diff --git a/DEPS b/DEPS
index 7dbbd90..edbfc8f 100644
--- a/DEPS
+++ b/DEPS
@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '6d4d6cce5e6e73d14c5d39c20321b189d737dfd5',
+  'skia_revision': '3f142b6a785ab7af64383fccf98ae2528cdd71e3',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'd6a08d86c04b5b652533978ef6b257de09d0599e',
+  'v8_revision': 'af0fd40ed6c28d2a58c4a88bd04550fac7d507d0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/base/metrics/histogram.h b/base/metrics/histogram.h
index 0f05945..63fd243 100644
--- a/base/metrics/histogram.h
+++ b/base/metrics/histogram.h
@@ -81,8 +81,11 @@
 #include "base/macros.h"
 #include "base/metrics/bucket_ranges.h"
 #include "base/metrics/histogram_base.h"
+#if !defined(OS_MACOSX) || defined(OS_IOS)
 // TODO(asvitkine): Migrate callers to to include this directly and remove this.
+// Note: Incrementally migrating platforms as they become clean.
 #include "base/metrics/histogram_macros.h"
+#endif
 #include "base/metrics/histogram_samples.h"
 #include "base/time/time.h"
 
diff --git a/base/metrics/sample_vector_unittest.cc b/base/metrics/sample_vector_unittest.cc
index 0abacad8..2d77d23 100644
--- a/base/metrics/sample_vector_unittest.cc
+++ b/base/metrics/sample_vector_unittest.cc
@@ -116,7 +116,6 @@
   EXPECT_EQ(samples1.redundant_count(), samples1.TotalCount());
 }
 
-#if (!defined(NDEBUG) || defined(DCHECK_ALWAYS_ON)) && GTEST_HAS_DEATH_TEST
 TEST(SampleVectorDeathTest, BucketIndexTest) {
   // 8 buckets with exponential layout:
   // [0, 1) [1, 2) [2, 4) [4, 8) [8, 16) [16, 32) [32, 64) [64, INT_MAX)
@@ -133,9 +132,9 @@
   EXPECT_EQ(3, samples.GetCount(65));
 
   // Extreme case.
-  EXPECT_DEATH(samples.Accumulate(INT_MIN, 100), "");
-  EXPECT_DEATH(samples.Accumulate(-1, 100), "");
-  EXPECT_DEATH(samples.Accumulate(INT_MAX, 100), "");
+  EXPECT_DCHECK_DEATH(samples.Accumulate(INT_MIN, 100));
+  EXPECT_DCHECK_DEATH(samples.Accumulate(-1, 100));
+  EXPECT_DCHECK_DEATH(samples.Accumulate(INT_MAX, 100));
 
   // Custom buckets: [1, 5) [5, 10)
   // Note, this is not a valid BucketRanges for Histogram because it does not
@@ -155,8 +154,8 @@
   EXPECT_EQ(4, samples2.GetCount(5));
 
   // Extreme case.
-  EXPECT_DEATH(samples2.Accumulate(0, 100), "");
-  EXPECT_DEATH(samples2.Accumulate(10, 100), "");
+  EXPECT_DCHECK_DEATH(samples2.Accumulate(0, 100));
+  EXPECT_DCHECK_DEATH(samples2.Accumulate(10, 100));
 }
 
 TEST(SampleVectorDeathTest, AddSubtractBucketNotMatchTest) {
@@ -182,25 +181,22 @@
 
   // Extra bucket in the beginning.
   samples2.Accumulate(0, 100);
-  EXPECT_DEATH(samples1.Add(samples2), "");
-  EXPECT_DEATH(samples1.Subtract(samples2), "");
+  EXPECT_DCHECK_DEATH(samples1.Add(samples2));
+  EXPECT_DCHECK_DEATH(samples1.Subtract(samples2));
 
   // Extra bucket in the end.
   samples2.Accumulate(0, -100);
   samples2.Accumulate(6, 100);
-  EXPECT_DEATH(samples1.Add(samples2), "");
-  EXPECT_DEATH(samples1.Subtract(samples2), "");
+  EXPECT_DCHECK_DEATH(samples1.Add(samples2));
+  EXPECT_DCHECK_DEATH(samples1.Subtract(samples2));
 
   // Bucket not match: [3, 5) VS [3, 6)
   samples2.Accumulate(6, -100);
   samples2.Accumulate(3, 100);
-  EXPECT_DEATH(samples1.Add(samples2), "");
-  EXPECT_DEATH(samples1.Subtract(samples2), "");
+  EXPECT_DCHECK_DEATH(samples1.Add(samples2));
+  EXPECT_DCHECK_DEATH(samples1.Subtract(samples2));
 }
 
-#endif
-// (!defined(NDEBUG) || defined(DCHECK_ALWAYS_ON)) && GTEST_HAS_DEATH_TEST
-
 TEST(SampleVectorIteratorTest, IterateTest) {
   BucketRanges ranges(5);
   ranges.set_range(0, 0);
diff --git a/base/task/cancelable_task_tracker_unittest.cc b/base/task/cancelable_task_tracker_unittest.cc
index 01a1f23..fd480f36 100644
--- a/base/task/cancelable_task_tracker_unittest.cc
+++ b/base/task/cancelable_task_tracker_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
+#include "base/test/gtest_util.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/threading/thread.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -348,11 +349,7 @@
 void MaybeRunDeadlyTaskTrackerMemberFunction(
     CancelableTaskTracker* task_tracker,
     const Callback<void(CancelableTaskTracker*)>& fn) {
-// CancelableTask uses DCHECKs with its ThreadChecker (itself only
-// enabled in debug mode).
-#if DCHECK_IS_ON()
-  EXPECT_DEATH_IF_SUPPORTED(fn.Run(task_tracker), "");
-#endif
+  EXPECT_DCHECK_DEATH(fn.Run(task_tracker));
 }
 
 void PostDoNothingTask(CancelableTaskTracker* task_tracker) {
diff --git a/base/trace_event/trace_event.h b/base/trace_event/trace_event.h
index fe8f657..51e6927 100644
--- a/base/trace_event/trace_event.h
+++ b/base/trace_event/trace_event.h
@@ -43,9 +43,21 @@
     trace_event_internal::TraceID::DontMangle(id)
 
 // By default, trace IDs are eventually converted to a single 64-bit number. Use
-// this macro to add a scope string.
-#define TRACE_ID_WITH_SCOPE(scope, id) \
-    trace_event_internal::TraceID::WithScope(scope, id)
+// this macro to add a scope string. For example,
+//
+// TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
+//     "network", "ResourceLoad",
+//     TRACE_ID_WITH_SCOPE("BlinkResourceID", resourceID));
+//
+// Also, it is possible to prepend the ID with another number, like the process
+// ID. This is useful in creatin IDs that are unique among all processes. To do
+// that, pass two numbers after the scope string instead of one. For example,
+//
+// TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
+//     "network", "ResourceLoad",
+//     TRACE_ID_WITH_SCOPE("BlinkResourceID", pid, resourceID));
+#define TRACE_ID_WITH_SCOPE(scope, ...) \
+  trace_event_internal::TraceID::WithScope(scope, ##__VA_ARGS__)
 
 #define TRACE_ID_GLOBAL(id) trace_event_internal::TraceID::GlobalId(id)
 #define TRACE_ID_LOCAL(id) trace_event_internal::TraceID::LocalId(id)
@@ -430,11 +442,27 @@
         : scope_(scope), raw_id_(global_id.raw_id()) {
       id_flags_ = TRACE_EVENT_FLAG_HAS_GLOBAL_ID;
     }
+    WithScope(const char* scope,
+              unsigned long long prefix,
+              unsigned long long raw_id)
+        : scope_(scope), has_prefix_(true), prefix_(prefix), raw_id_(raw_id) {}
+    WithScope(const char* scope, unsigned long long prefix, GlobalId global_id)
+        : scope_(scope),
+          has_prefix_(true),
+          prefix_(prefix),
+          raw_id_(global_id.raw_id()) {
+      id_flags_ = TRACE_EVENT_FLAG_HAS_GLOBAL_ID;
+    }
     unsigned long long raw_id() const { return raw_id_; }
     const char* scope() const { return scope_; }
+    bool has_prefix() const { return has_prefix_; }
+    unsigned long long prefix() const { return prefix_; }
     unsigned int id_flags() const { return id_flags_; }
+
    private:
     const char* scope_ = nullptr;
+    bool has_prefix_ = false;
+    unsigned long long prefix_;
     unsigned long long raw_id_;
     unsigned int id_flags_ = TRACE_EVENT_FLAG_HAS_ID;
   };
@@ -517,11 +545,17 @@
   TraceID(GlobalId raw_id) : raw_id_(raw_id.raw_id()) {
     id_flags_ = TRACE_EVENT_FLAG_HAS_GLOBAL_ID;
   }
-  TraceID(WithScope scoped_id) : scope_(scoped_id.scope()),
-      raw_id_(scoped_id.raw_id()), id_flags_(scoped_id.id_flags()) {}
+  TraceID(WithScope scoped_id)
+      : scope_(scoped_id.scope()),
+        has_prefix_(scoped_id.has_prefix()),
+        prefix_(scoped_id.prefix()),
+        raw_id_(scoped_id.raw_id()),
+        id_flags_(scoped_id.id_flags()) {}
 
   unsigned long long raw_id() const { return raw_id_; }
   const char* scope() const { return scope_; }
+  bool has_prefix() const { return has_prefix_; }
+  unsigned long long prefix() const { return prefix_; }
   unsigned int id_flags() const { return id_flags_; }
 
   std::unique_ptr<base::trace_event::ConvertableToTraceFormat>
@@ -529,6 +563,8 @@
 
  private:
   const char* scope_ = nullptr;
+  bool has_prefix_ = false;
+  unsigned long long prefix_;
   unsigned long long raw_id_;
   unsigned int id_flags_ = TRACE_EVENT_FLAG_HAS_ID;
 };
diff --git a/base/trace_event/trace_event_impl.cc b/base/trace_event/trace_event_impl.cc
index f9792d0d..cb23eb4 100644
--- a/base/trace_event/trace_event_impl.cc
+++ b/base/trace_event/trace_event_impl.cc
@@ -458,30 +458,32 @@
 
   if (scope_ != kGlobalScope)
     value->SetString("scope", scope_);
-  switch (id_flags_) {
-    case TRACE_EVENT_FLAG_HAS_ID:
-      value->SetString(
-          "id",
-          base::StringPrintf("0x%" PRIx64, static_cast<uint64_t>(raw_id_)));
-      break;
-    case TRACE_EVENT_FLAG_HAS_GLOBAL_ID:
-      value->BeginDictionary("id2");
-      value->SetString(
-          "global",
-          base::StringPrintf("0x%" PRIx64, static_cast<uint64_t>(raw_id_)));
-      value->EndDictionary();
-      break;
-    case TRACE_EVENT_FLAG_HAS_LOCAL_ID:
-      value->BeginDictionary("id2");
-      value->SetString(
-          "local",
-          base::StringPrintf("0x%" PRIx64, static_cast<uint64_t>(raw_id_)));
-      value->EndDictionary();
-      break;
-    default:
-      NOTREACHED() << "Unrecognized ID flag";
+
+  const char* id_field_name = "id";
+  if (id_flags_ == TRACE_EVENT_FLAG_HAS_GLOBAL_ID) {
+    id_field_name = "global";
+    value->BeginDictionary("id2");
+  } else if (id_flags_ == TRACE_EVENT_FLAG_HAS_LOCAL_ID) {
+    id_field_name = "local";
+    value->BeginDictionary("id2");
+  } else if (id_flags_ != TRACE_EVENT_FLAG_HAS_ID) {
+    NOTREACHED() << "Unrecognized ID flag";
   }
 
+  if (has_prefix_) {
+    value->SetString(id_field_name,
+                     base::StringPrintf("0x%" PRIx64 "/0x%" PRIx64,
+                                        static_cast<uint64_t>(prefix_),
+                                        static_cast<uint64_t>(raw_id_)));
+  } else {
+    value->SetString(
+        id_field_name,
+        base::StringPrintf("0x%" PRIx64, static_cast<uint64_t>(raw_id_)));
+  }
+
+  if (id_flags_ != TRACE_EVENT_FLAG_HAS_ID)
+    value->EndDictionary();
+
   return std::move(value);
 }
 
diff --git a/base/trace_event/trace_event_unittest.cc b/base/trace_event/trace_event_unittest.cc
index c22f660..29be3fe 100644
--- a/base/trace_event/trace_event_unittest.cc
+++ b/base/trace_event/trace_event_unittest.cc
@@ -528,6 +528,8 @@
                    TRACE_ID_LOCAL(0x2000));
     TRACE_LINK_IDS("all", "TRACE_LINK_IDS to a global ID", 0x1000,
                    TRACE_ID_GLOBAL(0x2000));
+    TRACE_LINK_IDS("all", "TRACE_LINK_IDS to a composite ID", 0x1000,
+                   TRACE_ID_WITH_SCOPE("scope 1", 0x2000, 0x3000));
 
     TRACE_EVENT_ASYNC_BEGIN0("all", "async default process scope", 0x1000);
     TRACE_EVENT_ASYNC_BEGIN0("all", "async local id", TRACE_ID_LOCAL(0x2000));
@@ -1048,6 +1050,25 @@
     EXPECT_EQ("0x2000", id2);
   }
 
+  EXPECT_FIND_("TRACE_LINK_IDS to a composite ID");
+  {
+    std::string ph;
+    EXPECT_TRUE((item && item->GetString("ph", &ph)));
+    EXPECT_EQ("=", ph);
+
+    EXPECT_FALSE(item->HasKey("scope"));
+    std::string id1;
+    EXPECT_TRUE(item->GetString("id", &id1));
+    EXPECT_EQ("0x1000", id1);
+
+    std::string scope;
+    EXPECT_TRUE(item->GetString("args.linked_id.scope", &scope));
+    EXPECT_EQ("scope 1", scope);
+    std::string id2;
+    EXPECT_TRUE(item->GetString("args.linked_id.id", &id2));
+    EXPECT_EQ(id2, "0x2000/0x3000");
+  }
+
   EXPECT_FIND_("async default process scope");
   {
     std::string ph;
diff --git a/cc/trees/layer_tree_host_in_process.cc b/cc/trees/layer_tree_host_in_process.cc
index 29cba59..9114246 100644
--- a/cc/trees/layer_tree_host_in_process.cc
+++ b/cc/trees/layer_tree_host_in_process.cc
@@ -197,6 +197,9 @@
 }
 
 LayerTreeHostInProcess::~LayerTreeHostInProcess() {
+  // Track when we're inside a main frame to see if compositor is being
+  // destroyed midway which causes a crash. crbug.com/654672
+  CHECK(!inside_main_frame_);
   TRACE_EVENT0("cc", "LayerTreeHostInProcess::~LayerTreeHostInProcess");
 
   // Clear any references into the LayerTreeHostInProcess.
@@ -258,12 +261,14 @@
 }
 
 void LayerTreeHostInProcess::WillBeginMainFrame() {
+  inside_main_frame_ = true;
   devtools_instrumentation::WillBeginMainThreadFrame(GetId(),
                                                      SourceFrameNumber());
   client_->WillBeginMainFrame();
 }
 
 void LayerTreeHostInProcess::DidBeginMainFrame() {
+  inside_main_frame_ = false;
   client_->DidBeginMainFrame();
 }
 
diff --git a/cc/trees/layer_tree_host_in_process.h b/cc/trees/layer_tree_host_in_process.h
index 909dce7..7d11066f 100644
--- a/cc/trees/layer_tree_host_in_process.h
+++ b/cc/trees/layer_tree_host_in_process.h
@@ -299,6 +299,9 @@
   int id_;
   bool next_commit_forces_redraw_ = false;
   bool next_commit_forces_recalculate_raster_scales_ = false;
+  // Track when we're inside a main frame to see if compositor is being
+  // destroyed midway which causes a crash. crbug.com/654672
+  bool inside_main_frame_ = false;
 
   TaskGraphRunner* task_graph_runner_;
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/LocationBarLayout.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/LocationBarLayout.java
index 8748a27..2456b194 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/LocationBarLayout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/LocationBarLayout.java
@@ -1274,7 +1274,10 @@
     public static int getSecurityIconResource(
             int securityLevel, boolean isSmallDevice, boolean isOfflinePage) {
         // Both conditions should be met, because isOfflinePage might take longer to be cleared.
-        if (securityLevel == ConnectionSecurityLevel.NONE && isOfflinePage) {
+        // HTTP_SHOW_WARNING added because of field trail causing http://crbug.com/671453.
+        if ((securityLevel == ConnectionSecurityLevel.NONE
+                    || securityLevel == ConnectionSecurityLevel.HTTP_SHOW_WARNING)
+                && isOfflinePage) {
             return R.drawable.offline_pin_round;
         }
         switch (securityLevel) {
@@ -1424,10 +1427,11 @@
      */
     private void updateVerboseStatusVisibility() {
         // Because is offline page is cleared a bit slower, we also ensure that connection security
-        // level is NONE.
+        // level is NONE or HTTP_SHOW_WARNING (http://crbug.com/671453).
         boolean verboseStatusVisible = !mUrlHasFocus && getCurrentTab() != null
                 && getCurrentTab().isOfflinePage()
-                && getSecurityLevel() == ConnectionSecurityLevel.NONE;
+                && (getSecurityLevel() == ConnectionSecurityLevel.NONE
+                           || getSecurityLevel() == ConnectionSecurityLevel.HTTP_SHOW_WARNING);
 
         int verboseStatusVisibility = verboseStatusVisible ? VISIBLE : GONE;
 
diff --git a/chrome/browser/chromeos/libc_close_tracking.cc b/chrome/browser/chromeos/libc_close_tracking.cc
index 3c491a2..5f77f0d 100644
--- a/chrome/browser/chromeos/libc_close_tracking.cc
+++ b/chrome/browser/chromeos/libc_close_tracking.cc
@@ -134,6 +134,10 @@
     return ret;
   }
 
+  // Only capture EBADF. Let caller handle other errors.
+  if (close_errno.captured_errno() != EBADF)
+    return ret;
+
   const base::debug::StackTrace* const last_close_stack =
       g_stack_tracker->GetStack(fd);
   if (!last_close_stack) {
diff --git a/chrome/browser/content_settings/content_settings_supervised_provider.cc b/chrome/browser/content_settings/content_settings_supervised_provider.cc
index 75cfcd21..c9c27b01 100644
--- a/chrome/browser/content_settings/content_settings_supervised_provider.cc
+++ b/chrome/browser/content_settings/content_settings_supervised_provider.cc
@@ -16,6 +16,7 @@
 struct ContentSettingsFromSupervisedSettingsEntry {
   const char* setting_name;
   ContentSettingsType content_type;
+  ContentSetting content_setting;
 };
 
 const ContentSettingsFromSupervisedSettingsEntry
@@ -23,12 +24,19 @@
   {
     supervised_users::kGeolocationDisabled,
     CONTENT_SETTINGS_TYPE_GEOLOCATION,
+    CONTENT_SETTING_BLOCK,
   }, {
     supervised_users::kCameraMicDisabled,
     CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
+    CONTENT_SETTING_BLOCK,
   }, {
     supervised_users::kCameraMicDisabled,
     CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC,
+    CONTENT_SETTING_BLOCK,
+  }, {
+    supervised_users::kCookiesAlwaysAllowed,
+    CONTENT_SETTINGS_TYPE_COOKIES,
+    CONTENT_SETTING_ALLOW,
   }
 };
 
@@ -56,9 +64,8 @@
     ContentSettingsType content_type,
     const ResourceIdentifier& resource_identifier,
     bool incognito) const {
-  std::unique_ptr<base::AutoLock> auto_lock(new base::AutoLock(lock_));
-  return value_map_.GetRuleIterator(content_type, resource_identifier,
-                                    std::move(auto_lock));
+  base::AutoLock auto_lock(lock_);
+  return value_map_.GetRuleIterator(content_type, resource_identifier);
 }
 
 void SupervisedProvider::OnSupervisedSettingsAvailable(
@@ -68,21 +75,23 @@
   {
     base::AutoLock auto_lock(lock_);
     for (const auto& entry : kContentSettingsFromSupervisedSettingsMap) {
-      bool new_value = false;
+      ContentSetting new_setting = CONTENT_SETTING_DEFAULT;
       if (settings && settings->HasKey(entry.setting_name)) {
-        bool is_bool = settings->GetBoolean(entry.setting_name, &new_value);
+        bool new_is_set = false;
+        bool is_bool = settings->GetBoolean(entry.setting_name, &new_is_set);
         DCHECK(is_bool);
+        if (new_is_set)
+          new_setting = entry.content_setting;
       }
-      bool old_value = !value_map_.IsContentSettingEnabled(entry.content_type);
-      if (new_value != old_value) {
+      if (new_setting != value_map_.GetContentSetting(entry.content_type)) {
         to_notify.push_back(entry.content_type);
-        value_map_.SetContentSettingDisabled(entry.content_type, new_value);
+        value_map_.SetContentSetting(entry.content_type, new_setting);
       }
     }
   }
-  for (const auto& notification : to_notify) {
+  for (ContentSettingsType type : to_notify) {
     NotifyObservers(ContentSettingsPattern(), ContentSettingsPattern(),
-                    notification, std::string());
+                    type, std::string());
   }
 }
 
diff --git a/chrome/browser/content_settings/content_settings_supervised_provider.h b/chrome/browser/content_settings/content_settings_supervised_provider.h
index c450364..a66e3ac 100644
--- a/chrome/browser/content_settings/content_settings_supervised_provider.h
+++ b/chrome/browser/content_settings/content_settings_supervised_provider.h
@@ -10,7 +10,7 @@
 #include "base/callback_list.h"
 #include "base/macros.h"
 #include "base/synchronization/lock.h"
-#include "components/content_settings/core/browser/content_settings_binary_value_map.h"
+#include "components/content_settings/core/browser/content_settings_global_value_map.h"
 #include "components/content_settings/core/browser/content_settings_observable_provider.h"
 
 class SupervisedUserSettingsService;
@@ -41,11 +41,11 @@
 
   void ShutdownOnUIThread() override;
 
+ private:
   // Callback on receiving settings from the supervised user settings service.
   void OnSupervisedSettingsAvailable(const base::DictionaryValue* settings);
 
- private:
-  BinaryValueMap value_map_;
+  GlobalValueMap value_map_;
 
   // Used around accesses to the |value_map_| object to guarantee
   // thread safety.
diff --git a/chrome/browser/content_settings/content_settings_supervised_provider_unittest.cc b/chrome/browser/content_settings/content_settings_supervised_provider_unittest.cc
index 726ed496..5eb11ef3 100644
--- a/chrome/browser/content_settings/content_settings_supervised_provider_unittest.cc
+++ b/chrome/browser/content_settings/content_settings_supervised_provider_unittest.cc
@@ -7,6 +7,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/ptr_util.h"
 #include "chrome/browser/content_settings/content_settings_mock_observer.h"
 #include "chrome/browser/supervised_user/supervised_user_constants.h"
 #include "chrome/browser/supervised_user/supervised_user_settings_service.h"
@@ -38,7 +39,7 @@
   pref_store_->NotifyInitializationCompleted();
   service_.Init(pref_store_);
   service_.SetActive(true);
-  provider_.reset(new SupervisedProvider(&service_));
+  provider_ = base::MakeUnique<SupervisedProvider>(&service_);
   provider_->AddObserver(&mock_observer_);
 }
 
@@ -49,17 +50,16 @@
 }
 
 TEST_F(SupervisedUserProviderTest, GeolocationTest) {
-  std::unique_ptr<RuleIterator> rule_iterator(provider_->GetRuleIterator(
-      CONTENT_SETTINGS_TYPE_GEOLOCATION, std::string(), false));
-  EXPECT_FALSE(rule_iterator->HasNext());
-  rule_iterator.reset();
+  std::unique_ptr<RuleIterator> rule_iterator = provider_->GetRuleIterator(
+      CONTENT_SETTINGS_TYPE_GEOLOCATION, std::string(), false);
+  EXPECT_FALSE(rule_iterator);
 
   // Disable the default geolocation setting.
-  EXPECT_CALL(mock_observer_, OnContentSettingChanged(
-                                  _, _, CONTENT_SETTINGS_TYPE_GEOLOCATION, ""));
-  service_.SetLocalSetting(
-      supervised_users::kGeolocationDisabled,
-      std::unique_ptr<base::Value>(new base::FundamentalValue(true)));
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_GEOLOCATION,
+                                      std::string()));
+  service_.SetLocalSetting(supervised_users::kGeolocationDisabled,
+                           base::MakeUnique<base::FundamentalValue>(true));
 
   rule_iterator = provider_->GetRuleIterator(CONTENT_SETTINGS_TYPE_GEOLOCATION,
                                              std::string(), false);
@@ -70,40 +70,71 @@
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.primary_pattern);
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.secondary_pattern);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, ValueToContentSetting(rule.value.get()));
-  rule_iterator.reset();
 
   // Re-enable the default geolocation setting.
-  EXPECT_CALL(mock_observer_, OnContentSettingChanged(
-                                  _, _, CONTENT_SETTINGS_TYPE_GEOLOCATION, ""));
-  service_.SetLocalSetting(
-      supervised_users::kGeolocationDisabled,
-      std::unique_ptr<base::Value>(new base::FundamentalValue(false)));
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_GEOLOCATION,
+                                      std::string()));
+  service_.SetLocalSetting(supervised_users::kGeolocationDisabled,
+                           base::MakeUnique<base::FundamentalValue>(false));
 
   rule_iterator = provider_->GetRuleIterator(CONTENT_SETTINGS_TYPE_GEOLOCATION,
                                              std::string(), false);
+  EXPECT_FALSE(rule_iterator);
+}
+
+TEST_F(SupervisedUserProviderTest, CookiesTest) {
+  std::unique_ptr<RuleIterator> rule_iterator = provider_->GetRuleIterator(
+      CONTENT_SETTINGS_TYPE_COOKIES, std::string(), false);
+  EXPECT_FALSE(rule_iterator);
+
+  // Allow cookies everywhere.
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_COOKIES,
+                                      std::string()));
+  service_.SetLocalSetting(supervised_users::kCookiesAlwaysAllowed,
+                           base::MakeUnique<base::FundamentalValue>(true));
+
+  rule_iterator = provider_->GetRuleIterator(CONTENT_SETTINGS_TYPE_COOKIES,
+                                             std::string(), false);
+  ASSERT_TRUE(rule_iterator->HasNext());
+  Rule rule = rule_iterator->Next();
   EXPECT_FALSE(rule_iterator->HasNext());
+
+  EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.primary_pattern);
+  EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.secondary_pattern);
+  EXPECT_EQ(CONTENT_SETTING_ALLOW, ValueToContentSetting(rule.value.get()));
+
+  // Re-enable the default cookie setting.
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_COOKIES,
+                                      std::string()));
+  service_.SetLocalSetting(supervised_users::kCookiesAlwaysAllowed,
+                           base::MakeUnique<base::FundamentalValue>(false));
+
+  rule_iterator = provider_->GetRuleIterator(CONTENT_SETTINGS_TYPE_COOKIES,
+                                             std::string(), false);
+  EXPECT_FALSE(rule_iterator);
 }
 
