diff --git a/DEPS b/DEPS
index 4ec6821..798b826 100644
--- a/DEPS
+++ b/DEPS
@@ -74,7 +74,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'f9af55641a6d67730d900c95004840e13a859a7d',
+  'skia_revision': '1946aaf15ca0cbed7842f6df8c347284061ef2f9',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -377,7 +377,7 @@
   },
 
   'src/third_party/googletest/src':
-    Var('chromium_git') + '/external/github.com/google/googletest.git' + '@' + '7f8fefabedf2965980585be8c2bff97458f28e0b',
+    Var('chromium_git') + '/external/github.com/google/googletest.git' + '@' + '247a3d8e5e5d403f7fcacdb8ccc71e5059f15daa',
 
   # GNU binutils assembler for x86-32.
   'src/third_party/gnu_binutils': {
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 9835649..5d221355 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -4762,6 +4762,15 @@
       "extensions/fake_safe_browsing_database_manager.h",
     ]
   }
+
+  if (has_spellcheck_panel) {
+    sources += [
+      "spellchecker/test/spellcheck_content_browser_client.cc",
+      "spellchecker/test/spellcheck_content_browser_client.h",
+      "spellchecker/test/spellcheck_mock_panel_host.cc",
+      "spellchecker/test/spellcheck_mock_panel_host.h",
+    ]
+  }
 }
 
 static_library("test_support_ui") {
diff --git a/chrome/browser/chrome_site_per_process_browsertest.cc b/chrome/browser/chrome_site_per_process_browsertest.cc
index e5a7459..739b0e7 100644
--- a/chrome/browser/chrome_site_per_process_browsertest.cc
+++ b/chrome/browser/chrome_site_per_process_browsertest.cc
@@ -52,6 +52,7 @@
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #if BUILDFLAG(HAS_SPELLCHECK_PANEL)
+#include "chrome/browser/spellchecker/test/spellcheck_content_browser_client.h"
 #include "components/spellcheck/common/spellcheck_panel.mojom.h"
 #endif  // BUILDFLAG(HAS_SPELLCHECK_PANEL)
 #endif
@@ -856,117 +857,11 @@
 }
 
 #if BUILDFLAG(HAS_SPELLCHECK_PANEL)
-class TestSpellCheckPanelHost : public spellcheck::mojom::SpellCheckPanelHost {
- public:
-  explicit TestSpellCheckPanelHost(content::RenderProcessHost* process_host)
-      : process_host_(process_host) {}
-
-  content::RenderProcessHost* process_host() const { return process_host_; }
-
-  bool SpellingPanelVisible() {
-    if (!show_spelling_panel_called_) {
-      base::RunLoop run_loop;
-      quit_ = run_loop.QuitClosure();
-      run_loop.Run();
-    }
-
-    EXPECT_TRUE(show_spelling_panel_called_);
-    return spelling_panel_visible_;
-  }
-
-  void SpellCheckPanelHostRequest(
-      spellcheck::mojom::SpellCheckPanelHostRequest request) {
-    bindings_.AddBinding(this, std::move(request));
-  }
-
- private:
-  // spellcheck::mojom::SpellCheckPanelHost:
-  void ShowSpellingPanel(bool show) override {
-    DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-
-    show_spelling_panel_called_ = true;
-    spelling_panel_visible_ = show;
-    if (quit_)
-      std::move(quit_).Run();
-  }
-
-  void UpdateSpellingPanelWithMisspelledWord(
-      const base::string16& word) override {
-    DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  }
-
-  mojo::BindingSet<spellcheck::mojom::SpellCheckPanelHost> bindings_;
-  content::RenderProcessHost* process_host_;
-  bool show_spelling_panel_called_ = false;
-  bool spelling_panel_visible_ = false;
-  base::OnceClosure quit_;
-
-  DISALLOW_COPY_AND_ASSIGN(TestSpellCheckPanelHost);
-};
-
-class TestBrowserClientForSpellCheckPanelHost
-    : public ChromeContentBrowserClient {
- public:
-  TestBrowserClientForSpellCheckPanelHost() = default;
-
-  // ContentBrowserClient overrides.
-  void OverrideOnBindInterface(
-      const service_manager::BindSourceInfo& remote_info,
-      const std::string& name,
-      mojo::ScopedMessagePipeHandle* handle) override {
-    if (name != spellcheck::mojom::SpellCheckPanelHost::Name_)
-      return;
-
-    spellcheck::mojom::SpellCheckPanelHostRequest request(std::move(*handle));
-
-    // Override the default SpellCheckHost interface.
-    auto ui_task_runner = content::BrowserThread::GetTaskRunnerForThread(
-        content::BrowserThread::UI);
-    ui_task_runner->PostTask(
-        FROM_HERE, base::Bind(&TestBrowserClientForSpellCheckPanelHost::
-                                  BindSpellCheckPanelHostRequest,
-                              base::Unretained(this), base::Passed(&request),
-                              remote_info));
-  }
-
-  TestSpellCheckPanelHost* GetTestSpellCheckPanelHostForProcess(
-      content::RenderProcessHost* render_process_host) const {
-    for (const auto& host : hosts_) {
-      if (host->process_host() == render_process_host)
-        return host.get();
-    }
-    return nullptr;
-  }
-
-  void RunUntilBind() {
-    base::RunLoop run_loop;
-    quit_on_bind_closure_ = run_loop.QuitClosure();
-    run_loop.Run();
-  }
-
- private:
-  void BindSpellCheckPanelHostRequest(
-      spellcheck::mojom::SpellCheckPanelHostRequest request,
-      const service_manager::BindSourceInfo& source_info) {
-    content::RenderProcessHost* render_process_host =
-        content::RenderProcessHost::FromRendererIdentity(source_info.identity);
-    auto spell_check_panel_host =
-        std::make_unique<TestSpellCheckPanelHost>(render_process_host);
-    spell_check_panel_host->SpellCheckPanelHostRequest(std::move(request));
-    hosts_.push_back(std::move(spell_check_panel_host));
-    std::move(quit_on_bind_closure_).Run();
-  }
-
-  base::OnceClosure quit_on_bind_closure_;
-  std::vector<std::unique_ptr<TestSpellCheckPanelHost>> hosts_;
-
-  DISALLOW_COPY_AND_ASSIGN(TestBrowserClientForSpellCheckPanelHost);
-};
 
 // Tests that the OSX spell check panel can be opened from an out-of-process
 // subframe, crbug.com/712395
 IN_PROC_BROWSER_TEST_F(ChromeSitePerProcessTest, OOPIFSpellCheckPanelTest) {
-  TestBrowserClientForSpellCheckPanelHost browser_client;
+  spellcheck::SpellCheckContentBrowserClient browser_client;
   content::ContentBrowserClient* old_browser_client =
       content::SetBrowserClientForTesting(&browser_client);
 
@@ -987,8 +882,8 @@
   spell_check_panel_client->ToggleSpellPanel(false);
   browser_client.RunUntilBind();
 
-  TestSpellCheckPanelHost* host =
-      browser_client.GetTestSpellCheckPanelHostForProcess(
+  spellcheck::SpellCheckMockPanelHost* host =
+      browser_client.GetSpellCheckMockPanelHostForProcess(
           cross_site_subframe->GetProcess());
   EXPECT_TRUE(host->SpellingPanelVisible());
 
diff --git a/chrome/browser/chromeos/system/automatic_reboot_manager.cc b/chrome/browser/chromeos/system/automatic_reboot_manager.cc
index a47c043..6dcc50b5 100644
--- a/chrome/browser/chromeos/system/automatic_reboot_manager.cc
+++ b/chrome/browser/chromeos/system/automatic_reboot_manager.cc
@@ -307,6 +307,7 @@
 }
 
 void AutomaticRebootManager::Reschedule() {
+  VLOG(1) << "Rescheduling reboot";
   // Safeguard against reboot loops under error conditions: If the boot time is
   // unavailable because /proc/uptime could not be read, do nothing.
   if (!have_boot_time_)
@@ -334,6 +335,7 @@
       local_state_registrar_.prefs()->GetBoolean(prefs::kRebootAfterUpdate) &&
       (!have_reboot_request_time ||
        update_reboot_needed_time_ < reboot_request_time)) {
+    VLOG(1) << "Scheduling reboot because of OS update";
     reboot_request_time = update_reboot_needed_time_;
     have_reboot_request_time = true;
     reboot_reason_ = AutomaticRebootManagerObserver::REBOOT_REASON_OS_UPDATE;
@@ -357,6 +359,7 @@
   // started in the past, the timer is still used with its delay set to zero.
   if (!grace_start_timer_)
     grace_start_timer_.reset(new base::OneShotTimer);
+  VLOG(1) << "Scheduling reboot attempt in " << (grace_start_time - now);
   grace_start_timer_->Start(FROM_HERE,
                             std::max(grace_start_time - now, kZeroTimeDelta),
                             base::Bind(&AutomaticRebootManager::RequestReboot,
@@ -368,6 +371,7 @@
   // in the past, the timer is still used with its delay set to zero.
   if (!grace_end_timer_)
     grace_end_timer_.reset(new base::OneShotTimer);
+  VLOG(1) << "Scheduling unconditional reboot in " << (grace_end_time - now);
   grace_end_timer_->Start(FROM_HERE,
                           std::max(grace_end_time - now, kZeroTimeDelta),
                           base::Bind(&AutomaticRebootManager::Reboot,
@@ -375,6 +379,7 @@
 }
 
 void AutomaticRebootManager::RequestReboot() {
+  VLOG(1) << "Reboot requested, reason: " << reboot_reason_;
   reboot_requested_ = true;
   DCHECK_NE(AutomaticRebootManagerObserver::REBOOT_REASON_UNKNOWN,
             reboot_reason_);
@@ -402,12 +407,14 @@
   if (user_manager::UserManager::Get()->IsUserLoggedIn() &&
       !user_manager::UserManager::Get()->IsLoggedInAsKioskApp() &&
       !user_manager::UserManager::Get()->IsLoggedInAsArcKioskApp()) {
+    VLOG(1) << "Skipping reboot because non-kiosk session is active";
     return;
   }
 
   login_screen_idle_timer_.reset();
   grace_start_timer_.reset();
   grace_end_timer_.reset();
+  VLOG(1) << "Rebooting immediately.";
   DBusThreadManager::Get()->GetPowerManagerClient()->RequestRestart(
       power_manager::REQUEST_RESTART_OTHER, "automatic reboot manager");
 }
diff --git a/chrome/browser/media/media_engagement_preloaded_list.cc b/chrome/browser/media/media_engagement_preloaded_list.cc
index 05a62d8..9a30167 100644
--- a/chrome/browser/media/media_engagement_preloaded_list.cc
+++ b/chrome/browser/media/media_engagement_preloaded_list.cc
@@ -5,35 +5,49 @@
 #include "chrome/browser/media/media_engagement_preloaded_list.h"
 
 #include "base/files/file_util.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/path_service.h"
 #include "chrome/browser/media/media_engagement_preload.pb.h"
 #include "net/base/lookup_string_in_fixed_set.h"
 #include "url/origin.h"
 
+const char MediaEngagementPreloadedList::kHistogramCheckResultName[] =
+    "Media.Engagement.PreloadedList.CheckResult";
+
+const char MediaEngagementPreloadedList::kHistogramLoadResultName[] =
+    "Media.Engagement.PreloadedList.LoadResult";
+
 MediaEngagementPreloadedList::MediaEngagementPreloadedList() = default;
 
 MediaEngagementPreloadedList::~MediaEngagementPreloadedList() = default;
 
 bool MediaEngagementPreloadedList::LoadFromFile(const base::FilePath& path) {
   // Check the file exists.
-  if (!base::PathExists(path))
+  if (!base::PathExists(path)) {
+    RecordLoadResult(LoadResult::kFileNotFound);
     return false;
+  }
 
   // Read the file to a string.
   std::string file_data;
-  if (!base::ReadFileToString(path, &file_data))
+  if (!base::ReadFileToString(path, &file_data)) {
+    RecordLoadResult(LoadResult::kFileReadFailed);
     return false;
+  }
 
   // Load the preloaded list into a proto message.
   chrome_browser_media::PreloadedData message;
-  if (!message.ParseFromString(file_data))
+  if (!message.ParseFromString(file_data)) {
+    RecordLoadResult(LoadResult::kParseProtoFailed);
     return false;
+  }
 
   // Copy data from the protobuf message.
   dafsa_ = std::vector<unsigned char>(
       message.dafsa().c_str(),
       message.dafsa().c_str() + message.dafsa().length());
 
+  RecordLoadResult(LoadResult::kLoaded);
   is_loaded_ = true;
   return true;
 }
@@ -45,7 +59,33 @@
 
 bool MediaEngagementPreloadedList::CheckStringIsPresent(
     const std::string& input) const {
-  return net::LookupStringInFixedSet(dafsa_.data(), dafsa_.size(),
-                                     input.c_str(),
-                                     input.size()) == net::kDafsaFound;
+  // Check if we have loaded the data.
+  if (!loaded()) {
+    RecordCheckResult(CheckResult::kListNotLoaded);
+    return false;
+  }
+
+  // Check if the data is empty.
+  if (empty()) {
+    RecordCheckResult(CheckResult::kListEmpty);
+    return false;
+  }
+
+  bool result =
+      net::LookupStringInFixedSet(dafsa_.data(), dafsa_.size(), input.c_str(),
+                                  input.size()) == net::kDafsaFound;
+
+  // Record and return the result.
+  RecordCheckResult(result ? CheckResult::kFound : CheckResult::kNotFound);
+  return result;
+}
+
+void MediaEngagementPreloadedList::RecordLoadResult(LoadResult result) {
+  UMA_HISTOGRAM_ENUMERATION(kHistogramLoadResultName, result,
+                            LoadResult::kCount);
+}
+
+void MediaEngagementPreloadedList::RecordCheckResult(CheckResult result) const {
+  UMA_HISTOGRAM_ENUMERATION(kHistogramCheckResultName, result,
+                            CheckResult::kCount);
 }
diff --git a/chrome/browser/media/media_engagement_preloaded_list.h b/chrome/browser/media/media_engagement_preloaded_list.h
index 939253e2..65c726b 100644
--- a/chrome/browser/media/media_engagement_preloaded_list.h
+++ b/chrome/browser/media/media_engagement_preloaded_list.h
@@ -39,9 +39,56 @@
  protected:
   friend class MediaEngagementPreloadedListTest;
 
