdef0123456789abcdef')
+    self.assertEqual(cb.ShortenUUID(
+      '01234567089ab0cdef001230456789abcdef'),
+      '01234567089ab0cdef001230456789abcdef')
+
+  def TestProcess(self):
+    blacklist = collections.OrderedDict()
+    try:
+      cb.Process('# comment', blacklist)
+      cb.Process('', blacklist)
+    except Exception:
+      self.fail('Failed test for comment or blank line.')
+
+    self.assertRaises(cb.BadLineException, cb.Process,
+      '00001812-0000-1000-8000-00805f9b34fb exclude-write exclude', blacklist)
+    self.assertRaises(cb.InvalidExclusionException, cb.Process,
+      '00001812-0000-1000-8000-00805f9b34fb exclude-write', blacklist)
+    self.assertRaises(cb.InvalidExclusionException, cb.Process,
+      '00001812-0000-1000-8000-00805f9b34fb exclude', blacklist)
+
+    try:
+      cb.Process('00001812-0000-1000-8000-00805f9b34fa exclude-writes',
+        blacklist)
+      cb.Process('00001812-0000-1000-8000-00805f9b34fb exclude-reads',
+        blacklist)
+      cb.Process('00001812-0000-1000-8000-00805f9b34fc', blacklist)
+    except Exception:
+      self.fail('Failed test for valid lines.')
+
+    self.assertRaises(cb.DuplicateUUIDException, cb.Process,
+      '00001812-0000-1000-8000-00805f9b34fa exclude-writes', blacklist)
+
+
+if __name__ == '__main__':
+  unittest.main()

diff --git a/ui/native_theme/native_theme_mac.h b/ui/native_theme/native_theme_mac.h
index ec48119..ddcd792 100644
--- a/ui/native_theme/native_theme_mac.h
+++ b/ui/native_theme/native_theme_mac.h

@@ -69,6 +69,9 @@
                                         bool focus);
 
  private:
+  SkColor GetAuraColorWithSystemTint(NativeTheme::ColorId color_id,
+                                     const NativeTheme* base_theme) const;
+
   NativeThemeMac();
   ~NativeThemeMac() override;
 

diff --git a/ui/native_theme/native_theme_mac.mm b/ui/native_theme/native_theme_mac.mm
index 1716bebe..1960780 100644
--- a/ui/native_theme/native_theme_mac.mm
+++ b/ui/native_theme/native_theme_mac.mm

@@ -133,20 +133,20 @@
       return NSSystemColorToSkColor([NSColor windowBackgroundColor]);
     case kColorId_DialogBackground:
       return ui::MaterialDesignController::IsSecondaryUiMaterial()
-                ? GetAuraColor(color_id, this)
+                ? GetAuraColorWithSystemTint(color_id, this)
                 : kDialogBackgroundColor;
     case kColorId_BubbleBackground:
       return SK_ColorWHITE;
 
     case kColorId_FocusedBorderColor:
       return ui::MaterialDesignController::IsSecondaryUiMaterial()
-                ? GetAuraColor(color_id, this)
+                ? GetAuraColorWithSystemTint(color_id, this)
                 : NSSystemColorToSkColor([NSColor keyboardFocusIndicatorColor]);
     case kColorId_FocusedMenuButtonBorderColor:
       return NSSystemColorToSkColor([NSColor keyboardFocusIndicatorColor]);
     case kColorId_UnfocusedBorderColor:
       return ui::MaterialDesignController::IsSecondaryUiMaterial()
-                ? GetAuraColor(color_id, this)
+                ? GetAuraColorWithSystemTint(color_id, this)
                 : NSSystemColorToSkColor([NSColor controlColor]);
 
     // Buttons and labels.
@@ -161,7 +161,7 @@
       return NSSystemColorToSkColor([NSColor controlTextColor]);
     case kColorId_CallToActionColor:
       return ui::MaterialDesignController::IsSecondaryUiMaterial()
-                ? GetAuraColor(color_id, this)
+                ? GetAuraColorWithSystemTint(color_id, this)
                 : NSSystemColorToSkColor([NSColor controlTextColor]);
     case kColorId_ButtonDisabledColor:
     case kColorId_LabelDisabledColor:
@@ -427,6 +427,12 @@
   canvas->drawDRRect(outer_shape, shape, paint);
 }
 
+SkColor NativeThemeMac::GetAuraColorWithSystemTint(
+    NativeTheme::ColorId color_id,
+    const NativeTheme* base_theme) const {
+  return ApplySystemControlTint(GetAuraColor(color_id, base_theme));
+}
+
 NativeThemeMac::NativeThemeMac() {
 }
 

diff --git a/ui/views/controls/button/menu_button.cc b/ui/views/controls/button/menu_button.cc
index 4b562c5e..38fc310 100644
--- a/ui/views/controls/button/menu_button.cc
+++ b/ui/views/controls/button/menu_button.cc