 TEST_F(SupervisedUserProviderTest, CameraMicTest) {
-  std::unique_ptr<RuleIterator> rule_iterator(provider_->GetRuleIterator(
-      CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, std::string(), false));
-  EXPECT_FALSE(rule_iterator->HasNext());
-  rule_iterator.reset();
+  std::unique_ptr<RuleIterator> rule_iterator = provider_->GetRuleIterator(
+      CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, std::string(), false);
+  EXPECT_FALSE(rule_iterator);
   rule_iterator = provider_->GetRuleIterator(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string(), false);
-  EXPECT_FALSE(rule_iterator->HasNext());
-  rule_iterator.reset();
+  EXPECT_FALSE(rule_iterator);
 
   // Disable the default camera and microphone setting.
-  EXPECT_CALL(mock_observer_,
-              OnContentSettingChanged(
-                  _, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, ""));
   EXPECT_CALL(
       mock_observer_,
-      OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, ""));
-  service_.SetLocalSetting(
-      supervised_users::kCameraMicDisabled,
-      std::unique_ptr<base::Value>(new base::FundamentalValue(true)));
+      OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
+                              std::string()));
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(
+                  _, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string()));
+  service_.SetLocalSetting(supervised_users::kCameraMicDisabled,
+                           base::MakeUnique<base::FundamentalValue>(true));
 
   rule_iterator = provider_->GetRuleIterator(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, std::string(), false);
@@ -114,7 +145,6 @@
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.primary_pattern);
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.secondary_pattern);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, ValueToContentSetting(rule.value.get()));
-  rule_iterator.reset();
 
   rule_iterator = provider_->GetRuleIterator(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string(), false);
@@ -125,26 +155,25 @@
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.primary_pattern);
   EXPECT_EQ(ContentSettingsPattern::Wildcard(), rule.secondary_pattern);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, ValueToContentSetting(rule.value.get()));
-  rule_iterator.reset();
 
   // Re-enable the default camera and microphone setting.
-  EXPECT_CALL(mock_observer_,
-              OnContentSettingChanged(
-                  _, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, ""));
   EXPECT_CALL(
       mock_observer_,
-      OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, ""));
-  service_.SetLocalSetting(
-      supervised_users::kCameraMicDisabled,
-      std::unique_ptr<base::Value>(new base::FundamentalValue(false)));
+      OnContentSettingChanged(_, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA,
+                              std::string()));
+  EXPECT_CALL(mock_observer_,
+              OnContentSettingChanged(
+                  _, _, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string()));
+  service_.SetLocalSetting(supervised_users::kCameraMicDisabled,
+                           base::MakeUnique<base::FundamentalValue>(false));
 
   rule_iterator = provider_->GetRuleIterator(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, std::string(), false);
-  EXPECT_FALSE(rule_iterator->HasNext());
-  rule_iterator.reset();
+  EXPECT_FALSE(rule_iterator);
+
   rule_iterator = provider_->GetRuleIterator(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string(), false);
-  EXPECT_FALSE(rule_iterator->HasNext());
+  EXPECT_FALSE(rule_iterator);
 }
 
 }  // namespace content_settings
diff --git a/chrome/browser/extensions/api_binding_perf_browsertest.cc b/chrome/browser/extensions/api_binding_perf_browsertest.cc
new file mode 100644
index 0000000..c8f6c4a
--- /dev/null
+++ b/chrome/browser/extensions/api_binding_perf_browsertest.cc
@@ -0,0 +1,122 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/time/time.h"
+#include "chrome/browser/extensions/extension_browsertest.h"
+#include "chrome/browser/extensions/test_extension_dir.h"
+#include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "extensions/common/switches.h"
+
+namespace extensions {
+namespace {
+
+// TODO(jbroman, devlin): This should ultimately be replaced with some more
+// sophisticated testing (e.g. in Telemetry) which is tracked on the perf bots.
+
+// These tests are designed to exercise the extension API bindings
+// system and measure performance with and without native bindings.
+// They are designed to be run locally, and there isn't much benefit to
+// running them on the bots. For this reason, they are all disabled.
+// To run them, append the --gtest_also_run_disabled_tests flag to the
+// test executable.
+#define LOCAL_TEST(TestName) DISABLED_ ## TestName
+
+enum BindingsType { NATIVE_BINDINGS, JAVASCRIPT_BINDINGS };
+
+class APIBindingPerfBrowserTest
+    : public ExtensionBrowserTest,
+      public ::testing::WithParamInterface<BindingsType> {
+ protected:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ExtensionBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kNativeCrxBindings,
+                                    GetParam() == NATIVE_BINDINGS ? "1" : "0");
+  }
+
+  void SetUpOnMainThread() override {
+    ExtensionBrowserTest::SetUpOnMainThread();
+    embedded_test_server()->ServeFilesFromDirectory(
+        base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
+    EXPECT_TRUE(embedded_test_server()->Start());
+  }
+
+  base::TimeDelta RunTestAndReportTime() {
+    double time_elapsed_ms = 0;
+    EXPECT_TRUE(content::ExecuteScriptAndExtractDouble(
+        browser()->tab_strip_model()->GetActiveWebContents(),
+        "runTest(time => window.domAutomationController.send(time))",
+        &time_elapsed_ms));
+    return base::TimeDelta::FromMillisecondsD(time_elapsed_ms);
+  }
+};
+
+const char kSimpleContentScriptManifest[] =
+    "{"
+    "  'name': 'Perf test extension',"
+    "  'version': '0',"
+    "  'manifest_version': 2,"
+    "  'content_scripts': [ {"
+    "    'all_frames': true,"
+    "    'matches': [ '<all_urls>' ],"
+    "    'run_at': 'document_end',"
+    "    'js': [ 'content_script.js' ]"
+    "  } ],"
+    "  'permissions': [ 'storage' ]"
+    "}";
+
+IN_PROC_BROWSER_TEST_P(APIBindingPerfBrowserTest,
+                       LOCAL_TEST(ManyFramesWithNoContentScript)) {
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL(
+                                   "/extensions/perf_tests/many_frames.html"));
+
+  base::TimeDelta time_elapsed = RunTestAndReportTime();
+  LOG(INFO) << "Executed in " << time_elapsed.InMillisecondsF() << " ms";
+}
+
+IN_PROC_BROWSER_TEST_P(APIBindingPerfBrowserTest,
+                       LOCAL_TEST(ManyFramesWithEmptyContentScript)) {
+  TestExtensionDir extension_dir;
+  extension_dir.WriteManifestWithSingleQuotes(kSimpleContentScriptManifest);
+  extension_dir.WriteFile(FILE_PATH_LITERAL("content_script.js"),
+                          "// This space intentionally left blank.");
+  ASSERT_TRUE(LoadExtension(extension_dir.UnpackedPath()));
+
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL(
+                                   "/extensions/perf_tests/many_frames.html"));
+
+  base::TimeDelta time_elapsed = RunTestAndReportTime();
+  LOG(INFO) << "Executed in " << time_elapsed.InMillisecondsF() << " ms";
+}
+
+IN_PROC_BROWSER_TEST_P(APIBindingPerfBrowserTest,
+                       LOCAL_TEST(ManyFramesWithStorageAndRuntime)) {
+  TestExtensionDir extension_dir;
+  extension_dir.WriteManifestWithSingleQuotes(kSimpleContentScriptManifest);
+  extension_dir.WriteFile(FILE_PATH_LITERAL("content_script.js"),
+                          "chrome.storage.onChanged.addListener;"
+                          "chrome.runtime.onMessage.addListener;");
+  ASSERT_TRUE(LoadExtension(extension_dir.UnpackedPath()));
+
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL(
+                                   "/extensions/perf_tests/many_frames.html"));
+
+  base::TimeDelta time_elapsed = RunTestAndReportTime();
+  LOG(INFO) << "Executed in " << time_elapsed.InMillisecondsF() << " ms";
+}
+
+INSTANTIATE_TEST_CASE_P(Native,
+                        APIBindingPerfBrowserTest,
+                        ::testing::Values(NATIVE_BINDINGS));
+INSTANTIATE_TEST_CASE_P(JavaScript,
+                        APIBindingPerfBrowserTest,
+                        ::testing::Values(JAVASCRIPT_BINDINGS));
+
+}  // namespace
+}  // namespace extensions
diff --git a/chrome/browser/prefs/incognito_mode_prefs_unittest.cc b/chrome/browser/prefs/incognito_mode_prefs_unittest.cc
index 9b2492a0..7637c6fd 100644
--- a/chrome/browser/prefs/incognito_mode_prefs_unittest.cc
+++ b/chrome/browser/prefs/incognito_mode_prefs_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
 
+#include "base/test/gtest_util.h"
 #include "chrome/common/pref_names.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -55,22 +56,12 @@
 
 typedef IncognitoModePrefsTest IncognitoModePrefsDeathTest;
 
-#if GTEST_HAS_DEATH_TEST
 TEST_F(IncognitoModePrefsDeathTest, GetAvailabilityBadValue) {
   prefs_.SetUserPref(prefs::kIncognitoModeAvailability,
                      new base::FundamentalValue(-1));
-#if defined(NDEBUG) && defined(DCHECK_ALWAYS_ON)
-  EXPECT_DEATH({
+  EXPECT_DCHECK_DEATH({
     IncognitoModePrefs::Availability availability =
         IncognitoModePrefs::GetAvailability(&prefs_);
     EXPECT_EQ(IncognitoModePrefs::ENABLED, availability);
-  }, "");
-#else
-  EXPECT_DEBUG_DEATH({
-    IncognitoModePrefs::Availability availability =
-        IncognitoModePrefs::GetAvailability(&prefs_);
-    EXPECT_EQ(IncognitoModePrefs::ENABLED, availability);
-  }, "");
-#endif
+  });
 }
-#endif  // GTEST_HAS_DEATH_TEST
diff --git a/chrome/browser/supervised_user/child_accounts/child_account_service.cc b/chrome/browser/supervised_user/child_accounts/child_account_service.cc
index c6fbe1ef..07dda34 100644
--- a/chrome/browser/supervised_user/child_accounts/child_account_service.cc
+++ b/chrome/browser/supervised_user/child_accounts/child_account_service.cc
@@ -152,6 +152,11 @@
         supervised_users::kSigninAllowed,
         base::MakeUnique<base::FundamentalValue>(true));
 
+    // Always allow cookies, to avoid website compatibility issues.
+    settings_service->SetLocalSetting(
+        supervised_users::kCookiesAlwaysAllowed,
+        base::MakeUnique<base::FundamentalValue>(true));
+
     // SafeSearch is controlled at the account level, so don't override it
     // client-side.
     settings_service->SetLocalSetting(
@@ -180,8 +185,15 @@
   } else {
     SupervisedUserSettingsService* settings_service =
         SupervisedUserSettingsServiceFactory::GetForProfile(profile_);
+    settings_service->SetLocalSetting(
+        supervised_users::kRecordHistoryIncludesSessionSync, nullptr);
     settings_service->SetLocalSetting(supervised_users::kSigninAllowed,
-                                      std::unique_ptr<base::Value>());
+                                      nullptr);
+    settings_service->SetLocalSetting(supervised_users::kCookiesAlwaysAllowed,
+                                      nullptr);
+    settings_service->SetLocalSetting(supervised_users::kForceSafeSearch,
+                                      nullptr);
+
 #if !defined(OS_CHROMEOS)
     SigninManagerFactory::GetForProfile(profile_)->ProhibitSignout(false);
 #endif
diff --git a/chrome/browser/supervised_user/supervised_user_constants.cc b/chrome/browser/supervised_user/supervised_user_constants.cc
index 3d733d84..e37216e 100644
--- a/chrome/browser/supervised_user/supervised_user_constants.cc
+++ b/chrome/browser/supervised_user/supervised_user_constants.cc
@@ -12,6 +12,7 @@
     "ContentPackDefaultFilteringBehavior";
 const char kContentPackManualBehaviorHosts[] = "ContentPackManualBehaviorHosts";
 const char kContentPackManualBehaviorURLs[] = "ContentPackManualBehaviorURLs";
+const char kCookiesAlwaysAllowed[] = "CookiesAlwaysAllowed";
 const char kForceSafeSearch[] = "ForceSafeSearch";
 const char kGeolocationDisabled[] = "GeolocationDisabled";
 const char kRecordHistory[] = "RecordHistory";
diff --git a/chrome/browser/supervised_user/supervised_user_constants.h b/chrome/browser/supervised_user/supervised_user_constants.h
index bf714096..3d7cc0dca 100644
--- a/chrome/browser/supervised_user/supervised_user_constants.h
+++ b/chrome/browser/supervised_user/supervised_user_constants.h
@@ -14,6 +14,7 @@
 extern const char kContentPackDefaultFilteringBehavior[];
 extern const char kContentPackManualBehaviorHosts[];
 extern const char kContentPackManualBehaviorURLs[];
+extern const char kCookiesAlwaysAllowed[];
 extern const char kForceSafeSearch[];
 extern const char kGeolocationDisabled[];
 extern const char kRecordHistory[];
diff --git a/chrome/browser/ui/website_settings/website_settings.cc b/chrome/browser/ui/website_settings/website_settings.cc
index dc13e59..74add62 100644
--- a/chrome/browser/ui/website_settings/website_settings.cc
+++ b/chrome/browser/ui/website_settings/website_settings.cc
@@ -598,9 +598,6 @@
         IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION,
         ASCIIToUTF16(ssl_version_str));
 
-    bool no_renegotiation =
-        (security_info.connection_status &
-         net::SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) != 0;
     const char *key_exchange, *cipher, *mac;
     bool is_aead, is_tls13;
     net::SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead,
@@ -631,12 +628,6 @@
             SITE_CONNECTION_STATUS_INSECURE_PASSIVE_SUBRESOURCE) {
       site_connection_status_ = SITE_CONNECTION_STATUS_ENCRYPTED_ERROR;
     }
-
-    if (no_renegotiation) {
-      site_connection_details_ += ASCIIToUTF16("\n\n");
-      site_connection_details_ += l10n_util::GetStringUTF16(
-          IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE);
-    }
   }
 
   // Check if a user decision has been made to allow or deny certificates with
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index e0cfab3..28831fb 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1458,6 +1458,7 @@
       "../browser/extensions/api/webrtc_logging_private/webrtc_event_log_apitest.cc",
       "../browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc",
       "../browser/extensions/api/webstore_private/webstore_private_apitest.cc",
+      "../browser/extensions/api_binding_perf_browsertest.cc",
       "../browser/extensions/app_background_page_apitest.cc",
       "../browser/extensions/app_process_apitest.cc",
       "../browser/extensions/app_window_overrides_browsertest.cc",
diff --git a/chrome/test/chromedriver/net/timeout_unittest.cc b/chrome/test/chromedriver/net/timeout_unittest.cc
index eb36631..6626a07 100644
--- a/chrome/test/chromedriver/net/timeout_unittest.cc
+++ b/chrome/test/chromedriver/net/timeout_unittest.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/logging.h"
+#include "base/test/gtest_util.h"
 #include "chrome/test/chromedriver/net/timeout.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -28,9 +29,7 @@
   // It's ok to set the same duration again, since nothing changes.
   timeout.SetDuration(TimeDelta::FromSeconds(1));
 
-#if DCHECK_IS_ON() && GTEST_HAS_DEATH_TEST && !defined(OS_ANDROID)
-  EXPECT_DEATH(timeout.SetDuration(TimeDelta::FromMinutes(30)), "");
-#endif  // DCHECK_IS_ON() && GTEST_HAS_DEATH_TEST && !defined(OS_ANDROID)
+  EXPECT_DCHECK_DEATH(timeout.SetDuration(TimeDelta::FromMinutes(30)));
 }
 
 TEST(TimeoutTest, Derive) {
diff --git a/chrome/test/data/extensions/perf_tests/many_frames.html b/chrome/test/data/extensions/perf_tests/many_frames.html
new file mode 100644
index 0000000..7da2b5b6
--- /dev/null
+++ b/chrome/test/data/extensions/perf_tests/many_frames.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<body>
+<script>
+function runTest(callback) {
+  const start = performance.now();
+  const frameCount = 100;
+  let framesLoaded = 0;
+  function onFrameLoad() {
+    if (++framesLoaded == frameCount)
+      callback(performance.now() - start);
+  }
+
+  const body = document.body;
+  for (let i = 0; i < frameCount; i++) {
+    const iframe = document.createElement('iframe');
+    iframe.src = '/title1.html';
+    iframe.onload = onFrameLoad;
+    body.appendChild(iframe);
+  }
+}
+</script>
+</body>
diff --git a/components/content_settings/core/browser/BUILD.gn b/components/content_settings/core/browser/BUILD.gn
index 270bbad0..3e4fa66 100644
--- a/components/content_settings/core/browser/BUILD.gn
+++ b/components/content_settings/core/browser/BUILD.gn
@@ -7,12 +7,12 @@
 
 static_library("browser") {
   sources = [
-    "content_settings_binary_value_map.cc",
-    "content_settings_binary_value_map.h",
     "content_settings_default_provider.cc",
     "content_settings_default_provider.h",
     "content_settings_details.cc",
     "content_settings_details.h",
+    "content_settings_global_value_map.cc",
+    "content_settings_global_value_map.h",
     "content_settings_info.cc",
     "content_settings_info.h",
     "content_settings_observable_provider.cc",
diff --git a/components/content_settings/core/browser/content_settings_binary_value_map.cc b/components/content_settings/core/browser/content_settings_binary_value_map.cc
deleted file mode 100644
index ddfb732..0000000
--- a/components/content_settings/core/browser/content_settings_binary_value_map.cc
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright (c) 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/content_settings/core/browser/content_settings_binary_value_map.h"
-
-#include <utility>
-
-#include "base/synchronization/lock.h"
-#include "components/content_settings/core/browser/content_settings_rule.h"
-#include "components/content_settings/core/common/content_settings.h"
-
-namespace content_settings {
-
-namespace {
-
-class RuleIteratorBinary : public RuleIterator {
- public:
-  RuleIteratorBinary(bool is_enabled, std::unique_ptr<base::AutoLock> auto_lock)
-      : is_done_(is_enabled), auto_lock_(std::move(auto_lock)) {}
-
-  bool HasNext() const override { return !is_done_; }
-
-  Rule Next() override {
-    DCHECK(HasNext());
-    is_done_ = true;
-    return Rule(ContentSettingsPattern::Wildcard(),
-                ContentSettingsPattern::Wildcard(),
-                new base::FundamentalValue(CONTENT_SETTING_BLOCK));
-  }
-
- private:
-  bool is_done_;
-  std::unique_ptr<base::AutoLock> auto_lock_;
-};
-
-}  // namespace
-
-BinaryValueMap::BinaryValueMap() {}
-
-BinaryValueMap::~BinaryValueMap() {}
-
-std::unique_ptr<RuleIterator> BinaryValueMap::GetRuleIterator(
-    ContentSettingsType content_type,
-    const ResourceIdentifier& resource_identifier,
-    std::unique_ptr<base::AutoLock> auto_lock) const {
-  if (!resource_identifier.empty())
-    return nullptr;
-  return std::unique_ptr<RuleIterator>(new RuleIteratorBinary(
-      IsContentSettingEnabled(content_type), std::move(auto_lock)));
-}
-
-void BinaryValueMap::SetContentSettingDisabled(ContentSettingsType content_type,
-                                               bool is_disabled) {
-  is_enabled_[content_type] = !is_disabled;
-}
-
-bool BinaryValueMap::IsContentSettingEnabled(
-    ContentSettingsType content_type) const {
-  auto it = is_enabled_.find(content_type);
-  return it == is_enabled_.end() || it->second;
-}
-
-}  // namespace content_settings
diff --git a/components/content_settings/core/browser/content_settings_binary_value_map.h b/components/content_settings/core/browser/content_settings_binary_value_map.h
deleted file mode 100644
index dbce8982..0000000
--- a/components/content_settings/core/browser/content_settings_binary_value_map.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright (c) 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_BINARY_VALUE_MAP_H_
-#define COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_BINARY_VALUE_MAP_H_
-
-#include <map>
-
-#include "components/content_settings/core/browser/content_settings_provider.h"
-#include "components/content_settings/core/common/content_settings_types.h"
-
-namespace base {
-class AutoLock;
-}  // namespace base
-
-namespace content_settings {
-
-class RuleIterator;
-
-// A simplified value map that can be used to disable or enable the entire
-// Content Setting. The default behaviour is enabling the Content Setting if
-// it is not set explicitly.
-class BinaryValueMap {
- public:
-  BinaryValueMap();
-  ~BinaryValueMap();
-
-  // Returns nullptr to indicate the RuleIterator is empty.
-  std::unique_ptr<RuleIterator> GetRuleIterator(
-      ContentSettingsType content_type,
-      const ResourceIdentifier& resource_identifier,
-      std::unique_ptr<base::AutoLock> lock) const;
-  void SetContentSettingDisabled(ContentSettingsType content_type,
-                                 bool disabled);
-  bool IsContentSettingEnabled(ContentSettingsType content_type) const;
-
- private:
-  std::map<ContentSettingsType, bool> is_enabled_;
-};
-
-}  // namespace content_settings
-
-#endif  // COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_BINARY_VALUE_MAP_H_
diff --git a/components/content_settings/core/browser/content_settings_global_value_map.cc b/components/content_settings/core/browser/content_settings_global_value_map.cc
new file mode 100644
index 0000000..94744fd
--- /dev/null
+++ b/components/content_settings/core/browser/content_settings_global_value_map.cc
@@ -0,0 +1,72 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/content_settings/core/browser/content_settings_global_value_map.h"
+
+#include <utility>
+
+#include "base/memory/ptr_util.h"
+#include "base/synchronization/lock.h"
+#include "components/content_settings/core/browser/content_settings_rule.h"
+#include "components/content_settings/core/common/content_settings.h"
+
+namespace content_settings {
+
+namespace {
+
+class RuleIteratorSimple : public RuleIterator {
+ public:
+  RuleIteratorSimple(ContentSetting setting) : setting_(setting) {}
+
+  bool HasNext() const override { return !is_done_; }
+
+  Rule Next() override {
+    DCHECK(HasNext());
+    is_done_ = true;
+    return Rule(ContentSettingsPattern::Wildcard(),
+                ContentSettingsPattern::Wildcard(),
+                new base::FundamentalValue(setting_));
+  }
+
+ private:
+  const ContentSetting setting_;
+  bool is_done_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(RuleIteratorSimple);
+};
+
+}  // namespace
+
+GlobalValueMap::GlobalValueMap() {}
+
+GlobalValueMap::~GlobalValueMap() {}
+
+std::unique_ptr<RuleIterator> GlobalValueMap::GetRuleIterator(
+    ContentSettingsType content_type,
+    const ResourceIdentifier& resource_identifier) const {
+  if (!resource_identifier.empty())
+    return nullptr;
+
+  auto it = settings_.find(content_type);
+  if (it == settings_.end())
+    return nullptr;
+
+  return base::MakeUnique<RuleIteratorSimple>(it->second);
+}
+
+void GlobalValueMap::SetContentSetting(ContentSettingsType content_type,
+                                       ContentSetting setting) {
+  if (setting == CONTENT_SETTING_DEFAULT)
+    settings_.erase(content_type);
+  else
+    settings_[content_type] = setting;
+}
+
+ContentSetting GlobalValueMap::GetContentSetting(
+    ContentSettingsType content_type) const {
+  auto it = settings_.find(content_type);
+  return it == settings_.end() ? CONTENT_SETTING_DEFAULT : it->second;
+}
+
+}  // namespace content_settings
diff --git a/components/content_settings/core/browser/content_settings_global_value_map.h b/components/content_settings/core/browser/content_settings_global_value_map.h
new file mode 100644
index 0000000..99407a1
--- /dev/null
+++ b/components/content_settings/core/browser/content_settings_global_value_map.h
@@ -0,0 +1,43 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_GLOBAL_VALUE_MAP_H_
+#define COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_GLOBAL_VALUE_MAP_H_
+
+#include <map>
+
+#include "components/content_settings/core/browser/content_settings_provider.h"
+#include "components/content_settings/core/common/content_settings_types.h"
+
+namespace content_settings {
+
+class RuleIterator;
+
+// A simplified value map that sets global content settings, i.e. applying to
+// all sites.
+// Note that this class does not do any synchronization. As content settings are
+// accessed from multiple threads, it's the responsibility of the client to
+// prevent concurrent access.
+class GlobalValueMap {
+ public:
+  GlobalValueMap();
+  ~GlobalValueMap();
+
+  // Returns nullptr to indicate the RuleIterator is empty.
+  std::unique_ptr<RuleIterator> GetRuleIterator(
+      ContentSettingsType content_type,
+      const ResourceIdentifier& resource_identifier) const;
+  void SetContentSetting(ContentSettingsType content_type,
+                         ContentSetting setting);
+  ContentSetting GetContentSetting(ContentSettingsType content_type) const;
+
+ private:
+  std::map<ContentSettingsType, ContentSetting> settings_;
+
+  DISALLOW_COPY_AND_ASSIGN(GlobalValueMap);
+};
+
+}  // namespace content_settings
+
+#endif  // COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_CONTENT_SETTINGS_GLOBAL_VALUE_MAP_H_
diff --git a/components/crash/content/app/fallback_crash_handler_win.cc b/components/crash/content/app/fallback_crash_handler_win.cc
index c17849429..f96d47a3 100644
--- a/components/crash/content/app/fallback_crash_handler_win.cc
+++ b/components/crash/content/app/fallback_crash_handler_win.cc
@@ -392,11 +392,6 @@
   crashpad::CrashReportDatabase::CallErrorWritingCrashReport on_error(
       database.get(), report);
 
-  // TODO(siggi): Go big on the detail here for Canary/Dev channels.
-  const uint32_t kMinidumpType = MiniDumpWithUnloadedModules |
-                                 MiniDumpWithProcessThreadData |
-                                 MiniDumpWithThreadInfo;
-
   MINIDUMP_EXCEPTION_INFORMATION exc_info = {};
   exc_info.ThreadId = thread_id_;
   exc_info.ExceptionPointers =
@@ -438,9 +433,18 @@
   if (!dump_file.IsValid())
     return false;
 