+  // The names of the CheckResult and LoadResult histograms.
+  static const char kHistogramCheckResultName[];
+  static const char kHistogramLoadResultName[];
+
+  // The result of the CheckStringIsPresent operation. This enum is used to
+  // record a histogram and should not be renumbered.
+  enum class CheckResult {
+    // The check succeeded and the string was found in the data.
+    kFound = 0,
+
+    // The check succeeded but the string was not found in the data.
+    kNotFound,
+
+    // The check failed because the list is empty.
+    kListEmpty,
+
+    // The check failed because the list has not been loaded.
+    kListNotLoaded,
+
+    kCount
+  };
+
+  // The result of the LoadFromFile operation. This enum is used to record
+  // a histogram and should not be renumbered.
+  enum class LoadResult {
+    // The list was loaded successfully.
+    kLoaded = 0,
+
+    // The list was not loaded because the file was not found.
+    kFileNotFound,
+
+    // The list was not loaded because the file could not be read.
+    kFileReadFailed,
+
+    // The list was not loaded because the proto stored in the file could not be
+    // parsed.
+    kParseProtoFailed,
+
+    kCount
+  };
+
   // Checks if |input| is present in the preloaded data.
   bool CheckStringIsPresent(const std::string& input) const;
 
+  // Records |result| to the LoadResult histogram.
+  void RecordLoadResult(LoadResult result);
+
+  // Records |result| to the CheckResult histogram.
+  void RecordCheckResult(CheckResult result) const;
+
  private:
   // The preloaded data in dafsa format.
   std::vector<unsigned char> dafsa_;
diff --git a/chrome/browser/media/media_engagement_preloaded_list_unittest.cc b/chrome/browser/media/media_engagement_preloaded_list_unittest.cc
index 1a6d78285b..2abe1ebf 100644
--- a/chrome/browser/media/media_engagement_preloaded_list_unittest.cc
+++ b/chrome/browser/media/media_engagement_preloaded_list_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/path_service.h"
+#include "base/test/histogram_tester.h"
 #include "build/build_config.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/test/base/testing_profile.h"
@@ -31,6 +32,9 @@
 
 const base::FilePath kEmptyFilePath = kTestDataPath.AppendASCII("empty.pb");
 
+const base::FilePath kFileReadFailedPath =
+    base::FilePath(FILE_PATH_LITERAL(".."));
+
 base::FilePath GetModulePath() {
   base::FilePath module_dir;
 #if defined(OS_ANDROID)
@@ -71,8 +75,69 @@
 
   bool IsEmpty() { return preloaded_list_->empty(); }
 
+  void ExpectCheckResultFoundCount(int count) {
+    ExpectCheckResultCount(MediaEngagementPreloadedList::CheckResult::kFound,
+                           count);
+  }
+
+  void ExpectCheckResultNotFoundCount(int count) {
+    ExpectCheckResultCount(MediaEngagementPreloadedList::CheckResult::kNotFound,
+                           count);
+  }
+
+  void ExpectCheckResultNotLoadedCount(int count) {
+    ExpectCheckResultCount(
+        MediaEngagementPreloadedList::CheckResult::kListNotLoaded, count);
+  }
+
+  void ExpectCheckResultListEmptyCount(int count) {
+    ExpectCheckResultCount(
+        MediaEngagementPreloadedList::CheckResult::kListEmpty, count);
+  }
+
+  void ExpectCheckResultTotal(int total) {
+    histogram_tester_.ExpectTotalCount(
+        MediaEngagementPreloadedList::kHistogramCheckResultName, total);
+  }
+
+  void ExpectLoadResultLoaded() {
+    ExpectLoadResult(MediaEngagementPreloadedList::LoadResult::kLoaded);
+  }
+
+  void ExpectLoadResultFileNotFound() {
+    ExpectLoadResult(MediaEngagementPreloadedList::LoadResult::kFileNotFound);
+  }
+
+  void ExpectLoadResultFileReadFailed() {
+    ExpectLoadResult(MediaEngagementPreloadedList::LoadResult::kFileReadFailed);
+  }
+
+  void ExpectLoadResultParseProtoFailed() {
+    ExpectLoadResult(
+        MediaEngagementPreloadedList::LoadResult::kParseProtoFailed);
+  }
+
  protected:
+  void ExpectLoadResult(MediaEngagementPreloadedList::LoadResult result) {
+    histogram_tester_.ExpectBucketCount(
+        MediaEngagementPreloadedList::kHistogramLoadResultName,
+        static_cast<int>(result), 1);
+
+    // Ensure not other results were logged.
+    histogram_tester_.ExpectTotalCount(
+        MediaEngagementPreloadedList::kHistogramLoadResultName, 1);
+  }
+
+  void ExpectCheckResultCount(MediaEngagementPreloadedList::CheckResult result,
+                              int count) {
+    histogram_tester_.ExpectBucketCount(
+        MediaEngagementPreloadedList::kHistogramCheckResultName,
+        static_cast<int>(result), count);
+  }
+
   std::unique_ptr<MediaEngagementPreloadedList> preloaded_list_;
+
+  base::HistogramTester histogram_tester_;
 };
 
 TEST_F(MediaEngagementPreloadedListTest, CheckOriginIsPresent) {
@@ -80,38 +145,95 @@
   EXPECT_TRUE(IsLoaded());
   EXPECT_FALSE(IsEmpty());
 
+  // Check the load result was recorded on the histogram.
+  ExpectLoadResultLoaded();
+
+  // Check some origins that are not in the list.
+  ExpectCheckResultTotal(0);
   EXPECT_TRUE(CheckOriginIsPresent(GURL("https://example.com")));
   EXPECT_TRUE(CheckOriginIsPresent(GURL("https://example.org:1234")));
   EXPECT_TRUE(CheckOriginIsPresent(GURL("https://test--3ya.com")));
   EXPECT_TRUE(CheckOriginIsPresent(GURL("http://123.123.123.123")));
 
+  // Check they were recorded on the histogram.
+  ExpectCheckResultTotal(4);
+  ExpectCheckResultFoundCount(4);
+
+  // Check some origins that are not in the list.
   EXPECT_FALSE(CheckOriginIsPresent(GURL("https://example.org")));
   EXPECT_FALSE(CheckOriginIsPresent(GURL("http://example.com")));
   EXPECT_FALSE(CheckOriginIsPresent(GURL("http://123.123.123.124")));
 
+  // Check they were recorded on the histogram.
+  ExpectCheckResultTotal(7);
+  ExpectCheckResultNotFoundCount(3);
+
   // Make sure only the full origin matches.
   EXPECT_FALSE(CheckStringIsPresent("123"));
   EXPECT_FALSE(CheckStringIsPresent("http"));
   EXPECT_FALSE(CheckStringIsPresent("example.com"));
+
+  // Check they were recorded on the histogram.
+  ExpectCheckResultTotal(10);
+  ExpectCheckResultNotFoundCount(6);
 }
 
 TEST_F(MediaEngagementPreloadedListTest, LoadMissingFile) {
   ASSERT_FALSE(LoadFromFile(GetFilePathRelativeToModule(kMissingFilePath)));
   EXPECT_FALSE(IsLoaded());
   EXPECT_TRUE(IsEmpty());
+
+  // Check the load result was recorded on the histogram.
+  ExpectLoadResultFileNotFound();
+
+  // Test checking an origin and make sure the result is recorded to the
+  // histogram.
   EXPECT_FALSE(CheckOriginIsPresent(GURL("https://example.com")));
+  ExpectCheckResultTotal(1);
+  ExpectCheckResultNotLoadedCount(1);
+}
+
+TEST_F(MediaEngagementPreloadedListTest, LoadFileReadFailed) {
+  ASSERT_FALSE(LoadFromFile(kFileReadFailedPath));
+  EXPECT_FALSE(IsLoaded());
+  EXPECT_TRUE(IsEmpty());
+
+  // Check the load result was recorded on the histogram.
+  ExpectLoadResultFileReadFailed();
+
+  // Test checking an origin and make sure the result is recorded to the
+  // histogram.
+  EXPECT_FALSE(CheckOriginIsPresent(GURL("https://example.com")));
+  ExpectCheckResultTotal(1);
+  ExpectCheckResultNotLoadedCount(1);
 }
 
 TEST_F(MediaEngagementPreloadedListTest, LoadBadFormatFile) {
   ASSERT_FALSE(LoadFromFile(GetFilePathRelativeToModule(kBadFormatFilePath)));
   EXPECT_FALSE(IsLoaded());
   EXPECT_TRUE(IsEmpty());
+
+  // Check the load result was recorded on the histogram.
+  ExpectLoadResultParseProtoFailed();
+
+  // Test checking an origin and make sure the result is recorded to the
+  // histogram.
   EXPECT_FALSE(CheckOriginIsPresent(GURL("https://example.com")));
+  ExpectCheckResultTotal(1);
+  ExpectCheckResultNotLoadedCount(1);
 }
 
 TEST_F(MediaEngagementPreloadedListTest, LoadEmptyFile) {
   ASSERT_TRUE(LoadFromFile(GetFilePathRelativeToModule(kEmptyFilePath)));
   EXPECT_TRUE(IsLoaded());
   EXPECT_TRUE(IsEmpty());
+
+  // Check the load result was recorded on the histogram.
+  ExpectLoadResultLoaded();
+
+  // Test checking an origin and make sure the result is recorded to the
+  // histogram.
   EXPECT_FALSE(CheckOriginIsPresent(GURL("https://example.com")));
+  ExpectCheckResultTotal(1);
+  ExpectCheckResultListEmptyCount(1);
 }
diff --git a/chrome/browser/page_load_metrics/observers/use_counter/ukm_features.cc b/chrome/browser/page_load_metrics/observers/use_counter/ukm_features.cc
index 1b435fa4..b903860 100644
--- a/chrome/browser/page_load_metrics/observers/use_counter/ukm_features.cc
+++ b/chrome/browser/page_load_metrics/observers/use_counter/ukm_features.cc
@@ -5,11 +5,19 @@
 #include "chrome/browser/page_load_metrics/observers/use_counter/ukm_features.h"
 #include "base/containers/flat_set.h"
 
+using WebFeature = blink::mojom::WebFeature;
+
 // UKM-based UseCounter features (WebFeature) should be defined in
 // opt_in_features list. Currently there have been no features opt-in for
 // UKM-based UseCounter, which is why the list is empty.
 bool IsAllowedUkmFeature(blink::mojom::WebFeature feature) {
-  CR_DEFINE_STATIC_LOCAL(const base::flat_set<blink::mojom::WebFeature>,
-                         opt_in_features, {});
+  CR_DEFINE_STATIC_LOCAL(
+      const base::flat_set<WebFeature>, opt_in_features,
+      ({
+          WebFeature::kNavigatorVibrate, WebFeature::kNavigatorVibrateSubFrame,
+          WebFeature::kVibrateWithoutUserGesture,
+          WebFeature::kTouchEventPreventedNoTouchAction,
+          WebFeature::kTouchEventPreventedForcedDocumentPassiveNoTouchAction,
+      }));
   return opt_in_features.count(feature);
 }
diff --git a/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer.h b/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer.h
index 9f9abee..a55f6601 100644
--- a/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer.h
+++ b/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer.h
@@ -15,6 +15,8 @@
 
 const char kFeaturesHistogramName[] =
     "Blink.UseCounter.Features_TestBrowserProcessLogging";
+const char kUkmUseCounterEventName[] = "Blink.UseCounter";
+const char kUkmUseCounterFeature[] = "Feature";
 
 }  // namespace internal
 
diff --git a/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer_unittest.cc b/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer_unittest.cc
index 2dcac50..d20e198 100644
--- a/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer_unittest.cc
+++ b/chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer_unittest.cc
@@ -92,3 +92,27 @@
   page_load_features_1.features = features_1;
   HistogramBasicTest(page_load_features_0, page_load_features_1);
 }
+
+TEST_F(UseCounterPageLoadMetricsObserverTest, RecordUkmUsage) {
+  std::vector<WebFeature> features_0(
+      {WebFeature::kFetch, WebFeature::kNavigatorVibrate});
+  std::vector<WebFeature> features_1(
+      {WebFeature::kTouchEventPreventedNoTouchAction});
+  page_load_metrics::mojom::PageLoadFeatures page_load_features_0;
+  page_load_metrics::mojom::PageLoadFeatures page_load_features_1;
+  page_load_features_0.features = features_0;
+  page_load_features_1.features = features_1;
+  HistogramBasicTest(page_load_features_0, page_load_features_1);
+
+  std::vector<const ukm::mojom::UkmEntry*> entries =
+      test_ukm_recorder().GetEntriesByName(internal::kUkmUseCounterEventName);
+  EXPECT_EQ(2ul, entries.size());
+  test_ukm_recorder().ExpectEntrySourceHasUrl(entries[0], GURL(kTestUrl));
+  test_ukm_recorder().ExpectEntryMetric(
+      entries[0], internal::kUkmUseCounterFeature,
+      static_cast<int64_t>(WebFeature::kNavigatorVibrate));
+  test_ukm_recorder().ExpectEntrySourceHasUrl(entries[1], GURL(kTestUrl));
+  test_ukm_recorder().ExpectEntryMetric(
+      entries[1], internal::kUkmUseCounterFeature,
+      static_cast<int64_t>(WebFeature::kTouchEventPreventedNoTouchAction));
+}
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
index ce85009..4402bbac 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
@@ -1189,9 +1189,34 @@
       static_cast<int32_t>(WebFeature::kV8Element_Animate_Method), 1);
   histogram_tester_.ExpectBucketCount(
       internal::kFeaturesHistogramName,
+      static_cast<int32_t>(WebFeature::kNavigatorVibrate), 1);
+  histogram_tester_.ExpectBucketCount(
+      internal::kFeaturesHistogramName,
       static_cast<int32_t>(WebFeature::kPageVisits), 1);
 }
 