@@ -145,8 +145,6 @@
     increment_pressed_lock_called_ = nullptr;
     destroyed_flag_ = nullptr;
 
-    menu_closed_time_ = TimeTicks::Now();
-
     if (!increment_pressed_lock_called && pressed_lock_count_ == 0) {
       AnimateInkDrop(InkDropState::ACTION_TRIGGERED,
                      ui::LocatedEvent::FromIfValid(event));
@@ -387,6 +385,7 @@
 
   // If this was the last lock, manually reset state to the desired state.
   if (pressed_lock_count_ == 0) {
+    menu_closed_time_ = TimeTicks::Now();
     ButtonState desired_state = STATE_NORMAL;
     if (should_disable_after_press_) {
       desired_state = STATE_DISABLED;

diff --git a/ui/views/mus/BUILD.gn b/ui/views/mus/BUILD.gn
index 3706566..701aed1 100644
--- a/ui/views/mus/BUILD.gn
+++ b/ui/views/mus/BUILD.gn

@@ -33,6 +33,8 @@
     "screen_mus_delegate.h",
     "surface_context_factory.cc",
     "surface_context_factory.h",
+    "text_input_client_impl.cc",
+    "text_input_client_impl.h",
     "window_manager_connection.cc",
     "window_manager_connection.h",
     "window_manager_constants_converters.cc",
@@ -149,6 +151,7 @@
 
   sources = [
     "display_list_unittest.cc",
+    "input_method_mus_unittest.cc",
     "native_widget_mus_unittest.cc",
     "os_exchange_data_provider_mus_unittest.cc",
     "pointer_watcher_event_router_unittest.cc",
@@ -198,6 +201,7 @@
 
   data_deps = [
     ":unittests_manifest",
+    "//services/ui/ime/test_ime_driver",
     "//services/ui/test_wm",
   ]
 

diff --git a/ui/views/mus/input_method_mus.cc b/ui/views/mus/input_method_mus.cc
index c8d027e..942dde7 100644
--- a/ui/views/mus/input_method_mus.cc
+++ b/ui/views/mus/input_method_mus.cc

@@ -7,43 +7,51 @@
 #include <utility>
 
 #include "services/ui/public/cpp/window.h"
+#include "services/ui/public/interfaces/ime.mojom.h"
 #include "ui/base/ime/text_input_client.h"
 #include "ui/events/event.h"
 #include "ui/platform_window/mojo/ime_type_converters.h"
 #include "ui/platform_window/mojo/text_input_state.mojom.h"
+#include "ui/views/mus/text_input_client_impl.h"
 
 namespace views {
 
 ////////////////////////////////////////////////////////////////////////////////
-// InputMethodMUS, public:
+// InputMethodMus, public:
 
-InputMethodMUS::InputMethodMUS(ui::internal::InputMethodDelegate* delegate,
+InputMethodMus::InputMethodMus(ui::internal::InputMethodDelegate* delegate,
                                ui::Window* window)
     : window_(window) {
   SetDelegate(delegate);
 }
 
-InputMethodMUS::~InputMethodMUS() {}
+InputMethodMus::~InputMethodMus() {}
+
+void InputMethodMus::Init(shell::Connector* connector) {
+  connector->ConnectToInterface("mojo:ui", &ime_server_);
+}
 
 ////////////////////////////////////////////////////////////////////////////////
-// InputMethodMUS, ui::InputMethod implementation:
+// InputMethodMus, ui::InputMethod implementation:
 
-void InputMethodMUS::OnFocus() {
+void InputMethodMus::OnFocus() {
   InputMethodBase::OnFocus();
   UpdateTextInputType();
 }
 
-void InputMethodMUS::OnBlur() {
+void InputMethodMus::OnBlur() {
   InputMethodBase::OnBlur();
   UpdateTextInputType();
 }
 
-bool InputMethodMUS::OnUntranslatedIMEMessage(const base::NativeEvent& event,
+bool InputMethodMus::OnUntranslatedIMEMessage(const base::NativeEvent& event,
                                               NativeEventResult* result) {
+  // This method is not called on non-Windows platforms. See the comments for
+  // ui::InputMethod::OnUntranslatedIMEMessage().
   return false;
 }
 
-void InputMethodMUS::DispatchKeyEvent(ui::KeyEvent* event) {
+void InputMethodMus::DispatchKeyEvent(ui::KeyEvent* event) {
   DCHECK(event->type() == ui::ET_KEY_PRESSED ||
          event->type() == ui::ET_KEY_RELEASED);
 