+  uint32_t minidump_type = MiniDumpWithUnloadedModules |
+                                 MiniDumpWithProcessThreadData |
+                                 MiniDumpWithThreadInfo;
+
+  // Capture more detail for canary and dev channels. The prefix search caters
+  // for the soon to be outdated "-m" suffixed multi-install channels.
+  if (channel.find("canary") == 0 || channel.find("dev") == 0)
+    minidump_type |= MiniDumpWithIndirectlyReferencedMemory;
+
   // Write the minidump to the temp file, and then copy the data to the
   // Crashpad-provided handle, as the latter is only open for write.
-  if (!MiniDumpWriteDumpWithCrashpadInfo(process_, kMinidumpType, &exc_info,
+  if (!MiniDumpWriteDumpWithCrashpadInfo(process_, minidump_type, &exc_info,
                                          crash_keys, client_id, report->uuid,
                                          &dump_file) ||
       !AppendFileContents(&dump_file, report->handle)) {
diff --git a/components/metrics/net/net_metrics_log_uploader.cc b/components/metrics/net/net_metrics_log_uploader.cc
index 7f76da2..5b2c95e 100644
--- a/components/metrics/net/net_metrics_log_uploader.cc
+++ b/components/metrics/net/net_metrics_log_uploader.cc
@@ -39,9 +39,9 @@
   DCHECK(!log_hash.empty());
   current_fetch_->AddExtraRequestHeader("X-Chrome-UMA-Log-SHA1: " + log_hash);
 
-  // We already drop cookies server-side, but we might as well strip them out
-  // client-side as well.
+  // Drop cookies and auth data.
   current_fetch_->SetLoadFlags(net::LOAD_DO_NOT_SAVE_COOKIES |
+                               net::LOAD_DO_NOT_SEND_AUTH_DATA |
                                net::LOAD_DO_NOT_SEND_COOKIES);
   current_fetch_->Start();
 }
diff --git a/components/pageinfo_strings.grdp b/components/pageinfo_strings.grdp
index 203605f..d5246fa 100644
--- a/components/pageinfo_strings.grdp
+++ b/components/pageinfo_strings.grdp
@@ -79,9 +79,6 @@
   <message name="IDS_PAGE_INFO_SECURITY_TAB_NO_REVOCATION_MECHANISM" desc="The text of the identity section when there is no certificate revocation mechanism.">
     The certificate does not specify a mechanism to check whether it has been revoked.
   </message>
-  <message name="IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE" desc="This message is displayed when the server hasn't been updated to fix a recent security issues. TLS here is an acronym and need not be translated. 'renegotiation' is a technical term describing a process of agreeing on a new set of security parameters and secrets. 'extension' here should be taken to mean 'amendment' rather than elongation.">
-    The server does not support the TLS renegotiation extension.
-  </message>
   <message name="IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION" desc="This message gives the version of the SSL protocol used to protect the HTTPS connection.">
     The connection uses <ph name="SSL_VERSION">$1<ex>TLS 1.0</ex></ph>.
   </message>
diff --git a/components/previews/core/previews_io_data.cc b/components/previews/core/previews_io_data.cc
index 82d17b2..9c333b2 100644
--- a/components/previews/core/previews_io_data.cc
+++ b/components/previews/core/previews_io_data.cc
@@ -9,7 +9,7 @@
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
-#include "base/metrics/histogram.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
 #include "base/time/default_clock.h"
 #include "components/previews/core/previews_black_list.h"
diff --git a/content/browser/renderer_host/input/synthetic_touch_driver.cc b/content/browser/renderer_host/input/synthetic_touch_driver.cc
index 3adb753c..2926c57 100644
--- a/content/browser/renderer_host/input/synthetic_touch_driver.cc
+++ b/content/browser/renderer_host/input/synthetic_touch_driver.cc
@@ -22,7 +22,8 @@
 void SyntheticTouchDriver::DispatchEvent(SyntheticGestureTarget* target,
                                          const base::TimeTicks& timestamp) {
   touch_event_.setTimeStampSeconds(ConvertTimestampToSeconds(timestamp));
-  target->DispatchInputEventToPlatform(touch_event_);
+  if (touch_event_.type() != blink::WebInputEvent::Undefined)
+    target->DispatchInputEventToPlatform(touch_event_);
   touch_event_.ResetPoints();
 }
 
diff --git a/content/child/child_process.cc b/content/child/child_process.cc
index 7c5b408..19b28b7 100644
--- a/content/child/child_process.cc
+++ b/content/child/child_process.cc
@@ -13,6 +13,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task_scheduler/task_scheduler.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_local.h"
 #include "build/build_config.h"
@@ -47,6 +48,15 @@
 
   base::StatisticsRecorder::Initialize();
 
+  // Initialize TaskScheduler if not already done. A TaskScheduler may already
+  // exist when ChildProcess is instantiated in the browser process or in a
+  // test process.
+  if (!base::TaskScheduler::GetInstance()) {
+    InitializeTaskScheduler();
+    DCHECK(base::TaskScheduler::GetInstance());
+    initialized_task_scheduler_ = true;
+  }
+
   // We can't recover from failing to start the IO thread.
   base::Thread::Options thread_options(base::MessageLoop::TYPE_IO, 0);
   thread_options.priority = io_thread_priority;
@@ -80,6 +90,11 @@
 
   g_lazy_tls.Pointer()->Set(NULL);
   io_thread_.Stop();
+
+  if (initialized_task_scheduler_) {
+    DCHECK(base::TaskScheduler::GetInstance());
+    base::TaskScheduler::GetInstance()->Shutdown();
+  }
 }
 
 ChildThreadImpl* ChildProcess::main_thread() {
@@ -162,4 +177,9 @@
 #endif  // defined(OS_POSIX)
 }
 
+void ChildProcess::InitializeTaskScheduler() {
+  constexpr int kMaxThreads = 2;
+  base::TaskScheduler::CreateAndSetSimpleTaskScheduler(kMaxThreads);
+}
+
 }  // namespace content
diff --git a/content/child/child_process.h b/content/child/child_process.h
index 9a56e76..ecc8a7fe1 100644
--- a/content/child/child_process.h
+++ b/content/child/child_process.h
@@ -79,6 +79,10 @@
 
   static void WaitForDebugger(const std::string& label);
  private:
+  // Initializes TaskScheduler. May be overridden to initialize TaskScheduler
+  // with custom arguments.
+  virtual void InitializeTaskScheduler();
+
   int ref_count_;
 
   // An event that will be signalled when we shutdown.
@@ -92,6 +96,9 @@
   // io_thread_.
   std::unique_ptr<ChildThreadImpl> main_thread_;
 
+  // Whether this ChildProcess initialized TaskScheduler.
+  bool initialized_task_scheduler_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(ChildProcess);
 };
 
diff --git a/content/renderer/gpu/actions_parser.cc b/content/renderer/gpu/actions_parser.cc
index 534c0d1..41b5a3e2 100644
--- a/content/renderer/gpu/actions_parser.cc
+++ b/content/renderer/gpu/actions_parser.cc
@@ -8,6 +8,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
+#include "cc/output/begin_frame_args.h"
 
 namespace content {
 
@@ -131,9 +132,6 @@
     return false;
   }
 
-  if (actions->GetSize() > longest_action_sequence_)
-    longest_action_sequence_ = actions->GetSize();
-
   if (!ParseActions(*actions))
     return false;
 
@@ -152,6 +150,10 @@
       return false;
     }
   }
+
+  if (param_list.size() > longest_action_sequence_)
+    longest_action_sequence_ = param_list.size();
+
   pointer_actions_list_.push_back(param_list);
   return true;
 }
@@ -190,6 +192,24 @@
     return false;
   }
 
+  double duration = 0;
+  int num_idle = 0;
+  if (pointer_action_type ==
+      SyntheticPointerActionParams::PointerActionType::IDLE) {
+    num_idle = 1;
+    if (action.HasKey("duration") && !action.GetDouble("duration", &duration)) {
+      error_message_ = base::StringPrintf(
+          "actions[%d].actions.x is not a number", action_index_);
+      return false;
+    }
+  }
+
+  // If users pause for given seconds, we convert to the number of idle frames.
+  if (duration > 0) {
+    num_idle = static_cast<int>(std::ceil(
+        duration / cc::BeginFrameArgs::DefaultInterval().InSecondsF()));
+  }
+
   SyntheticPointerActionParams action_param(pointer_action_type);
   action_param.set_index(action_index_);
   if (pointer_action_type ==
@@ -199,6 +219,12 @@
     action_param.set_position(gfx::PointF(position_x, position_y));
   }
   param_list.push_back(action_param);
+
+  // We queue all the IDLE actions in the action parameter list to make sure we
+  // will pause long enough on the given pointer.
+  for (int count = 1; count < num_idle; ++count)
+    param_list.push_back(action_param);
+
   return true;
 }
 
diff --git a/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc b/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc
index a1580b5..a2c0a70 100644
--- a/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc
+++ b/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc
@@ -68,9 +68,9 @@
     case blink::WebMediaStreamTrack::ContentHintType::AudioMusic:
       NOTREACHED();
       break;
-    case blink::WebMediaStreamTrack::ContentHintType::VideoFluid:
+    case blink::WebMediaStreamTrack::ContentHintType::VideoMotion:
       return webrtc::VideoTrackInterface::ContentHint::kFluid;
-    case blink::WebMediaStreamTrack::ContentHintType::VideoDetailed:
+    case blink::WebMediaStreamTrack::ContentHintType::VideoDetail:
       return webrtc::VideoTrackInterface::ContentHint::kDetailed;
   }
   NOTREACHED();
diff --git a/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc b/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc
index 84daf7e..dc0a3ee 100644
--- a/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc
+++ b/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc
@@ -322,11 +322,11 @@
 bool WebRtcVideoCapturerAdapter::ShouldAdaptResolution() const {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (content_hint_ ==
-      blink::WebMediaStreamTrack::ContentHintType::VideoFluid) {
+      blink::WebMediaStreamTrack::ContentHintType::VideoMotion) {
     return true;
   }
   if (content_hint_ ==
-      blink::WebMediaStreamTrack::ContentHintType::VideoDetailed) {
+      blink::WebMediaStreamTrack::ContentHintType::VideoDetail) {
     return false;
   }
   // Screencast does not adapt by default.
diff --git a/content/renderer/media/webrtc/webrtc_video_capturer_adapter_unittest.cc b/content/renderer/media/webrtc/webrtc_video_capturer_adapter_unittest.cc
index c96fb1b..30e0125 100644
--- a/content/renderer/media/webrtc/webrtc_video_capturer_adapter_unittest.cc
+++ b/content/renderer/media/webrtc/webrtc_video_capturer_adapter_unittest.cc
@@ -156,42 +156,42 @@
 
 TEST_F(WebRtcVideoCapturerAdapterTest,
        NonScreencastAdapterDoesNotAdaptContentHintDetail) {
-  // Non-screenshare adapter should not adapt frames when detailed is set.
+  // Non-screenshare adapter should not adapt frames when detail is set.
   TestContentHintResolutionAdaptation(
       false, blink::WebMediaStreamTrack::ContentHintType::None, true,
-      blink::WebMediaStreamTrack::ContentHintType::VideoDetailed, false);
+      blink::WebMediaStreamTrack::ContentHintType::VideoDetail, false);
 }
 
 TEST_F(WebRtcVideoCapturerAdapterTest,
        NonScreencastAdapterAdaptsContentHintFluid) {
-  // Non-screenshare adapter should still adapt frames when fluid is set.
+  // Non-screenshare adapter should still adapt frames when motion is set.
   TestContentHintResolutionAdaptation(
       false, blink::WebMediaStreamTrack::ContentHintType::None, true,
-      blink::WebMediaStreamTrack::ContentHintType::VideoFluid, true);
+      blink::WebMediaStreamTrack::ContentHintType::VideoMotion, true);
 }
 
 TEST_F(WebRtcVideoCapturerAdapterTest,
        ScreencastAdapterAdaptsContentHintFluid) {
-  // Screenshare adapter should adapt frames when fluid is set.
+  // Screenshare adapter should adapt frames when motion is set.
   TestContentHintResolutionAdaptation(
       true, blink::WebMediaStreamTrack::ContentHintType::None, false,
-      blink::WebMediaStreamTrack::ContentHintType::VideoFluid, true);
+      blink::WebMediaStreamTrack::ContentHintType::VideoMotion, true);
 }
 
 TEST_F(WebRtcVideoCapturerAdapterTest,
        ScreencastAdapterDoesNotAdaptContentHintDetailed) {
-  // Screenshare adapter should still not adapt frames when detailed is set.
+  // Screenshare adapter should still not adapt frames when detail is set.
   TestContentHintResolutionAdaptation(
       true, blink::WebMediaStreamTrack::ContentHintType::None, false,
-      blink::WebMediaStreamTrack::ContentHintType::VideoDetailed, false);
+      blink::WebMediaStreamTrack::ContentHintType::VideoDetail, false);
 }
 
 TEST_F(WebRtcVideoCapturerAdapterTest, RespectsConstructionTimeContentHint) {
-  // Non-screenshare adapter constructed with detailed content hint should not
+  // Non-screenshare adapter constructed with detail content hint should not
   // adapt before SetContentHint is run.
   TestContentHintResolutionAdaptation(
-      false, blink::WebMediaStreamTrack::ContentHintType::VideoDetailed, false,
-      blink::WebMediaStreamTrack::ContentHintType::VideoFluid, true);
+      false, blink::WebMediaStreamTrack::ContentHintType::VideoDetail, false,
+      blink::WebMediaStreamTrack::ContentHintType::VideoMotion, true);
 }
 
 }  // namespace content
diff --git a/content/renderer/render_process_impl.cc b/content/renderer/render_process_impl.cc
index 180e34fe..fa6012c 100644
--- a/content/renderer/render_process_impl.cc
+++ b/content/renderer/render_process_impl.cc
@@ -126,33 +126,6 @@
   return is_background ? BACKGROUND : FOREGROUND;
 }
 
-void InitializeTaskScheduler() {
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kSingleProcess)) {
-    // There should already be a TaskScheduler when the renderer runs inside the
-    // browser process.
-    DCHECK(base::TaskScheduler::GetInstance());
-    return;
-  }
-  DCHECK(!base::TaskScheduler::GetInstance());
-
-  std::vector<base::SchedulerWorkerPoolParams> params_vector;
-  base::TaskScheduler::WorkerPoolIndexForTraitsCallback
-      index_to_traits_callback;
-  content::GetContentClient()->renderer()->GetTaskSchedulerInitializationParams(
-      &params_vector, &index_to_traits_callback);
-
-  if (params_vector.empty()) {
-    params_vector = GetDefaultSchedulerWorkerPoolParams();
-    index_to_traits_callback =
-        base::Bind(&DefaultRendererWorkerPoolIndexForTraits);
-  }
-  DCHECK(index_to_traits_callback);
-
-  base::TaskScheduler::CreateAndSetDefaultTaskScheduler(
-      params_vector, index_to_traits_callback);
-}
-
 }  // namespace
 
 namespace content {
@@ -213,8 +186,6 @@
 
   SiteIsolationStatsGatherer::SetEnabled(
       GetContentClient()->renderer()->ShouldGatherSiteIsolationStats());
-
-  InitializeTaskScheduler();
 }
 
 RenderProcessImpl::~RenderProcessImpl() {
@@ -224,12 +195,6 @@
     DLOG(ERROR) << "WebFrame LEAKED " << count << " TIMES";
 #endif
 
-  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kSingleProcess)) {
-    DCHECK(base::TaskScheduler::GetInstance());
-    base::TaskScheduler::GetInstance()->Shutdown();
-  }
-
   GetShutDownEvent()->Signal();
 }
 
@@ -241,4 +206,22 @@
   return enabled_bindings_;
 }
 
+void RenderProcessImpl::InitializeTaskScheduler() {
+  std::vector<base::SchedulerWorkerPoolParams> params_vector;
+  base::TaskScheduler::WorkerPoolIndexForTraitsCallback
+      index_to_traits_callback;
+  content::GetContentClient()->renderer()->GetTaskSchedulerInitializationParams(
+      &params_vector, &index_to_traits_callback);
+
+  if (params_vector.empty()) {
+    params_vector = GetDefaultSchedulerWorkerPoolParams();
+    index_to_traits_callback =
+        base::Bind(&DefaultRendererWorkerPoolIndexForTraits);
+  }
+  DCHECK(index_to_traits_callback);
+
+  base::TaskScheduler::CreateAndSetDefaultTaskScheduler(
+      params_vector, index_to_traits_callback);
+}
+
 }  // namespace content
diff --git a/content/renderer/render_process_impl.h b/content/renderer/render_process_impl.h
index 768ef7d..ae964a0 100644
--- a/content/renderer/render_process_impl.h
+++ b/content/renderer/render_process_impl.h
@@ -23,6 +23,8 @@
   int GetEnabledBindings() const override;
 
  private:
+  void InitializeTaskScheduler() override;
+
   // Bitwise-ORed set of extra bindings that have been enabled anywhere in this
   // process.  See BindingsPolicy for details.
   int enabled_bindings_;
diff --git a/docs/memory-infra/memory_benchmarks.md b/docs/memory-infra/memory_benchmarks.md
index c33610a..aa50645 100644
--- a/docs/memory-infra/memory_benchmarks.md
+++ b/docs/memory-infra/memory_benchmarks.md
@@ -181,9 +181,48 @@
 
 ## Appendix
 
-### Other benchmarks
+There are a few other benchmarks maintained by the memory-infra team.
+These also use the same set of metrics as system health, but have differences
+on the kind of stories that they run.
 
-Other benchmarks maintained by the memory-infra team are:
+### memory.top_10_mobile
+
+The *top-10-mobile* benchmarks are in the process of being deprecated
+in favor of system health benchmarks. This process, however, hasn't been
+finalized and currently they are still the reference benchmark used for
+decision making in the Android release process. Therefore, **it is important
+to diagnose and fix regressions caught by these benchmarks**.
+
+*   [memory.top_10_mobile][memory_py] - Cycle between:
+
+    - load a page on Chrome, wait for it to load, [force garbage collection
+      and measure memory][measure];
+    - push Chrome to the background, force garbage collection and measure
+      memory again.
+
+    Repeat for each of 10 pages *without closing the browser*.
+
+    Close the browser, re-open and repeat the full page set a total of 5 times.
+
+    Story groups are either `foreground` or `background` depending on the state
+    of the browser at the time of measurement.
+
+*   [memory.top_10_mobile_stress][memory_py] - same as above, but keeps a single
+    instance of the browser open for the whole duration of the test and
+    *does not* force any garbage collection.
+
+The main difference to watch out between these and system health benchmarks is
+that, since a single browser instance is kept open and shared by many
+individual stories, they are not independent of each other. In particular, **do
+not use the `--story-filter` argument when trying to reproduce regressions**
+on these benchmarks, as doing so will affect the results.
+
+[measure]: https://github.com/catapult-project/catapult/blob/master/telemetry/telemetry/internal/actions/action_runner.py#L133
+
+### Dual browser benchmarks
+
+Dual browser benchmarks are intended to assess the memory implications of
+shared resources between Chrome and WebView.
 
 *   [memory.dual_browser_test][memory_py] - cycle between doing Google searches
     on a WebView-based browser (a stand-in for the Google Search app) and
@@ -197,14 +236,4 @@
     duration of the test and without forcing garbage collection. Intended as a
     last-resort net to catch memory leaks not apparent on shorter tests.
 
-*   [memory.top_10_mobile][memory_py] - cycle between loading a page on Chrome,
-    pushing the browser to the background, and then back to the foreground.
-    *(To be deprecated in favor of system_health.memory_mobile.)*
-
-    Story groups are either `foreground` or `background` indicating the state
-    of the browser at the time of measurement.
-
-*   [memory.top_10_mobile_stress][memory_py] - same as above, but keeps a single
-    instance of the browser open for 5 repetitions. *(To be deprecated.)*
-
 [memory_py]: https://chromium.googlesource.com/chromium/src/+/master/tools/perf/benchmarks/memory.py
diff --git a/ios/chrome/browser/metrics/BUILD.gn b/ios/chrome/browser/metrics/BUILD.gn
index cc28d43..9e4e718 100644
--- a/ios/chrome/browser/metrics/BUILD.gn
+++ b/ios/chrome/browser/metrics/BUILD.gn
@@ -52,7 +52,6 @@
     "//ios/chrome/browser/variations",
     "//ios/chrome/browser/variations:ios_chrome_ui_string_overrider_factory",
     "//ios/chrome/common",
-    "//ios/public/provider/chrome/browser",
     "//ios/web",
   ]
 }
diff --git a/ios/chrome/browser/metrics/ios_chrome_metrics_services_manager_client.mm b/ios/chrome/browser/metrics/ios_chrome_metrics_services_manager_client.mm
index 9d4cf92..f7b96d4 100644
--- a/ios/chrome/browser/metrics/ios_chrome_metrics_services_manager_client.mm
+++ b/ios/chrome/browser/metrics/ios_chrome_metrics_services_manager_client.mm
@@ -19,7 +19,6 @@
 #include "ios/chrome/browser/tabs/tab_model_list.h"
 #include "ios/chrome/browser/variations/ios_chrome_variations_service_client.h"
 #include "ios/chrome/browser/variations/ios_ui_string_overrider_factory.h"
-#include "ios/public/provider/chrome/browser/chrome_browser_provider.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -97,8 +96,7 @@
 
 bool IOSChromeMetricsServicesManagerClient::IsSafeBrowsingEnabled(
     const base::Closure& on_update_callback) {
-  return ios::GetChromeBrowserProvider()->IsSafeBrowsingEnabled(
-      on_update_callback);
+  return false;
 }
 
 bool IOSChromeMetricsServicesManagerClient::IsMetricsReportingEnabled() {
diff --git a/ios/chrome/browser/ui/omnibox/page_info_model.cc b/ios/chrome/browser/ui/omnibox/page_info_model.cc
index a524461..83476906 100644
--- a/ios/chrome/browser/ui/omnibox/page_info_model.cc
+++ b/ios/chrome/browser/ui/omnibox/page_info_model.cc
@@ -221,9 +221,6 @@
         l10n_util::GetStringFUTF16(IDS_PAGE_INFO_SECURITY_TAB_SSL_VERSION,
                                    base::ASCIIToUTF16(ssl_version_str));
 
-    bool no_renegotiation =
-        (ssl.connection_status &
-         net::SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION) != 0;
     const char *key_exchange, *cipher, *mac;
     bool is_aead;
     bool is_tls13;
@@ -241,12 +238,6 @@
           base::ASCIIToUTF16(cipher), base::ASCIIToUTF16(mac),
           base::ASCIIToUTF16(key_exchange));
     }
-
-    if (no_renegotiation) {
-      description += base::ASCIIToUTF16("\n\n");
-      description += l10n_util::GetStringUTF16(
-          IDS_PAGE_INFO_SECURITY_TAB_RENEGOTIATION_MESSAGE);
-    }
   }
 
   if (!description.empty()) {
diff --git a/ios/chrome/browser/ui/suggestions/BUILD.gn b/ios/chrome/browser/ui/suggestions/BUILD.gn
index d99d9c5..908f720 100644
--- a/ios/chrome/browser/ui/suggestions/BUILD.gn
+++ b/ios/chrome/browser/ui/suggestions/BUILD.gn
@@ -16,6 +16,9 @@
     "suggestions_item.h",
     "suggestions_item.mm",
     "suggestions_item_actions.h",
+    "suggestions_stack_item.h",
+    "suggestions_stack_item.mm",
+    "suggestions_stack_item_actions.h",
     "suggestions_view_controller.h",
     "suggestions_view_controller.mm",
   ]
@@ -32,11 +35,13 @@
 }
 
 source_set("unit_tests") {
+  configs += [ "//build/config/compiler:enable_arc" ]
   testonly = true
   sources = [
     "suggestions_article_item_unittest.mm",
     "suggestions_expandable_item_unittest.mm",
     "suggestions_item_unittest.mm",
+    "suggestions_stack_item_unittest.mm",
   ]
   deps = [
     ":suggestions",
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_article_item_unittest.mm b/ios/chrome/browser/ui/suggestions/suggestions_article_item_unittest.mm
index 74a22e4..aa20975 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_article_item_unittest.mm
+++ b/ios/chrome/browser/ui/suggestions/suggestions_article_item_unittest.mm
@@ -4,11 +4,15 @@
 
 #import "ios/chrome/browser/ui/suggestions/suggestions_article_item.h"
 
-#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 namespace {
 
+// Tests that configureCell: set all the fields of the cell.
 TEST(SuggestionsArticleItemTest, CellIsConfigured) {
   NSString* title = @"testTitle";
   NSString* subtitle = @"testSubtitle";
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h b/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h
index aadb227..85ca539 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h
+++ b/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h
@@ -7,17 +7,26 @@
 
 #import <UIKit/UIKit.h>
 
+#import "ios/chrome/browser/ui/collection_view/collection_view_model.h"
+
 @class SuggestionsViewController;
 
+// Enum defining the ItemType of this SuggestionsCollectionUpdater.
+typedef NS_ENUM(NSInteger, ItemType) {
+  ItemTypeText = kItemTypeEnumZero,
+  ItemTypeArticle,
+  ItemTypeExpand,
+  ItemTypeStack,
+};
+
 // Updater for a CollectionViewController populating it with some items and
 // handling the items addition.
 @interface SuggestionsCollectionUpdater : NSObject
 
-// |collectionViewController| this Updater will update.
-- (instancetype)initWithCollectionViewController:
-    (SuggestionsViewController*)collectionViewController
-    NS_DESIGNATED_INITIALIZER;
-- (instancetype)init NS_UNAVAILABLE;
+// |collectionViewController| this Updater will update. Needs to be set before
+// adding items.
+@property(nonatomic, assign)
+    SuggestionsViewController* collectionViewController;
 
 // Adds a text item with a |title| and a |subtitle| in the section numbered
 // |section|. If |section| is greater than the current number of section, it
@@ -26,6 +35,9 @@
            subtitle:(NSString*)subtitle
           toSection:(NSInteger)inputSection;
 
+// Returns whether the section should use the default, non-card style.
+- (BOOL)shouldUseCustomStyleForSection:(NSInteger)section;
+
 @end
 
 #endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_COLLECTION_UPDATER_H_
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.mm b/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.mm
index 01c6d0c..272ef98 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.mm
+++ b/ios/chrome/browser/ui/suggestions/suggestions_collection_updater.mm
@@ -4,70 +4,67 @@
 