+// Test UseCounter UKM features observed.
+IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest,
+                       UseCounterUkmFeaturesLogged) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  auto waiter = CreatePageLoadMetricsWaiter();
+  waiter->AddPageExpectation(TimingField::LOAD_EVENT);
+  GURL url = embedded_test_server()->GetURL(
+      "/page_load_metrics/use_counter_features.html");
+  ui_test_utils::NavigateToURL(browser(), url);
+  waiter->Wait();
+  NavigateToUntrackedUrl();
+
+  const auto& entries =
+      test_ukm_recorder_->GetEntriesByName(internal::kUkmUseCounterEventName);
+  EXPECT_EQ(1u, entries.size());
+  test_ukm_recorder_->ExpectEntrySourceHasUrl(entries[0], url);
+  test_ukm_recorder_->ExpectEntryMetric(
+      entries[0], internal::kUkmUseCounterFeature,
+      static_cast<int64_t>(WebFeature::kNavigatorVibrate));
+}
+
 // Test UseCounter Features observed in a child frame are recorded, exactly
 // once per feature.
 IN_PROC_BROWSER_TEST_F(PageLoadMetricsBrowserTest, UseCounterFeaturesInIframe) {
@@ -1213,6 +1238,9 @@
       static_cast<int32_t>(WebFeature::kV8Element_Animate_Method), 1);
   histogram_tester_.ExpectBucketCount(
       internal::kFeaturesHistogramName,
+      static_cast<int32_t>(WebFeature::kNavigatorVibrate), 1);
+  histogram_tester_.ExpectBucketCount(
+      internal::kFeaturesHistogramName,
       static_cast<int32_t>(WebFeature::kPageVisits), 1);
 }
 
@@ -1239,6 +1267,9 @@
       static_cast<int32_t>(WebFeature::kV8Element_Animate_Method), 1);
   histogram_tester_.ExpectBucketCount(
       internal::kFeaturesHistogramName,
+      static_cast<int32_t>(WebFeature::kNavigatorVibrate), 1);
+  histogram_tester_.ExpectBucketCount(
+      internal::kFeaturesHistogramName,
       static_cast<int32_t>(WebFeature::kPageVisits), 1);
 }
 
diff --git a/chrome/browser/policy/policy_prefs_browsertest.cc b/chrome/browser/policy/policy_prefs_browsertest.cc
index 13f89fc..88266f0 100644
--- a/chrome/browser/policy/policy_prefs_browsertest.cc
+++ b/chrome/browser/policy/policy_prefs_browsertest.cc
@@ -59,6 +59,10 @@
 
 namespace {
 
+// The name of the template example in policy_test_cases.json that does not need
+// to be parsed.
+const char kTemplateSampleTest[] = "-- Template --";
+
 const char kCrosSettingsPrefix[] = "cros.";
 
 std::string GetPolicyName(const std::string& policy_name_decorated) {
@@ -250,15 +254,10 @@
       ADD_FAILURE() << "Error parsing policy_test_cases.json: " << error_string;
       return;
     }
-    Schema chrome_schema = Schema::Wrap(GetChromeSchemaData());
-    if (!chrome_schema.valid()) {
-      ADD_FAILURE();
-      return;
-    }
     for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd();
          it.Advance()) {
       const std::string policy_name = GetPolicyName(it.key());
-      if (!chrome_schema.GetKnownProperty(policy_name).valid())
+      if (policy_name == kTemplateSampleTest)
         continue;
       PolicyTestCase* policy_test_case = GetPolicyTestCase(dict, it.key());
       if (policy_test_case)
@@ -300,6 +299,7 @@
     policy_test_dict->GetBoolean("can_be_recommended", &can_be_recommended);
     std::string indicator_selector;
     policy_test_dict->GetString("indicator_selector", &indicator_selector);
+
     PolicyTestCase* policy_test_case = new PolicyTestCase(name,
                                                           is_official_only,
                                                           can_be_recommended,
@@ -312,6 +312,7 @@
           policy_test_case->AddSupportedOs(os);
       }
     }
+
     const base::DictionaryValue* policy = NULL;
     if (policy_test_dict->GetDictionary("test_policy", &policy))
       policy_test_case->SetTestPolicy(*policy);
@@ -322,8 +323,8 @@
         std::string pref;
         if (!pref_mappings->GetDictionary(i, &pref_mapping_dict) ||
             !pref_mapping_dict->GetString("pref", &pref)) {
-          ADD_FAILURE() << "Malformed pref_mappings entry in "
-                        << "policy_test_cases.json.";
+          ADD_FAILURE() << "Malformed pref_mappings entry for " << name
+                        << " in policy_test_cases.json.";
           continue;
         }
         bool is_local_state = false;
@@ -351,8 +352,8 @@
             const base::DictionaryValue* policy = NULL;
             if (!indicator_tests->GetDictionary(i, &indicator_test_dict) ||
                 !indicator_test_dict->GetDictionary("policy", &policy)) {
-              ADD_FAILURE() << "Malformed indicator_tests entry in "
-                            << "policy_test_cases.json.";
+              ADD_FAILURE() << "Malformed indicator_tests entry for " << name
+                            << " in policy_test_cases.json.";
               continue;
             }
             std::string value;
@@ -389,8 +390,26 @@
   PolicyTestCases policy_test_cases;
   for (Schema::Iterator it = chrome_schema.GetPropertiesIterator();
        !it.IsAtEnd(); it.Advance()) {
-    EXPECT_TRUE(base::ContainsKey(policy_test_cases.map(), it.key()))
-        << "Missing policy test case for: " << it.key();
+    auto policy = policy_test_cases.map().find(it.key());
+    if (policy == policy_test_cases.map().end()) {
+      ADD_FAILURE() << "Missing policy test case for: " << it.key();
+    } else {
+      bool has_test_case_for_this_os = false;
+      for (PolicyTestCases::PolicyTestCaseVector::const_iterator test_case =
+               policy->second.begin();
+           test_case != policy->second.end() && !has_test_case_for_this_os;
+           ++test_case) {
+        has_test_case_for_this_os |= (*test_case)->IsSupported();
+      }
+      // This can only be a warning as many policies are not really testable
+      // this way and only present as a single line in the file.
+      // Although they could at least contain the "os" and "test_policy" fields.
+      // See http://crbug.com/791125.
+      LOG_IF(WARNING, !has_test_case_for_this_os)
+          << "Policy " << policy->first
+          << " is marked as supported on this OS in policy_templates.json but "
+          << "have a test for this platform in policy_test_cases.json.";
+    }
   }
 }
 
@@ -439,6 +458,8 @@
 // Verifies that policies make their corresponding preferences become managed,
 // and that the user can't override that setting.
 IN_PROC_BROWSER_TEST_F(PolicyPrefsTest, PolicyToPrefsMapping) {
+  Schema chrome_schema = Schema::Wrap(GetChromeSchemaData());
+  ASSERT_TRUE(chrome_schema.valid());
   PrefService* local_state = g_browser_process->local_state();
   PrefService* user_prefs = browser()->profile()->GetPrefs();
 
@@ -451,6 +472,24 @@
          test_case != policy->second.end();
          ++test_case) {
       const auto& pref_mappings = (*test_case)->pref_mappings();
+      if (!chrome_schema.GetKnownProperty(policy->first).valid()) {
+        // If the policy is supported on this platform according to the test it
+        // should be known otherwise we signal this as a failure.
+        // =====================================================================
+        // !NOTE! If you see this assertion after changing Chrome's VERSION most
+        // probably the mentioned policy was deprecated and deleted. Verify this
+        // in policy_templates.json and remove the corresponding test entry
+        // in policy_test_cases.json. Don't completely delete it from there just
+        // replace it's definition with a single "note" value stating its
+        // deprecation date (see other examples present in the file already).
+        // =====================================================================
+        EXPECT_FALSE((*test_case)->IsSupported())
+            << "Policy " << policy->first
+            << " is marked as supported on this OS but does not exist in the "
+            << "Chrome policy schema.";
+        continue;
+      }
+
       if (!(*test_case)->IsSupported() || pref_mappings.empty())
         continue;
 
diff --git a/chrome/browser/spellchecker/spellcheck_mac_view_browsertest.mm b/chrome/browser/spellchecker/spellcheck_mac_view_browsertest.mm
new file mode 100644
index 0000000..f82036c
--- /dev/null
+++ b/chrome/browser/spellchecker/spellcheck_mac_view_browsertest.mm
@@ -0,0 +1,48 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import <Cocoa/Cocoa.h>
+#include "chrome/browser/ui/browser.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "components/spellcheck/spellcheck_build_features.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_widget_host_view.h"
+#include "content/public/browser/web_contents.h"
+
+#if BUILDFLAG(ENABLE_SPELLCHECK)
+#include "chrome/browser/spellchecker/test/spellcheck_content_browser_client.h"
+#endif
+
+namespace {
+
+class SpellCheckMacViewBrowserTest : public InProcessBrowserTest {
+ public:
+  SpellCheckMacViewBrowserTest() {}
+};
+
+#if BUILDFLAG(ENABLE_SPELLCHECK)
+IN_PROC_BROWSER_TEST_F(SpellCheckMacViewBrowserTest, SpellCheckPanelVisible) {
+  spellcheck::SpellCheckContentBrowserClient browser_client;
+  content::ContentBrowserClient* old_browser_client =
+      content::SetBrowserClientForTesting(&browser_client);
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  auto* web_contents = browser()->tab_strip_model()->GetActiveWebContents();
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL("/title1.html"));
+
+  SEL show_guess_panel = NSSelectorFromString(@"showGuessPanel:");
+  [web_contents->GetRenderWidgetHostView()->GetNativeView()
+      performSelector:show_guess_panel];
+  browser_client.RunUntilBind();
+  spellcheck::SpellCheckMockPanelHost* host =
+      browser_client.GetSpellCheckMockPanelHostForProcess(
+          web_contents->GetMainFrame()->GetProcess());
+  EXPECT_TRUE(host->SpellingPanelVisible());
+  content::SetBrowserClientForTesting(old_browser_client);
+}
+#endif
+
+}  // namespace
diff --git a/chrome/browser/spellchecker/test/spellcheck_content_browser_client.cc b/chrome/browser/spellchecker/test/spellcheck_content_browser_client.cc
new file mode 100644
index 0000000..e3cce89
--- /dev/null
+++ b/chrome/browser/spellchecker/test/spellcheck_content_browser_client.cc
@@ -0,0 +1,61 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/spellchecker/test/spellcheck_content_browser_client.h"
+
+#include "content/public/browser/browser_thread.h"
+#include "services/service_manager/public/cpp/bind_source_info.h"
+
+namespace spellcheck {
+
+SpellCheckContentBrowserClient::SpellCheckContentBrowserClient() {}
+SpellCheckContentBrowserClient::~SpellCheckContentBrowserClient() {}
+
+void SpellCheckContentBrowserClient::OverrideOnBindInterface(
+    const service_manager::BindSourceInfo& remote_info,
+    const std::string& name,
+    mojo::ScopedMessagePipeHandle* handle) {
+  if (name != spellcheck::mojom::SpellCheckPanelHost::Name_)
+    return;
+
+  spellcheck::mojom::SpellCheckPanelHostRequest request(std::move(*handle));
+
+  // Override the default SpellCheckHost interface.
+  auto ui_task_runner = content::BrowserThread::GetTaskRunnerForThread(
+      content::BrowserThread::UI);
+  ui_task_runner->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          &SpellCheckContentBrowserClient::BindSpellCheckPanelHostRequest,
+          base::Unretained(this), base::Passed(&request), remote_info));
+}
+
+SpellCheckMockPanelHost*
+SpellCheckContentBrowserClient::GetSpellCheckMockPanelHostForProcess(
+    content::RenderProcessHost* render_process_host) const {
+  for (const auto& host : hosts_) {
+    if (host->process_host() == render_process_host)
+      return host.get();
+  }
+  return nullptr;
+}
+
+void SpellCheckContentBrowserClient::RunUntilBind() {
+  base::RunLoop run_loop;
+  quit_on_bind_closure_ = run_loop.QuitClosure();
+  run_loop.Run();
+}
+
+void SpellCheckContentBrowserClient::BindSpellCheckPanelHostRequest(
+    spellcheck::mojom::SpellCheckPanelHostRequest request,
+    const service_manager::BindSourceInfo& source_info) {
+  content::RenderProcessHost* render_process_host =
+      content::RenderProcessHost::FromRendererIdentity(source_info.identity);
+  auto spell_check_panel_host =
+      std::make_unique<SpellCheckMockPanelHost>(render_process_host);
+  spell_check_panel_host->SpellCheckPanelHostRequest(std::move(request));
+  hosts_.push_back(std::move(spell_check_panel_host));
+  std::move(quit_on_bind_closure_).Run();
+}
+}  // namespace spellcheck
diff --git a/chrome/browser/spellchecker/test/spellcheck_content_browser_client.h b/chrome/browser/spellchecker/test/spellcheck_content_browser_client.h
new file mode 100644
index 0000000..39afe1d
--- /dev/null
+++ b/chrome/browser/spellchecker/test/spellcheck_content_browser_client.h
@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_CONTENT_BROWSER_CLIENT_H_
+#define CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_CONTENT_BROWSER_CLIENT_H_
+
+#include <vector>
+
+#include "chrome/browser/chrome_content_browser_client.h"
+#include "chrome/browser/spellchecker/test/spellcheck_mock_panel_host.h"
+
+namespace spellcheck {
+class SpellCheckContentBrowserClient : public ChromeContentBrowserClient {
+ public:
+  SpellCheckContentBrowserClient();
+  ~SpellCheckContentBrowserClient() override;
+
+  // ContentBrowserClient overrides.
+  void OverrideOnBindInterface(
+      const service_manager::BindSourceInfo& remote_info,
+      const std::string& name,
+      mojo::ScopedMessagePipeHandle* handle) override;
+
+  SpellCheckMockPanelHost* GetSpellCheckMockPanelHostForProcess(
+      content::RenderProcessHost* render_process_host) const;
+
+  void RunUntilBind();
+
+ private:
+  void BindSpellCheckPanelHostRequest(
+      spellcheck::mojom::SpellCheckPanelHostRequest request,
+      const service_manager::BindSourceInfo& source_info);
+
+  base::OnceClosure quit_on_bind_closure_;
+  std::vector<std::unique_ptr<SpellCheckMockPanelHost>> hosts_;
+
+  DISALLOW_COPY_AND_ASSIGN(SpellCheckContentBrowserClient);
+};
+}  // namespace spellcheck
+
+#endif  // CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_CONTENT_BROWSER_CLIENT_H_
diff --git a/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.cc b/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.cc
new file mode 100644
index 0000000..dd809c9
--- /dev/null
+++ b/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.cc
@@ -0,0 +1,47 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/spellchecker/test/spellcheck_mock_panel_host.h"
+
+#include "base/run_loop.h"
+#include "content/public/browser/browser_thread.h"
+
+namespace spellcheck {
+
+SpellCheckMockPanelHost::SpellCheckMockPanelHost(
+    content::RenderProcessHost* process_host)
+    : process_host_(process_host) {}
+
+SpellCheckMockPanelHost::~SpellCheckMockPanelHost() {}
+
+bool SpellCheckMockPanelHost::SpellingPanelVisible() {
+  if (!show_spelling_panel_called_) {
+    base::RunLoop run_loop;
+    quit_ = run_loop.QuitClosure();
+    run_loop.Run();
+  }
+
+  return spelling_panel_visible_;
+}
+
+void SpellCheckMockPanelHost::SpellCheckPanelHostRequest(
+    spellcheck::mojom::SpellCheckPanelHostRequest request) {
+  bindings_.AddBinding(this, std::move(request));
+}
+
+// spellcheck::mojom::SpellCheckPanelHost:
+void SpellCheckMockPanelHost::ShowSpellingPanel(bool show) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  show_spelling_panel_called_ = true;
+  spelling_panel_visible_ = show;
+  if (quit_)
+    std::move(quit_).Run();
+}
+
+void SpellCheckMockPanelHost::UpdateSpellingPanelWithMisspelledWord(
+    const base::string16& word) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+}
+}  // namespace spellcheck
diff --git a/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.h b/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.h
new file mode 100644
index 0000000..3ae1355
--- /dev/null
+++ b/chrome/browser/spellchecker/test/spellcheck_mock_panel_host.h
@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_MOCK_PANEL_HOST_H_
+#define CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_MOCK_PANEL_HOST_H_
+
+#include "base/callback.h"
+#include "components/spellcheck/common/spellcheck_panel.mojom.h"
+#include "content/public/browser/render_process_host.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
+
+namespace spellcheck {
+
+class SpellCheckMockPanelHost : public spellcheck::mojom::SpellCheckPanelHost {
+ public:
+  explicit SpellCheckMockPanelHost(content::RenderProcessHost* process_host);
+  ~SpellCheckMockPanelHost() override;
+
+  content::RenderProcessHost* process_host() const { return process_host_; }
+
+  bool SpellingPanelVisible();
+  void SpellCheckPanelHostRequest(
+      spellcheck::mojom::SpellCheckPanelHostRequest request);
+
+ private:
+  // spellcheck::mojom::SpellCheckPanelHost:
+  void ShowSpellingPanel(bool show) override;
+  void UpdateSpellingPanelWithMisspelledWord(
+      const base::string16& word) override;
+
+  mojo::BindingSet<spellcheck::mojom::SpellCheckPanelHost> bindings_;
+  content::RenderProcessHost* process_host_;
+  bool show_spelling_panel_called_ = false;
+  bool spelling_panel_visible_ = false;
+  base::OnceClosure quit_;
+
+  DISALLOW_COPY_AND_ASSIGN(SpellCheckMockPanelHost);
+};
+}  // namespace spellcheck
+
+#endif  // CHROME_BROWSER_SPELLCHECKER_TEST_SPELLCHECK_MOCK_PANEL_HOST_H_
diff --git a/chrome/browser/sync/test/integration/bookmarks_helper.cc b/chrome/browser/sync/test/integration/bookmarks_helper.cc
index c392f30..70244977 100644
--- a/chrome/browser/sync/test/integration/bookmarks_helper.cc
+++ b/chrome/browser/sync/test/integration/bookmarks_helper.cc
@@ -80,21 +80,12 @@
 class FaviconChangeObserver : public bookmarks::BookmarkModelObserver {
  public:
   FaviconChangeObserver(BookmarkModel* model, const BookmarkNode* node)
-      : model_(model),
-        node_(node),
-        wait_for_load_(false) {
+      : model_(model), node_(node) {
     model->AddObserver(this);
   }
   ~FaviconChangeObserver() override { model_->RemoveObserver(this); }
-  void WaitForGetFavicon() {
-    DCHECK(!run_loop_.running());
-    wait_for_load_ = true;
-    content::RunThisRunLoop(&run_loop_);
-    ASSERT_TRUE(node_->is_favicon_loaded());
-  }
   void WaitForSetFavicon() {
     DCHECK(!run_loop_.running());
-    wait_for_load_ = false;
     content::RunThisRunLoop(&run_loop_);
   }
 