@@ -53,12 +61,14 @@
     return;
   }
 
-  // Here is where we change the differ from our base class's logic. Instead of
-  // always dispatching a key down event, and then sending a synthesized
-  // character event, we instead check to see if this is a character event and
-  // send out the key if it is. (We fallback to normal dispatch if it isn't.)
+  // TODO(moshayedi): crbug.com/641355. Currently if we stop propagation of
+  // non-char events here, accelerators ddn't work. This is because we send the
+  // event ack too early in NativeWidgetMus. We should send both char and
+  // non-char events to the IME driver once we fix this.
   if (event->is_char()) {
-    GetTextInputClient()->InsertChar(*event);
+    // IME driver will notify the text input client if it is not interested in
+    // event, which in turn will call DispatchKeyEventPostIME().
+    input_method_->ProcessKeyEvent(ui::Event::Clone(*event));
     event->StopPropagation();
     return;
   }
@@ -66,41 +76,65 @@
   ignore_result(DispatchKeyEventPostIME(event));
 }
 
-void InputMethodMUS::OnTextInputTypeChanged(const ui::TextInputClient* client) {
+void InputMethodMus::OnTextInputTypeChanged(const ui::TextInputClient* client) {
   if (IsTextInputClientFocused(client))
     UpdateTextInputType();
   InputMethodBase::OnTextInputTypeChanged(client);
+
+  if (input_method_) {
+    input_method_->OnTextInputTypeChanged(
+        static_cast<ui::mojom::TextInputType>(client->GetTextInputType()));
+  }
 }
 
-void InputMethodMUS::OnCaretBoundsChanged(const ui::TextInputClient* client) {}
-
-void InputMethodMUS::CancelComposition(const ui::TextInputClient* client) {}
-
-void InputMethodMUS::OnInputLocaleChanged() {}
-
-std::string InputMethodMUS::GetInputLocale() {
-  return "";
+void InputMethodMus::OnCaretBoundsChanged(const ui::TextInputClient* client) {
+  if (input_method_)
+    input_method_->OnCaretBoundsChanged(client->GetCaretBounds());
 }
 
-bool InputMethodMUS::IsCandidatePopupOpen() const {
+void InputMethodMus::CancelComposition(const ui::TextInputClient* client) {
+  if (input_method_)
+    input_method_->CancelComposition();
+}
+
+void InputMethodMus::OnInputLocaleChanged() {
+  // TODO(moshayedi): crbug.com/637418. Not supported in ChromeOS. Investigate
+  // whether we want to support this or not.
+}
+
+std::string InputMethodMus::GetInputLocale() {
+  // TODO(moshayedi): crbug.com/637418. Not supported in ChromeOS. Investigate
+  // whether we want to support this or not.
+  return std::string();
+}
+
+bool InputMethodMus::IsCandidatePopupOpen() const {
+  // TODO(moshayedi): crbug.com/637416. Implement this properly when we have a
+  // mean for displaying candidate list popup.
   return false;
 }
 
-void InputMethodMUS::OnDidChangeFocusedClient(
+void InputMethodMus::OnDidChangeFocusedClient(
     ui::TextInputClient* focused_before,
     ui::TextInputClient* focused) {
   InputMethodBase::OnDidChangeFocusedClient(focused_before, focused);
   UpdateTextInputType();
+
+  text_input_client_.reset(new TextInputClientImpl(focused, this));
+  ime_server_->StartSession(text_input_client_->CreateInterfacePtrAndBind(),
+                            GetProxy(&input_method_));
 }
 
-void InputMethodMUS::UpdateTextInputType() {
+void InputMethodMus::UpdateTextInputType() {
   ui::TextInputType type = GetTextInputType();
   mojo::TextInputStatePtr state = mojo::TextInputState::New();
   state->type = mojo::ConvertTo<mojo::TextInputType>(type);
-  if (type != ui::TEXT_INPUT_TYPE_NONE)
-    window_->SetImeVisibility(true, std::move(state));
-  else
-    window_->SetTextInputState(std::move(state));
+  if (window_) {
+    if (type != ui::TEXT_INPUT_TYPE_NONE)
+      window_->SetImeVisibility(true, std::move(state));
+    else
+      window_->SetTextInputState(std::move(state));
+  }
 }
 
 }  // namespace views

diff --git a/ui/views/mus/input_method_mus.h b/ui/views/mus/input_method_mus.h
index 1ed2f774..146b5c3 100644
--- a/ui/views/mus/input_method_mus.h
+++ b/ui/views/mus/input_method_mus.h

@@ -8,6 +8,9 @@
 #define UI_VIEWS_MUS_INPUT_METHOD_MUS_H_
 
 #include "base/macros.h"
+#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "services/shell/public/cpp/connector.h"
+#include "services/ui/public/interfaces/ime.mojom.h"
 #include "ui/views/mus/mus_export.h"
 
 namespace ui {
@@ -16,13 +19,16 @@
 
 namespace views {
 
-class VIEWS_MUS_EXPORT InputMethodMUS : public ui::InputMethodBase {
- public:
-  InputMethodMUS(ui::internal::InputMethodDelegate* delegate,
-                 ui::Window* window);
-  ~InputMethodMUS() override;
+class TextInputClientImpl;
 