 #import "ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h"
 
+#include "base/logging.h"
 #include "base/mac/foundation_util.h"
 #import "ios/chrome/browser/ui/collection_view/collection_view_controller.h"
 #import "ios/chrome/browser/ui/collection_view/collection_view_model.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_article_item.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_expandable_item.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_item.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_view_controller.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
 #endif
 
-namespace {
-typedef NS_ENUM(NSInteger, ItemType) {
-  ItemTypeText = kItemTypeEnumZero,
-  ItemTypeArticle,
-  ItemTypeExpand,
-};
+@implementation SuggestionsCollectionUpdater
 
-}  // namespace
+@synthesize collectionViewController = _collectionViewController;
 
-@implementation SuggestionsCollectionUpdater {
-  SuggestionsViewController* _collectionViewController;
-}
+#pragma mark - Properties
 
-- (instancetype)initWithCollectionViewController:
+- (void)setCollectionViewController:
     (SuggestionsViewController*)collectionViewController {
-  self = [super init];
-  if (self) {
-    _collectionViewController = collectionViewController;
-    [collectionViewController loadModel];
-    CollectionViewModel* model = collectionViewController.collectionViewModel;
-    NSInteger sectionIdentifier = kSectionIdentifierEnumZero;
-    for (NSInteger i = 0; i < 3; i++) {
-      [model addSectionWithIdentifier:sectionIdentifier];
-      [model addItem:[[SuggestionsItem alloc] initWithType:ItemTypeText
-                                                     title:@"The title"
-                                                  subtitle:@"The subtitle"]
-          toSectionWithIdentifier:sectionIdentifier];
-      [model addItem:
-                 [[SuggestionsArticleItem alloc]
-                     initWithType:ItemTypeArticle
-                            title:@"Title of an Article"
-                         subtitle:@"This is the subtitle of an article, can "
-                                  @"spawn on multiple lines"
-                            image:[UIImage imageNamed:@"distillation_success"]]
-          toSectionWithIdentifier:sectionIdentifier];
-      SuggestionsExpandableItem* expandableItem =
-          [[SuggestionsExpandableItem alloc]
-              initWithType:ItemTypeExpand
-                     title:@"Title of an Expandable Article"
-                  subtitle:@"This Article can be expanded to display "
-                           @"additional information or interaction "
-                           @"options"
-                     image:[UIImage imageNamed:@"distillation_fail"]
-                detailText:@"Details shown only when the article is "
-                           @"expanded. It can be displayed on "
-                           @"multiple lines."];
-      expandableItem.delegate = collectionViewController;
-      [model addItem:expandableItem toSectionWithIdentifier:sectionIdentifier];
-      sectionIdentifier++;
-    }
+  _collectionViewController = collectionViewController;
+  [collectionViewController loadModel];
+  CollectionViewModel* model = collectionViewController.collectionViewModel;
+  NSInteger sectionIdentifier = kSectionIdentifierEnumZero;
+  [model addSectionWithIdentifier:sectionIdentifier];
+  [model addItem:[[SuggestionsStackItem alloc] initWithType:ItemTypeStack
+                                                      title:@"The title"
+                                                   subtitle:@"The subtitle"]
+      toSectionWithIdentifier:sectionIdentifier++];
+
+  for (NSInteger i = 0; i < 3; i++) {
+    [model addSectionWithIdentifier:sectionIdentifier];
+    [model addItem:[[SuggestionsItem alloc] initWithType:ItemTypeText
+                                                   title:@"The title"
+                                                subtitle:@"The subtitle"]
+        toSectionWithIdentifier:sectionIdentifier];
+    [model addItem:[[SuggestionsArticleItem alloc]
+                       initWithType:ItemTypeArticle
+                              title:@"Title of an Article"
+                           subtitle:@"This is the subtitle of an article, can "
+                                    @"spawn on multiple lines"
+                              image:[UIImage
+                                        imageNamed:@"distillation_success"]]
+        toSectionWithIdentifier:sectionIdentifier];
+    SuggestionsExpandableItem* expandableItem =
+        [[SuggestionsExpandableItem alloc]
+            initWithType:ItemTypeExpand
+                   title:@"Title of an Expandable Article"
+                subtitle:@"This Article can be expanded to display "
+                         @"additional information or interaction "
+                         @"options"
+                   image:[UIImage imageNamed:@"distillation_fail"]
+              detailText:@"Details shown only when the article is "
+                         @"expanded. It can be displayed on "
+                         @"multiple lines."];
+    expandableItem.delegate = _collectionViewController;
+    [model addItem:expandableItem toSectionWithIdentifier:sectionIdentifier];
+    sectionIdentifier++;
   }
-  return self;
 }
 
 #pragma mark - Public methods
@@ -75,6 +72,7 @@
 - (void)addTextItem:(NSString*)title
            subtitle:(NSString*)subtitle
           toSection:(NSInteger)inputSection {
+  DCHECK(_collectionViewController);
   SuggestionsItem* item = [[SuggestionsItem alloc] initWithType:ItemTypeText
                                                           title:title
                                                        subtitle:subtitle];
@@ -105,4 +103,8 @@
                                                      completion:nil];
 }
 
+- (BOOL)shouldUseCustomStyleForSection:(NSInteger)section {
+  return section == 0;
+}
+
 @end
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_commands.h b/ios/chrome/browser/ui/suggestions/suggestions_commands.h
index dff2596..a1642ce 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_commands.h
+++ b/ios/chrome/browser/ui/suggestions/suggestions_commands.h
@@ -10,6 +10,10 @@
 
 // Adds a new empty SuggestionItem.
 - (void)addEmptyItem;
+// Opens the Reading List.
+- (void)openReadingList;
+// Opens the first page of the Reading List.
+- (void)openFirstPageOfReadingList;
 
 @end
 
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_expandable_item_unittest.mm b/ios/chrome/browser/ui/suggestions/suggestions_expandable_item_unittest.mm
index 906abf7..0fe5c97 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_expandable_item_unittest.mm
+++ b/ios/chrome/browser/ui/suggestions/suggestions_expandable_item_unittest.mm
@@ -4,11 +4,14 @@
 
 #import "ios/chrome/browser/ui/suggestions/suggestions_expandable_item.h"
 
-#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
 #include "third_party/ocmock/gtest_support.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 // Test subclass of the SuggestionsExpandableCell.
 @interface TestSuggestionsExpandableCell : SuggestionsExpandableCell
 
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_item_unittest.mm b/ios/chrome/browser/ui/suggestions/suggestions_item_unittest.mm
index d5ae0f85..7c6f344 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_item_unittest.mm
+++ b/ios/chrome/browser/ui/suggestions/suggestions_item_unittest.mm
@@ -4,9 +4,12 @@
 
 #import "ios/chrome/browser/ui/suggestions/suggestions_item.h"
 
-#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 namespace {
 
 // Tests that configureCell: set all the fields of the cell.
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_stack_item.h b/ios/chrome/browser/ui/suggestions/suggestions_stack_item.h
new file mode 100644
index 0000000..3dafe83
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_stack_item.h
@@ -0,0 +1,33 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_H_
+#define IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_H_
+
+#import "ios/chrome/browser/ui/collection_view/cells/collection_view_item.h"
+#import "ios/third_party/material_components_ios/src/components/CollectionCells/src/MaterialCollectionCells.h"
+
+// Item for a suggestions stack item. The stack items show an item on the top
+// and hint that there are other items available. Click on the top item will
+// trigger an action, clicking the rest of the cell another.
+@interface SuggestionsStackItem : CollectionViewItem
+
+// Initialize a suggestions item with a |title| and a |subtitle|. |type| is the
+// type of the item.
+- (instancetype)initWithType:(NSInteger)type
+                       title:(NSString*)title
+                    subtitle:(NSString*)subtitle NS_DESIGNATED_INITIALIZER;
+- (instancetype)initWithType:(NSInteger)type NS_UNAVAILABLE;
+
+@end
+
+// Corresponding cell for a suggestions stack item.
+@interface SuggestionsStackCell : MDCCollectionViewCell
+
+@property(nonatomic, readonly, strong) UIButton* titleButton;
+@property(nonatomic, readonly, strong) UILabel* detailTextLabel;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_H_
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_stack_item.mm b/ios/chrome/browser/ui/suggestions/suggestions_stack_item.mm
new file mode 100644
index 0000000..1ea97d7
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_stack_item.mm
@@ -0,0 +1,143 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item.h"
+
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item_actions.h"
+#import "ios/chrome/browser/ui/uikit_ui_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+const CGFloat kStackSpacing = 8;
+}
+
+@implementation SuggestionsStackItem {
+  NSString* _title;
+  NSString* _subtitle;
+}
+
+- (instancetype)initWithType:(NSInteger)type
+                       title:(NSString*)title
+                    subtitle:(NSString*)subtitle {
+  self = [super initWithType:type];
+  if (self) {
+    self.cellClass = [SuggestionsStackCell class];
+    _title = [title copy];
+    _subtitle = [subtitle copy];
+  }
+  return self;
+}
+
+#pragma mark - CollectionViewItem
+
+- (void)configureCell:(SuggestionsStackCell*)cell {
+  [super configureCell:cell];
+  [cell.titleButton setTitle:_title forState:UIControlStateNormal];
+  cell.detailTextLabel.text = _subtitle;
+}
+
+@end
+
+@implementation SuggestionsStackCell
+
+@synthesize titleButton = _titleButton;
+@synthesize detailTextLabel = _detailTextLabel;
+
+- (instancetype)initWithFrame:(CGRect)frame {
+  self = [super initWithFrame:frame];
+  if (self) {
+    self.backgroundColor = [UIColor clearColor];
+    self.contentView.backgroundColor = [UIColor clearColor];
+    self.backgroundView.backgroundColor = [UIColor clearColor];
+
+    UIControl* itemDisplay = [[UIControl alloc] init];
+    itemDisplay.layer.borderColor = [UIColor blackColor].CGColor;
+    itemDisplay.layer.borderWidth = 1;
+    itemDisplay.backgroundColor = [UIColor whiteColor];
+    [itemDisplay addTarget:nil
+                    action:@selector(openReadingListFirstItem:)
+          forControlEvents:UIControlEventTouchUpInside];
+    itemDisplay.translatesAutoresizingMaskIntoConstraints = NO;
+
+    _titleButton = [UIButton buttonWithType:UIButtonTypeSystem];
+    _detailTextLabel = [[UILabel alloc] init];
+    _titleButton.translatesAutoresizingMaskIntoConstraints = NO;
+    _detailTextLabel.translatesAutoresizingMaskIntoConstraints = NO;
+
+    [itemDisplay addSubview:_titleButton];
+    [itemDisplay addSubview:_detailTextLabel];
+
+    // Placeholder. This view is only used to display a border below the item.
+    UIView* secondView = [[UIView alloc] init];
+    secondView.backgroundColor = [UIColor whiteColor];
+    secondView.translatesAutoresizingMaskIntoConstraints = NO;
+    secondView.layer.borderColor = [UIColor blackColor].CGColor;
+    secondView.layer.borderWidth = 1;
+
+    // Placeholder. This view is only used to display a border below the item.
+    UIView* thirdView = [[UIView alloc] init];
+    thirdView.backgroundColor = [UIColor whiteColor];
+    thirdView.translatesAutoresizingMaskIntoConstraints = NO;
+    thirdView.layer.borderColor = [UIColor blackColor].CGColor;
+    thirdView.layer.borderWidth = 1;
+
+    // Placeholder. This view is only used to display a border below the item.
+    UIView* fourthView = [[UIView alloc] init];
+    fourthView.backgroundColor = [UIColor whiteColor];
+    fourthView.translatesAutoresizingMaskIntoConstraints = NO;
+    fourthView.layer.borderColor = [UIColor blackColor].CGColor;
+    fourthView.layer.borderWidth = 1;
+
+    [self.contentView addSubview:itemDisplay];
+    [self.contentView insertSubview:secondView belowSubview:itemDisplay];
+    [self.contentView insertSubview:thirdView belowSubview:secondView];
+    [self.contentView insertSubview:fourthView belowSubview:thirdView];
+
+    [NSLayoutConstraint activateConstraints:@[
+      [itemDisplay.widthAnchor constraintEqualToAnchor:secondView.widthAnchor],
+      [itemDisplay.heightAnchor
+          constraintEqualToAnchor:secondView.heightAnchor],
+      [itemDisplay.widthAnchor constraintEqualToAnchor:thirdView.widthAnchor],
+      [itemDisplay.heightAnchor constraintEqualToAnchor:thirdView.heightAnchor],
+      [itemDisplay.widthAnchor constraintEqualToAnchor:fourthView.widthAnchor],
+      [itemDisplay.heightAnchor
+          constraintEqualToAnchor:fourthView.heightAnchor],
+    ]];
+
+    ApplyVisualConstraintsWithMetrics(
+        @[
+          @"H:|-[title]-|",
+          @"H:|-[text]-|",
+          @"H:|[item]-(fourSpace)-|",
+          @"H:|-(oneSpace)-[second]-(threeSpace)-|",
+          @"H:|-(twoSpace)-[third]-(twoSpace)-|",
+          @"H:|-(threeSpace)-[fourth]-(oneSpace)-|",
+          @"V:|-[title]-[text]-|",
+          @"V:|[item]",
+          @"V:|-(oneSpace)-[second]",
+          @"V:|-(twoSpace)-[third]",
+          @"V:|-(threeSpace)-[fourth]|",
+        ],
+        @{
+          @"title" : _titleButton,
+          @"text" : _detailTextLabel,
+          @"item" : itemDisplay,
+          @"second" : secondView,
+          @"third" : thirdView,
+          @"fourth" : fourthView,
+        },
+        @{
+          @"oneSpace" : @(kStackSpacing * 1),
+          @"twoSpace" : @(kStackSpacing * 2),
+          @"threeSpace" : @(kStackSpacing * 3),
+          @"fourSpace" : @(kStackSpacing * 4)
+        });
+  }
+  return self;
+}
+
+@end
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_stack_item_actions.h b/ios/chrome/browser/ui/suggestions/suggestions_stack_item_actions.h
new file mode 100644
index 0000000..6a87c19f
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_stack_item_actions.h
@@ -0,0 +1,16 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_ACTIONS_H_
+#define IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_ACTIONS_H_
+
+// Actions for the Suggestions Stack.
+@protocol SuggestionsStackItemActions
+
+// The item on the top of the stack have been pressed.
+- (void)openReadingListFirstItem:(id)sender;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_UI_SUGGESTIONS_SUGGESTIONS_STACK_ITEM_ACTIONS_H_
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_stack_item_unittest.mm b/ios/chrome/browser/ui/suggestions/suggestions_stack_item_unittest.mm
new file mode 100644
index 0000000..4a6ddec4
--- /dev/null
+++ b/ios/chrome/browser/ui/suggestions/suggestions_stack_item_unittest.mm
@@ -0,0 +1,31 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+
+// Tests that configureCell: set all the fields of the cell.
+TEST(SuggestionsStackItemTest, CellIsConfigured) {
+  NSString* title = @"testTitle";
+  NSString* subtitle = @"testSubtitle";
+  SuggestionsStackItem* item =
+      [[SuggestionsStackItem alloc] initWithType:0
+                                           title:title
+                                        subtitle:subtitle];
+  SuggestionsStackCell* cell = [[[item cellClass] alloc] init];
+  EXPECT_TRUE([cell isMemberOfClass:[SuggestionsStackCell class]]);
+
+  [item configureCell:cell];
+  EXPECT_EQ(title, [cell.titleButton titleForState:UIControlStateNormal]);
+  EXPECT_EQ(subtitle, cell.detailTextLabel.text);
+}
+
+}  // namespace
diff --git a/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm
index 84a8ef63..035bccf 100644
--- a/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm
+++ b/ios/chrome/browser/ui/suggestions/suggestions_view_controller.mm
@@ -12,6 +12,8 @@
 #import "ios/chrome/browser/ui/suggestions/suggestions_collection_updater.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_commands.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_item_actions.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item.h"
+#import "ios/chrome/browser/ui/suggestions/suggestions_stack_item_actions.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -21,7 +23,8 @@
 const NSTimeInterval kAnimationDuration = 0.35;
 }  // namespace
 
-@interface SuggestionsViewController ()<SuggestionsItemActions>
+@interface SuggestionsViewController ()<SuggestionsItemActions,
+                                        SuggestionsStackItemActions>
 
 @property(nonatomic, strong) SuggestionsCollectionUpdater* collectionUpdater;
 
@@ -41,27 +44,24 @@
 - (void)viewDidLoad {
   [super viewDidLoad];
 
-  _collectionUpdater = [[SuggestionsCollectionUpdater alloc]
-      initWithCollectionViewController:self];
+  _collectionUpdater = [[SuggestionsCollectionUpdater alloc] init];
+  _collectionUpdater.collectionViewController = self;
 
   self.collectionView.delegate = self;
   self.styler.cellStyle = MDCCollectionViewCellStyleCard;
 }
 
-#pragma mark - MDCCollectionViewStylingDelegate
+#pragma mark - UICollectionViewDelegate
 
-- (CGFloat)collectionView:(UICollectionView*)collectionView
-    cellHeightAtIndexPath:(NSIndexPath*)indexPath {
+- (void)collectionView:(UICollectionView*)collectionView
+    didSelectItemAtIndexPath:(NSIndexPath*)indexPath {
+  [super collectionView:collectionView didSelectItemAtIndexPath:indexPath];
+
   CollectionViewItem* item =
       [self.collectionViewModel itemAtIndexPath:indexPath];
-  UIEdgeInsets inset = [self collectionView:collectionView
-                                     layout:collectionView.collectionViewLayout
-                     insetForSectionAtIndex:indexPath.section];
-
-  return [MDCCollectionViewCell
-      cr_preferredHeightForWidth:CGRectGetWidth(collectionView.bounds) -
-                                 inset.left - inset.right
-                         forItem:item];
+  if (item.type == ItemTypeStack) {
+    [self.suggestionCommandHandler openReadingList];
+  }
 }
 
 #pragma mark - SuggestionsExpandableCellDelegate
@@ -90,6 +90,46 @@
                             toSection:inputSection];
 }
 
+#pragma mark - SuggestionsStackItemActions
+
+- (void)openReadingListFirstItem:(id)sender {
+  [self.suggestionCommandHandler openFirstPageOfReadingList];
+}
+
+#pragma mark - MDCCollectionViewStylingDelegate
+
+- (UIColor*)collectionView:(nonnull UICollectionView*)collectionView
+    cellBackgroundColorAtIndexPath:(nonnull NSIndexPath*)indexPath {
+  if ([self.collectionUpdater
+          shouldUseCustomStyleForSection:indexPath.section]) {
+    return [UIColor clearColor];
+  }
+  return [UIColor whiteColor];
+}
+
+- (BOOL)collectionView:(nonnull UICollectionView*)collectionView
+    shouldHideItemBackgroundAtIndexPath:(nonnull NSIndexPath*)indexPath {
+  if ([self.collectionUpdater
+          shouldUseCustomStyleForSection:indexPath.section]) {
+    return YES;
+  }
+  return NO;
+}
+
+- (CGFloat)collectionView:(UICollectionView*)collectionView
+    cellHeightAtIndexPath:(NSIndexPath*)indexPath {
+  CollectionViewItem* item =
+      [self.collectionViewModel itemAtIndexPath:indexPath];
+  UIEdgeInsets inset = [self collectionView:collectionView
+                                     layout:collectionView.collectionViewLayout
+                     insetForSectionAtIndex:indexPath.section];
+
+  return [MDCCollectionViewCell
+      cr_preferredHeightForWidth:CGRectGetWidth(collectionView.bounds) -
+                                 inset.left - inset.right
+                         forItem:item];
+}
+
 #pragma mark - Private
 
 - (void)expand:(BOOL)expand cell:(UICollectionViewCell*)cell {
diff --git a/ios/public/provider/chrome/browser/chrome_browser_provider.h b/ios/public/provider/chrome/browser/chrome_browser_provider.h
index 38aef4f0..3e98961 100644
--- a/ios/public/provider/chrome/browser/chrome_browser_provider.h
+++ b/ios/public/provider/chrome/browser/chrome_browser_provider.h
@@ -13,7 +13,6 @@
 #include <string>
 #include <vector>
 
-#include "base/callback_forward.h"
 #include "base/memory/ref_counted.h"
 
 class AppDistributionProvider;
@@ -81,10 +80,6 @@
   virtual ChromeIdentityService* GetChromeIdentityService();
   // Returns an instance of a GeolocationUpdaterProvider.
   virtual GeolocationUpdaterProvider* GetGeolocationUpdaterProvider();
-  // Returns "enabled", "disabled", or "default".
-  virtual std::string DataReductionProxyAvailability();
-  // Returns the distribution brand code.
-  virtual std::string GetDistributionBrandCode();
   // Returns risk data used in Wallet requests.
   virtual std::string GetRiskData();
   // Creates and returns a new styled text field with the given |frame|.
@@ -103,10 +98,6 @@
   // is not yet available through web::WebState.
   virtual void AttachTabHelpers(web::WebState* web_state, Tab* tab) const;
 
-  // Returns whether safe browsing is enabled. See the comment on
-  // metrics_services_manager_client.h for details on |on_update_callback|.
-  virtual bool IsSafeBrowsingEnabled(const base::Closure& on_update_callback);
-
   // Returns an instance of the voice search provider, if one exists.
   virtual VoiceSearchProvider* GetVoiceSearchProvider() const;
 
diff --git a/ios/public/provider/chrome/browser/chrome_browser_provider.mm b/ios/public/provider/chrome/browser/chrome_browser_provider.mm
index 1c9a88d..7cb146b 100644
--- a/ios/public/provider/chrome/browser/chrome_browser_provider.mm
+++ b/ios/public/provider/chrome/browser/chrome_browser_provider.mm
@@ -53,14 +53,6 @@
   return nullptr;
 }
 
-std::string ChromeBrowserProvider::DataReductionProxyAvailability() {
-  return "default";
-}
-
-std::string ChromeBrowserProvider::GetDistributionBrandCode() {
-  return std::string();
-}
-
 std::string ChromeBrowserProvider::GetRiskData() {
   return std::string();
 }
@@ -80,11 +72,6 @@
 void ChromeBrowserProvider::AttachTabHelpers(web::WebState* web_state,
                                              Tab* tab) const {}
 
-bool ChromeBrowserProvider::IsSafeBrowsingEnabled(
-    const base::Closure& on_update_callback) {
-  return false;
-}
-
 VoiceSearchProvider* ChromeBrowserProvider::GetVoiceSearchProvider() const {
   return nullptr;
 }
diff --git a/ios/showcase/suggestions/sc_suggestions_coordinator.mm b/ios/showcase/suggestions/sc_suggestions_coordinator.mm
index 707363d..06c6feb1 100644
--- a/ios/showcase/suggestions/sc_suggestions_coordinator.mm
+++ b/ios/showcase/suggestions/sc_suggestions_coordinator.mm
@@ -6,6 +6,7 @@
 
 #import "ios/chrome/browser/ui/suggestions/suggestions_commands.h"
 #import "ios/chrome/browser/ui/suggestions/suggestions_view_controller.h"
+#import "ios/showcase/common/protocol_alerter.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -15,6 +16,7 @@
 
 @property(nonatomic, strong)
     SuggestionsViewController* suggestionViewController;
+@property(nonatomic, strong) ProtocolAlerter* alerter;
 
 @end
 
@@ -22,10 +24,15 @@
 
 @synthesize baseViewController;
 @synthesize suggestionViewController = _suggestionViewController;
+@synthesize alerter = _alerter;
 
 #pragma mark - Coordinator
 
 - (void)start {
+  self.alerter = [[ProtocolAlerter alloc]
+      initWithProtocols:@[ @protocol(SuggestionsCommands) ]];
+  self.alerter.baseViewController = self.baseViewController;
+
   _suggestionViewController = [[SuggestionsViewController alloc]
       initWithStyle:CollectionViewControllerStyleDefault];
 
@@ -43,4 +50,13 @@
                                    toSection:5];
 }
 
+- (void)openReadingList {
+  [static_cast<id<SuggestionsCommands>>(self.alerter) openReadingList];
+}
+
+- (void)openFirstPageOfReadingList {
+  [static_cast<id<SuggestionsCommands>>(self.alerter)
+      openFirstPageOfReadingList];
+}
+
 @end
diff --git a/mojo/public/cpp/bindings/tests/BUILD.gn b/mojo/public/cpp/bindings/tests/BUILD.gn
index 3d4f8af..71305b8e 100644
--- a/mojo/public/cpp/bindings/tests/BUILD.gn
+++ b/mojo/public/cpp/bindings/tests/BUILD.gn
@@ -41,6 +41,7 @@
 
   deps = [
     ":mojo_public_bindings_test_utils",
+    "//base/test:test_support",
     "//mojo/edk/system",
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
diff --git a/mojo/public/cpp/bindings/tests/binding_callback_unittest.cc b/mojo/public/cpp/bindings/tests/binding_callback_unittest.cc
index 0f5369c..43122ce 100644
--- a/mojo/public/cpp/bindings/tests/binding_callback_unittest.cc
+++ b/mojo/public/cpp/bindings/tests/binding_callback_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "base/test/gtest_util.h"
 #include "build/build_config.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/interface_ptr.h"
@@ -329,17 +330,7 @@
   EXPECT_EQ(7, server_impl.last_server_value_seen());
   EXPECT_EQ(0, last_client_callback_value_seen_);
 
-#if (!defined(NDEBUG) || defined(DCHECK_ALWAYS_ON)) && !defined(OS_ANDROID)
-  // Delete the callback without running it. This should cause a crash in debug
-  // builds due to a DCHECK.
-  std::string regex("Check failed: !is_valid");
-#if defined(OS_WIN)
-  // TODO(msw): Fix MOJO_DCHECK logs and EXPECT_DEATH* on Win: crbug.com/535014
-  regex.clear();
-#endif  // OS_WIN
-  EXPECT_DEATH_IF_SUPPORTED(server_impl.DeleteCallback(), regex.c_str());
-#endif  // (!defined(NDEBUG) || defined(DCHECK_ALWAYS_ON)) &&
-        // !defined(OS_ANDROID)
+  EXPECT_DCHECK_DEATH(server_impl.DeleteCallback());
 }
 