@@ -127,16 +118,13 @@
                                      const BookmarkNode* node) override {}
   void BookmarkNodeFaviconChanged(BookmarkModel* model,
                                   const BookmarkNode* node) override {
-    if (model == model_ && node == node_ && run_loop_.running()) {
-      if (!wait_for_load_ || (wait_for_load_ && node->is_favicon_loaded()))
-        run_loop_.Quit();
-    }
+    if (model == model_ && node == node_)
+      run_loop_.Quit();
   }
 
  private:
   BookmarkModel* model_;
   const BookmarkNode* node_;
-  bool wait_for_load_;
   base::RunLoop run_loop_;
   DISALLOW_COPY_AND_ASSIGN(FaviconChangeObserver);
 };
@@ -221,9 +209,10 @@
   GURL icon_url;
 };
 
-// Gets the favicon and icon URL associated with |node| in |model|.
-FaviconData GetFaviconData(BookmarkModel* model,
-                           const BookmarkNode* node) {
+// Gets the favicon and icon URL associated with |node| in |model|. Returns
+// nullopt if the favicon is still loading.
+base::Optional<FaviconData> GetFaviconData(BookmarkModel* model,
+                                           const BookmarkNode* node) {
   // If a favicon wasn't explicitly set for a particular URL, simply return its
   // blank favicon.
   if (!urls_with_favicons_ ||
@@ -233,10 +222,12 @@
   // If a favicon was explicitly set, we may need to wait for it to be loaded
   // via BookmarkModel::GetFavicon(), which is an asynchronous operation.
   if (!node->is_favicon_loaded()) {
-    FaviconChangeObserver observer(model, node);
     model->GetFavicon(node);
-    observer.WaitForGetFavicon();
+    // Favicon still loading, no data available just yet.
+    return base::nullopt;
   }
+
+  // Favicon loaded: return actual image.
   return FaviconData(model->GetFavicon(node),
                      node->icon_url() ? *node->icon_url() : GURL());
 }
@@ -266,9 +257,7 @@
 
     // Wait for the favicon for |node| to be invalidated.
     observer.WaitForSetFavicon();
-    // Wait for the BookmarkModel to fetch the updated favicon and for the new
-    // favicon to be sent to BookmarkChangeProcessor.
-    GetFaviconData(model, node);
+    model->GetFavicon(node);
 }
 
 // Expires the favicon for |profile| and |node|. |profile| may be
@@ -315,9 +304,7 @@
 
   // Wait for the favicon for |node| to be invalidated.
   observer.WaitForSetFavicon();
-  // Wait for the BookmarkModel to fetch the updated favicon and for the new
-  // favicon to be sent to BookmarkChangeProcessor.
-  GetFaviconData(model, node);
+  model->GetFavicon(node);
 }
 
 // Wait for all currently scheduled tasks on the history thread for all
@@ -360,14 +347,19 @@
                    BookmarkModel* model_b,
                    const BookmarkNode* node_a,
                    const BookmarkNode* node_b) {
-  FaviconData favicon_data_a = GetFaviconData(model_a, node_a);
-  FaviconData favicon_data_b = GetFaviconData(model_b, node_b);
+  base::Optional<FaviconData> favicon_data_a = GetFaviconData(model_a, node_a);
+  base::Optional<FaviconData> favicon_data_b = GetFaviconData(model_b, node_b);
 
-  if (favicon_data_a.icon_url != favicon_data_b.icon_url)
+  // If either of the two favicons is still loading, let's return false now
+  // because observers will get notified when the load completes.
+  if (!favicon_data_a.has_value() || !favicon_data_b.has_value())
     return false;
 
-  gfx::Image image_a = favicon_data_a.image;
-  gfx::Image image_b = favicon_data_b.image;
+  if (favicon_data_a->icon_url != favicon_data_b->icon_url)
+    return false;
+
+  gfx::Image image_a = favicon_data_a->image;
+  gfx::Image image_b = favicon_data_b->image;
 
   if (image_a.IsEmpty() && image_b.IsEmpty())
     return true;  // Two empty images are equivalent.
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 5fa0883..817de08f 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -675,6 +675,7 @@
       "../browser/net/network_connection_tracker_browsertest.cc",
       "../browser/speech/extension_api/tts_extension_apitest.cc",
       "../browser/speech/speech_recognition_browsertest.cc",
+      "../browser/spellchecker/spellcheck_mac_view_browsertest.mm",
       "../browser/spellchecker/spellcheck_service_browsertest.cc",
       "../browser/ssl/cert_verifier_browser_test.cc",
       "../browser/ssl/cert_verifier_browser_test.h",
diff --git a/chrome/test/data/page_load_metrics/use_counter_features.html b/chrome/test/data/page_load_metrics/use_counter_features.html
index 8196b74..a59a2b2c 100644
--- a/chrome/test/data/page_load_metrics/use_counter_features.html
+++ b/chrome/test/data/page_load_metrics/use_counter_features.html
@@ -10,6 +10,7 @@
         { transform: 'translateY(-300px)' }
     ]);
     document.getElementById("para").firstChild.wholeText;
+    navigator.vibrate(10);
   }
   </script>
   </body>
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index 9c24297..8eecc4e 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -31,7 +31,7 @@
   },
 
   "UnsafelyTreatInsecureOriginAsSecure": {
-    "os": ["win", "linux", "max", "chromeos", "android"],
+    "os": ["win", "linux", "mac"],
     "test_policy": { "UnsafelyTreatInsecureOriginAsSecure": ["http://example.com/"] },
     "pref_mappings": [ { "pref": "unsafely_treat_insecure_origin_as_secure" } ]
   },
@@ -126,16 +126,7 @@
   },
 
   "DnsPrefetchingEnabled": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "can_be_recommended": true,
-    "test_policy": { "DnsPrefetchingEnabled": false },
-    "pref_mappings": [
-      { "pref": "net.network_prediction_options",
-        "indicator_tests": [
-          { "policy": { "DnsPrefetchingEnabled": false } }
-        ]
-      }
-    ]
+    "note": "This policy has been removed. See https://bugs.chromium.org/p/chromium/issues/detail?id=624095"
   },
 
   "NetworkPredictionOptions": {
@@ -152,11 +143,7 @@
   },
 
   "DisableSpdy": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": { "DisableSpdy": true },
-    "pref_mappings": [
-      { "pref": "spdy.disabled" }
-    ]
+    "note": "This policy has been removed. See https://bugs.chromium.org/p/chromium/issues/detail?id=624095"
   },
 
   "QuicAllowed": {
@@ -540,9 +527,7 @@
   },
 
   "DisablePluginFinder": {
-    "note": "This policy is not in use anymore.",
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": { "DisablePluginFinder": true }
+    "note": "This policy is not in use anymore since Chrome 65."
   },
 
   "SyncDisabled": {
@@ -562,8 +547,7 @@
   },
 
   "EnableDeprecatedWebBasedSignin": {
-    "os": ["win", "linux", "mac"],
-    "test_policy": { "EnableDeprecatedWebBasedSignin": false }
+    "note": "This policy has been removed in Chrome 42."
   },
 
   "UserDataDir": {
@@ -724,6 +708,7 @@
           { "policy": { "ProxySettings": { "ProxyMode": "direct" } } }
         ]
       }
+
     ]
   },
 
@@ -732,13 +717,7 @@
   },
 
   "DisableSSLRecordSplitting": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": { "DisableSSLRecordSplitting": true },
-    "pref_mappings": [
-      { "pref": "ssl.ssl_record_splitting.disabled",
-        "local_state": true
-      }
-    ]
+    "note": "This policy is retired, see https://bugs.chromium.org/p/chromium/issues/detail?id=485097#c17."
   },
 
   "EnableOnlineRevocationChecks": {
@@ -832,7 +811,7 @@
   },
 
   "GSSAPILibraryName": {
-    "os": ["mac", "linux"],
+    "os": ["linux"],
     "test_policy": { "GSSAPILibraryName": "libwhatever.so" },
     "pref_mappings": [
       { "pref": "auth.gssapi_library_name",
@@ -1113,16 +1092,7 @@
   },
 
   "DefaultSearchProviderInstantURL": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": {
-      "DefaultSearchProviderEnabled": true,
-      "DefaultSearchProviderSearchURL": "http://www.google.com/?q={searchTerms}",
-      "DefaultSearchProviderKeyword": "google",
-      "DefaultSearchProviderInstantURL": "http://www.google.com/instant?q={searchTerms}"
-    },
-    "pref_mappings": [
-      { "pref": "default_search_provider_data.template_url_data" }
-    ]
+    "note": "Deprecated since Chrome 63. See https://crbug.com/476079"
   },
 
   "DefaultSearchProviderNewTabURL": {
@@ -1178,16 +1148,7 @@
   },
 
   "DefaultSearchProviderSearchTermsReplacementKey": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": {
-      "DefaultSearchProviderEnabled": true,
-      "DefaultSearchProviderSearchURL": "http://www.google.com/?q={searchTerms}",
-      "DefaultSearchProviderKeyword": "google",
-      "DefaultSearchProviderSearchTermsReplacementKey": "espv"
-    },
-    "pref_mappings": [
-      { "pref": "default_search_provider_data.template_url_data" }
-    ]
+    "note": "Deprecated since Chrome 63. See https://crbug.com/476079"
   },
 
   "DefaultSearchProviderImageURL": {
@@ -1230,16 +1191,7 @@
   },
 
   "DefaultSearchProviderInstantURLPostParams": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": {
-      "DefaultSearchProviderEnabled": true,
-      "DefaultSearchProviderSearchURL": "http://www.google.com/?q={searchTerms}",
-      "DefaultSearchProviderKeyword": "google",
-      "DefaultSearchProviderInstantURLPostParams": ""
-    },
-    "pref_mappings": [
-      { "pref": "default_search_provider_data.template_url_data" }
-    ]
+    "note": "Deprecated since Chrome 63. See https://crbug.com/476079"
   },
 
   "DefaultSearchProviderImageURLPostParams": {
@@ -1784,11 +1736,7 @@
   },
 
   "AlwaysAuthorizePlugins": {
-    "os": ["win", "linux", "mac", "chromeos"],
-    "test_policy": { "AlwaysAuthorizePlugins": true },
-    "pref_mappings": [
-      { "pref": "plugins.always_authorize" }
-    ]
+    "note": "This policy has been removed since Chrome 65."
   },
 