- private:
+class VIEWS_MUS_EXPORT InputMethodMus : public ui::InputMethodBase {
+ public:
+  InputMethodMus(ui::internal::InputMethodDelegate* delegate,
+                 ui::Window* window);
+  ~InputMethodMus() override;
+
+  void Init(shell::Connector* connector);
+
   // Overridden from ui::InputMethod:
   void OnFocus() override;
   void OnBlur() override;
@@ -36,16 +42,24 @@
   std::string GetInputLocale() override;
   bool IsCandidatePopupOpen() const override;
 
+ private:
+  friend TextInputClientImpl;
+
   // Overridden from ui::InputMethodBase:
   void OnDidChangeFocusedClient(ui::TextInputClient* focused_before,
                                 ui::TextInputClient* focused) override;
 
   void UpdateTextInputType();
 
-  // The toplevel window which is not owned by this class.
+  // The toplevel window which is not owned by this class. This may be null
+  // for tests.
   ui::Window* window_;
 
-  DISALLOW_COPY_AND_ASSIGN(InputMethodMUS);
+  ui::mojom::IMEServerPtr ime_server_;
+  ui::mojom::InputMethodPtr input_method_;
+  std::unique_ptr<TextInputClientImpl> text_input_client_;
+
+  DISALLOW_COPY_AND_ASSIGN(InputMethodMus);
 };
 
 }  // namespace views

diff --git a/ui/views/mus/input_method_mus_unittest.cc b/ui/views/mus/input_method_mus_unittest.cc
new file mode 100644
index 0000000..0c0e3c6
--- /dev/null
+++ b/ui/views/mus/input_method_mus_unittest.cc

@@ -0,0 +1,99 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/views/mus/input_method_mus.h"
+
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/base/ime/dummy_text_input_client.h"
+#include "ui/base/ime/input_method_delegate.h"
+#include "ui/events/event.h"
+#include "ui/views/mus/window_manager_connection.h"
+#include "ui/views/test/scoped_views_test_helper.h"
+
+namespace views {
+namespace {
+
+class TestInputMethodDelegate : public ui::internal::InputMethodDelegate {
+ public:
+  TestInputMethodDelegate() {}
+  ~TestInputMethodDelegate() override {}
+
+  // ui::internal::InputMethodDelegate:
+  ui::EventDispatchDetails DispatchKeyEventPostIME(
+      ui::KeyEvent* key_event) override {
+    return ui::EventDispatchDetails();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TestInputMethodDelegate);
+};
+
+class TestTextInputClient : public ui::DummyTextInputClient {
+ public:
+  TestTextInputClient() {}
+  ~TestTextInputClient() override {}
+
+  ui::KeyEvent* WaitUntilInputReceieved() {
+    run_loop_.reset(new base::RunLoop);
+    run_loop_->Run();
+    run_loop_.reset();
+
+    return received_event_->AsKeyEvent();
+  }
+
+  // ui::DummyTextInputClient:
+  void InsertChar(const ui::KeyEvent& event) override {
+    received_event_ = ui::Event::Clone(event);
+    run_loop_->Quit();
+  }
+
+ private:
+  std::unique_ptr<base::RunLoop> run_loop_;
+  std::unique_ptr<ui::Event> received_event_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestTextInputClient);
+};
+
+}  // namespace
+
+class InputMethodMusTest : public testing::Test {
+ public:
+  InputMethodMusTest() : message_loop_(base::MessageLoop::TYPE_UI) {}
+  ~InputMethodMusTest() override {}
+
+  shell::Connector* connector() {
+    return WindowManagerConnection::Get()->connector();
+  }
+
+ private:
+  base::MessageLoop message_loop_;
+  ScopedViewsTestHelper helper_;
+
+  DISALLOW_COPY_AND_ASSIGN(InputMethodMusTest);
+};
+
+TEST_F(InputMethodMusTest, DispatchKeyEvent) {
+  // test_ime_driver will register itself as the current IMEDriver. It echoes
+  // back the character key events it receives.
+  EXPECT_TRUE(connector()->Connect("mojo:test_ime_driver"));
+
+  TestInputMethodDelegate input_method_delegate;
+  InputMethodMus input_method(&input_method_delegate, nullptr);
+  input_method.Init(connector());
+
+  TestTextInputClient text_input_client;
+  input_method.SetFocusedTextInputClient(&text_input_client);
+
+  ui::KeyEvent key_event('A', ui::VKEY_A, 0);
+  input_method.DispatchKeyEvent(&key_event);
+
+  ui::KeyEvent* received_event = text_input_client.WaitUntilInputReceieved();
+  EXPECT_EQ(ui::ET_KEY_PRESSED, received_event->type());
+  EXPECT_TRUE(received_event->is_char());
+  EXPECT_EQ(key_event.GetCharacter(), received_event->GetCharacter());
+}
+
+}  // namespace views

diff --git a/ui/views/mus/native_widget_mus.cc b/ui/views/mus/native_widget_mus.cc
index dd79ff86..e1fbfbb 100644
--- a/ui/views/mus/native_widget_mus.cc
+++ b/ui/views/mus/native_widget_mus.cc