 }  // namespace
diff --git a/net/http/http_stream_factory_impl_job_controller.cc b/net/http/http_stream_factory_impl_job_controller.cc
index c72fd3d..052a17e 100644
--- a/net/http/http_stream_factory_impl_job_controller.cc
+++ b/net/http/http_stream_factory_impl_job_controller.cc
@@ -152,13 +152,6 @@
     } else {
       DCHECK(bound_job_->job_type() == ALTERNATIVE);
       alternative_job_.reset();
-      // If ResumeMainJob() is not executed, reset |main_job_|. Otherwise,
-      // OnOrphanedJobComplete() will clean up |this| when the job completes.
-      // Use |main_job_is_blocked_| and |!main_job_wait_time_.is_zero()| instead
-      // of |main_job_|->is_waiting() because |main_job_| can be in proxy
-      // resolution step.
-      if (main_job_ && (main_job_is_blocked_ || !main_job_wait_time_.is_zero()))
-        main_job_.reset();
     }
     bound_job_ = nullptr;
   }
@@ -743,7 +736,17 @@
   } else if (bound_job_->job_type() == ALTERNATIVE && main_job_) {
     // Orphan main job.
     factory_->request_map_.erase(main_job_.get());
-    main_job_->Orphan();
+    // If ResumeMainJob() is not executed, reset |main_job_|. Otherwise,
+    // OnOrphanedJobComplete() will clean up |this| when the job completes.
+    // Use |main_job_is_blocked_| and |!main_job_wait_time_.is_zero()| instead
+    // of |main_job_|->is_waiting() because |main_job_| can be in proxy
+    // resolution step.
+    if (main_job_ && (main_job_is_blocked_ || !main_job_wait_time_.is_zero())) {
+      DCHECK(alternative_job_);
+      main_job_.reset();
+    } else {
+      main_job_->Orphan();
+    }
   }
 }
 
diff --git a/net/http/http_stream_factory_impl_job_controller_unittest.cc b/net/http/http_stream_factory_impl_job_controller_unittest.cc
index 4502399..d0b7fc0 100644
--- a/net/http/http_stream_factory_impl_job_controller_unittest.cc
+++ b/net/http/http_stream_factory_impl_job_controller_unittest.cc
@@ -371,8 +371,9 @@
   EXPECT_TRUE(HttpStreamFactoryImplPeer::IsJobControllerDeleted(factory_));
 }
 
-// Tests that if alt job succeeds and main job is blocked, |request_| completion
-// will clean up JobController. Regression test for crbug.com/678768.
+// Tests that if alt job succeeds and main job is blocked, main job should be
+// cancelled immediately. |request_| completion will clean up the JobController.
+// Regression test for crbug.com/678768.
 TEST_F(HttpStreamFactoryImplJobControllerTest,
        AltJobSucceedsMainJobBlockedControllerDestroyed) {
   ProxyConfig proxy_config;
@@ -407,9 +408,8 @@
       .WillOnce(Invoke(DeleteHttpStreamPointer));
   job_controller_->OnStreamReady(job_factory_.alternative_job(), SSLConfig());
 
-  EXPECT_TRUE(job_controller_->main_job());
+  EXPECT_FALSE(job_controller_->main_job());
   EXPECT_TRUE(job_controller_->alternative_job());
-  EXPECT_TRUE(JobControllerPeer::main_job_is_blocked(job_controller_));
 
   // Invoke OnRequestComplete() which should delete |job_controller_| from
   // |factory_|.
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index 80a49aa..6fd3c363 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -819,9 +819,6 @@
   SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_.get()),
                                 &ssl_info->connection_status);
 
-  if (!SSL_get_secure_renegotiation_support(ssl_.get()))
-    ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
-
   ssl_info->handshake_type = SSL_session_reused(ssl_.get())
                                  ? SSLInfo::HANDSHAKE_RESUME
                                  : SSLInfo::HANDSHAKE_FULL;
diff --git a/net/socket/ssl_server_socket_impl.cc b/net/socket/ssl_server_socket_impl.cc
index c1b8084c..4337aa1 100644
--- a/net/socket/ssl_server_socket_impl.cc
+++ b/net/socket/ssl_server_socket_impl.cc
@@ -355,9 +355,6 @@
   SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_.get()),
                                 &ssl_info->connection_status);
 
-  if (!SSL_get_secure_renegotiation_support(ssl_.get()))
-    ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
-
   ssl_info->handshake_type = SSL_session_reused(ssl_.get())
                                  ? SSLInfo::HANDSHAKE_RESUME
                                  : SSLInfo::HANDSHAKE_FULL;
diff --git a/net/ssl/ssl_connection_status_flags.h b/net/ssl/ssl_connection_status_flags.h
index d3062724..ce6bc55d 100644
--- a/net/ssl/ssl_connection_status_flags.h
+++ b/net/ssl/ssl_connection_status_flags.h
@@ -22,12 +22,7 @@
   SSL_CONNECTION_COMPRESSION_MASK = 3,
 
   // 1 << 18 was previously used for SSL_CONNECTION_VERSION_FALLBACK.
-
-  // The server doesn't support the renegotiation_info extension. If this bit
-  // is not set then either the extension isn't supported, or we don't have any
-  // knowledge either way. (The latter case will occur when we use an SSL
-  // library that doesn't report it, like SChannel.)
-  SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION = 1 << 19,
+  // 1 << 19 was previously used for SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION.
 
   // The next three bits are reserved for the SSL version.
   SSL_CONNECTION_VERSION_SHIFT = 20,
diff --git a/remoting/host/win/entry_point.cc b/remoting/host/win/entry_point.cc
index a4e1f10..963d43f 100644
--- a/remoting/host/win/entry_point.cc
+++ b/remoting/host/win/entry_point.cc
@@ -21,7 +21,7 @@
 // is required.
 int WINAPI wWinMain (HINSTANCE hInstance,
                      HINSTANCE hPrevInstance,
-                     LPSTR lpCmdLine,
+                     LPWSTR lpCmdLine,
                      int nCmdShow) {
   HostEntryPoint();
   return 0;
diff --git a/third_party/WebKit/LayoutTests/SlowTests b/third_party/WebKit/LayoutTests/SlowTests
index 5a52109..6d56b42 100644
--- a/third_party/WebKit/LayoutTests/SlowTests
+++ b/third_party/WebKit/LayoutTests/SlowTests
@@ -236,7 +236,6 @@
 crbug.com/490939 imported/wpt/html/dom/reflection-forms.html [ Slow ]
 crbug.com/490939 imported/wpt/html/dom/reflection-grouping.html [ Slow ]
 crbug.com/490939 imported/wpt/html/dom/reflection-metadata.html [ Slow ]
-crbug.com/490939 imported/wpt/html/dom/reflection-misc.html [ Slow ]
 crbug.com/490939 imported/wpt/html/dom/reflection-obsolete.html [ Slow ]
 crbug.com/490939 imported/wpt/html/dom/reflection-sections.html [ Slow ]
 crbug.com/490939 imported/wpt/html/dom/reflection-tabular.html [ Slow ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 5f431ab..8c3a243 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -101,7 +101,8 @@
 
 crbug.com/632000 [ Win ] images/paint-subrect-grid.html [ Pass Failure ]
 
-crbug.com/636271 [ Mac10.10 ] paint/invalidation/resize-iframe-text.html [ Pass Failure ]
+crbug.com/636271 [ Mac ] paint/invalidation/resize-iframe-text.html [ Pass Failure ]
+crbug.com/636271 [ Mac ] virtual/stable/paint/invalidation/resize-iframe-text.html [ Pass Failure ]
 
 crbug.com/639147 svg/wicd/test-rightsizing-b.xhtml [ Failure Pass ]
 
@@ -604,7 +605,6 @@
 
 crbug.com/267206 [ Mac ] virtual/rootlayerscrolls/fast/scrolling/scrollbar-tickmarks-hittest.html [ Timeout ]
 
-crbug.com/280342 [ Linux Win ] http/tests/media/progress-events-generated-correctly.html [ Failure ]
 crbug.com/280342 [ Linux Win ] virtual/mojo-loading/http/tests/media/progress-events-generated-correctly.html [ Failure ]
 
 crbug.com/520739 [ Mac ] http/tests/websocket/close-code-and-reason.html [ Failure Pass Timeout ]
@@ -966,7 +966,6 @@
 crbug.com/492664 imported/csswg-test/css-writing-modes-3/text-combine-upright-value-all-003.html [ Failure ]
 
 # We're experimenting with changing the behavior of the 'nonce' attribute
-crbug.com/680419 imported/wpt/html/dom/reflection-misc.html [ Failure ]
 
 # These CSS Writing Modes Level 3 tests pass but causes 1px diff on images, notified to the submitter.
 crbug.com/492664 [ Mac ] imported/csswg-test/css-writing-modes-3/block-flow-direction-htb-001.xht [ Failure ]
@@ -1661,6 +1660,7 @@
 crbug.com/490015 virtual/stable/http/tests/navigation/same-and-different-back.html [ Skip ]
 
 # ====== New tests from w3c-test-autoroller added here ======
+crbug.com/626703 [ Trusty Mac10.11 Mac10.10 Retina Win7 Win10 Mac10.9 ] imported/wpt/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html [ Timeout ]
 crbug.com/626703 [ Trusty Mac10.11 Mac10.10 Retina Win7 Win10 Mac10.9 ] imported/csswg-test/css-writing-modes-3/sizing-orthog-prct-htb-in-vrl-002.xht [ Failure ]
 crbug.com/626703 [ Trusty Mac10.11 Mac10.10 Retina Win7 Win10 Mac10.9 ] imported/csswg-test/css-writing-modes-3/sizing-orthog-htb-in-vrl-020.xht [ Failure ]
 crbug.com/626703 [ Trusty Mac10.11 Mac10.10 Retina Win7 Win10 Mac10.9 ] imported/csswg-test/css-writing-modes-3/sizing-orthog-vlr-in-htb-020.xht [ Failure ]
@@ -1927,11 +1927,6 @@
 crbug.com/602693 imported/wpt/service-workers/stub-4.7.2.1-install-event-section.html [ Failure ]
 crbug.com/602693 imported/wpt/service-workers/stub-4.7.4.1-fetch-event-section.html [ Failure ]
 
-# Bug(dpranke)
-# crbug.com/618616 imported/wpt/service-workers/service-worker/fetch-event-redirect.https.html [ Pass Timeout ]
-crbug.com/618616 imported/wpt/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html [ Timeout ]
-crbug.com/618616 imported/wpt/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html [ Timeout ]
-
 # Untriaged service-worker timeout. Is it crbug.com/618616?
 # Bug(dpranke)
 # crbug.com/618616 imported/wpt/service-workers/service-worker/update-after-oneday.https.html [ Timeout ]
@@ -1981,7 +1976,6 @@
 Bug(dpranke) imported/wpt/html/browsers/history/the-history-interface/010.html [ Failure ]
 Bug(dpranke) imported/wpt/html/browsers/history/the-history-interface/history_pushstate_err.html [ Failure ]
 Bug(dpranke) imported/wpt/html/browsers/history/the-history-interface/history_replacestate_err.html [ Failure ]
-Bug(dpranke) imported/wpt/html/browsers/history/the-location-interface/security_location_0.htm [ Failure ]
 Bug(dpranke) imported/wpt/html/browsers/offline/application-cache-api/api_status_idle.html [ Failure ]
 Bug(dpranke) imported/wpt/html/browsers/offline/application-cache-api/api_update.html [ Failure ]
 Bug(dpranke) imported/wpt/html/browsers/origin/origin-of-data-document.html [ Failure ]
@@ -1990,16 +1984,9 @@
 Bug(dpranke) imported/wpt/html/dom/reflection-obsolete.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/document-metadata/the-base-element/base_href_specified.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/document-metadata/the-link-element/document-without-browsing-context.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-control.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-insert-br.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-insert-source.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-insert-text.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-remove-source.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/embedded-content/media-elements/loading-the-media-resource/resource-selection-pointer-remove-text.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/embedded-content/the-iframe-element/same_origin_parentage.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/embedded-content/the-img-element/sizes/parse-a-sizes-attribute.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/forms/form-submission-0/getactionurl.html [ Failure ]
-Bug(dpranke) imported/wpt/html/semantics/forms/historical.html [ Failure ]
 Bug(dpranke) imported/wpt/html/semantics/scripting-1/the-script-element/script-onerror-insertion-point-2.html [ Failure ]
 Bug(dpranke) imported/wpt/html/webappapis/scripting/events/messageevent-constructor.https.html [ Failure ]
 Bug(dpranke) imported/wpt/html/webappapis/scripting/processing-model-2/compile-error-cross-origin.html [ Failure ]
@@ -2011,8 +1998,6 @@
 Bug(dpranke) imported/wpt/html/webappapis/scripting/processing-model-2/runtime-error-in-setTimeout.html [ Failure ]
 Bug(dpranke) imported/wpt/html/webappapis/system-state-and-capabilities/the-navigator-object/protocol.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-add.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-delete.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-match.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-matchAll.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-put.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/cache-storage/serviceworker/cache-storage-keys.https.html [ Failure ]
@@ -2025,14 +2010,11 @@
 Bug(dpranke) imported/wpt/service-workers/cache-storage/worker/cache-match.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/cache-storage/worker/cache-put.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/unregister.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/update.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/activate-event-after-install-state-change.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/activation-after-registration.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/activation.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/active.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/appcache-ordering-main.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/claim-not-using-registration.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/claim-using-registration.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/clients-get.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html [ Failure ]
@@ -2041,7 +2023,6 @@
 Bug(dpranke) imported/wpt/service-workers/service-worker/controller-on-load.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/controller-on-reload.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/extendable-event-waituntil.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/fetch-event-after-navigation-within-page.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/fetch-event-network-error.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/fetch-event-redirect.https.html [ Failure ]
@@ -2069,8 +2050,6 @@
 Bug(dpranke) imported/wpt/service-workers/service-worker/postmessage-to-client.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/postmessage.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/ready.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/register-default-scope.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/register-wait-forever-in-install-worker.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/registration-end-to-end.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/registration-events.https.html [ Failure ]
@@ -2080,10 +2059,8 @@
 Bug(dpranke) imported/wpt/service-workers/service-worker/resource-timing.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/service-worker-csp-connect.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/service-worker-csp-default.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/service-worker-csp-script.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/serviceworker-message-event-historical.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/serviceworkerobject-scripturl.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/shared-worker-controlled.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/skip-waiting-installed.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/skip-waiting-using-registration.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/skip-waiting-without-client.https.html [ Failure ]
@@ -2093,8 +2070,6 @@
 Bug(dpranke) imported/wpt/service-workers/service-worker/synced-state.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/uncontrolled-page.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/unregister-controller.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html [ Failure ]
-Bug(dpranke) imported/wpt/service-workers/service-worker/unregister-then-register.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/unregister.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/update-after-navigation-fetch-event.https.html [ Failure ]
 Bug(dpranke) imported/wpt/service-workers/service-worker/update-after-oneday.https.html [ Failure ]
diff --git a/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-contentHint.html b/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-contentHint.html
index 108ad39..a6c8c15d 100644
--- a/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-contentHint.html
+++ b/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-contentHint.html
@@ -46,7 +46,7 @@
   audio_track = createAudioTrack();
   audio_track.contentHint = "speech";
   assert_equals(audio_track.contentHint, "speech");
-  audio_track.contentHint = "fluid";
+  audio_track.contentHint = "motion";
   assert_equals(audio_track.contentHint, "speech",
                 "Audio tracks should ignore video-only contentHints.");
   audio_track.contentHint = "bogus";
@@ -56,39 +56,39 @@
 
 test(t => {
   video_track = createVideoTrack();
-  video_track.contentHint = "fluid";
-  assert_equals(video_track.contentHint, "fluid");
-  video_track.contentHint = "detailed";
-  assert_equals(video_track.contentHint, "detailed");
+  video_track.contentHint = "motion";
+  assert_equals(video_track.contentHint, "motion");
+  video_track.contentHint = "detail";
+  assert_equals(video_track.contentHint, "detail");
   video_track.contentHint = "";
   assert_equals(video_track.contentHint, "");
 }, "Accepts valid video contentHints");
 
 test(t => {
   video_track = createVideoTrack();
-  video_track.contentHint = "fluid";
-  assert_equals(video_track.contentHint, "fluid");
+  video_track.contentHint = "motion";
+  assert_equals(video_track.contentHint, "motion");
   video_track.contentHint = "speech";
-  assert_equals(video_track.contentHint, "fluid",
+  assert_equals(video_track.contentHint, "motion",
                 "Video tracks should ignore audio-only contentHints.");
   video_track.contentHint = "bogus";
-  assert_equals(video_track.contentHint, "fluid",
+  assert_equals(video_track.contentHint, "motion",
                 "Video tracks should ignore garbage contentHints");
 }, "Video tracks ignore invalid/audio contentHints");
 
 test(t => {
   video_track = createVideoTrack();
-  video_track.contentHint = "fluid";
-  assert_equals(video_track.contentHint, "fluid");
+  video_track.contentHint = "motion";
+  assert_equals(video_track.contentHint, "motion");
 
   // Cloning a track should preserve contentHint.
   video_track_clone = video_track.clone();
-  assert_equals(video_track_clone.contentHint, "fluid");
+  assert_equals(video_track_clone.contentHint, "motion");
 
   // Changing a cloned track's contentHint should not change the original.
-  video_track_clone.contentHint = "detailed";
-  assert_equals(video_track_clone.contentHint, "detailed");
-  assert_equals(video_track.contentHint, "fluid");
+  video_track_clone.contentHint = "detail";
+  assert_equals(video_track_clone.contentHint, "detail");
+  assert_equals(video_track.contentHint, "motion");
 }, "Cloned video tracks have separate contentHints");
 
 test(t => {
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/MANIFEST.json b/third_party/WebKit/LayoutTests/imported/wpt/MANIFEST.json
index d337896..610ece5 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/imported/wpt/MANIFEST.json
@@ -265,6 +265,12 @@
      {}
     ]
    ],
+   "pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html": [
+    [
+     "/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html",
+     {}
+    ]
+   ],
    "pointerevents/pointerevent_attributes_hoverable_pointers-manual.html": [
     [
      "/pointerevents/pointerevent_attributes_hoverable_pointers-manual.html",
@@ -4810,6 +4816,11 @@
      {}
     ]
    ],
+   "domparsing/createContextualFragment-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "domparsing/innerhtml-01-expected.txt": [
     [
      {}
@@ -7530,11 +7541,6 @@
      {}
     ]
    ],
-   "html/dom/reflection-misc-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "html/dom/reflection-obsolete-expected.txt": [
     [
      {}
@@ -11620,6 +11626,11 @@
      {}
     ]
    ],
+   "html/infrastructure/common-dom-interfaces/collections/domstringlist.idl": [
+    [
+     {}
+    ]
+   ],
    "html/infrastructure/common-dom-interfaces/collections/htmlallcollection-expected.txt": [
     [
      {}
@@ -14355,6 +14366,11 @@
      {}
     ]
    ],
+   "innerText/setter-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "innerText/setter-tests.js": [
     [
      {}
@@ -16530,6 +16546,11 @@
      {}
     ]
    ],
+   "webvr/idlharness-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "workers/README.md": [
     [
      {}
@@ -24014,14 +24035,6 @@
      }
     ]
    ],
-   "html/dom/reflection-misc.html": [
-    [
-     "/html/dom/reflection-misc.html",
-     {
-      "timeout": "long"
-     }
-    ]
-   ],
    "html/dom/reflection-obsolete.html": [
     [
      "/html/dom/reflection-obsolete.html",
@@ -24156,6 +24169,24 @@
      {}
     ]
    ],
+   "html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html": [
+    [
+     "/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html",
+     {}
+    ]
+   ],
+   "html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.js": [
+    [
+     "/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.html",
+     {}
+    ]
+   ],
+   "html/infrastructure/common-dom-interfaces/collections/domstringlist.html": [
+    [
+     "/html/infrastructure/common-dom-interfaces/collections/domstringlist.html",
+     {}
+    ]
+   ],
    "html/infrastructure/common-dom-interfaces/collections/historical.html": [
     [
      "/html/infrastructure/common-dom-interfaces/collections/historical.html",
@@ -32200,7 +32231,7 @@
    "support"
   ],
   "./README.md": [
-   "930f9755157d0a3da03b6a6f67c3ba12c05b22c4",
+   "e9590560efb0d37ab870037edaafc1c47dc7a785",
    "support"
   ],
   "./check_stability.py": [
@@ -35611,6 +35642,10 @@
    "f981058d771b4e6a0936e9f496527fe6177b2479",
    "testharness"
   ],
+  "domparsing/createContextualFragment-expected.txt": [
+   "6fec3d7f117871eb0e4373c0977300f323886564",
+   "support"
+  ],
   "domparsing/createContextualFragment.html": [
    "e3d576cab516b137b3c758f4ab7528303a28744a",
    "testharness"
@@ -40528,7 +40563,7 @@
    "support"
   ],
   "html/dom/reflection-embedded-expected.txt": [
-   "0f9696b0830a2ee07d4e00bdc4a6aa9b0ed3d189",
+   "b9c46fed5ba5e31ef958673fea6059153ab74969",
    "support"
   ],
   "html/dom/reflection-embedded.html": [
@@ -40555,14 +40590,6 @@
    "91c3a4fdf4585fec9ef901ac060656849e47accc",
    "testharness"
   ],
-  "html/dom/reflection-misc-expected.txt": [
-   "a9a3fc4851308339e3f36ddc1cfa9ae660336d07",
-   "support"
-  ],
-  "html/dom/reflection-misc.html": [
-   "7f8de0ad7188dfc54234eb85b37fdc3248c0886e",
-   "testharness"
-  ],
   "html/dom/reflection-obsolete-expected.txt": [
    "bd8d975b3f43dada2a9a4a2350113b0243aed185",
    "support"
@@ -43943,6 +43970,22 @@
    "de0ed7f283f4e17155cd3fc07dd5cb688d6fd8be",
    "support"
   ],
+  "html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html": [
+   "ca8af91733f0b0704409e26f17d4a14977ce14f7",
+   "testharness"
+  ],
+  "html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.js": [
+   "2e35f55a86d31d98e69ad1013c18ab1ff9d9be02",
+   "testharness"
+  ],
+  "html/infrastructure/common-dom-interfaces/collections/domstringlist.html": [
+   "b51c104271ba1cc404de0d68fd004b4e4ecb0d8c",
+   "testharness"
+  ],
+  "html/infrastructure/common-dom-interfaces/collections/domstringlist.idl": [
+   "3b23d2861e3e3037ef3364781394d1b3e8371bae",
+   "support"
+  ],
   "html/infrastructure/common-dom-interfaces/collections/historical.html": [
    "bbfb3cfbf6a9f5cf7f48eb048f0f6a2047386e41",
    "testharness"
@@ -43960,7 +44003,7 @@
    "support"
   ],
   "html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection.html": [
-   "1820c5daf000c5ec6a406434f2e42edfff4ed3ad",
+   "d7e37f34db97de971957d5d206b59e7eb5ad9ea7",
    "testharness"
   ],
   "html/infrastructure/common-dom-interfaces/collections/htmloptionscollection-expected.txt": [
@@ -44696,7 +44739,7 @@
    "support"
   ],
   "html/resources/common.js": [
-   "b6d4631ff396a97cfd9b899c1fa348d01dee6ebd",
+   "6b4bdb2032fb40bf9ccdf6d827cfd367f34a78f9",
    "support"
   ],
   "html/semantics/disabled-elements/disabledElement.html": [
@@ -45852,7 +45895,7 @@
    "support"
   ],
   "html/semantics/forms/constraints/form-validation-willValidate.html": [
-   "7aea32e4780bad32ab256d94feed464c864158af",
+   "fda957c08b1a84c691ce64b08a0b18592ff70a2d",
    "testharness"
   ],
   "html/semantics/forms/constraints/inputwillvalidate.html": [
@@ -45872,7 +45915,7 @@
    "support"
   ],
   "html/semantics/forms/form-control-infrastructure/form.html": [
-   "61bff6734ea9c31f91e456a67e9b491bc11ab624",
+   "1605a4d3965075882f97b5712b3c3bf1b2f5f6c4",
    "testharness"
   ],
   "html/semantics/forms/form-submission-0/contains.json": [
@@ -45900,7 +45943,7 @@
    "testharness"
   ],
   "html/semantics/forms/resetting-a-form/reset-form.html": [
-   "8f3bf4f89c3605f5cbeb65242caf4ffb10ece9d6",
+   "73e4daacde901f0dc1babb9136f4bcebd98b0250",
    "testharness"
   ],
   "html/semantics/forms/textfieldselection/original-id.json": [
@@ -46032,7 +46075,7 @@
    "support"
   ],
   "html/semantics/forms/the-form-element/form-nameditem.html": [
-   "1947b2cb928721c9eba8a588d97b6dc77bf14288",
+   "928a0029fbad4251a30dc660de10ad6fd7f08def",
    "testharness"
   ],
   "html/semantics/forms/the-form-element/resources/form-action-url-iframe.html": [
@@ -46268,7 +46311,7 @@
    "support"
   ],
   "html/semantics/forms/the-label-element/labelable-elements.html": [
-   "c986614de7fdda8ee41869e6dfda2f512cf4df95",
+   "fcb095273778268e18f45ae4bfb831ebdabde738",
    "testharness"
   ],
   "html/semantics/forms/the-legend-element/legend-form.html": [
@@ -46816,7 +46859,7 @@
    "testharness"
   ],
   "html/semantics/interfaces.js": [
-   "d50a20fbc3305953f9a5f48c299ff019371ac290",
+   "ca5bd62a7392b8dfb9aada99372e44e518b722d6",
    "support"
   ],
   "html/semantics/links/downloading-resources/contains.json": [
@@ -47216,7 +47259,7 @@
    "support"
   ],
   "html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html": [
-   "3e1f551b68d4d3c95b8e50cf96308ea2258a76b7",
+   "661adb3f098161bf4535d9184e175612cfcab886",
    "testharness"
   ],
   "html/semantics/scripting-1/the-template-element/template-element/template-content-node-document.html": [
@@ -48927,12 +48970,16 @@
    "644b5b18359d26db9cd4d037b075ca016e2337b5",
    "testharness"
   ],
+  "innerText/setter-expected.txt": [
+   "209263e59ee152ccaac3b4656390d70d37688a9a",
+   "support"
+  ],
   "innerText/setter-tests.js": [
-   "21cf96bdb5c7c77684c92df45650d054c173d3f2",
+   "8d59eda6625ecbc94de223ae03f09b3fdf1f4def",
    "support"
   ],
   "innerText/setter.html": [
-   "34c84d25188b369a46a1919398bcde4fafc2d4b3",
+   "c7b9fa4c3e9b504ebd035c4b2fbe5d9e0f7616f7",
    "testharness"
   ],
   "input-events/idlharness.html": [
@@ -49115,6 +49162,10 @@
    "91a8bd86357b0d96ba3ab8f08f88c28436de484c",
    "support"
   ],
+  "pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html": [
+   "cba44e2dd2a3c54106bfecc6cdd407643e2ba995",
+   "manual"
+  ],
   "pointerevents/idlharness-expected.txt": [
    "c78797644b8d399b294dd5d30e853b1cd86e5fe1",
    "support"
@@ -49244,11 +49295,11 @@
    "manual"
   ],
   "pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html": [
-   "246898b5718e51a3db76fa841fb00c3cfcb0df20",
+   "2b08fe3eb773d9516801e1eb4f4d7d72b739c1c7",
    "manual"
   ],
   "pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html": [
-   "4e1b5b9aa263cb41d4aef15b2b52570903557818",
+   "b8fc3192509af5a0e7ba15a9b9d8b440f565551c",
    "manual"
   ],
   "pointerevents/pointerevent_setpointercapture_disconnected-manual.html": [
@@ -52847,6 +52898,10 @@
    "19fd5ede17b9c7e9d234e855eb7dd7fe343bc73e",
    "testharness"
   ],
+  "webvr/idlharness-expected.txt": [
+   "8929a16ee3585369c3c94cb89ac1db19681445d5",
+   "support"
+  ],
   "webvr/idlharness.html": [
    "ecfd51818c20d46b9983bb1d045a9308fc9a26b7",
    "testharness"
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/README.md b/third_party/WebKit/LayoutTests/imported/wpt/README.md
index 690e4e3..1461d07 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/README.md
+++ b/third_party/WebKit/LayoutTests/imported/wpt/README.md
@@ -131,8 +131,10 @@
 
 The master branch is automatically synced to http://w3c-test.org/.
 