   "RunAllFlashInAllowMode": {
@@ -1925,7 +1873,7 @@
   },
 
   "MaxConnectionsPerProxy": {
-    "os": ["win", "linux", "mac", "chromeos"],
+    "os": ["win", "linux", "mac"],
     "test_policy": { "MaxConnectionsPerProxy": 16 },
     "pref_mappings": [
       { "pref": "net.max_connections_per_proxy",
@@ -2095,7 +2043,7 @@
   },
 
   "HideWebStoreIcon": {
-    "os": ["win", "linux", "mac", "chromeos"],
+    "os": ["win", "linux", "mac"],
     "test_policy": { "HideWebStoreIcon": true },
     "pref_mappings": [
       { "pref": "hide_web_store_icon" }
@@ -2165,7 +2113,7 @@
   },
 
   "ForceBrowserSignin": {
-    "os": ["win", "linux", "mac"],
+    "os": ["win"],
     "test_policy": { "ForceBrowserSignin": false },
     "pref_mappings": [
       { "pref": "profile.force_browser_signin",
@@ -3313,7 +3261,7 @@
   },
 
   "BrowserNetworkTimeQueriesEnabled": {
-    "os": ["win", "linux", "mac", "chromeos"],
+    "os": ["win", "linux", "mac"],
     "test_policy": { "BrowserNetworkTimeQueriesEnabled": true },
     "pref_mappings": [
       { "pref": "network_time.network_time_queries_enabled",
@@ -3327,8 +3275,7 @@
   },
 
   "DeviceEcryptfsMigrationStrategy": {
-    "note": "This policy is deprecated.",
-    "os": ["chromeos"]
+    "note": "This policy is deprecated and removed since Chrome 61."
   },
 
   "NoteTakingAppsLockScreenWhitelist": {
diff --git a/components/autofill/core/browser/autofill_field.cc b/components/autofill/core/browser/autofill_field.cc
index 63ace0e..0e86da83 100644
--- a/components/autofill/core/browser/autofill_field.cc
+++ b/components/autofill/core/browser/autofill_field.cc
@@ -91,18 +91,19 @@
 }
 
 AutofillType AutofillField::Type() const {
+  // If autocomplete=tel/tel-* and server confirms it really is a phone field,
+  // we always user the server prediction as html types are not very reliable.
+  if ((GroupTypeOfHtmlFieldType(html_type_, html_mode_) == PHONE_BILLING ||
+       GroupTypeOfHtmlFieldType(html_type_, html_mode_) == PHONE_HOME) &&
+      (GroupTypeOfServerFieldType(overall_server_type_) == PHONE_BILLING ||
+       GroupTypeOfServerFieldType(overall_server_type_) == PHONE_HOME)) {
+    return AutofillType(overall_server_type_);
+  }
+
   // Use the html type specified by the website unless it is unrecognized and
   // autofill predicts a credit card type.
   if (html_type_ != HTML_TYPE_UNSPECIFIED &&
       !(html_type_ == HTML_TYPE_UNRECOGNIZED && IsCreditCardPrediction())) {
-    // If autocomplete=tel and server says it's a phone field without country
-    // code, we override html prediction(autocomplete=tel leads to whole number
-    // prediction).
-    if (html_type_ == HTML_TYPE_TEL &&
-        overall_server_type_ == PHONE_HOME_CITY_AND_NUMBER) {
-      return AutofillType(PHONE_HOME_CITY_AND_NUMBER);
-    }
-
     return AutofillType(html_type_, html_mode_);
   }
 
diff --git a/components/autofill/core/browser/autofill_type.cc b/components/autofill/core/browser/autofill_type.cc
index b58d1a13..f40ee0b9 100644
--- a/components/autofill/core/browser/autofill_type.cc
+++ b/components/autofill/core/browser/autofill_type.cc
@@ -8,40 +8,8 @@
 
 namespace autofill {
 
-AutofillType::AutofillType(ServerFieldType field_type)
-    : html_type_(HTML_TYPE_UNSPECIFIED), html_mode_(HTML_MODE_NONE) {
-  if ((field_type < NO_SERVER_DATA || field_type >= MAX_VALID_FIELD_TYPE) ||
-      (field_type >= 15 && field_type <= 19) ||
-      (field_type >= 25 && field_type <= 29) ||
-      (field_type >= 44 && field_type <= 50)) {
-    server_type_ = UNKNOWN_TYPE;
-  } else {
-    server_type_ = field_type;
-  }
-}
-
-AutofillType::AutofillType(HtmlFieldType field_type, HtmlFieldMode mode)
-    : server_type_(UNKNOWN_TYPE),
-      html_type_(field_type),
-      html_mode_(mode) {}
-
-
-AutofillType::AutofillType(const AutofillType& autofill_type) {
-  *this = autofill_type;
-}
-
-AutofillType& AutofillType::operator=(const AutofillType& autofill_type) {
-  if (this != &autofill_type) {
-    this->server_type_ = autofill_type.server_type_;
-    this->html_type_ = autofill_type.html_type_;
-    this->html_mode_ = autofill_type.html_mode_;
-  }
-
-  return *this;
-}
-
-FieldTypeGroup AutofillType::group() const {
-  switch (server_type_) {
+FieldTypeGroup GroupTypeOfServerFieldType(ServerFieldType field_type) {
+  switch (field_type) {
     case NAME_FIRST:
     case NAME_MIDDLE:
     case NAME_LAST:
@@ -150,16 +118,21 @@
       return USERNAME_FIELD;
 
     case UNKNOWN_TYPE:
-      break;
+      return NO_GROUP;
+    default:
+      return NO_GROUP;
   }
+}
 
-  switch (html_type_) {
+FieldTypeGroup GroupTypeOfHtmlFieldType(HtmlFieldType field_type,
+                                        HtmlFieldMode field_mode) {
+  switch (field_type) {
     case HTML_TYPE_NAME:
     case HTML_TYPE_GIVEN_NAME:
     case HTML_TYPE_ADDITIONAL_NAME:
     case HTML_TYPE_ADDITIONAL_NAME_INITIAL:
     case HTML_TYPE_FAMILY_NAME:
-      return html_mode_ == HTML_MODE_BILLING ? NAME_BILLING : NAME;
+      return field_mode == HTML_MODE_BILLING ? NAME_BILLING : NAME;
 
     case HTML_TYPE_ORGANIZATION:
       return COMPANY;
@@ -175,7 +148,7 @@
     case HTML_TYPE_COUNTRY_NAME:
     case HTML_TYPE_POSTAL_CODE:
     case HTML_TYPE_FULL_ADDRESS:
-      return html_mode_ == HTML_MODE_BILLING ? ADDRESS_BILLING : ADDRESS_HOME;
+      return field_mode == HTML_MODE_BILLING ? ADDRESS_BILLING : ADDRESS_HOME;
 
     case HTML_TYPE_CREDIT_CARD_NAME_FULL:
     case HTML_TYPE_CREDIT_CARD_NAME_FIRST:
@@ -204,21 +177,46 @@
     case HTML_TYPE_TEL_LOCAL_PREFIX:
     case HTML_TYPE_TEL_LOCAL_SUFFIX:
     case HTML_TYPE_TEL_EXTENSION:
-      return html_mode_ == HTML_MODE_BILLING ? PHONE_BILLING : PHONE_HOME;
+      return field_mode == HTML_MODE_BILLING ? PHONE_BILLING : PHONE_HOME;
 
     case HTML_TYPE_EMAIL:
       return EMAIL;
 
     case HTML_TYPE_UPI_VPA:
       // TODO(crbug/702223): Add support for UPI-VPA.
-      break;
+      return NO_GROUP;
 
     case HTML_TYPE_UNSPECIFIED:
     case HTML_TYPE_UNRECOGNIZED:
-      break;
+      return NO_GROUP;
+    default:
+      return NO_GROUP;
   }
+}
 
-  return NO_GROUP;
+AutofillType::AutofillType(ServerFieldType field_type)
+    : html_type_(HTML_TYPE_UNSPECIFIED), html_mode_(HTML_MODE_NONE) {
+  if ((field_type < NO_SERVER_DATA || field_type >= MAX_VALID_FIELD_TYPE) ||
+      (field_type >= 15 && field_type <= 19) ||
+      (field_type >= 25 && field_type <= 29) ||
+      (field_type >= 44 && field_type <= 50)) {
+    server_type_ = UNKNOWN_TYPE;
+  } else {
+    server_type_ = field_type;
+  }
+}
+
+AutofillType::AutofillType(HtmlFieldType field_type, HtmlFieldMode mode)
+    : server_type_(UNKNOWN_TYPE), html_type_(field_type), html_mode_(mode) {}
+
+FieldTypeGroup AutofillType::group() const {
+  FieldTypeGroup result = NO_GROUP;
+  if (server_type_ != UNKNOWN_TYPE) {
+    result = GroupTypeOfServerFieldType(server_type_);
+  } else {
+    result = GroupTypeOfHtmlFieldType(html_type_, html_mode_);
+  }
+  return result;
 }
 
 bool AutofillType::IsUnknown() const {
diff --git a/components/autofill/core/browser/autofill_type.h b/components/autofill/core/browser/autofill_type.h
index 20f5b76..893567a 100644
--- a/components/autofill/core/browser/autofill_type.h
+++ b/components/autofill/core/browser/autofill_type.h
@@ -11,14 +11,23 @@
 
 namespace autofill {
 
+// Help method that takes a |ServerFieldType| and returns it's corresponding
+// |FieldTypeGroup| value.
+FieldTypeGroup GroupTypeOfServerFieldType(ServerFieldType field_type);
+
+// Help method that takes a |HtmlFieldType| and |HtmlFieldMode|, then returns
+// their corresponding |FieldTypeGroup| value.
+FieldTypeGroup GroupTypeOfHtmlFieldType(HtmlFieldType field_type,
+                                        HtmlFieldMode field_mode);
+
 // The high-level description of Autofill types, used to categorize form fields
 // and for associating form fields with form values in the Web Database.
 class AutofillType {
  public:
   explicit AutofillType(ServerFieldType field_type);
   AutofillType(HtmlFieldType field_type, HtmlFieldMode mode);
-  AutofillType(const AutofillType& autofill_type);
-  AutofillType& operator=(const AutofillType& autofill_type);
+  AutofillType(const AutofillType& autofill_type) = default;
+  AutofillType& operator=(const AutofillType& autofill_type) = default;
 
   HtmlFieldType html_type() const { return html_type_; }
 
diff --git a/components/autofill/core/browser/field_filler_unittest.cc b/components/autofill/core/browser/field_filler_unittest.cc
index 26b82ba..0c2da9f 100644
--- a/components/autofill/core/browser/field_filler_unittest.cc
+++ b/components/autofill/core/browser/field_filler_unittest.cc
@@ -211,8 +211,9 @@
   EXPECT_EQ(NAME_FULL, field.Type().GetStorableType());
 }
 
-// Tests that a server prediction of *_CITY_AND_NUMBER override html
-// "autocomplete=tel" prediction, which is always *_WHOLE_NUMBER
+// Tests that if both autocomplete attibutes and server agree it's a phone
+// field, always use server predicted type. If they disagree with autocomplete
+// says it's a phone field, always use autocomplete attribute.
 TEST_F(AutofillFieldFillerTest,
        Type_ServerPredictionOfCityAndNumber_OverrideHtml) {
   AutofillField field;
@@ -222,11 +223,22 @@
   field.set_overall_server_type(PHONE_HOME_CITY_AND_NUMBER);
   EXPECT_EQ(PHONE_HOME_CITY_AND_NUMBER, field.Type().GetStorableType());
 
-  // Other phone number prediction does not override.
+  // Overrides to another number format.
   field.set_overall_server_type(PHONE_HOME_NUMBER);
+  EXPECT_EQ(PHONE_HOME_NUMBER, field.Type().GetStorableType());
+
+  // Overrides autocomplete=tel-national too.
+  field.SetHtmlType(HTML_TYPE_TEL_NATIONAL, HTML_MODE_NONE);
+  field.set_overall_server_type(PHONE_HOME_WHOLE_NUMBER);
   EXPECT_EQ(PHONE_HOME_WHOLE_NUMBER, field.Type().GetStorableType());
 
-  // If html type not specified, we use server prediction.
+  // If autocomplete=tel-national but server says it's not a phone field,
+  // do not override.
+  field.SetHtmlType(HTML_TYPE_TEL_NATIONAL, HTML_MODE_NONE);
+  field.set_overall_server_type(CREDIT_CARD_EXP_DATE_2_DIGIT_YEAR);
+  EXPECT_EQ(PHONE_HOME_CITY_AND_NUMBER, field.Type().GetStorableType());
+
+  // If html type not specified, we still use server prediction.
   field.SetHtmlType(HTML_TYPE_UNSPECIFIED, HTML_MODE_NONE);
   field.set_overall_server_type(PHONE_HOME_CITY_AND_NUMBER);
   EXPECT_EQ(PHONE_HOME_CITY_AND_NUMBER, field.Type().GetStorableType());
diff --git a/components/autofill/ios/browser/autofill_client_ios_bridge.h b/components/autofill/ios/browser/autofill_client_ios_bridge.h
index 18ab563..d99ed3ec 100644
--- a/components/autofill/ios/browser/autofill_client_ios_bridge.h
+++ b/components/autofill/ios/browser/autofill_client_ios_bridge.h
@@ -5,20 +5,16 @@
 #ifndef COMPONENTS_AUTOFILL_IOS_BROWSER_AUTOFILL_CLIENT_IOS_BRIDGE_H_
 #define COMPONENTS_AUTOFILL_IOS_BROWSER_AUTOFILL_CLIENT_IOS_BRIDGE_H_
 
-#include <stdint.h>
 #include <vector>
 
 #include "base/memory/weak_ptr.h"
 
 namespace autofill {
 class AutofillPopupDelegate;
-struct FormData;
-class FormStructure;
 struct Suggestion;
 };
 
-// Interface used to pipe events from AutoFillManangerDelegateIOS to the
-// embedder.
+// Interface used to pipe events from AutofillClientIOS to the embedder.
 @protocol AutofillClientIOSBridge
 
 - (void)showAutofillPopup:(const std::vector<autofill::Suggestion>&)suggestions
@@ -27,12 +23,6 @@
 
 - (void)hideAutofillPopup;
 
-- (void)onFormDataFilled:(uint16_t)query_id
-                  result:(const autofill::FormData&)result;
-
-- (void)sendAutofillTypePredictionsToRenderer:
-        (const std::vector<autofill::FormStructure*>&)forms;
-
 @end
 