@@ -32,6 +32,7 @@
 #include "ui/gfx/path.h"
 #include "ui/native_theme/native_theme_aura.h"
 #include "ui/platform_window/platform_window_delegate.h"
+#include "ui/views/mus/window_manager_connection.h"
 #include "ui/views/mus/window_manager_constants_converters.h"
 #include "ui/views/mus/window_manager_frame_values.h"
 #include "ui/views/mus/window_tree_host_mus.h"
@@ -687,6 +688,13 @@
   window_tree_host_->InitHost();
   hosted_window->SetProperty(kMusWindow, window_);
 
+  // TODO(moshayedi): crbug.com/641039. Investigate whether there are any cases
+  // where we need input method but don't have the WindowManagerConnection here.
+  if (WindowManagerConnection::Exists()) {
+    window_tree_host_->InitInputMethod(
+        WindowManagerConnection::Get()->connector());
+  }
+
   focus_client_.reset(
       new FocusControllerMus(new FocusRulesImpl(hosted_window)));
 

diff --git a/ui/views/mus/text_input_client_impl.cc b/ui/views/mus/text_input_client_impl.cc
new file mode 100644
index 0000000..59b4b99
--- /dev/null
+++ b/ui/views/mus/text_input_client_impl.cc

@@ -0,0 +1,55 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/views/mus/text_input_client_impl.h"
+
+#include "ui/base/ime/text_input_client.h"
+#include "ui/views/mus/input_method_mus.h"
+
+namespace views {
+
+TextInputClientImpl::TextInputClientImpl(ui::TextInputClient* text_input_client,
+                                         InputMethodMus* input_method)
+    : text_input_client_(text_input_client),
+      input_method_(input_method),
+      binding_(this) {}
+
+TextInputClientImpl::~TextInputClientImpl() {}
+
+ui::mojom::TextInputClientPtr TextInputClientImpl::CreateInterfacePtrAndBind() {
+  return binding_.CreateInterfacePtrAndBind();
+}
+
+void TextInputClientImpl::OnCompositionEvent(
+    ui::mojom::CompositionEventPtr event) {
+  switch (event->type) {
+    case ui::mojom::CompositionEventType::INSERT_CHAR: {
+      DCHECK((*event->key_event)->IsKeyEvent());
+      ui::KeyEvent* key_event = (*event->key_event)->AsKeyEvent();
+      DCHECK(key_event->is_char());
+      text_input_client_->InsertChar(*key_event);
+      break;
+    }
+    case ui::mojom::CompositionEventType::CONFIRM:
+      text_input_client_->ConfirmCompositionText();
+      break;
+    case ui::mojom::CompositionEventType::CLEAR:
+      text_input_client_->ClearCompositionText();
+      break;
+    case ui::mojom::CompositionEventType::UPDATE:
+    case ui::mojom::CompositionEventType::INSERT_TEXT:
+      // TODO(moshayedi): crbug.com/631524. Implement these types of composition
+      // events once we have the necessary fields in ui.mojom.CompositionEvent.
+      NOTIMPLEMENTED();
+      break;
+  }
+}
+
+void TextInputClientImpl::OnUnhandledEvent(
+    std::unique_ptr<ui::Event> key_event) {
+  DCHECK(key_event && key_event->IsKeyEvent());
+  input_method_->DispatchKeyEventPostIME(key_event->AsKeyEvent());
+}
+
+}  // namespace views

diff --git a/ui/views/mus/text_input_client_impl.h b/ui/views/mus/text_input_client_impl.h
new file mode 100644
index 0000000..cb51a6c
--- /dev/null
+++ b/ui/views/mus/text_input_client_impl.h

@@ -0,0 +1,43 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_VIEWS_MUS_TEXT_INPUT_CLIENT_IMPL_H_
+#define UI_VIEWS_MUS_TEXT_INPUT_CLIENT_IMPL_H_
+
+#include "mojo/public/cpp/bindings/binding.h"
+#include "services/ui/public/interfaces/ime.mojom.h"
+
+namespace ui {
+class TextInputClient;
+}
+
+namespace views {
+
+class InputMethodMus;
+
+// TextInputClientImpl receieves updates from IME drivers over Mojo IPC, and
+// notifies the underlying ui::TextInputClient accordingly.
+class TextInputClientImpl : public ui::mojom::TextInputClient {
+ public:
+  TextInputClientImpl(ui::TextInputClient* text_input_client,
+                      InputMethodMus* input_method);
+  ~TextInputClientImpl() override;
+
+  ui::mojom::TextInputClientPtr CreateInterfacePtrAndBind();
+
+ private:
+  // ui::mojom::TextInputClient:
+  void OnCompositionEvent(ui::mojom::CompositionEventPtr event) override;
+  void OnUnhandledEvent(std::unique_ptr<ui::Event> key_event) override;
+
+  ui::TextInputClient* text_input_client_;
+  InputMethodMus* input_method_;
+  mojo::Binding<ui::mojom::TextInputClient> binding_;
+
+  DISALLOW_COPY_AND_ASSIGN(TextInputClientImpl);
+};
+
+}  // namespace views
+
+#endif  // UI_VIEWS_MUS_TEXT_INPUT_CLIENT_IMPL_H_