-Pull requests that have been checked are automatically mirrored to
-http://w3c-test.org/submissions/.
+Pull requests are automatically mirrored to
+http://w3c-test.org/submissions/ a few minutes after someone with merge
+access has added a comment with "LGTM" (or "w3c-test:mirror") to indicate
+the PR has been checked.
 
 Finding Things
 ==============
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc-expected.txt
deleted file mode 100644
index a99a4a9..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc-expected.txt
+++ /dev/null
@@ -1,178 +0,0 @@
-This is a testharness.js-based test.
-PASS html.title: 32 tests
-PASS html.lang: 32 tests
-PASS html.dir: 62 tests
-PASS html.className (<html class>): 32 tests
-PASS html.hidden: 33 tests
-PASS html.accessKey: 32 tests
-PASS html.tabIndex: 24 tests
-PASS html.version: 32 tests
-PASS script.title: 32 tests
-PASS script.lang: 32 tests
-PASS script.dir: 62 tests
-PASS script.className (<script class>): 32 tests
-PASS script.hidden: 33 tests
-PASS script.accessKey: 32 tests
-PASS script.tabIndex: 24 tests
-PASS script.src: 38 tests
-PASS script.type: 32 tests
-PASS script.charset: 32 tests
-PASS script.defer: 33 tests
-PASS script.crossOrigin: 52 tests
-PASS script.nonce: 32 tests
-PASS script.integrity: 32 tests
-PASS noscript.title: 32 tests
-PASS noscript.lang: 32 tests
-PASS noscript.dir: 62 tests
-PASS noscript.className (<noscript class>): 32 tests
-PASS noscript.hidden: 33 tests
-PASS noscript.accessKey: 32 tests
-PASS noscript.tabIndex: 24 tests
-PASS ins.title: 32 tests
-PASS ins.lang: 32 tests
-PASS ins.dir: 62 tests
-PASS ins.className (<ins class>): 32 tests
-PASS ins.hidden: 33 tests
-PASS ins.accessKey: 32 tests
-PASS ins.tabIndex: 24 tests
-PASS ins.cite: 38 tests
-PASS ins.dateTime: 32 tests
-PASS del.title: 32 tests
-PASS del.lang: 32 tests
-PASS del.dir: 62 tests
-PASS del.className (<del class>): 32 tests
-PASS del.hidden: 33 tests
-PASS del.accessKey: 32 tests
-PASS del.tabIndex: 24 tests
-PASS del.cite: 38 tests
-PASS del.dateTime: 32 tests
-PASS details.title: 32 tests
-PASS details.lang: 32 tests
-PASS details.dir: 62 tests
-PASS details.className (<details class>): 32 tests
-PASS details.hidden: 33 tests
-PASS details.accessKey: 32 tests
-PASS details.tabIndex: 24 tests
-PASS details.open: 33 tests
-PASS summary.title: 32 tests
-PASS summary.lang: 32 tests
-PASS summary.dir: 62 tests
-PASS summary.className (<summary class>): 32 tests
-PASS summary.hidden: 33 tests
-PASS summary.accessKey: 32 tests
-PASS summary.tabIndex: typeof IDL attribute 
-FAIL summary.tabIndex: setAttribute() to -36 assert_equals: IDL get expected -36 but got -1
-PASS summary.tabIndex: setAttribute() to -1 
-FAIL summary.tabIndex: setAttribute() to 0 assert_equals: IDL get expected 0 but got -1
-FAIL summary.tabIndex: setAttribute() to 1 assert_equals: IDL get expected 1 but got -1
-FAIL summary.tabIndex: setAttribute() to 2147483647 assert_equals: IDL get expected 2147483647 but got -1
-FAIL summary.tabIndex: setAttribute() to -2147483648 assert_equals: IDL get expected -2147483648 but got -1
-PASS summary.tabIndex: setAttribute() to "-1" 
-FAIL summary.tabIndex: setAttribute() to "-0" assert_equals: IDL get expected 0 but got -1
-FAIL summary.tabIndex: setAttribute() to "0" assert_equals: IDL get expected 0 but got -1
-FAIL summary.tabIndex: setAttribute() to "1" assert_equals: IDL get expected 1 but got -1
-FAIL summary.tabIndex: setAttribute() to "\t7" assert_equals: IDL get expected 7 but got -1
-FAIL summary.tabIndex: setAttribute() to "\f7" assert_equals: IDL get expected 7 but got -1
-FAIL summary.tabIndex: setAttribute() to " 7" assert_equals: IDL get expected 7 but got -1
-FAIL summary.tabIndex: setAttribute() to "\n7" assert_equals: IDL get expected 7 but got -1
-FAIL summary.tabIndex: setAttribute() to "\r7" assert_equals: IDL get expected 7 but got -1
-FAIL summary.tabIndex: setAttribute() to 1.5 assert_equals: IDL get expected 1 but got -1
-FAIL summary.tabIndex: setAttribute() to object "2" assert_equals: IDL get expected 2 but got -1
-FAIL summary.tabIndex: IDL set to -36 assert_equals: IDL get expected -36 but got -1
-PASS summary.tabIndex: IDL set to -1 
-FAIL summary.tabIndex: IDL set to 0 assert_equals: IDL get expected 0 but got -1
-FAIL summary.tabIndex: IDL set to 1 assert_equals: IDL get expected 1 but got -1
-FAIL summary.tabIndex: IDL set to 2147483647 assert_equals: IDL get expected 2147483647 but got -1
-FAIL summary.tabIndex: IDL set to -2147483648 assert_equals: IDL get expected -2147483648 but got -1
-PASS menu.title: 32 tests
-PASS menu.lang: 32 tests
-PASS menu.dir: 62 tests
-PASS menu.className (<menu class>): 32 tests
-PASS menu.hidden: 33 tests
-PASS menu.accessKey: 32 tests
-PASS menu.tabIndex: 24 tests
-PASS menu.type: typeof IDL attribute 
-FAIL menu.type: IDL get with DOM attribute unset assert_equals: expected "toolbar" but got ""
-FAIL menu.type: setAttribute() to "" assert_equals: IDL get expected "toolbar" but got ""
-FAIL menu.type: setAttribute() to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " assert_equals: IDL get expected "toolbar" but got " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo "
-FAIL menu.type: setAttribute() to undefined assert_equals: IDL get expected "toolbar" but got "undefined"
-FAIL menu.type: setAttribute() to 7 assert_equals: IDL get expected "toolbar" but got "7"
-FAIL menu.type: setAttribute() to 1.5 assert_equals: IDL get expected "toolbar" but got "1.5"
-FAIL menu.type: setAttribute() to true assert_equals: IDL get expected "toolbar" but got "true"
-FAIL menu.type: setAttribute() to false assert_equals: IDL get expected "toolbar" but got "false"
-FAIL menu.type: setAttribute() to object "[object Object]" assert_equals: IDL get expected "toolbar" but got "[object Object]"
-FAIL menu.type: setAttribute() to NaN assert_equals: IDL get expected "toolbar" but got "NaN"
-FAIL menu.type: setAttribute() to Infinity assert_equals: IDL get expected "toolbar" but got "Infinity"
-FAIL menu.type: setAttribute() to -Infinity assert_equals: IDL get expected "toolbar" but got "-Infinity"
-FAIL menu.type: setAttribute() to "\0" assert_equals: IDL get expected "toolbar" but got "\0"
-FAIL menu.type: setAttribute() to null assert_equals: IDL get expected "toolbar" but got "null"
-FAIL menu.type: setAttribute() to object "test-toString" assert_equals: IDL get expected "toolbar" but got "test-toString"
-FAIL menu.type: setAttribute() to object "test-valueOf" assert_equals: IDL get expected "toolbar" but got "test-valueOf"
-PASS menu.type: setAttribute() to "popup" 
-FAIL menu.type: setAttribute() to "xpopup" assert_equals: IDL get expected "toolbar" but got "xpopup"
-FAIL menu.type: setAttribute() to "popup\0" assert_equals: IDL get expected "toolbar" but got "popup\0"
-FAIL menu.type: setAttribute() to "opup" assert_equals: IDL get expected "toolbar" but got "opup"
-FAIL menu.type: setAttribute() to "POPUP" assert_equals: IDL get expected "popup" but got "POPUP"
-PASS menu.type: setAttribute() to "toolbar" 
-FAIL menu.type: setAttribute() to "xtoolbar" assert_equals: IDL get expected "toolbar" but got "xtoolbar"
-FAIL menu.type: setAttribute() to "toolbar\0" assert_equals: IDL get expected "toolbar" but got "toolbar\0"
-FAIL menu.type: setAttribute() to "oolbar" assert_equals: IDL get expected "toolbar" but got "oolbar"
-FAIL menu.type: setAttribute() to "TOOLBAR" assert_equals: IDL get expected "toolbar" but got "TOOLBAR"
-FAIL menu.type: IDL set to "" assert_equals: IDL get expected "toolbar" but got ""
-FAIL menu.type: IDL set to " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo " assert_equals: IDL get expected "toolbar" but got " \0\x01\x02\x03\x04\x05\x06\x07 \b\t\n\v\f\r\x0e\x0f \x10\x11\x12\x13\x14\x15\x16\x17 \x18\x19\x1a\x1b\x1c\x1d\x1e\x1f  foo "
-FAIL menu.type: IDL set to undefined assert_equals: IDL get expected "toolbar" but got "undefined"
-FAIL menu.type: IDL set to 7 assert_equals: IDL get expected "toolbar" but got "7"
-FAIL menu.type: IDL set to 1.5 assert_equals: IDL get expected "toolbar" but got "1.5"
-FAIL menu.type: IDL set to true assert_equals: IDL get expected "toolbar" but got "true"
-FAIL menu.type: IDL set to false assert_equals: IDL get expected "toolbar" but got "false"
-FAIL menu.type: IDL set to object "[object Object]" assert_equals: IDL get expected "toolbar" but got "[object Object]"
-FAIL menu.type: IDL set to NaN assert_equals: IDL get expected "toolbar" but got "NaN"
-FAIL menu.type: IDL set to Infinity assert_equals: IDL get expected "toolbar" but got "Infinity"
-FAIL menu.type: IDL set to -Infinity assert_equals: IDL get expected "toolbar" but got "-Infinity"
-FAIL menu.type: IDL set to "\0" assert_equals: IDL get expected "toolbar" but got "\0"
-FAIL menu.type: IDL set to null assert_equals: IDL get expected "toolbar" but got "null"
-FAIL menu.type: IDL set to object "test-toString" assert_equals: IDL get expected "toolbar" but got "test-toString"
-FAIL menu.type: IDL set to object "test-valueOf" assert_equals: IDL get expected "toolbar" but got "test-valueOf"
-PASS menu.type: IDL set to "popup" 
-FAIL menu.type: IDL set to "xpopup" assert_equals: IDL get expected "toolbar" but got "xpopup"
-FAIL menu.type: IDL set to "popup\0" assert_equals: IDL get expected "toolbar" but got "popup\0"
-FAIL menu.type: IDL set to "opup" assert_equals: IDL get expected "toolbar" but got "opup"
-FAIL menu.type: IDL set to "POPUP" assert_equals: IDL get expected "popup" but got "POPUP"
-PASS menu.type: IDL set to "toolbar" 
-FAIL menu.type: IDL set to "xtoolbar" assert_equals: IDL get expected "toolbar" but got "xtoolbar"
-FAIL menu.type: IDL set to "toolbar\0" assert_equals: IDL get expected "toolbar" but got "toolbar\0"
-FAIL menu.type: IDL set to "oolbar" assert_equals: IDL get expected "toolbar" but got "oolbar"
-FAIL menu.type: IDL set to "TOOLBAR" assert_equals: IDL get expected "toolbar" but got "TOOLBAR"
-PASS menu.label: 32 tests
-PASS menu.compact: 33 tests
-PASS menuitem.title: 32 tests
-PASS menuitem.lang: 32 tests
-PASS menuitem.dir: 62 tests
-PASS menuitem.className (<menuitem class>): 32 tests
-PASS menuitem.hidden: 33 tests
-PASS menuitem.accessKey: 32 tests
-PASS menuitem.tabIndex: 24 tests
-PASS menuitem.type: 62 tests
-PASS menuitem.label: 32 tests
-PASS menuitem.icon: 38 tests
-PASS menuitem.disabled: 33 tests
-PASS menuitem.checked: 33 tests
-PASS menuitem.radiogroup: 32 tests
-PASS menuitem.default: 33 tests
-PASS dialog.title: 32 tests
-PASS dialog.lang: 32 tests
-PASS dialog.dir: 62 tests
-PASS dialog.className (<dialog class>): 32 tests
-PASS dialog.hidden: 33 tests
-PASS dialog.accessKey: 32 tests
-PASS dialog.tabIndex: 24 tests
-PASS dialog.open: 33 tests
-PASS undefinedelement.title: 32 tests
-PASS undefinedelement.lang: 32 tests
-PASS undefinedelement.dir: 62 tests
-PASS undefinedelement.className (<undefinedelement class>): 32 tests
-PASS undefinedelement.hidden: 33 tests
-PASS undefinedelement.accessKey: 32 tests
-PASS undefinedelement.tabIndex: 24 tests
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc.html b/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc.html
deleted file mode 100644
index 915f6fad..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/dom/reflection-misc.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!doctype html>
-<title>HTML5 reflection tests: miscellaneous elements</title>
-<meta name=timeout content=long>
-<p>Implementers looking to fix bugs might want to use the <a
-href=reflection-original.html>original version</a> of this suite's test
-framework, which conveniently aggregates similar errors and only reports
-failures.  This file is (part of) the authoritative conformance test suite, and
-is suitable for incorporation into automated test suites.
-
-<div id=log></div>
-
-<script src="/resources/testharness.js"></script>
-<script src=/resources/testharnessreport.js></script>
-<script src=original-harness.js></script>
-<script src=new-harness.js></script>
-<script src=elements-misc.js></script>
-<script src=reflection.js></script>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface-expected.txt
new file mode 100644
index 0000000..d01e30e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface-expected.txt
@@ -0,0 +1,19 @@
+This is a testharness.js-based test.
+PASS DOMStringList IDL tests 
+PASS DOMStringList interface: existence and properties of interface object 
+PASS DOMStringList interface object length 
+PASS DOMStringList interface object name 
+FAIL DOMStringList interface: existence and properties of interface prototype object assert_equals: class string of DOMStringList.prototype expected "[object DOMStringListPrototype]" but got "[object DOMStringList]"
+PASS DOMStringList interface: existence and properties of interface prototype object's "constructor" property 
+PASS DOMStringList interface: attribute length 
+PASS DOMStringList interface: operation item(unsigned long) 
+PASS DOMStringList interface: operation contains(DOMString) 
+PASS DOMStringList must be primary interface of location.ancestorOrigins 
+PASS Stringification of location.ancestorOrigins 
+PASS DOMStringList interface: location.ancestorOrigins must inherit property "length" with the proper type (0) 
+PASS DOMStringList interface: location.ancestorOrigins must inherit property "item" with the proper type (1) 
+PASS DOMStringList interface: calling item(unsigned long) on location.ancestorOrigins with too few arguments must throw TypeError 
+PASS DOMStringList interface: location.ancestorOrigins must inherit property "contains" with the proper type (2) 
+PASS DOMStringList interface: calling contains(DOMString) on location.ancestorOrigins with too few arguments must throw TypeError 
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html
new file mode 100644
index 0000000..a4bc173
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.html
@@ -0,0 +1,32 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>DOMStringList IDL tests</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src=/resources/WebIDLParser.js></script>
+<script src=/resources/idlharness.js></script>
+
+<h1>DOMStringList IDL tests</h1>
+<div id=log></div>
+
+<script>
+"use strict";
+async_test(function(t) {
+  var request = new XMLHttpRequest();
+  request.open("GET", "domstringlist.idl");
+  request.send();
+  request.onload = t.step_func(function() {
+    var idlArray = new IdlArray();
+    var idls = request.responseText;
+
+    idlArray.add_idls(idls);
+
+    idlArray.add_objects({
+      DOMStringList: ['location.ancestorOrigins'],
+    });
+
+    idlArray.test();
+    t.done();
+  });
+});
+</script>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.js b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.js
new file mode 100644
index 0000000..0231b50
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist-interface.worker.js
@@ -0,0 +1,24 @@
+"use strict";
+
+importScripts("/resources/testharness.js");
+importScripts("/resources/WebIDLParser.js", "/resources/idlharness.js");
+
+async_test(function(t) {
+  var request = new XMLHttpRequest();
+  request.open("GET", "domstringlist.idl");
+  request.send();
+  request.onload = t.step_func(function() {
+    var idlArray = new IdlArray();
+    var idls = request.responseText;
+
+    idlArray.add_idls(idls);
+
+    idlArray.add_objects({
+      DOMStringList: [],
+    });
+    idlArray.test();
+    t.done();
+  });
+});
+
+done();
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.html b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.html
new file mode 100644
index 0000000..ab5a5c0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.html
@@ -0,0 +1,61 @@
+<!doctype html>
+<title>DOMStringList</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+
+// Returns a promise that resolves to a DOMStringList with
+// the requested entries. Relies on Indexed DB.
+function createDOMStringList(entries) {
+  return new Promise((resolve, reject) => {
+    const dbname = String(self.location + Math.random());
+    const request = indexedDB.open(dbname);
+    request.onerror = () => reject(request.error);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      entries.forEach(entry => db.createObjectStore(entry));
+      const dsl = db.objectStoreNames;
+      resolve(dsl);
+      request.transaction.abort();
+    }
+  });
+}
+
+function dsl_test(entries, func, description) {
+  promise_test(t => createDOMStringList(entries).then(dsl => func(t, dsl)),
+               description);
+}
+
+dsl_test(['a', 'b', 'c'], (t, dsl) => {
+  assert_equals(dsl.length, 3, 'length attribute');
+}, 'DOMStringList: length attribute');
+
+dsl_test(['a', 'b', 'c'], (t, dsl) => {
+  assert_equals(dsl.item(0), 'a', 'item method');
+  assert_equals(dsl.item(1), 'b', 'item method');
+  assert_equals(dsl.item(2), 'c', 'item method');
+  assert_equals(dsl.item(3), null, 'item method out of range');
+  assert_equals(dsl.item(-1), null, 'item method out of range');
+  assert_throws(TypeError(), () => dsl.item(),
+                'item method should throw if called without enough args');
+}, 'DOMStringList: item() method');
+
+dsl_test(['a', 'b', 'c'], (t, dsl) => {
+  assert_equals(dsl[0], 'a', 'indexed getter');
+  assert_equals(dsl[1], 'b', 'indexed getter');
+  assert_equals(dsl[2], 'c', 'indexed getter');
+  assert_equals(dsl[3], undefined, 'indexed getter out of range');
+  assert_equals(dsl[-1], undefined, 'indexed getter out of range');
+}, 'DOMStringList: indexed getter');
+
+dsl_test(['a', 'b', 'c'], (t, dsl) => {
+  assert_true(dsl.contains('a'), 'contains method matched');
+  assert_true(dsl.contains('b'), 'contains method matched');
+  assert_true(dsl.contains('c'), 'contains method matched');
+  assert_false(dsl.contains(''), 'contains method unmatched');
+  assert_false(dsl.contains('d'), 'contains method unmatched');
+  assert_throws(TypeError(), () => dsl.contains(),
+    'contains method should throw if called without enough args');
+}, 'DOMStringList: contains() method');
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.idl b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.idl
new file mode 100644
index 0000000..9b72a7c8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/domstringlist.idl
@@ -0,0 +1,6 @@
+[Exposed=(Window,Worker)]
+interface DOMStringList {
+  readonly attribute unsigned long length;
+  getter DOMString? item(unsigned long index);
+  boolean contains(DOMString string);
+};
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection-expected.txt
deleted file mode 100644
index 6500285..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-This is a testharness.js-based test.
-FAIL The length attribute must return the number of elements in the form assert_equals: The length attribute is incorrect. expected 2 but got 1
-PASS HTMLFormControlsCollection.item(index) must return the indexed item 
-PASS HTMLFormControlsCollection[index] must return the indexed item 
-PASS HTMLFormControlsCollection is not callable 
-PASS HTMLFormControlsCollection[name] must return the named item 
-PASS HTMLFormControlsCollection.namedItem(name) must return the named item 
-PASS The namedItem(name) must return an Element 
-PASS The namedItem(name) must return RadioNodeList 
-PASS The namedItem(name) must return null if the name is empty 
-PASS The namedItem(name) must return null if there is no matched element 
-FAIL Controls can be indexed by id or name attribute assert_equals: Controls can be named by 'id' attribute. expected Element node <keygen id="kg" name="key"></keygen> but got null
-PASS The namedItem(name) must return the items with id or name attribute 
-FAIL The HTMLFormControlsCollection interface is used for collections of listed elements in form element assert_equals: The length should be 8. expected 8 but got 7
-FAIL The HTMLFormControlsCollection interface is used for collections of listed elements in fieldset element assert_equals: The length should be 8. expected 8 but got 7
-PASS The controls in the form element must be sorted in tree order 
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection.html b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection.html
index 8c8e1dbc..aa9f0a5d 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/infrastructure/common-dom-interfaces/collections/htmlformcontrolscollection.html
@@ -7,8 +7,8 @@
 <script src="/resources/testharnessreport.js"></script>
 <div id="log"></div>
 <form id="f1">
-  <input type="radio" id="r1">
-  <keygen id="kg" name="key"></keygen>
+  <input type="radio" id="r1" name="ra">
+  <keygen id="kg" name="key"></keygen> <!-- we test that it does *not* appear in form.elements -->
 </form>
 <form id="f2">
   <table>
@@ -39,7 +39,7 @@
 
 //length
 test(function () {
-  assert_equals(coll1.length, 2, "The length attribute is incorrect.");
+  assert_equals(coll1.length, 1, "The length attribute is incorrect.");
   assert_equals(coll2.length, 4, "The length attribute is incorrect.");
 }, "The length attribute must return the number of elements in the form");
 
@@ -83,17 +83,22 @@
 }, "The namedItem(name) must return null if there is no matched element");
 
 test(function () {
-  assert_equals(coll1.namedItem("kg"), document.getElementById("kg"), "Controls can be named by 'id' attribute.");
-  assert_equals(coll1.namedItem("key"), document.getElementById("kg"), "Controls can be named by 'name' attribute.");
+  assert_equals(coll1.namedItem("r1"), document.getElementById("r1"), "Controls can be named by 'id' attribute.");
+  assert_equals(coll1.namedItem("ra"), document.getElementById("r1"), "Controls can be named by 'name' attribute.");
 }, "Controls can be indexed by id or name attribute");
 
 test(function () {
+  assert_equals(coll1.namedItem("kg"), null, "Keygen does not show up when queried by id.");
+  assert_equals(coll1.namedItem("key"), null, "Keygen does not show up when queried by name.");
+}, "Keygen controls do not show up at all");
+
+test(function () {
   assert_equals(coll2.namedItem("btn").length, 2, "The length attribute should be 2.");
 }, "The namedItem(name) must return the items with id or name attribute");
 
 //various controls in fieldset and form
 var containers = ["form", "fieldset"],
-    controls = ["button", "fieldset", "input", "keygen", "object", "output", "select", "textarea"];
+    controls = ["button", "fieldset", "input", "object", "output", "select", "textarea"];
 for (var m = 0; m < containers.length; m++) {
   test(function () {
     var container = document.createElement(containers[m]);
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/resources/common.js b/third_party/WebKit/LayoutTests/imported/wpt/html/resources/common.js
index 12e0fe7..236a65f 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/resources/common.js
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/resources/common.js
@@ -31,7 +31,7 @@
         'track', 'wbr' ];
 