 #endif  // COMPONENTS_AUTOFILL_IOS_BROWSER_AUTOFILL_CLIENT_IOS_BRIDGE_H_
diff --git a/components/autofill/ios/browser/autofill_driver_ios_bridge.h b/components/autofill/ios/browser/autofill_driver_ios_bridge.h
index c60388fa..1a816e6e 100644
--- a/components/autofill/ios/browser/autofill_driver_ios_bridge.h
+++ b/components/autofill/ios/browser/autofill_driver_ios_bridge.h
@@ -14,6 +14,7 @@
 class FormStructure;
 }
 
+// Interface used to pipe form data from AutofillDriverIOS to the embedder.
 @protocol AutofillDriverIOSBridge
 
 - (void)onFormDataFilled:(uint16_t)query_id
diff --git a/components/bookmarks/browser/bookmark_model.h b/components/bookmarks/browser/bookmark_model.h
index dc54a7f..b555ba10f 100644
--- a/components/bookmarks/browser/bookmark_model.h
+++ b/components/bookmarks/browser/bookmark_model.h
@@ -147,8 +147,11 @@
             const BookmarkNode* new_parent,
             int index);
 
-  // Returns the favicon for |node|. If the favicon has not yet been
-  // loaded it is loaded and the observer of the model notified when done.
+  // Returns the favicon for |node|. If the favicon has not yet been loaded,
+  // a load will be triggered and the observer of the model notified when done.
+  // This also means that, on return, the node's state is guaranteed to be
+  // either LOADED_FAVICON (if it was already loaded prior to the call) or
+  // LOADING_FAVICON (with the exception of folders, where the call is a no-op).
   const gfx::Image& GetFavicon(const BookmarkNode* node);
 
   // Returns the type of the favicon for |node|. If the favicon has not yet
diff --git a/media/gpu/BUILD.gn b/media/gpu/BUILD.gn
index 4ad0235d..758ec52 100644
--- a/media/gpu/BUILD.gn
+++ b/media/gpu/BUILD.gn
@@ -360,18 +360,12 @@
 
   if (is_win) {
     sources += [
-      "d3d11_video_decode_accelerator_win.cc",
-      "d3d11_video_decode_accelerator_win.h",
       "dxva_picture_buffer_win.cc",
       "dxva_picture_buffer_win.h",
       "dxva_video_decode_accelerator_win.cc",
       "dxva_video_decode_accelerator_win.h",
       "media_foundation_video_encode_accelerator_win.cc",
       "media_foundation_video_encode_accelerator_win.h",
-      "windows/d3d11_h264_accelerator.cc",
-      "windows/d3d11_h264_accelerator.h",
-      "windows/d3d11_picture_buffer.cc",
-      "windows/d3d11_picture_buffer.h",
       "windows/init_guid.cc",
     ]
     configs += [
@@ -403,6 +397,10 @@
     ]
     if (enable_d3d11_video_decoder) {
       sources += [
+        "windows/d3d11_h264_accelerator.cc",
+        "windows/d3d11_h264_accelerator.h",
+        "windows/d3d11_picture_buffer.cc",
+        "windows/d3d11_picture_buffer.h",
         "windows/d3d11_video_decoder.cc",
         "windows/d3d11_video_decoder.h",
         "windows/d3d11_video_decoder_impl.cc",
diff --git a/media/gpu/d3d11_video_decode_accelerator_win.cc b/media/gpu/d3d11_video_decode_accelerator_win.cc
deleted file mode 100644
index c96e7a4..0000000
--- a/media/gpu/d3d11_video_decode_accelerator_win.cc
+++ /dev/null
@@ -1,253 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "media/gpu/d3d11_video_decode_accelerator_win.h"
-
-#include "base/bits.h"
-#include "base/memory/ptr_util.h"
-#include "base/memory/shared_memory.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "base/trace_event/trace_event.h"
-#include "media/gpu/h264_decoder.h"
-#include "media/gpu/h264_dpb.h"
-#include "media/gpu/windows/d3d11_h264_accelerator.h"
-#include "media/gpu/windows/d3d11_picture_buffer.h"
-#include "ui/gfx/color_space.h"
-#include "ui/gl/gl_angle_util_win.h"
-#include "ui/gl/gl_bindings.h"
-
-namespace media {
-
-#define RETURN_ON_FAILURE(result, log, ret) \
-  do {                                      \
-    if (!(result)) {                        \
-      DLOG(ERROR) << log;                   \
-      return ret;                           \
-    }                                       \
-  } while (0)
-
-D3D11VideoDecodeAccelerator::D3D11VideoDecodeAccelerator(
-    const GetGLContextCallback& get_gl_context_cb,
-    const MakeGLContextCurrentCallback& make_context_current_cb,
-    const BindGLImageCallback& bind_image_cb)
-    : get_gl_context_cb_(get_gl_context_cb),
-      make_context_current_cb_(make_context_current_cb),
-      bind_image_cb_(bind_image_cb) {}
-
-D3D11VideoDecodeAccelerator::~D3D11VideoDecodeAccelerator() {}
-
-bool D3D11VideoDecodeAccelerator::Initialize(const Config& config,
-                                             Client* client) {
-  client_ = client;
-  make_context_current_cb_.Run();
-
-  device_ = gl::QueryD3D11DeviceObjectFromANGLE();
-  device_->GetImmediateContext(device_context_.GetAddressOf());
-
-  HRESULT hr = device_context_.CopyTo(video_context_.GetAddressOf());
-  CHECK(SUCCEEDED(hr));
-
-  hr = device_.CopyTo(video_device_.GetAddressOf());
-  CHECK(SUCCEEDED(hr));
-
-  bool is_h264 =
-      config.profile >= H264PROFILE_MIN && config.profile <= H264PROFILE_MAX;
-  if (!is_h264)
-    return false;
-
-  GUID needed_guid;
-  memcpy(&needed_guid, &D3D11_DECODER_PROFILE_H264_VLD_NOFGT,
-         sizeof(needed_guid));
-  GUID decoder_guid = {};
-
-  {
-    // Enumerate supported video profiles and look for the H264 profile.
-    bool found = false;
-    UINT profile_count = video_device_->GetVideoDecoderProfileCount();
-    for (UINT profile_idx = 0; profile_idx < profile_count; profile_idx++) {
-      GUID profile_id = {};
-      hr = video_device_->GetVideoDecoderProfile(profile_idx, &profile_id);
-      if (SUCCEEDED(hr) && (profile_id == needed_guid)) {
-        decoder_guid = profile_id;
-        found = true;
-        break;
-      }
-    }
-    CHECK(found);
-  }
-
-  D3D11_VIDEO_DECODER_DESC desc = {};
-  desc.Guid = decoder_guid;
-  desc.SampleWidth = 1920;
-  desc.SampleHeight = 1088;
-  desc.OutputFormat = DXGI_FORMAT_NV12;
-  UINT config_count = 0;
-  hr = video_device_->GetVideoDecoderConfigCount(&desc, &config_count);
-  if (FAILED(hr) || config_count == 0)
-    CHECK(false);
-
-  D3D11_VIDEO_DECODER_CONFIG dec_config = {};
-  for (UINT i = 0; i < config_count; i++) {
-    hr = video_device_->GetVideoDecoderConfig(&desc, i, &dec_config);
-    if (FAILED(hr))
-      CHECK(false);
-    if (dec_config.ConfigBitstreamRaw == 2)
-      break;
-  }
-  memcpy(&decoder_guid_, &decoder_guid, sizeof decoder_guid_);
-
-  Microsoft::WRL::ComPtr<ID3D11VideoDecoder> video_decoder;
-  hr = video_device_->CreateVideoDecoder(&desc, &dec_config,
-                                         video_decoder.GetAddressOf());
-  CHECK(video_decoder.Get());
-
-  h264_accelerator_.reset(new D3D11H264Accelerator(
-      this, video_decoder, video_device_, video_context_));
-  decoder_.reset(new media::H264Decoder(h264_accelerator_.get()));
-
-  return true;
-}
-
-void D3D11VideoDecodeAccelerator::Decode(
-    const BitstreamBuffer& bitstream_buffer) {
-  input_buffer_queue_.push_back(bitstream_buffer);
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(&D3D11VideoDecodeAccelerator::DoDecode,
-                            base::Unretained(this)));
-}
-
-void D3D11VideoDecodeAccelerator::DoDecode() {
-  if (!bitstream_buffer_) {
-    if (input_buffer_queue_.empty())
-      return;
-    BitstreamBuffer buffer = input_buffer_queue_.front();
-    bitstream_buffer_ =
-        base::MakeUnique<base::SharedMemory>(buffer.handle(), true);
-    bitstream_buffer_->Map(buffer.size());
-    bitstream_buffer_size_ = buffer.size();
-    input_buffer_id_ = buffer.id();
-    input_buffer_queue_.pop_front();
-    decoder_->SetStream((const uint8_t*)bitstream_buffer_->memory(),
-                        bitstream_buffer_size_);
-  }
-
-  while (true) {
-    media::AcceleratedVideoDecoder::DecodeResult result = decoder_->Decode();
-    if (result == media::AcceleratedVideoDecoder::kRanOutOfStreamData) {
-      client_->NotifyEndOfBitstreamBuffer(input_buffer_id_);
-      bitstream_buffer_.reset();
-      break;
-    }
-    if (result == media::AcceleratedVideoDecoder::kRanOutOfSurfaces) {
-      return;
-    }
-    if (result == media::AcceleratedVideoDecoder::kAllocateNewSurfaces) {
-      client_->ProvidePictureBuffers(20, PIXEL_FORMAT_NV12, 2,
-                                     decoder_->GetPicSize(),
-                                     GL_TEXTURE_EXTERNAL_OES);
-      return;
-
-    } else {
-      LOG(ERROR) << "VDA Error " << result;
-      CHECK(false);
-    }
-  }
-
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(&D3D11VideoDecodeAccelerator::DoDecode,
-                            base::Unretained(this)));
-}
-
-void D3D11VideoDecodeAccelerator::AssignPictureBuffers(
-    const std::vector<PictureBuffer>& buffers) {
-  D3D11_TEXTURE2D_DESC texture_desc = {};
-  texture_desc.Width = decoder_->GetPicSize().width();
-  texture_desc.Height = decoder_->GetPicSize().height();
-  texture_desc.MipLevels = 1;
-  texture_desc.ArraySize = buffers.size();
-  texture_desc.Format = DXGI_FORMAT_NV12;
-  texture_desc.SampleDesc.Count = 1;
-  texture_desc.Usage = D3D11_USAGE_DEFAULT;
-  texture_desc.BindFlags = D3D11_BIND_DECODER | D3D11_BIND_SHADER_RESOURCE;
-  texture_desc.MiscFlags = D3D11_RESOURCE_MISC_SHARED;
-
-  Microsoft::WRL::ComPtr<ID3D11Texture2D> out_texture;
-  HRESULT hr = device_->CreateTexture2D(&texture_desc, nullptr,
-                                        out_texture.GetAddressOf());
-  CHECK(SUCCEEDED(hr));
-
-  make_context_current_cb_.Run();
-  picture_buffers_.clear();
-
-  for (size_t i = 0; i < buffers.size(); i++) {
-    picture_buffers_.push_back(
-        base::MakeUnique<D3D11PictureBuffer>(buffers[i], i));
-    picture_buffers_[i]->Init(video_device_, out_texture, decoder_guid_);
-    for (uint32_t client_id : buffers[i].client_texture_ids()) {
-      // The picture buffer handles the actual binding of its contents to
-      // texture ids. This call just causes the texture manager to hold a
-      // reference to the GLImage as long as either texture exists.
-      bind_image_cb_.Run(client_id, GL_TEXTURE_EXTERNAL_OES,
-                         picture_buffers_[i]->gl_image(), true);
-    }
-  }
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(&D3D11VideoDecodeAccelerator::DoDecode,
-                            base::Unretained(this)));
-}
-
-void D3D11VideoDecodeAccelerator::ReusePictureBuffer(
-    int32_t picture_buffer_id) {
-  make_context_current_cb_.Run();
-  for (auto& buffer : picture_buffers_) {
-    if (buffer->picture_buffer().id() == picture_buffer_id) {
-      buffer->set_in_client_use(false);
-
-      break;
-    }
-  }
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(&D3D11VideoDecodeAccelerator::DoDecode,
-                            base::Unretained(this)));
-}
-
-D3D11PictureBuffer* D3D11VideoDecodeAccelerator::GetPicture() {
-  for (auto& buffer : picture_buffers_)
-    if (!buffer->in_client_use() && !buffer->in_picture_use()) {
-      return buffer.get();
-    }
-  return nullptr;
-}
-
-void D3D11VideoDecodeAccelerator::Flush() {
-  client_->NotifyFlushDone();
-}
-
-void D3D11VideoDecodeAccelerator::Reset() {
-  client_->NotifyResetDone();
-}
-void D3D11VideoDecodeAccelerator::Destroy() {}
-
-bool D3D11VideoDecodeAccelerator::TryToSetupDecodeOnSeparateThread(
-    const base::WeakPtr<Client>& decode_client,
-    const scoped_refptr<base::SingleThreadTaskRunner>& decode_task_runner) {
-  return false;
-}
-
-GLenum D3D11VideoDecodeAccelerator::GetSurfaceInternalFormat() const {
-  return GL_BGRA_EXT;
-}
-
-size_t D3D11VideoDecodeAccelerator::input_buffer_id() const {
-  return input_buffer_id_;
-}
-
-void D3D11VideoDecodeAccelerator::OutputResult(D3D11PictureBuffer* buffer,
-                                               size_t input_buffer_id) {
-  buffer->set_in_client_use(true);
-  Picture picture(buffer->picture_buffer().id(), input_buffer_id,
-                  gfx::Rect(0, 0), gfx::ColorSpace(), true);
-  client_->PictureReady(picture);
-}
-}  // namespace media
diff --git a/media/gpu/d3d11_video_decode_accelerator_win.h b/media/gpu/d3d11_video_decode_accelerator_win.h
deleted file mode 100644
index e753afc6..0000000
--- a/media/gpu/d3d11_video_decode_accelerator_win.h
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef MEDIA_GPU_D3D11_VIDEO_DECODE_ACCELERATOR_WIN_H_
-#define MEDIA_GPU_D3D11_VIDEO_DECODE_ACCELERATOR_WIN_H_
-
-#include <d3d11.h>
-#include <wrl/client.h>
-
-#include <list>
-#include <memory>
-
-#include "media/gpu/accelerated_video_decoder.h"
-#include "media/gpu/gpu_video_decode_accelerator_helpers.h"
-#include "media/gpu/media_gpu_export.h"
-#include "media/gpu/windows/d3d11_h264_accelerator.h"
-#include "media/video/video_decode_accelerator.h"
-
-namespace media {
-
-class MEDIA_GPU_EXPORT D3D11VideoDecodeAccelerator
-    : public VideoDecodeAccelerator,
-      public D3D11VideoDecoderClient {
- public:
-  D3D11VideoDecodeAccelerator(
-      const GetGLContextCallback& get_gl_context_cb,
-      const MakeGLContextCurrentCallback& make_context_current_cb,
-      const BindGLImageCallback& bind_image_cb);
-
-  ~D3D11VideoDecodeAccelerator() override;
-
-  // VideoDecodeAccelerator implementation.
-  bool Initialize(const Config& config, Client* client) override;
-  void Decode(const BitstreamBuffer& bitstream_buffer) override;
-  void DoDecode();
-  void AssignPictureBuffers(const std::vector<PictureBuffer>& buffers) override;
-  void ReusePictureBuffer(int32_t picture_buffer_id) override;
-  void Flush() override;
-  void Reset() override;
-  void Destroy() override;
-  bool TryToSetupDecodeOnSeparateThread(
-      const base::WeakPtr<Client>& decode_client,
-      const scoped_refptr<base::SingleThreadTaskRunner>& decode_task_runner)
-      override;
-  GLenum GetSurfaceInternalFormat() const override;
-
-  // D3D11VideoDecoderClient implementation.
-  D3D11PictureBuffer* GetPicture() override;
-  void OutputResult(D3D11PictureBuffer* buffer,
-                    size_t input_buffer_id) override;
-  size_t input_buffer_id() const override;
-
- private:
-  Client* client_;
-  GetGLContextCallback get_gl_context_cb_;
-  MakeGLContextCurrentCallback make_context_current_cb_;
-  BindGLImageCallback bind_image_cb_;
-  Microsoft::WRL::ComPtr<ID3D11Device> device_;
-  Microsoft::WRL::ComPtr<ID3D11DeviceContext> device_context_;
-  Microsoft::WRL::ComPtr<ID3D11VideoDevice> video_device_;
-  Microsoft::WRL::ComPtr<ID3D11VideoContext> video_context_;
-  std::unique_ptr<AcceleratedVideoDecoder> decoder_;
-  std::unique_ptr<D3D11H264Accelerator> h264_accelerator_;
-
-  GUID decoder_guid_;
-
-  std::list<BitstreamBuffer> input_buffer_queue_;
-  uint32_t input_buffer_id_;
-  std::unique_ptr<base::SharedMemory> bitstream_buffer_;
-  size_t bitstream_buffer_size_;
-
-  std::vector<std::unique_ptr<D3D11PictureBuffer>> picture_buffers_;
-
-  DISALLOW_COPY_AND_ASSIGN(D3D11VideoDecodeAccelerator);
-};
-
-}  // namespace media
-
-#endif  // MEDIA_GPU_D3D11_VIDEO_DECODE_ACCELERATOR_WIN_H_
diff --git a/media/gpu/gpu_video_decode_accelerator_factory.cc b/media/gpu/gpu_video_decode_accelerator_factory.cc
index f40347a..1ef66d1 100644
--- a/media/gpu/gpu_video_decode_accelerator_factory.cc
+++ b/media/gpu/gpu_video_decode_accelerator_factory.cc
@@ -15,7 +15,6 @@
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
-#include "media/gpu/d3d11_video_decode_accelerator_win.h"
 #include "media/gpu/dxva_video_decode_accelerator_win.h"
 #endif
 #if defined(OS_MACOSX)
@@ -137,7 +136,6 @@
                                            const gpu::GpuPreferences&) const;
   const CreateVDAFp create_vda_fps[] = {
 #if defined(OS_WIN)
-    &GpuVideoDecodeAcceleratorFactory::CreateD3D11VDA,
     &GpuVideoDecodeAcceleratorFactory::CreateDXVAVDA,
 #endif
 #if BUILDFLAG(USE_V4L2_CODEC)
@@ -168,21 +166,6 @@
 