diff --git a/ui/views/mus/window_tree_host_mus.cc b/ui/views/mus/window_tree_host_mus.cc
index 3f38b4e1..3629f2f5 100644
--- a/ui/views/mus/window_tree_host_mus.cc
+++ b/ui/views/mus/window_tree_host_mus.cc

@@ -54,7 +54,7 @@
   dispatcher()->set_transform_events(false);
   compositor()->SetHostHasTransparentBackground(true);
 
-  input_method_.reset(new InputMethodMUS(this, window));
+  input_method_.reset(new InputMethodMus(this, window));
   SetSharedInputMethod(input_method_.get());
 }
 
@@ -63,6 +63,10 @@
   DestroyDispatcher();
 }
 
+void WindowTreeHostMus::InitInputMethod(shell::Connector* connector) {
+  input_method_->Init(connector);
+}
+
 void WindowTreeHostMus::DispatchEvent(ui::Event* event) {
   if (event->IsKeyEvent() && GetInputMethod()) {
     GetInputMethod()->DispatchKeyEvent(event->AsKeyEvent());

diff --git a/ui/views/mus/window_tree_host_mus.h b/ui/views/mus/window_tree_host_mus.h
index fa096fc..a6065532 100644
--- a/ui/views/mus/window_tree_host_mus.h
+++ b/ui/views/mus/window_tree_host_mus.h

@@ -6,6 +6,7 @@
 #define UI_VIEWS_MUS_WINDOW_TREE_HOST_MUS_H_
 
 #include "base/macros.h"
+#include "services/shell/public/cpp/connector.h"
 #include "ui/aura/window_tree_host_platform.h"
 #include "ui/views/mus/mus_export.h"
 
@@ -21,7 +22,7 @@
 
 namespace views {
 
-class InputMethodMUS;
+class InputMethodMus;
 class NativeWidgetMus;
 class PlatformWindowMus;
 
@@ -31,6 +32,8 @@
   ~WindowTreeHostMus() override;
   NativeWidgetMus* native_widget() { return native_widget_; }
 
+  void InitInputMethod(shell::Connector* connector);
+
  private:
   // aura::WindowTreeHostPlatform:
   void DispatchEvent(ui::Event* event) override;
@@ -39,7 +42,7 @@
   void OnCloseRequest() override;
 
   NativeWidgetMus* native_widget_;
-  std::unique_ptr<InputMethodMUS> input_method_;
+  std::unique_ptr<InputMethodMus> input_method_;
 
   DISALLOW_COPY_AND_ASSIGN(WindowTreeHostMus);
 };

diff --git a/url/gurl.cc b/url/gurl.cc
index 2c8f3f56..8b5c8926 100644
--- a/url/gurl.cc
+++ b/url/gurl.cc

@@ -491,47 +491,13 @@
 #endif  // WIN32
 
 bool GURL::DomainIs(base::StringPiece lower_ascii_domain) const {
-  if (!is_valid_ || lower_ascii_domain.empty())
+  if (!is_valid_)
     return false;
 
-  // FileSystem URLs have empty parsed_.host, so check this first.
+  // FileSystem URLs have empty host_piece, so check this first.
   if (SchemeIsFileSystem() && inner_url_)
     return inner_url_->DomainIs(lower_ascii_domain);
-
-  if (!parsed_.host.is_nonempty())
-    return false;
-
-  // If the host name ends with a dot but the input domain doesn't,
-  // then we ignore the dot in the host name.
-  const char* host_last_pos = spec_.data() + parsed_.host.end() - 1;
-  int host_len = parsed_.host.len;
-  int domain_len = lower_ascii_domain.length();
-  if ('.' == *host_last_pos && '.' != lower_ascii_domain[domain_len - 1]) {
-    host_last_pos--;
-    host_len--;
-  }
-
-  if (host_len < domain_len)
-    return false;
-
-  // |host_first_pos| is the start of the compared part of the host name, not
-  // start of the whole host name.
-  const char* host_first_pos = spec_.data() + parsed_.host.begin +
-                               host_len - domain_len;
-
-  if (!base::LowerCaseEqualsASCII(
-           base::StringPiece(host_first_pos, domain_len), lower_ascii_domain))
-    return false;
-
-  // Make sure there aren't extra characters in host before the compared part;
-  // if the host name is longer than the input domain name, then the character
-  // immediately before the compared part should be a dot. For example,
-  // www.google.com has domain "google.com", but www.iamnotgoogle.com does not.
-  if ('.' != lower_ascii_domain[0] && host_len > domain_len &&
-      '.' != *(host_first_pos - 1))
-    return false;
-
-  return true;
+  return url::DomainIs(host_piece(), lower_ascii_domain);
 }
 
 void GURL::Swap(GURL* other) {

diff --git a/url/origin.cc b/url/origin.cc
index 97e24f20..a14c891 100644
--- a/url/origin.cc
+++ b/url/origin.cc