 // https://html.spec.whatwg.org/multipage/multipage/forms.html#form-associated-element
-var HTML5_FORM_ASSOCIATED_ELEMENTS = [ 'button', 'fieldset', 'input', 'keygen',
+var HTML5_FORM_ASSOCIATED_ELEMENTS = [ 'button', 'fieldset', 'input',
         'object', 'output', 'select', 'textarea' ];
 
 function newDocument() {
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate-expected.txt
index 4f00e7c..f84b050 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate-expected.txt
@@ -7,7 +7,6 @@
 FAIL [fieldset]  Must not be barred from the constraint validation assert_true: The willValidate attribute should be true. expected true got false
 FAIL [output]  Must not be barred from the constraint validation assert_true: The willValidate attribute should be true. expected true got false
 PASS [object]  Must be barred from the constraint validation 
-FAIL [keygen]  Must be barred from the constraint validation assert_true: The willValidate attribute doesn't exist. expected true got false
 PASS [INPUT in TEXT status] Must be barred from the constraint validation if it is disabled 
 PASS [INPUT in TEXT status] The willValidate attribute must be true if an element is mutable 
 PASS [INPUT in TEXT status] Must be barred from the constraint validation if it is readonly 
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate.html
index 237572b..273429f 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/constraints/form-validation-willValidate.html
@@ -39,11 +39,6 @@
       types: [],
       testData: [{conditions: {}, expected: false, name: "[target] Must be barred from the constraint validation"}]
     },
-    {
-      tag: "keygen",
-      types: [],
-      testData: [{conditions: {}, expected: false, name: "[target] Must be barred from the constraint validation"}]
-    },
     //If an element is disabled, it is barred from constraint validation.
     //The willValidate attribute must be true if an element is mutable
     //If the readonly attribute is specified on an INPUT element, the element is barred from constraint validation.
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form-expected.txt
index 8531b05a..f937e4db 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form-expected.txt
@@ -2,9 +2,6 @@
 PASS button.form 
 PASS fieldset.form 
 PASS input.form 
-FAIL keygen.form assert_equals: expected (object) Element node <form id="form">
-<p><button id="button">button</button>
-<... but got (undefined) undefined
 PASS object.form 
 PASS output.form 
 PASS select.form 
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form.html
index 29a14ca..064fcbd 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/form-control-infrastructure/form.html
@@ -9,7 +9,6 @@
 <p><button id="button">button</button>
 <p><fieldset id="fieldset">fieldset</fieldset>
 <p><input id="input">
-<p><keygen id="keygen">
 <p><object id="object">object</object>
 <p><output id="output">output</output>
 <p><select id="select"><option>select</option></select>
@@ -59,7 +58,6 @@
   "button",
   "fieldset",
   "input",
-  "keygen",
   "object",
   "output",
   "select",
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/resetting-a-form/reset-form.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/resetting-a-form/reset-form.html
index 7654ced..c7ac3e0 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/resetting-a-form/reset-form.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/resetting-a-form/reset-form.html
@@ -15,7 +15,6 @@
   <input type="checkbox" id="cb1" checked="checked" />
   <input type="checkbox" id="cb2" />
   <textarea id="ta">abc</textarea>
-  <!--<keygen id="kg"></keygen>-->
   <output id="opt">5</output>
   <select id="slt1">
     <option value="1">ITEM1</option>
@@ -114,7 +113,6 @@
     assert_true(document.getElementById("slt3").options[1].selected, "The second option in the select element with multiple attribute should be selected.");
     assert_true(document.getElementById("slt3").options[2].selected, "The third option in the select element with multiple attribute should be selected.");
   }, "Resetting <select> " + description);
-  //TODO: The keygen reset algorithm
 }
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-form-element/form-nameditem.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-form-element/form-nameditem.html
index 0155d38b..e794f07 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-form-element/form-nameditem.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-form-element/form-nameditem.html
@@ -5,7 +5,6 @@
 <script src="/resources/testharnessreport.js"></script>
 <div id=log></div>
 <!-- XXX Nothing tests id attributes yet. -->
-<!-- XXX Keygen. -->
 <!-- XXX We also need tests for moving inputs and forms in the DOM. -->
 <form>
 <input type=button name=button>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements-expected.txt
index d6fc410..895d1fd 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements-expected.txt
@@ -13,8 +13,8 @@
 FAIL Check if the hidden input element can access 'labels' Cannot read property 'length' of null
 PASS Check if the input element in radio state is a labelable element 
 PASS Check if the input element in radio state can access 'labels' 
-FAIL Check if the keygen element is a labelable element Cannot read property 'id' of null
-FAIL Check if the keygen element can access 'labels' Cannot read property 'length' of undefined
+PASS Check if the keygen element is not a labelable element 
+PASS Check if the keygen element can access 'labels' 
 PASS Check if the meter element is a labelable element 
 PASS Check if the meter element can access 'labels' 
 PASS Check if the fieldset element is not a labelable element 
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements.html
index 7bbb0b3..a508a91 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-label-element/labelable-elements.html
@@ -103,11 +103,12 @@
 }, "Check if the input element in radio state can access 'labels'");
 
 test(function() {
-  assert_equals(document.getElementById("lbl7").control.id, "testkeygen", "A keygen element should be labelable.");
-}, "Check if the keygen element is a labelable element");
+  assert_not_equals(document.getElementById("lbl7").control, document.getElementById("testkeygen"));
+  assert_equals(document.getElementById("lbl7").control, null, "A keygen element should not be labelable.");
+}, "Check if the keygen element is not a labelable element");
 
 test(function() {
-  testLabelsAttr("testkeygen", "lbl7");
+  assert_equals(document.getElementById("testkeygen").labels, undefined);
 }, "Check if the keygen element can access 'labels'");
 
 test(function() {
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/interfaces.js b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/interfaces.js
index 0280e27..b34a845d 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/interfaces.js
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/interfaces.js
@@ -72,7 +72,7 @@
   ["ins", "Mod"],
   ["isindex", "Unknown"],
   ["kbd", ""],
-  ["keygen", "Keygen"],
+  ["keygen", "Unknown"],
   ["label", "Label"],
   ["legend", "Legend"],
   ["li", "LI"],
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt
index e8c5a27e..6f9048d 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt
@@ -4,7 +4,7 @@
 FAIL Template element as a descendant of the FRAMESET element. Template element is created by innerHTML assert_equals: Template element should not be allowed as a descendant of the FRAMESET element expected null but got Element node <template>some text</template>
 PASS Template element as an indirect descendant of the BODY element. Template element is created by innerHTML 
 PASS Template element as an indirect descendant of the HEAD element. Template element is created by innerHTML 
-FAIL Template element as a descendant of the FRAMESET element. Template element is created by innerHTML assert_equals: Template element should not be allowed as indirect descendant of the FRAMESET element expected null but got Element node <template>some text</template>
+FAIL Template element as an indirect descendant of the FRAMESET element. Template element is created by innerHTML assert_equals: Template element should not be allowed as indirect descendant of the FRAMESET element expected null but got Element node <template>some text</template>
 PASS Template element as a descendant of the BODY element. Template element is appended by appendChild() 
 PASS Template element as a descendant of the HEAD element. Template element is appended by appendChild() 
 PASS Template element as a descendant of the FRAMESET element. Template element is  appended by appendChild() 
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
index 6a6482d..8ad6532 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
@@ -5,7 +5,7 @@
 <meta name="author" title="Sergey G. Grekhov" href="mailto:sgrekhov@unipro.ru">
 <meta name="author" title="Aleksei Yu. Semenov" href="mailto:a.semenov@unipro.ru">
 <meta name="assert" content="Template element can be a descendant of the body element">
-<link rel="help" href="http://www.w3.org/TR/2013/WD-html-templates-20130214/#template-element">
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#the-template-element">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src='/html/resources/common.js'></script>
@@ -93,7 +93,7 @@
 generate_tests(templateIsAnIndirectChild, parameters,
         'Template element as an indirect descendant of the HEAD, BODY and FRAMESET elements');
 
-parameters = [['Template element as a descendant of the FRAMESET element. ' +
+parameters = [['Template element as an indirect descendant of the FRAMESET element. ' +
                'Template element is created by innerHTML',
                frameset],
                ];
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-expected.txt
index f9f4be08..70b2ab3f 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-expected.txt
@@ -21,7 +21,7 @@
 PASS Leading whitespace preserved 
 PASS Trailing whitespace preserved 
 PASS Whitespace not compressed 
-PASS Existing text deleted 
+FAIL Existing text deleted assert_not_equals: Child should be a *new* text node got disallowed value Text node "abc"
 PASS Existing <br> deleted 
 PASS Assigning the empty string 
 PASS Assigning null 
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-tests.js b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-tests.js
index 9318607e..7042f05f 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-tests.js
+++ b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter-tests.js
@@ -20,8 +20,8 @@
 testText("<div>", " abc", " abc", "Leading whitespace preserved");
 testText("<div>", "abc ", "abc ", "Trailing whitespace preserved");
 testText("<div>", "abc  def", "abc  def", "Whitespace not compressed");
-testHTML("<div>abc\n\n", "abc", "abc", "Existing text deleted");
-testHTML("<div><br>", "abc", "abc", "Existing <br> deleted");
+testText("<div>abc\n\n", "abc", "abc", "Existing text deleted");
+testText("<div><br>", "abc", "abc", "Existing <br> deleted");
 testHTML("<div>", "", "", "Assigning the empty string");
 testHTML("<div>", null, "", "Assigning null");
 testHTML("<div>", undefined, "undefined", "Assigning undefined");
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter.html b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter.html
index 7fc198a..c2ffb37 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/innerText/setter.html
@@ -16,21 +16,25 @@
   while (e && e.nodeType != Node.ELEMENT_NODE) {
     e = e.nextSibling;
   }
+  var oldChild = e.firstChild;
   e.innerText = plain;
-  return e;
+  return [e, oldChild];
 }
 function testText(context, plain, expectedText, msg) {
   test(function(){
-    var e = setupTest(context, plain);
+    var arr = setupTest(context, plain);
+    var e = arr[0];
+    var oldChild = arr[1];
     assert_not_equals(e.firstChild, null, "Should have a child");
     assert_equals(e.firstChild.nodeType, Node.TEXT_NODE, "Child should be a text node");
     assert_equals(e.firstChild.nextSibling, null, "Should have only one child");
     assert_equals(e.firstChild.data, expectedText);
+    assert_not_equals(e.firstChild, oldChild, "Child should be a *new* text node");
   }, msg);
 }
 function testHTML(context, plain, expectedHTML, msg) {
   test(function(){
-    var e = setupTest(context, plain);
+    var e = setupTest(context, plain)[0];
     assert_equals(e.innerHTML, expectedHTML);
   }, msg);
 }
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html
new file mode 100644
index 0000000..3537e0e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html
@@ -0,0 +1,102 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Pointer Event: touch-action test for two-finger interaction</title>
+    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"/>
+    <link rel="author" title="Google" href="http://www.google.com "/>
+    <link rel="help" href="https://compat.spec.whatwg.org/#touch-action" />
+    <meta name="assert" content="Tests that a two-finger pan gesture is cancelled in 'touch-action: pan-x pan-y' but is allowed in 'touch-action: pinch-zoom'"/>
+    <link rel="stylesheet" type="text/css" href="../pointerevent_styles.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script type="text/javascript" src="../pointerevent_support.js"></script>
+    <script type="text/javascript">
+      var event_log = [];
+      var active_pointers = 0;
+
+      function resetTestState() {
+        event_log = [];
+        active_pointers = 0;
+      }
+
+      function run() {
+        var test_pointer_events = [
+          setup_pointerevent_test("two-finger pan on 'touch-action: pan-x pan-y'", ["touch"]),
+          setup_pointerevent_test("two-finger pan on 'touch-action: pinch-zoom'", ["touch"])
+        ];
+        var expected_events = [
+          "pointerdown@black, pointerdown@black, pointerup@black, pointerup@black",
+          "pointerdown@grey, pointerdown@grey, pointercancel@grey, pointercancel@grey"
+        ];
+        var current_test_index = 0;
+
+        on_event(document.getElementById("done"), "click", function() {
+          test_pointer_events[current_test_index].step(function () {
+            assert_equals(active_pointers, 0);
+            assert_equals(event_log.join(", "), expected_events[current_test_index]);
+          });
+          event_log = [];
+
+          test_pointer_events[current_test_index++].done();
+        });
+
+        var targets = [document.getElementById("black"), document.getElementById("grey")];
+
+        ["pointerdown", "pointerup", "pointercancel"].forEach(function(eventName) {
+          targets.forEach(function(target){
+            on_event(target, eventName, function (event) {
+              event_log.push(event.type + "@" + event.target.id);
+
+              if (event.type == "pointerdown") {
+                active_pointers++;
+
+              } else {
+                active_pointers--;
+              }
+            });
+          });
+        });
+      }
+    </script>
+    <style>
+      .box {
+        width: 250px;
+        height: 150px;
+        float: left;
+        margin: 10px;
+      }
+
+      #black {
+        touch-action: pan-x pan-y;
+        background-color: black;
+      }
+
+      #grey {
+        touch-action: pinch-zoom;
+        background-color: grey;
+      }
+
+      #done {
+        float: left;
+        padding: 20px;
+      }
+    </style>
+  </head>
+  <body onload="run()">
+    <h1>Pointer Event: touch-action test for two-finger interaction</h1>
+    <h2 id="pointerTypeDescription"></h2>
+    <h4>
+      Tests that a two-finger pan gesture is cancelled in 'touch-action: pan-x pan-y' but is allowed in 'touch-action: pinch-zoom'
+    </h4>
+    <ol>
+      <li>Touch on Black with two fingers and drag both fingers down at same speed.</li>
+      <li>Tap on Done.</li>
+      <li>Touch on Grey with two fingers and drag both fingers down at same speed.</li>
+      <li>Tap on Done.</li>
+    </ol>
+    <div class="box" id="black"></div>
+    <input type="button" id="done" value="Done" />
+    <div class="box" id="grey"></div>
+    <div id="log"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html
index 274f9a4..0b93c84 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html
@@ -63,7 +63,7 @@
     </style>
   </head>
   <body onload="run()">
-    <h1>Pointer Event: Event sequence at implicit release on click<h1>
+    <h1>Pointer Event: Event sequence at implicit release on click</h1>
     <h2 id="pointerTypeDescription"></h2>
     <h4>
       When a captured pointer is implicitly released after a click, the boundary events should follow the lostpointercapture event.
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html
index 7b8e39b9..982167d 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html
+++ b/third_party/WebKit/LayoutTests/imported/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html
@@ -64,7 +64,7 @@
     </style>
   </head>
   <body onload="run()">
-    <h1>Pointer Event: Event sequence at implicit release on drag<h1>
+    <h1>Pointer Event: Event sequence at implicit release on drag</h1>
     <h2 id="pointerTypeDescription"></h2>
     <h4>
       When a captured pointer is implicitly released after a drag, the boundary events should follow the lostpointercapture event.
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-005-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-005-expected.txt
deleted file mode 100644
index 41fad1f..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-005-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-This is a testharness.js-based test.
-PASS A_04_01_05_T01 
-FAIL A_04_01_05_T02 assert_equals: Elements in shadow DOM must not be accessible from owner's document keygen.form attribute expected (object) null but got (undefined) undefined
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-007-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-007-expected.txt
deleted file mode 100644
index 4334e48..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-007-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-This is a testharness.js-based test.
-PASS A_04_01_07_T01 
-FAIL A_04_01_07_T02 assert_equals: Elements in shadow DOM must be accessible from shadow document keygen.form attribute expected (object) Element node <form id="form_id"></form> but got (undefined) undefined
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/imported/wpt_automation/pointerevents/pointerevent_common_input.js b/third_party/WebKit/LayoutTests/imported/wpt_automation/pointerevents/pointerevent_common_input.js
index 84b0ced..c6a3c59 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt_automation/pointerevents/pointerevent_common_input.js
+++ b/third_party/WebKit/LayoutTests/imported/wpt_automation/pointerevents/pointerevent_common_input.js
@@ -160,8 +160,29 @@
       scrollPageIfNeeded(targetSelector, document);
       var target = document.querySelector(targetSelector);
       var targetRect = target.getBoundingClientRect();
-      chrome.gpuBenchmarking.smoothScrollBy(scrollOffset, resolve,
-          targetRect.left + boundaryOffset, targetRect.top + boundaryOffset, touchSourceType, direction);
+      var xPosition = targetRect.left + boundaryOffset;
+      var yPosition = targetRect.top + boundaryOffset;
+      var newXPosition = xPosition;
+      var newYPosition = yPosition;
+      if (direction == "down")
+        newYPosition -= scrollOffset;
+      else if (direction == "up")
+        newYPosition += scrollOffset;
+      else if (direction == "right")
+        newXPosition -= scrollOffset;
+      else if (direction == "left")
+        newXPosition += scrollOffset;
+      else
+        throw("Scroll direction '" + direction + "' is not expected, we expecte 'down', 'up', 'left' or 'right'");
+
+      chrome.gpuBenchmarking.pointerActionSequence( [
+        {"source": "touch",
+         "actions": [
+            { "name": "pointerDown", "x": xPosition, "y": yPosition },
+            { "name": "pointerMove", "x": newXPosition, "y": newYPosition },
+            { "name": "pause", "duration": 0.1 },
+            { "name": "pointerUp" }
+        ]}], resolve);
     } else {
       reject();
     }
@@ -174,9 +195,17 @@
       scrollPageIfNeeded(targetSelector, document);
       var target = document.querySelector(targetSelector);
       var targetRect = target.getBoundingClientRect();
-      chrome.gpuBenchmarking.pinchBy(scale, targetRect.left + (targetRect.width/2), targetRect.top + (targetRect.height/2), function() {
-        resolve();
-      });
+      var xPosition = targetRect.left + (targetRect.width/2);
+      var yPosition1 = targetRect.top + (targetRect.height/2) - 10;
+      var yPosition2 = targetRect.top + (targetRect.height/2) + 10;
+      var text = '[{"source": "touch", "actions": [{ "name": "pointerDown", "x":' + xPosition +', "y":' + yPosition1 +' },';
+      for (var offset=10; offset<80; offset+=10)
+        text += '{ "name": "pointerMove", "x":' + xPosition +', "y":' + (yPosition1 - offset) +' },';
+      text += '{ "name": "pointerUp" }]}, {"source": "touch", "actions": [{ "name": "pointerDown", "x":' + xPosition +', "y":' + yPosition2 +' },';
+      for (var offset=10; offset<80; offset+=10)
+        text += '{ "name": "pointerMove", "x":' + xPosition +', "y":' + (yPosition2 + offset) +' },';
+      text += '{ "name": "pointerUp" }]}]';
+      chrome.gpuBenchmarking.pointerActionSequence(JSON.parse(text), resolve);
     } else {
       reject();
     }
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.png
deleted file mode 100644
index 3ff17ff..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.txt
index f91329c..f2b69df4 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/virtual/stable/paint/invalidation/resize-iframe-text-expected.txt
@@ -2,33 +2,23 @@
   "layers": [
     {
       "name": "LayoutView #document",
-      "bounds": [800, 745],
+      "bounds": [800, 681],
       "contentsOpaque": true,
       "drawsContent": true,
       "paintInvalidations": [
         {
           "object": "LayoutIFrame (positioned) IFRAME",
-          "rect": [0, 0, 800, 745],
+          "rect": [0, 0, 800, 681],
           "reason": "forced by layout"
         },
         {
           "object": "LayoutView #document",
-          "rect": [0, 600, 800, 145],
+          "rect": [0, 600, 800, 81],
           "reason": "incremental"
         },
         {
-          "object": "LayoutBlockFlow HTML",
-          "rect": [0, 0, 800, 34],
-          "reason": "forced by layout"
-        },
-        {
-          "object": "LayoutBlockFlow HTML",
-          "rect": [0, 0, 785, 745],
-          "reason": "forced by layout"
-        },
-        {
           "object": "LayoutView #document",
-          "rect": [0, 600, 785, 145],
+          "rect": [0, 600, 785, 81],
           "reason": "incremental"
         },
         {
@@ -37,18 +27,13 @@
           "reason": "forced by layout"
         },
         {
-          "object": "LayoutBlockFlow H1",
-          "rect": [8, 700, 600, 37],
-          "reason": "became visible"
-        },
-        {
           "object": "LayoutText #text",
           "rect": [8, 8, 346, 18],
           "reason": "forced by layout"
         },
         {
           "object": "LayoutView #document",
-          "rect": [785, 0, 15, 745],
+          "rect": [785, 0, 15, 681],
           "reason": "scroll"
         },
         {
@@ -65,10 +50,6 @@
       "reason": "incremental"
     },
     {
-      "object": "LayoutBlockFlow HTML",
-      "reason": "forced by layout"
-    },
-    {
       "object": "LayoutBlockFlow BODY",
       "reason": "forced by layout"
     },
@@ -103,18 +84,6 @@
     {
       "object": "LayoutView #document",
       "reason": "incremental"
-    },
-    {
-      "object": "LayoutBlockFlow HTML",
-      "reason": "forced by layout"
-    },
-    {
-      "object": "LayoutBlockFlow H1",
-      "reason": "became visible"
-    },
-    {
-      "object": "RootInlineBox",
-      "reason": "became visible"
     }
   ]
 }
diff --git a/third_party/WebKit/Source/core/editing/Editor.cpp b/third_party/WebKit/Source/core/editing/Editor.cpp
index 0945f8a..0974f556 100644
--- a/third_party/WebKit/Source/core/editing/Editor.cpp
+++ b/third_party/WebKit/Source/core/editing/Editor.cpp
@@ -229,13 +229,12 @@
   if (event->isPaste()) {
     if (event->pastingFragment()) {
       replaceSelectionWithFragment(
-          EditCommandSource::kMenuOrKeyBinding, event->pastingFragment(), false,
-          event->shouldSmartReplace(), event->shouldMatchStyle(),
-          InputEvent::InputType::InsertFromPaste);
+          event->pastingFragment(), false, event->shouldSmartReplace(),
+          event->shouldMatchStyle(), InputEvent::InputType::InsertFromPaste);
     } else {
-      replaceSelectionWithText(
-          EditCommandSource::kMenuOrKeyBinding, event->data(), false,
-          event->shouldSmartReplace(), InputEvent::InputType::InsertFromPaste);
+      replaceSelectionWithText(event->data(), false,
+                               event->shouldSmartReplace(),
+                               InputEvent::InputType::InsertFromPaste);
     }
     return true;
   }
@@ -258,8 +257,7 @@
     insertLineBreak();
   }
 
-  return insertTextWithoutSendingTextEvent(EditCommandSource::kMenuOrKeyBinding,
-                                           data, false, event);
+  return insertTextWithoutSendingTextEvent(data, false, event);
 }
 
 bool Editor::canEdit() const {
@@ -339,8 +337,7 @@
   return false;
 }
 
-bool Editor::deleteWithDirection(EditCommandSource source,
-                                 DeleteDirection direction,
+bool Editor::deleteWithDirection(DeleteDirection direction,
                                  TextGranularity granularity,
                                  bool killRing,
                                  bool isTypingAction) {
@@ -359,7 +356,6 @@
       if (killRing)
         addToKillRing(selectedRange());
       deleteSelectionWithSmartDelete(
-          source,
           canSmartCopyOrDelete() ? DeleteMode::Smart : DeleteMode::Simple,
           deletionInputTypeFromTextGranularity(direction, granularity));
       // Implicitly calls revealSelectionAfterEditingOperation().
@@ -396,9 +392,7 @@
   return true;
 }
 
-// TODO(chongz): Pass |EditCommandSource| to |CompositeEditCommand|.
 void Editor::deleteSelectionWithSmartDelete(
-    EditCommandSource,
     DeleteMode deleteMode,
     InputEvent::InputType inputType,
     const Position& referenceMovePosition) {
@@ -591,9 +585,7 @@
   return smartInsertDeleteEnabled() && pasteboard->canSmartReplace();
 }
 
-// TODO(chongz): Pass |EditCommandSource| to |CompositeEditCommand|.
-void Editor::replaceSelectionWithFragment(EditCommandSource,
-                                          DocumentFragment* fragment,
+void Editor::replaceSelectionWithFragment(DocumentFragment* fragment,
                                           bool selectReplacement,
                                           bool smartReplace,
                                           bool matchStyle,
@@ -619,14 +611,13 @@
   revealSelectionAfterEditingOperation();
 }
 
-void Editor::replaceSelectionWithText(EditCommandSource source,
-                                      const String& text,
+void Editor::replaceSelectionWithText(const String& text,
                                       bool selectReplacement,
                                       bool smartReplace,
                                       InputEvent::InputType inputType) {
-  replaceSelectionWithFragment(
-      source, createFragmentFromText(selectedRange(), text), selectReplacement,
-      smartReplace, true, inputType);
+  replaceSelectionWithFragment(createFragmentFromText(selectedRange(), text),
+                               selectReplacement, smartReplace, true,
+                               inputType);
 }
 
 // TODO(xiaochengh): Merge it with |replaceSelectionWithFragment()|.
@@ -665,8 +656,7 @@
 
   if (shouldDelete && dragSource->isConnected()) {
     deleteSelectionWithSmartDelete(
-        EditCommandSource::kMenuOrKeyBinding, deleteMode,
-        InputEvent::InputType::DeleteByDrag, referenceMovePosition);
+        deleteMode, InputEvent::InputType::DeleteByDrag, referenceMovePosition);
   }
 
   return true;
@@ -730,8 +720,7 @@
   client().respondToChangedContents();
 }
 
-// TODO(chongz): Pass |EditCommandSource| to |CompositeEditCommand|.
-void Editor::removeFormattingAndStyle(EditCommandSource) {
+void Editor::removeFormattingAndStyle() {
   DCHECK(frame().document());
   RemoveFormatCommand::create(*frame().document())->apply();
 }
@@ -757,15 +746,14 @@
   return findEventTargetFrom(frame().selection().selection());
 }
 
-void Editor::applyStyle(EditCommandSource source,
-                        StylePropertySet* style,
+void Editor::applyStyle(StylePropertySet* style,
                         InputEvent::InputType inputType) {
   switch (frame().selection().getSelectionType()) {
     case NoSelection:
       // do nothing
       break;
     case CaretSelection:
-      computeAndSetTypingStyle(source, style, inputType);
+      computeAndSetTypingStyle(style, inputType);
       break;
     case RangeSelection:
       if (style) {
@@ -778,9 +766,7 @@
   }
 }
 
-// TODO(chongz): Pass |EditCommandSource| to |CompositeEditCommand|.
-void Editor::applyParagraphStyle(EditCommandSource,
-                                 StylePropertySet* style,
+void Editor::applyParagraphStyle(StylePropertySet* style,
                                  InputEvent::InputType inputType) {
   if (frame().selection().isNone() || !style)
     return;
@@ -790,22 +776,20 @@
       ->apply();
 }
 
-void Editor::applyStyleToSelection(EditCommandSource source,
-                                   StylePropertySet* style,
+void Editor::applyStyleToSelection(StylePropertySet* style,
                                    InputEvent::InputType inputType) {
   if (!style || style->isEmpty() || !canEditRichly())
     return;
 
-  applyStyle(source, style, inputType);
+  applyStyle(style, inputType);
 }
 
-void Editor::applyParagraphStyleToSelection(EditCommandSource source,
-                                            StylePropertySet* style,
+void Editor::applyParagraphStyleToSelection(StylePropertySet* style,
                                             InputEvent::InputType inputType) {
   if (!style || style->isEmpty() || !canEditRichly())
     return;
 
-  applyParagraphStyle(source, style, inputType);
+  applyParagraphStyle(style, inputType);
 }
 
 bool Editor::selectionStartHasStyle(CSSPropertyID propertyID,
@@ -999,8 +983,7 @@
   return frame().eventHandler().handleTextInputEvent(text, triggeringEvent);
 }
 