 #if defined(OS_WIN)
 std::unique_ptr<VideoDecodeAccelerator>
-GpuVideoDecodeAcceleratorFactory::CreateD3D11VDA(
-    const gpu::GpuDriverBugWorkarounds& workarounds,
-    const gpu::GpuPreferences& gpu_preferences) const {
-  std::unique_ptr<VideoDecodeAccelerator> decoder;
-  if (!base::FeatureList::IsEnabled(kD3D11VideoDecoding))
-    return decoder;
-  if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
-    DVLOG(0) << "Initializing D3D11 HW decoder for windows.";
-    decoder.reset(new D3D11VideoDecodeAccelerator(
-        get_gl_context_cb_, make_context_current_cb_, bind_image_cb_));
-  }
-  return decoder;
-}
-
-std::unique_ptr<VideoDecodeAccelerator>
 GpuVideoDecodeAcceleratorFactory::CreateDXVAVDA(
     const gpu::GpuDriverBugWorkarounds& workarounds,
     const gpu::GpuPreferences& gpu_preferences) const {
diff --git a/net/socket/sequenced_socket_data_unittest.cc b/net/socket/sequenced_socket_data_unittest.cc
index 4d54f23..47e7a7db 100644
--- a/net/socket/sequenced_socket_data_unittest.cc
+++ b/net/socket/sequenced_socket_data_unittest.cc
@@ -671,8 +671,8 @@
 
   static const char* kExpectedFailures[] = {
       "Expected: (data.length()) >= (expected_data.length())",
-      "To be equal to: actual_data",
-      "To be equal to: sock_->Write(buf.get(), len, failing_callback_)"};
+      "Expected equality of these values:\n  expected_data",
+      "Expected equality of these values:\n  rv"};
   ASSERT_EQ(arraysize(kExpectedFailures),
             static_cast<size_t>(gtest_failures.size()));
 
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 20ac164..e4804b2 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -2408,7 +2408,6 @@
 crbug.com/788337 external/wpt/css/css-multicol/multicol-count-computed-005.xht [ Failure ]
 crbug.com/788337 external/wpt/css/css-multicol/multicol-height-block-child-001.xht [ Failure ]
 crbug.com/788337 external/wpt/css/css-multicol/multicol-rule-004.xht [ Failure ]
-crbug.com/788337 external/wpt/css/css-multicol/multicol-rule-fraction-003.xht [ Failure ]
 crbug.com/788337 external/wpt/css/css-multicol/multicol-rule-inset-000.xht [ Failure ]
 crbug.com/788337 external/wpt/css/css-multicol/multicol-rule-outset-000.xht [ Failure ]
 crbug.com/788337 external/wpt/css/css-multicol/multicol-rule-style-inset-001.xht [ Failure ]
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/multicol-rule-fraction-3-ref.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/multicol-rule-fraction-3-ref.xht
index 9189b97..f4d3b845d0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/multicol-rule-fraction-3-ref.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-multicol/multicol-rule-fraction-3-ref.xht
@@ -32,9 +32,9 @@
 	background: blue;
 	width: 1em;
 }
-#a1 {left: 2.43em;}
+#a1 {left: 2.4em;}
 #a2 {left: 3.75em;}
-#a3 {left: 6.13em;}
+#a3 {left: 6.15em;}
 #a4 {left: 7.5em;}
 #a5 {left: 9.9em;}
 #a6 {left: 11.25em;}
diff --git a/third_party/WebKit/Source/bindings/scripts/idl_types.py b/third_party/WebKit/Source/bindings/scripts/idl_types.py
index 05298fe..b30aa692 100644
--- a/third_party/WebKit/Source/bindings/scripts/idl_types.py
+++ b/third_party/WebKit/Source/bindings/scripts/idl_types.py
@@ -370,6 +370,11 @@
             lambda member_type: member_type.base_type == 'boolean')
 
     @property
+    def sequence_member_type(self):
+        return self.single_matching_member_type(
+            lambda member_type: member_type.is_sequence_type)
+
+    @property
     def as_union_type(self):
         # Note: Use this to "look through" a possible IdlNullableType wrapper.
         return self
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_types.py b/third_party/WebKit/Source/bindings/scripts/v8_types.py
index 0dc4ed8b..16191434 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_types.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_types.py
@@ -1034,6 +1034,8 @@
         member_type = idl_type.numeric_member_type
     elif idl_literal.idl_type == 'boolean':
         member_type = idl_type.boolean_member_type
+    elif idl_literal.idl_type == 'sequence':
+        member_type = idl_type.sequence_member_type
     else:
         raise ValueError('Unsupported literal type: ' + idl_literal.idl_type)
 
diff --git a/third_party/WebKit/Source/bindings/tests/idls/core/TestDictionary.idl b/third_party/WebKit/Source/bindings/tests/idls/core/TestDictionary.idl
index b1a630be..8432d04 100644
--- a/third_party/WebKit/Source/bindings/tests/idls/core/TestDictionary.idl
+++ b/third_party/WebKit/Source/bindings/tests/idls/core/TestDictionary.idl
@@ -48,4 +48,5 @@
     (Float or BooleanType) unionWithTypedefs;
     [Clamp] long applicableToTypeLongMember;
     [TreatNullAs=EmptyString] DOMString applicableToTypeStringMember;
+    (double or sequence<double>) unionMemberWithSequenceDefault = [];
 };
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.cpp b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.cpp
index 7d76415..649bbe22 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.cpp
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.cpp
@@ -30,6 +30,7 @@
   setTestInterfaceGarbageCollectedSequenceMember(HeapVector<Member<TestInterfaceGarbageCollected>>());
   setTestInterfaceSequenceMember(HeapVector<Member<TestInterfaceImplementation>>());
   setTreatNullAsStringSequenceMember(Vector<String>());
+  setUnionMemberWithSequenceDefault(DoubleOrDoubleSequence::FromDoubleSequence(Vector<double>()));
   setUnrestrictedDoubleMember(3.14);
 }
 
@@ -130,6 +131,10 @@
   has_union_in_record_member_ = true;
 }
 
+void TestDictionary::setUnionMemberWithSequenceDefault(const DoubleOrDoubleSequence& value) {
+  union_member_with_sequence_default_ = value;
+}
+
 void TestDictionary::setUnionWithTypedefs(const FloatOrBoolean& value) {
   union_with_typedefs_ = value;
 }
@@ -152,6 +157,7 @@
   visitor->Trace(test_object_sequence_member_);
   visitor->Trace(uint8_array_member_);
   visitor->Trace(union_in_record_member_);
+  visitor->Trace(union_member_with_sequence_default_);
   visitor->Trace(union_with_typedefs_);
   IDLDictionaryBase::Trace(visitor);
 }
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h
index 99d9c71..8f694146 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/TestDictionary.h
@@ -14,6 +14,7 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/IDLDictionaryBase.h"
 #include "bindings/core/v8/ScriptValue.h"
+#include "bindings/core/v8/double_or_double_sequence.h"
 #include "bindings/core/v8/double_or_string.h"
 #include "bindings/core/v8/float_or_boolean.h"
 #include "bindings/core/v8/long_or_boolean.h"
@@ -318,6 +319,12 @@
   }
   void setUnionInRecordMember(const HeapVector<std::pair<String, LongOrBoolean>>&);
 
+  bool hasUnionMemberWithSequenceDefault() const { return !union_member_with_sequence_default_.IsNull(); }
+  const DoubleOrDoubleSequence& unionMemberWithSequenceDefault() const {
+    return union_member_with_sequence_default_;
+  }
+  void setUnionMemberWithSequenceDefault(const DoubleOrDoubleSequence&);
+
   bool hasUnionWithTypedefs() const { return !union_with_typedefs_.IsNull(); }
   const FloatOrBoolean& unionWithTypedefs() const {
     return union_with_typedefs_;
@@ -401,6 +408,7 @@
   Vector<String> treat_null_as_string_sequence_member_;
   Member<DOMUint8Array> uint8_array_member_;
   HeapVector<std::pair<String, LongOrBoolean>> union_in_record_member_;
+  DoubleOrDoubleSequence union_member_with_sequence_default_;
   FloatOrBoolean union_with_typedefs_;
   double unrestricted_double_member_;
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/V8TestDictionary.cpp b/third_party/WebKit/Source/bindings/tests/results/core/V8TestDictionary.cpp
index a5cb768..c1bfc8a5 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/V8TestDictionary.cpp
+++ b/third_party/WebKit/Source/bindings/tests/results/core/V8TestDictionary.cpp
@@ -76,6 +76,7 @@
     "treatNullAsStringSequenceMember",
     "uint8ArrayMember",
     "unionInRecordMember",
+    "unionMemberWithSequenceDefault",
     "unionWithTypedefs",
     "unrestrictedDoubleMember",
   };
@@ -685,8 +686,23 @@
     impl.setUnionInRecordMember(unionInRecordMemberCppValue);
   }
 
+  v8::Local<v8::Value> unionMemberWithSequenceDefaultValue;
+  if (!v8Object->Get(context, keys[42].Get(isolate)).ToLocal(&unionMemberWithSequenceDefaultValue)) {
+    exceptionState.RethrowV8Exception(block.Exception());
+    return;
+  }
+  if (unionMemberWithSequenceDefaultValue.IsEmpty() || unionMemberWithSequenceDefaultValue->IsUndefined()) {
+    // Do nothing.
+  } else {
+    DoubleOrDoubleSequence unionMemberWithSequenceDefaultCppValue;
+    V8DoubleOrDoubleSequence::ToImpl(isolate, unionMemberWithSequenceDefaultValue, unionMemberWithSequenceDefaultCppValue, UnionTypeConversionMode::kNotNullable, exceptionState);
+    if (exceptionState.HadException())
+      return;
+    impl.setUnionMemberWithSequenceDefault(unionMemberWithSequenceDefaultCppValue);
+  }
+
   v8::Local<v8::Value> unionWithTypedefsValue;
-  if (!v8Object->Get(context, keys[42].Get(isolate)).ToLocal(&unionWithTypedefsValue)) {
+  if (!v8Object->Get(context, keys[43].Get(isolate)).ToLocal(&unionWithTypedefsValue)) {
     exceptionState.RethrowV8Exception(block.Exception());
     return;
   }
@@ -701,7 +717,7 @@
   }
 
   v8::Local<v8::Value> unrestrictedDoubleMemberValue;
-  if (!v8Object->Get(context, keys[43].Get(isolate)).ToLocal(&unrestrictedDoubleMemberValue)) {
+  if (!v8Object->Get(context, keys[44].Get(isolate)).ToLocal(&unrestrictedDoubleMemberValue)) {
     exceptionState.RethrowV8Exception(block.Exception());
     return;
   }
@@ -1258,6 +1274,20 @@
     return false;
   }
 