@@ -72,6 +72,10 @@
   return tuple_.Equals(other.tuple_);
 }
 
+bool Origin::DomainIs(base::StringPiece lower_ascii_domain) const {
+  return !unique_ && url::DomainIs(tuple_.host(), lower_ascii_domain);
+}
+
 bool Origin::operator<(const Origin& other) const {
   return tuple_ < other.tuple_;
 }

diff --git a/url/origin.h b/url/origin.h
index aab1f05a..9ac7779 100644
--- a/url/origin.h
+++ b/url/origin.h

@@ -122,6 +122,9 @@
     return IsSameOriginWith(other);
   }
 
+  // Same as GURL::DomainIs. If |this| origin is unique, then returns false.
+  bool DomainIs(base::StringPiece lower_ascii_domain) const;
+
   // Allows Origin to be used as a key in STL (for example, a std::set or
   // std::map).
   bool operator<(const Origin& other) const;

diff --git a/url/origin_unittest.cc b/url/origin_unittest.cc
index 74ffd303..416e0e3 100644
--- a/url/origin_unittest.cc
+++ b/url/origin_unittest.cc

@@ -252,4 +252,61 @@
   }
 }
 
+TEST(OriginTest, DomainIs) {
+  const struct {
+    const char* url;
+    const char* lower_ascii_domain;
+    bool expected_domain_is;
+  } kTestCases[] = {
+      {"http://google.com/foo", "google.com", true},
+      {"http://www.google.com:99/foo", "google.com", true},
+      {"http://www.google.com.cn/foo", "google.com", false},
+      {"http://www.google.comm", "google.com", false},
+      {"http://www.iamnotgoogle.com/foo", "google.com", false},
+      {"http://www.google.com/foo", "Google.com", false},
+
+      // If the host ends with a dot, it matches domains with or without a dot.
+      {"http://www.google.com./foo", "google.com", true},
+      {"http://www.google.com./foo", "google.com.", true},
+      {"http://www.google.com./foo", ".com", true},
+      {"http://www.google.com./foo", ".com.", true},
+
+      // But, if the host doesn't end with a dot and the input domain does, then
+      // it's considered to not match.
+      {"http://google.com/foo", "google.com.", false},
+
+      // If the host ends with two dots, it doesn't match.
+      {"http://www.google.com../foo", "google.com", false},
+
+      // Filesystem scheme.
+      {"filesystem:http://www.google.com:99/foo/", "google.com", true},
+      {"filesystem:http://www.iamnotgoogle.com/foo/", "google.com", false},
+
+      // File scheme.
+      {"file:///home/user/text.txt", "", false},
+      {"file:///home/user/text.txt", "txt", false},
+  };
+
+  for (const auto& test_case : kTestCases) {
+    SCOPED_TRACE(testing::Message() << "(url, domain): (" << test_case.url
+                                    << ", " << test_case.lower_ascii_domain
+                                    << ")");
+    GURL url(test_case.url);
+    ASSERT_TRUE(url.is_valid());
+    url::Origin origin(url);
+
+    EXPECT_EQ(test_case.expected_domain_is,
+              origin.DomainIs(test_case.lower_ascii_domain));
+  }
+
+  // If the URL is invalid, DomainIs returns false.
+  GURL invalid_url("google.com");
+  ASSERT_FALSE(invalid_url.is_valid());
+  EXPECT_FALSE(url::Origin(invalid_url).DomainIs("google.com"));
+
+  // Unique origins.
+  EXPECT_FALSE(url::Origin().DomainIs(""));
+  EXPECT_FALSE(url::Origin().DomainIs("com"));
+}
+
 }  // namespace url

diff --git a/url/url_util.cc b/url/url_util.cc
index c1e9979..7a0a1f8 100644
--- a/url/url_util.cc
+++ b/url/url_util.cc

@@ -488,6 +488,43 @@
   return DoFindAndCompareScheme(str, str_len, compare, found_scheme);
 }
 
+bool DomainIs(base::StringPiece canonicalized_host,
+              base::StringPiece lower_ascii_domain) {
+  if (canonicalized_host.empty() || lower_ascii_domain.empty())
+    return false;
+
+  // If the host name ends with a dot but the input domain doesn't, then we
+  // ignore the dot in the host name.
+  size_t host_len = canonicalized_host.length();
+  if (canonicalized_host.back() == '.' && lower_ascii_domain.back() != '.')
+    --host_len;
+
+  if (host_len < lower_ascii_domain.length())
+    return false;
+
+  // |host_first_pos| is the start of the compared part of the host name, not
+  // start of the whole host name.
+  const char* host_first_pos =
+      canonicalized_host.data() + host_len - lower_ascii_domain.length();
+
+  if (!base::LowerCaseEqualsASCII(
+          base::StringPiece(host_first_pos, lower_ascii_domain.length()),
+          lower_ascii_domain)) {
+    return false;
+  }
+
+  // Make sure there aren't extra characters in host before the compared part;
+  // if the host name is longer than the input domain name, then the character
+  // immediately before the compared part should be a dot. For example,
+  // www.google.com has domain "google.com", but www.iamnotgoogle.com does not.
+  if (lower_ascii_domain[0] != '.' && host_len > lower_ascii_domain.length() &&
+      *(host_first_pos - 1) != '.') {
+    return false;
+  }
+
+  return true;
+}
+
 bool Canonicalize(const char* spec,
                   int spec_len,
                   bool trim_path_end,

diff --git a/url/url_util.h b/url/url_util.h
index a209a61c..724ce95 100644
--- a/url/url_util.h
+++ b/url/url_util.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/strings/string16.h"
+#include "base/strings/string_piece.h"
 #include "url/third_party/mozilla/url_parse.h"
 #include "url/url_canon.h"
 #include "url/url_constants.h"
@@ -35,7 +36,7 @@
 // library.
 URL_EXPORT void Shutdown();
 
-// Schemes --------------------------------------------------------------------
+// Schemes ---------------------------------------------------------------------
 
 // Types of a scheme representing the requirements on the data represented by
 // the authority component of a URL with the scheme.
@@ -132,7 +133,20 @@
                                       const Component& scheme,
                                       SchemeType* type);
 
-// URL library wrappers -------------------------------------------------------
+// Domains ---------------------------------------------------------------------
+
+// Returns true if the |canonicalized_host| matches or is in the same domain as
+// the given |lower_ascii_domain| string. For example, if the canonicalized
+// hostname is "www.google.com", this will return true for "com", "google.com",
+// and "www.google.com" domains.
+//
+// If either of the input StringPieces is empty, the return value is false. The
+// input domain should be a lower-case ASCII string in order to match the
+// canonicalized host.
+URL_EXPORT bool DomainIs(base::StringPiece canonicalized_host,
+                         base::StringPiece lower_ascii_domain);
+
+// URL library wrappers --------------------------------------------------------
 
 // Parses the given spec according to the extracted scheme type. Normal users
 // should use the URL object, although this may be useful if performance is
@@ -204,7 +218,7 @@
     CanonOutput* output,
     Parsed* out_parsed);
 
-// String helper functions ----------------------------------------------------
+// String helper functions -----------------------------------------------------
 
 // Unescapes the given string using URL escaping rules.
 URL_EXPORT void DecodeURLEscapeSequences(const char* input,

diff --git a/url/url_util_unittest.cc b/url/url_util_unittest.cc
index f0032c2..af5d5500 100644
--- a/url/url_util_unittest.cc
+++ b/url/url_util_unittest.cc

@@ -374,4 +374,47 @@
   EXPECT_FALSE(resolved_parsed.ref.is_valid());
 }
 
+TEST(URLUtilTest, TestDomainIs) {
+  const struct {
+    const char* canonicalized_host;
+    const char* lower_ascii_domain;
+    bool expected_domain_is;
+  } kTestCases[] = {
+      {"google.com", "google.com", true},
+      {"www.google.com", "google.com", true},      // Subdomain is ignored.
+      {"www.google.com.cn", "google.com", false},  // Different TLD.
+      {"www.google.comm", "google.com", false},
+      {"www.iamnotgoogle.com", "google.com", false},  // Different hostname.
+      {"www.google.com", "Google.com", false},  // The input is not lower-cased.
+
+      // If the host ends with a dot, it matches domains with or without a dot.
+      {"www.google.com.", "google.com", true},
+      {"www.google.com.", "google.com.", true},
+      {"www.google.com.", ".com", true},
+      {"www.google.com.", ".com.", true},
+
+      // But, if the host doesn't end with a dot and the input domain does, then
+      // it's considered to not match.
+      {"www.google.com", "google.com.", false},
+
+      // If the host ends with two dots, it doesn't match.
+      {"www.google.com..", "google.com", false},
+
+      // Empty parameters.
+      {"www.google.com", "", false},
+      {"", "www.google.com", false},
+      {"", "", false},
+  };
+
+  for (const auto& test_case : kTestCases) {
+    SCOPED_TRACE(testing::Message() << "(host, domain): ("
+                                    << test_case.canonicalized_host << ", "
+                                    << test_case.lower_ascii_domain << ")");
+
+    EXPECT_EQ(
+        test_case.expected_domain_is,
+        DomainIs(test_case.canonicalized_host, test_case.lower_ascii_domain));
+  }
+}
+
 }  // namespace url