+  v8::Local<v8::Value> unionMemberWithSequenceDefaultValue;
+  bool unionMemberWithSequenceDefaultHasValueOrDefault = false;
+  if (impl.hasUnionMemberWithSequenceDefault()) {
+    unionMemberWithSequenceDefaultValue = ToV8(impl.unionMemberWithSequenceDefault(), creationContext, isolate);
+    unionMemberWithSequenceDefaultHasValueOrDefault = true;
+  } else {
+    unionMemberWithSequenceDefaultValue = ToV8(DoubleOrDoubleSequence::FromDoubleSequence(Vector<double>()), creationContext, isolate);
+    unionMemberWithSequenceDefaultHasValueOrDefault = true;
+  }
+  if (unionMemberWithSequenceDefaultHasValueOrDefault &&
+      !V8CallBoolean(dictionary->CreateDataProperty(context, keys[42].Get(isolate), unionMemberWithSequenceDefaultValue))) {
+    return false;
+  }
+
   v8::Local<v8::Value> unionWithTypedefsValue;
   bool unionWithTypedefsHasValueOrDefault = false;
   if (impl.hasUnionWithTypedefs()) {
@@ -1265,7 +1295,7 @@
     unionWithTypedefsHasValueOrDefault = true;
   }
   if (unionWithTypedefsHasValueOrDefault &&
-      !V8CallBoolean(dictionary->CreateDataProperty(context, keys[42].Get(isolate), unionWithTypedefsValue))) {
+      !V8CallBoolean(dictionary->CreateDataProperty(context, keys[43].Get(isolate), unionWithTypedefsValue))) {
     return false;
   }
 
@@ -1279,7 +1309,7 @@
     unrestrictedDoubleMemberHasValueOrDefault = true;
   }
   if (unrestrictedDoubleMemberHasValueOrDefault &&
-      !V8CallBoolean(dictionary->CreateDataProperty(context, keys[43].Get(isolate), unrestrictedDoubleMemberValue))) {
+      !V8CallBoolean(dictionary->CreateDataProperty(context, keys[44].Get(isolate), unrestrictedDoubleMemberValue))) {
     return false;
   }
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.cc b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.cc
new file mode 100644
index 0000000..6ee2698
--- /dev/null
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.cc
@@ -0,0 +1,114 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file has been auto-generated from the Jinja2 template
+// third_party/WebKit/Source/bindings/templates/union_container.cpp.tmpl
+// by the script code_generator_v8.py.
+// DO NOT MODIFY!
+
+// clang-format off
+#include "double_or_double_sequence.h"
+
+#include "bindings/core/v8/IDLTypes.h"
+#include "bindings/core/v8/NativeValueTraitsImpl.h"
+#include "bindings/core/v8/ToV8ForCore.h"
+
+namespace blink {
+
+DoubleOrDoubleSequence::DoubleOrDoubleSequence() : type_(SpecificType::kNone) {}
+
+double DoubleOrDoubleSequence::GetAsDouble() const {
+  DCHECK(IsDouble());
+  return double_;
+}
+
+void DoubleOrDoubleSequence::SetDouble(double value) {
+  DCHECK(IsNull());
+  double_ = value;
+  type_ = SpecificType::kDouble;
+}
+
+DoubleOrDoubleSequence DoubleOrDoubleSequence::FromDouble(double value) {
+  DoubleOrDoubleSequence container;
+  container.SetDouble(value);
+  return container;
+}
+
+const Vector<double>& DoubleOrDoubleSequence::GetAsDoubleSequence() const {
+  DCHECK(IsDoubleSequence());
+  return double_sequence_;
+}
+
+void DoubleOrDoubleSequence::SetDoubleSequence(const Vector<double>& value) {
+  DCHECK(IsNull());
+  double_sequence_ = value;
+  type_ = SpecificType::kDoubleSequence;
+}
+
+DoubleOrDoubleSequence DoubleOrDoubleSequence::FromDoubleSequence(const Vector<double>& value) {
+  DoubleOrDoubleSequence container;
+  container.SetDoubleSequence(value);
+  return container;
+}
+
+DoubleOrDoubleSequence::DoubleOrDoubleSequence(const DoubleOrDoubleSequence&) = default;
+DoubleOrDoubleSequence::~DoubleOrDoubleSequence() = default;
+DoubleOrDoubleSequence& DoubleOrDoubleSequence::operator=(const DoubleOrDoubleSequence&) = default;
+
+void DoubleOrDoubleSequence::Trace(blink::Visitor* visitor) {
+}
+
+void V8DoubleOrDoubleSequence::ToImpl(v8::Isolate* isolate, v8::Local<v8::Value> v8Value, DoubleOrDoubleSequence& impl, UnionTypeConversionMode conversionMode, ExceptionState& exceptionState) {
+  if (v8Value.IsEmpty())
+    return;
+
+  if (conversionMode == UnionTypeConversionMode::kNullable && IsUndefinedOrNull(v8Value))
+    return;
+
+  if (HasCallableIteratorSymbol(isolate, v8Value, exceptionState)) {
+    Vector<double> cppValue = NativeValueTraits<IDLSequence<IDLDouble>>::NativeValue(isolate, v8Value, exceptionState);
+    if (exceptionState.HadException())
+      return;
+    impl.SetDoubleSequence(cppValue);
+    return;
+  }
+
+  if (v8Value->IsNumber()) {
+    double cppValue = NativeValueTraits<IDLDouble>::NativeValue(isolate, v8Value, exceptionState);
+    if (exceptionState.HadException())
+      return;
+    impl.SetDouble(cppValue);
+    return;
+  }
+
+  {
+    double cppValue = NativeValueTraits<IDLDouble>::NativeValue(isolate, v8Value, exceptionState);
+    if (exceptionState.HadException())
+      return;
+    impl.SetDouble(cppValue);
+    return;
+  }
+}
+
+v8::Local<v8::Value> ToV8(const DoubleOrDoubleSequence& impl, v8::Local<v8::Object> creationContext, v8::Isolate* isolate) {
+  switch (impl.type_) {
+    case DoubleOrDoubleSequence::SpecificType::kNone:
+      return v8::Null(isolate);
+    case DoubleOrDoubleSequence::SpecificType::kDouble:
+      return v8::Number::New(isolate, impl.GetAsDouble());
+    case DoubleOrDoubleSequence::SpecificType::kDoubleSequence:
+      return ToV8(impl.GetAsDoubleSequence(), creationContext, isolate);
+    default:
+      NOTREACHED();
+  }
+  return v8::Local<v8::Value>();
+}
+
+DoubleOrDoubleSequence NativeValueTraits<DoubleOrDoubleSequence>::NativeValue(v8::Isolate* isolate, v8::Local<v8::Value> value, ExceptionState& exceptionState) {
+  DoubleOrDoubleSequence impl;
+  V8DoubleOrDoubleSequence::ToImpl(isolate, value, impl, UnionTypeConversionMode::kNotNullable, exceptionState);
+  return impl;
+}
+
+}  // namespace blink
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h
new file mode 100644
index 0000000..9d824d7
--- /dev/null
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h
@@ -0,0 +1,93 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file has been auto-generated from the Jinja2 template
+// third_party/WebKit/Source/bindings/templates/union_container.h.tmpl
+// by the script code_generator_v8.py.
+// DO NOT MODIFY!
+
+// clang-format off
+#ifndef DoubleOrDoubleSequence_h
+#define DoubleOrDoubleSequence_h
+
+#include "bindings/core/v8/Dictionary.h"
+#include "bindings/core/v8/ExceptionState.h"
+#include "bindings/core/v8/NativeValueTraits.h"
+#include "bindings/core/v8/V8BindingForCore.h"
+#include "core/CoreExport.h"
+#include "platform/heap/Handle.h"
+
+namespace blink {
+
+class CORE_EXPORT DoubleOrDoubleSequence final {
+  DISALLOW_NEW_EXCEPT_PLACEMENT_NEW();
+ public:
+  DoubleOrDoubleSequence();
+  bool IsNull() const { return type_ == SpecificType::kNone; }
+
+  bool IsDouble() const { return type_ == SpecificType::kDouble; }
+  double GetAsDouble() const;
+  void SetDouble(double);
+  static DoubleOrDoubleSequence FromDouble(double);
+
+  bool IsDoubleSequence() const { return type_ == SpecificType::kDoubleSequence; }
+  const Vector<double>& GetAsDoubleSequence() const;
+  void SetDoubleSequence(const Vector<double>&);
+  static DoubleOrDoubleSequence FromDoubleSequence(const Vector<double>&);
+
+  DoubleOrDoubleSequence(const DoubleOrDoubleSequence&);
+  ~DoubleOrDoubleSequence();
+  DoubleOrDoubleSequence& operator=(const DoubleOrDoubleSequence&);
+  void Trace(blink::Visitor*);
+
+ private:
+  enum class SpecificType {
+    kNone,
+    kDouble,
+    kDoubleSequence,
+  };
+  SpecificType type_;
+
+  double double_;
+  Vector<double> double_sequence_;
+
+  friend CORE_EXPORT v8::Local<v8::Value> ToV8(const DoubleOrDoubleSequence&, v8::Local<v8::Object>, v8::Isolate*);
+};
+
+class V8DoubleOrDoubleSequence final {
+ public:
+  CORE_EXPORT static void ToImpl(v8::Isolate*, v8::Local<v8::Value>, DoubleOrDoubleSequence&, UnionTypeConversionMode, ExceptionState&);
+};
+
+CORE_EXPORT v8::Local<v8::Value> ToV8(const DoubleOrDoubleSequence&, v8::Local<v8::Object>, v8::Isolate*);
+
+template <class CallbackInfo>
+inline void V8SetReturnValue(const CallbackInfo& callbackInfo, DoubleOrDoubleSequence& impl) {
+  V8SetReturnValue(callbackInfo, ToV8(impl, callbackInfo.Holder(), callbackInfo.GetIsolate()));
+}
+
+template <class CallbackInfo>
+inline void V8SetReturnValue(const CallbackInfo& callbackInfo, DoubleOrDoubleSequence& impl, v8::Local<v8::Object> creationContext) {
+  V8SetReturnValue(callbackInfo, ToV8(impl, creationContext, callbackInfo.GetIsolate()));
+}
+
+template <>
+struct NativeValueTraits<DoubleOrDoubleSequence> : public NativeValueTraitsBase<DoubleOrDoubleSequence> {
+  CORE_EXPORT static DoubleOrDoubleSequence NativeValue(v8::Isolate*, v8::Local<v8::Value>, ExceptionState&);
+};
+
+template <>
+struct V8TypeOf<DoubleOrDoubleSequence> {
+  typedef V8DoubleOrDoubleSequence Type;
+};
+
+}  // namespace blink
+
+// We need to set canInitializeWithMemset=true because HeapVector supports
+// items that can initialize with memset or have a vtable. It is safe to
+// set canInitializeWithMemset=true for a union type object in practice.
+// See https://codereview.chromium.org/1118993002/#msg5 for more details.
+WTF_ALLOW_MOVE_AND_INIT_WITH_MEM_FUNCTIONS(blink::DoubleOrDoubleSequence);
+
+#endif  // DoubleOrDoubleSequence_h
diff --git a/tools/cygprofile/profile_android_startup.py b/tools/cygprofile/profile_android_startup.py
index 74c64f3..a9cbfe7b 100755
--- a/tools/cygprofile/profile_android_startup.py
+++ b/tools/cygprofile/profile_android_startup.py
@@ -104,9 +104,9 @@
       binary_manager.InitDependencyManager([])
     self._wpr_server = webpagereplay_go_server.ReplayServer(
         self._wpr_archive, '127.0.0.1', 0, 0, replay_options=[])
-    ports = self._wpr_server.StartServer()[:-1]
-    self._host_http_port = ports[0]
-    self._host_https_port = ports[1]
+    ports = self._wpr_server.StartServer()
+    self._host_http_port = ports['http']
+    self._host_https_port = ports['https']
 
   def _StopWpr(self):
     """ Stop the WPR and forwarder. """
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 19474c6..4f6b15c 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -33858,6 +33858,20 @@
   <int value="2" label="VERSION_LATEST"/>
 </enum>
 
+<enum name="PreloadedListCheckResult">
+  <int value="0" label="string was found"/>
+  <int value="1" label="string was not found"/>
+  <int value="2" label="check failed because list was empty"/>
+  <int value="3" label="check failed because list was not loaded"/>
+</enum>
+
+<enum name="PreloadedListLoadResult">
+  <int value="0" label="loaded"/>
+  <int value="1" label="file not found"/>
+  <int value="2" label="file read failed"/>
+  <int value="3" label="parse proto failed"/>
+</enum>
+
 <enum name="PrerenderCookieSendType">
   <obsolete>
     Deprecated March 13 2015.
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index c7a0782..91574c81 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -33818,6 +33818,30 @@
   </summary>
 </histogram>
 
+<histogram name="Media.Engagement.PreloadedList.CheckResult"
+    enum="PreloadedListCheckResult">
+  <owner>beccahughes@chromium.org</owner>
+  <owner>media-dev@chromium.org</owner>
+  <summary>
+    Recorded when the Media Engagement Preloaded List is checked whether a
+    string is present on that list. If the check was successful then the result
+    of the check is recorded in this histogram. If the check was not successful
+    then the reason for the check failing is recorded.
+  </summary>
+</histogram>
+
+<histogram name="Media.Engagement.PreloadedList.LoadResult"
+    enum="PreloadedListLoadResult">
+  <owner>beccahughes@chromium.org</owner>
+  <owner>media-dev@chromium.org</owner>
+  <summary>
+    Recorded when data is loaded into the Media Engagement Preloaded List. If
+    the load is successful then &quot;loaded&quot; is recorded to this
+    histogram. If the load was not successful then the reason why is recorded to
+    this histogram.
+  </summary>
+</histogram>
+
 <histogram name="Media.Engagement.ScoreAtPlayback" units="%">
   <owner>beccahughes@chromium.org</owner>
   <owner>media-dev@chromium.org</owner>