-bool Editor::insertTextWithoutSendingTextEvent(EditCommandSource source,
-                                               const String& text,
+bool Editor::insertTextWithoutSendingTextEvent(const String& text,
                                                bool selectInsertedText,
                                                TextEvent* triggeringEvent) {
   if (text.isEmpty())
@@ -1105,7 +1088,7 @@
         return;
     }
     deleteSelectionWithSmartDelete(
-        source, canSmartCopyOrDelete() ? DeleteMode::Smart : DeleteMode::Simple,
+        canSmartCopyOrDelete() ? DeleteMode::Smart : DeleteMode::Simple,
         InputEvent::InputType::DeleteByCut);
   }
 }
@@ -1182,7 +1165,7 @@
   pasteAsPlainTextWithPasteboard(Pasteboard::generalPasteboard());
 }
 
-void Editor::performDelete(EditCommandSource source) {
+void Editor::performDelete() {
   if (!canDelete())
     return;
 
@@ -1195,7 +1178,7 @@
   // TODO(chongz): |Editor::performDelete()| has no direction.
   // https://github.com/w3c/editing/issues/130
   deleteSelectionWithSmartDelete(
-      source, canSmartCopyOrDelete() ? DeleteMode::Smart : DeleteMode::Simple,
+      canSmartCopyOrDelete() ? DeleteMode::Smart : DeleteMode::Simple,
       InputEvent::InputType::DeleteContentBackward);
 
   // clear the "start new kill ring sequence" setting, because it was set to
@@ -1282,8 +1265,7 @@
   return m_undoStack->canUndo();
 }
 
-// TODO(chongz): Fire 'beforeinput' for user triggered undo.
-void Editor::undo(EditCommandSource) {
+void Editor::undo() {
   m_undoStack->undo();
 }
 
@@ -1291,8 +1273,7 @@
   return m_undoStack->canRedo();
 }
 
-// TODO(chongz): Fire 'beforeinput' for user triggered redo.
-void Editor::redo(EditCommandSource) {
+void Editor::redo() {
   m_undoStack->redo();
 }
 
@@ -1316,8 +1297,7 @@
           : direction == RightToLeftWritingDirection ? "rtl" : "inherit",
       false);
   applyParagraphStyleToSelection(
-      EditCommandSource::kMenuOrKeyBinding, style,
-      InputEvent::InputType::FormatSetBlockTextDirection);
+      style, InputEvent::InputType::FormatSetBlockTextDirection);
 }
 
 void Editor::revealSelectionAfterEditingOperation(
@@ -1328,7 +1308,7 @@
   frame().selection().revealSelection(alignment, revealExtentOption);
 }
 
-void Editor::transpose(EditCommandSource source) {
+void Editor::transpose() {
   if (!canEdit())
     return;
 
@@ -1365,7 +1345,7 @@
   // Insert the transposed characters.
   // TODO(chongz): Once we add |InsertTranspose| in |InputEvent::InputType|, we
   // should use it instead of |InsertFromPaste|.
-  replaceSelectionWithText(source, transposed, false, false,
+  replaceSelectionWithText(transposed, false, false,
                            InputEvent::InputType::InsertFromPaste);
 }
 
@@ -1446,9 +1426,7 @@
                  startCaretRect.height());
 }
 
-// TODO(chongz): Pass |EditCommandSource| to |CompositeEditCommand|.
-void Editor::computeAndSetTypingStyle(EditCommandSource,
-                                      StylePropertySet* style,
+void Editor::computeAndSetTypingStyle(StylePropertySet* style,
                                       InputEvent::InputType inputType) {
   if (!style || style->isEmpty()) {
     frame().selection().clearTypingStyle();
@@ -1720,17 +1698,7 @@
   DCHECK(!frame().document()->needsLayoutTreeUpdate());
   bool selectReplacement = behavior().shouldSelectReplacement();
   bool smartReplace = true;
-  replaceSelectionWithText(EditCommandSource::kMenuOrKeyBinding, text,
-                           selectReplacement, smartReplace,
-                           InputEvent::InputType::InsertReplacementText);
-}
-
-void Editor::replaceSelectionForSpellChecker(const String& text) {
-  DCHECK(!frame().document()->needsLayoutTreeUpdate());
-  const bool kSelectReplacement = false;
-  const bool kSmartReplace = false;
-  replaceSelectionWithText(EditCommandSource::kMenuOrKeyBinding, text,
-                           kSelectReplacement, kSmartReplace,
+  replaceSelectionWithText(text, selectReplacement, smartReplace,
                            InputEvent::InputType::InsertReplacementText);
 }
 
diff --git a/third_party/WebKit/Source/core/editing/Editor.h b/third_party/WebKit/Source/core/editing/Editor.h
index 85ad1f9..e34b28d 100644
--- a/third_party/WebKit/Source/core/editing/Editor.h
+++ b/third_party/WebKit/Source/core/editing/Editor.h
@@ -34,7 +34,6 @@
 #include "core/editing/FrameSelection.h"
 #include "core/editing/VisibleSelection.h"
 #include "core/editing/WritingDirection.h"
-#include "core/editing/commands/CompositeEditCommand.h"
 #include "core/editing/iterators/TextIterator.h"
 #include "core/editing/markers/DocumentMarker.h"
 #include "core/events/InputEvent.h"
@@ -99,12 +98,12 @@
   void copy();
   void paste(EditCommandSource);
   void pasteAsPlainText(EditCommandSource);
-  void performDelete(EditCommandSource);
+  void performDelete();
 
   static void countEvent(ExecutionContext*, const Event*);
   void copyImage(const HitTestResult&);
 
-  void transpose(EditCommandSource);
+  void transpose();
 
   void respondToChangedContents(const VisibleSelection& endingSelection);
 
@@ -112,32 +111,24 @@
   TriState selectionHasStyle(CSSPropertyID, const String& value) const;
   String selectionStartCSSPropertyValue(CSSPropertyID);
 
-  void removeFormattingAndStyle(EditCommandSource);
+  void removeFormattingAndStyle();
 
   void registerCommandGroup(CompositeEditCommand* commandGroupWrapper);
   void clearLastEditCommand();
 
-  bool deleteWithDirection(EditCommandSource,
-                           DeleteDirection,
+  bool deleteWithDirection(DeleteDirection,
                            TextGranularity,
                            bool killRing,
                            bool isTypingAction);
   void deleteSelectionWithSmartDelete(
-      EditCommandSource,
       DeleteMode,
       InputEvent::InputType,
       const Position& referenceMovePosition = Position());
 
-  void applyStyle(EditCommandSource, StylePropertySet*, InputEvent::InputType);
-  void applyParagraphStyle(EditCommandSource,
-                           StylePropertySet*,
-                           InputEvent::InputType);
-  void applyStyleToSelection(EditCommandSource,
-                             StylePropertySet*,
-                             InputEvent::InputType);
-  void applyParagraphStyleToSelection(EditCommandSource,
-                                      StylePropertySet*,
-                                      InputEvent::InputType);
+  void applyStyle(StylePropertySet*, InputEvent::InputType);
+  void applyParagraphStyle(StylePropertySet*, InputEvent::InputType);
+  void applyStyleToSelection(StylePropertySet*, InputEvent::InputType);
+  void applyParagraphStyleToSelection(StylePropertySet*, InputEvent::InputType);
 
   void appliedEditing(CompositeEditCommand*);
   void unappliedEditing(EditCommandComposition*);
@@ -193,8 +184,7 @@
   bool executeCommand(const String& commandName, const String& value);
 
   bool insertText(const String&, KeyboardEvent* triggeringEvent);
-  bool insertTextWithoutSendingTextEvent(EditCommandSource,
-                                         const String&,
+  bool insertTextWithoutSendingTextEvent(const String&,
                                          bool selectInsertedText,
                                          TextEvent* triggeringEvent);
   bool insertLineBreak();
@@ -204,9 +194,9 @@
   void toggleOverwriteModeEnabled();
 
   bool canUndo();
-  void undo(EditCommandSource);
+  void undo();
   bool canRedo();
-  void redo(EditCommandSource);
+  void redo();
 
   void setBaseWritingDirection(WritingDirection);
 
@@ -250,9 +240,7 @@
   const VisibleSelection& mark() const;  // Mark, to be used as emacs uses it.
   void setMark(const VisibleSelection&);
 
-  void computeAndSetTypingStyle(EditCommandSource,
-                                StylePropertySet*,
-                                InputEvent::InputType);
+  void computeAndSetTypingStyle(StylePropertySet*, InputEvent::InputType);
 
   // |firstRectForRange| requires up-to-date layout.
   IntRect firstRectForRange(const EphemeralRange&) const;
@@ -263,22 +251,18 @@
   bool markedTextMatchesAreHighlighted() const;
   void setMarkedTextMatchesAreHighlighted(bool);
 
-  void replaceSelectionWithFragment(EditCommandSource,
-                                    DocumentFragment*,
+  void replaceSelectionWithFragment(DocumentFragment*,
                                     bool selectReplacement,
                                     bool smartReplace,
                                     bool matchStyle,
                                     InputEvent::InputType);
-  void replaceSelectionWithText(EditCommandSource,
-                                const String&,
+  void replaceSelectionWithText(const String&,
                                 bool selectReplacement,
                                 bool smartReplace,
                                 InputEvent::InputType);
 
   // Implementation of WebLocalFrameImpl::replaceSelection.
   void replaceSelection(const String&);
-  // Implementation of SpellChecker::replaceMisspelledRange.
-  void replaceSelectionForSpellChecker(const String&);
 
   void replaceSelectionAfterDragging(DocumentFragment*,
                                      InsertMode,
diff --git a/third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp b/third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp
index d6da2ae..ec9bd2e 100644
--- a/third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/EditorCommand.cpp
@@ -249,10 +249,10 @@
   // good reason for that?
   switch (source) {
     case EditCommandSource::kMenuOrKeyBinding:
-      frame.editor().applyStyleToSelection(source, style, inputType);
+      frame.editor().applyStyleToSelection(style, inputType);
       return true;
     case EditCommandSource::kDOM:
-      frame.editor().applyStyle(source, style, inputType);
+      frame.editor().applyStyle(style, inputType);
       return true;
   }
   NOTREACHED();
@@ -352,10 +352,10 @@
   // good reason for that?
   switch (source) {
     case EditCommandSource::kMenuOrKeyBinding:
-      frame.editor().applyParagraphStyleToSelection(source, style, inputType);
+      frame.editor().applyParagraphStyleToSelection(style, inputType);
       return true;
     case EditCommandSource::kDOM:
-      frame.editor().applyParagraphStyle(source, style, inputType);
+      frame.editor().applyParagraphStyle(style, inputType);
       return true;
   }
   NOTREACHED();
@@ -363,7 +363,6 @@
 }
 
 static bool executeInsertFragment(LocalFrame& frame,
-                                  EditCommandSource,
                                   DocumentFragment* fragment) {
   DCHECK(frame.document());
   return ReplaceSelectionCommand::create(
@@ -373,16 +372,14 @@
       ->apply();
 }
 
-static bool executeInsertElement(LocalFrame& frame,
-                                 EditCommandSource source,
-                                 HTMLElement* content) {
+static bool executeInsertElement(LocalFrame& frame, HTMLElement* content) {
   DCHECK(frame.document());
   DocumentFragment* fragment = DocumentFragment::create(*frame.document());
   DummyExceptionStateForTesting exceptionState;
   fragment->appendChild(content, exceptionState);
   if (exceptionState.hadException())
     return false;
-  return executeInsertFragment(frame, source, fragment);
+  return executeInsertFragment(frame, fragment);
 }
 
 static bool expandSelectionToGranularity(LocalFrame& frame,
@@ -583,7 +580,7 @@
   switch (source) {
     case EditCommandSource::kMenuOrKeyBinding: {
       // Doesn't modify the text if the current selection isn't a range.
-      frame.editor().performDelete(source);
+      frame.editor().performDelete();
       return true;
     }
     case EditCommandSource::kDOM:
@@ -604,9 +601,9 @@
 
 static bool executeDeleteBackward(LocalFrame& frame,
                                   Event*,
-                                  EditCommandSource source,
+                                  EditCommandSource,
                                   const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Backward,
+  frame.editor().deleteWithDirection(DeleteDirection::Backward,
                                      CharacterGranularity, false, true);
   return true;
 }
@@ -614,68 +611,68 @@
 static bool executeDeleteBackwardByDecomposingPreviousCharacter(
     LocalFrame& frame,
     Event*,
-    EditCommandSource source,
+    EditCommandSource,
     const String&) {
   DLOG(ERROR) << "DeleteBackwardByDecomposingPreviousCharacter is not "
                  "implemented, doing DeleteBackward instead";
-  frame.editor().deleteWithDirection(source, DeleteDirection::Backward,
+  frame.editor().deleteWithDirection(DeleteDirection::Backward,
                                      CharacterGranularity, false, true);
   return true;
 }
 
 static bool executeDeleteForward(LocalFrame& frame,
                                  Event*,
-                                 EditCommandSource source,
+                                 EditCommandSource,
                                  const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Forward,
+  frame.editor().deleteWithDirection(DeleteDirection::Forward,
                                      CharacterGranularity, false, true);
   return true;
 }
 
 static bool executeDeleteToBeginningOfLine(LocalFrame& frame,
                                            Event*,
-                                           EditCommandSource source,
+                                           EditCommandSource,
                                            const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Backward,
-                                     LineBoundary, true, false);
+  frame.editor().deleteWithDirection(DeleteDirection::Backward, LineBoundary,
+                                     true, false);
   return true;
 }
 
 static bool executeDeleteToBeginningOfParagraph(LocalFrame& frame,
                                                 Event*,
-                                                EditCommandSource source,
+                                                EditCommandSource,
                                                 const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Backward,
+  frame.editor().deleteWithDirection(DeleteDirection::Backward,
                                      ParagraphBoundary, true, false);
   return true;
 }
 
 static bool executeDeleteToEndOfLine(LocalFrame& frame,
                                      Event*,
-                                     EditCommandSource source,
+                                     EditCommandSource,
                                      const String&) {
   // Despite its name, this command should delete the newline at the end of a
   // paragraph if you are at the end of a paragraph (like
   // DeleteToEndOfParagraph).
-  frame.editor().deleteWithDirection(source, DeleteDirection::Forward,
-                                     LineBoundary, true, false);
+  frame.editor().deleteWithDirection(DeleteDirection::Forward, LineBoundary,
+                                     true, false);
   return true;
 }
 
 static bool executeDeleteToEndOfParagraph(LocalFrame& frame,
                                           Event*,
-                                          EditCommandSource source,
+                                          EditCommandSource,
                                           const String&) {
   // Despite its name, this command should delete the newline at the end of
   // a paragraph if you are at the end of a paragraph.
-  frame.editor().deleteWithDirection(source, DeleteDirection::Forward,
+  frame.editor().deleteWithDirection(DeleteDirection::Forward,
                                      ParagraphBoundary, true, false);
   return true;
 }
 
 static bool executeDeleteToMark(LocalFrame& frame,
                                 Event*,
-                                EditCommandSource source,
+                                EditCommandSource,
                                 const String&) {
   const EphemeralRange mark =
       frame.editor().mark().toNormalizedEphemeralRange();
@@ -688,26 +685,26 @@
     if (!selected)
       return false;
   }
-  frame.editor().performDelete(source);
+  frame.editor().performDelete();
   frame.editor().setMark(frame.selection().selection());
   return true;
 }
 
 static bool executeDeleteWordBackward(LocalFrame& frame,
                                       Event*,
-                                      EditCommandSource source,
+                                      EditCommandSource,
                                       const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Backward,
-                                     WordGranularity, true, false);
+  frame.editor().deleteWithDirection(DeleteDirection::Backward, WordGranularity,
+                                     true, false);
   return true;
 }
 
 static bool executeDeleteWordForward(LocalFrame& frame,
                                      Event*,
-                                     EditCommandSource source,
+                                     EditCommandSource,
                                      const String&) {
-  frame.editor().deleteWithDirection(source, DeleteDirection::Forward,
-                                     WordGranularity, true, false);
+  frame.editor().deleteWithDirection(DeleteDirection::Forward, WordGranularity,
+                                     true, false);
   return true;
 }
 
@@ -781,7 +778,7 @@
   EditingState editingState;
   switch (source) {
     case EditCommandSource::kMenuOrKeyBinding:
-      frame.editor().deleteWithDirection(source, DeleteDirection::Forward,
+      frame.editor().deleteWithDirection(DeleteDirection::Forward,
                                          CharacterGranularity, false, true);
       return true;
     case EditCommandSource::kDOM:
@@ -819,10 +816,8 @@
 
 static bool executeInsertBacktab(LocalFrame& frame,
                                  Event* event,
-                                 EditCommandSource source,
+                                 EditCommandSource,
                                  const String&) {
-  DCHECK_EQ(source, EditCommandSource::kMenuOrKeyBinding)
-      << "|TextInputEvent| should only be triggered from user action.";
   return targetFrame(frame, event)
       ->eventHandler()
       .handleTextInputEvent("\t", event, TextEventInputBackTab);
@@ -830,33 +825,33 @@
 
 static bool executeInsertHorizontalRule(LocalFrame& frame,
                                         Event*,
-                                        EditCommandSource source,
+                                        EditCommandSource,
                                         const String& value) {
   DCHECK(frame.document());
   HTMLHRElement* rule = HTMLHRElement::create(*frame.document());
   if (!value.isEmpty())
     rule->setIdAttribute(AtomicString(value));
-  return executeInsertElement(frame, source, rule);
+  return executeInsertElement(frame, rule);
 }
 
 static bool executeInsertHTML(LocalFrame& frame,
                               Event*,
-                              EditCommandSource source,
+                              EditCommandSource,
                               const String& value) {
   DCHECK(frame.document());
   return executeInsertFragment(
-      frame, source, createFragmentFromMarkup(*frame.document(), value, ""));
+      frame, createFragmentFromMarkup(*frame.document(), value, ""));
 }
 
 static bool executeInsertImage(LocalFrame& frame,
                                Event*,
-                               EditCommandSource source,
+                               EditCommandSource,
                                const String& value) {
   DCHECK(frame.document());
   HTMLImageElement* image = HTMLImageElement::create(*frame.document());
   if (!value.isEmpty())
     image->setSrc(value);
-  return executeInsertElement(frame, source, image);
+  return executeInsertElement(frame, image);
 }
 
 static bool executeInsertLineBreak(LocalFrame& frame,
@@ -882,10 +877,8 @@
 
 static bool executeInsertNewline(LocalFrame& frame,
                                  Event* event,
-                                 EditCommandSource source,
+                                 EditCommandSource,
                                  const String&) {
-  DCHECK_EQ(source, EditCommandSource::kMenuOrKeyBinding)
-      << "|TextInputEvent| should only be triggered from user action.";
   LocalFrame* targetFrame = blink::targetFrame(frame, event);
   return targetFrame->eventHandler().handleTextInputEvent(
       "\n", event, targetFrame->editor().canEditRichly()
@@ -922,10 +915,8 @@
 
 static bool executeInsertTab(LocalFrame& frame,
                              Event* event,
-                             EditCommandSource source,
+                             EditCommandSource,
                              const String&) {
-  DCHECK_EQ(source, EditCommandSource::kMenuOrKeyBinding)
-      << "|TextInputEvent| should only be triggered from user action.";
   return targetFrame(frame, event)
       ->eventHandler()
       .handleTextInputEvent("\t", event);
@@ -988,38 +979,38 @@
 
 static bool executeMakeTextWritingDirectionLeftToRight(LocalFrame& frame,
                                                        Event*,
-                                                       EditCommandSource source,
+                                                       EditCommandSource,
                                                        const String&) {
   MutableStylePropertySet* style =
       MutableStylePropertySet::create(HTMLQuirksMode);
   style->setProperty(CSSPropertyUnicodeBidi, CSSValueIsolate);
   style->setProperty(CSSPropertyDirection, CSSValueLtr);
-  frame.editor().applyStyle(source, style,
+  frame.editor().applyStyle(style,
                             InputEvent::InputType::FormatSetBlockTextDirection);
   return true;
 }
 
 static bool executeMakeTextWritingDirectionNatural(LocalFrame& frame,
                                                    Event*,
-                                                   EditCommandSource source,
+                                                   EditCommandSource,
                                                    const String&) {
   MutableStylePropertySet* style =
       MutableStylePropertySet::create(HTMLQuirksMode);
   style->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
-  frame.editor().applyStyle(source, style,
+  frame.editor().applyStyle(style,
                             InputEvent::InputType::FormatSetBlockTextDirection);
   return true;
 }
 
 static bool executeMakeTextWritingDirectionRightToLeft(LocalFrame& frame,
                                                        Event*,
-                                                       EditCommandSource source,
+                                                       EditCommandSource,
                                                        const String&) {
   MutableStylePropertySet* style =
       MutableStylePropertySet::create(HTMLQuirksMode);
   style->setProperty(CSSPropertyUnicodeBidi, CSSValueIsolate);
   style->setProperty(CSSPropertyDirection, CSSValueRtl);
-  frame.editor().applyStyle(source, style,
+  frame.editor().applyStyle(style,
                             InputEvent::InputType::FormatSetBlockTextDirection);
   return true;
 }
@@ -1550,17 +1541,17 @@
 
 static bool executeRedo(LocalFrame& frame,
                         Event*,
-                        EditCommandSource source,
+                        EditCommandSource,
                         const String&) {
-  frame.editor().redo(source);
+  frame.editor().redo();
   return true;
 }
 
 static bool executeRemoveFormat(LocalFrame& frame,
                                 Event*,
-                                EditCommandSource source,
+                                EditCommandSource,
                                 const String&) {
-  frame.editor().removeFormattingAndStyle(source);
+  frame.editor().removeFormattingAndStyle();
   return true;
 }
 
@@ -1747,9 +1738,9 @@
 
 static bool executeTranspose(LocalFrame& frame,
                              Event*,
-                             EditCommandSource source,
+                             EditCommandSource,
                              const String&) {
-  frame.editor().transpose(source);
+  frame.editor().transpose();
   return true;
 }
 
@@ -1765,9 +1756,9 @@
 
 static bool executeUndo(LocalFrame& frame,
                         Event*,
-                        EditCommandSource source,
+                        EditCommandSource,
                         const String&) {
-  frame.editor().undo(source);
+  frame.editor().undo();
   return true;
 }
 
@@ -1797,20 +1788,20 @@
 
 static bool executeYank(LocalFrame& frame,
                         Event*,
-                        EditCommandSource source,
+                        EditCommandSource,
                         const String&) {
   frame.editor().insertTextWithoutSendingTextEvent(
-      source, frame.editor().killRing().yank(), false, 0);
+      frame.editor().killRing().yank(), false, 0);
   frame.editor().killRing().setToYankedState();
   return true;
 }
 
 static bool executeYankAndSelect(LocalFrame& frame,
                                  Event*,
-                                 EditCommandSource source,
+                                 EditCommandSource,
                                  const String&) {
   frame.editor().insertTextWithoutSendingTextEvent(
-      source, frame.editor().killRing().yank(), true, 0);
+      frame.editor().killRing().yank(), true, 0);
   frame.editor().killRing().setToYankedState();
   return true;
 }
@@ -2563,11 +2554,9 @@
   // Specially handling commands that Editor::execCommand does not directly
   // support.
   if (commandName == "DeleteToEndOfParagraph") {
-    if (!deleteWithDirection(EditCommandSource::kMenuOrKeyBinding,
-                             DeleteDirection::Forward, ParagraphBoundary, true,
+    if (!deleteWithDirection(DeleteDirection::Forward, ParagraphBoundary, true,
                              false))
-      deleteWithDirection(EditCommandSource::kMenuOrKeyBinding,
-                          DeleteDirection::Forward, CharacterGranularity, true,
+      deleteWithDirection(DeleteDirection::Forward, CharacterGranularity, true,
                           false);
     return true;
   }
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index 8f5d02f..664da65 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -855,7 +855,8 @@
 
   if (cancel)
     return;
-  frame().editor().replaceSelectionForSpellChecker(text);
+  frame().editor().replaceSelectionWithText(
+      text, false, false, InputEvent::InputType::InsertReplacementText);
 }
 
 static bool shouldCheckOldSelection(const Position& oldSelectionStart) {
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
index 5d21ce0b..ea42449 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
@@ -47,8 +47,8 @@
 static const char kContentHintStringNone[] = "";
 static const char kContentHintStringAudioSpeech[] = "speech";
 static const char kContentHintStringAudioMusic[] = "music";
-static const char kContentHintStringVideoFluid[] = "fluid";
-static const char kContentHintStringVideoDetailed[] = "detailed";
+static const char kContentHintStringVideoMotion[] = "motion";
+static const char kContentHintStringVideoDetail[] = "detail";
 }  // namespace
 
 MediaStreamTrack* MediaStreamTrack::create(ExecutionContext* context,
@@ -121,10 +121,10 @@
       return kContentHintStringAudioSpeech;
     case WebMediaStreamTrack::ContentHintType::AudioMusic:
       return kContentHintStringAudioMusic;
-    case WebMediaStreamTrack::ContentHintType::VideoFluid:
-      return kContentHintStringVideoFluid;
-    case WebMediaStreamTrack::ContentHintType::VideoDetailed:
-      return kContentHintStringVideoDetailed;
+    case WebMediaStreamTrack::ContentHintType::VideoMotion:
+      return kContentHintStringVideoMotion;
+    case WebMediaStreamTrack::ContentHintType::VideoDetail:
+      return kContentHintStringVideoDetail;
   }
 
   NOTREACHED();
@@ -152,10 +152,10 @@
     case MediaStreamSource::TypeVideo:
       if (hint == kContentHintStringNone) {
         translatedHint = WebMediaStreamTrack::ContentHintType::None;
-      } else if (hint == kContentHintStringVideoFluid) {
-        translatedHint = WebMediaStreamTrack::ContentHintType::VideoFluid;
-      } else if (hint == kContentHintStringVideoDetailed) {
-        translatedHint = WebMediaStreamTrack::ContentHintType::VideoDetailed;
+      } else if (hint == kContentHintStringVideoMotion) {
+        translatedHint = WebMediaStreamTrack::ContentHintType::VideoMotion;
+      } else if (hint == kContentHintStringVideoDetail) {
+        translatedHint = WebMediaStreamTrack::ContentHintType::VideoDetail;
       } else {
         // TODO(pbos): Log warning?
         // Invalid values for video are to be ignored (similar to invalid enum
diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.h b/third_party/WebKit/Source/platform/fonts/FontCache.h
index 8b5febdd8..0935f29 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.h
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.h
@@ -48,6 +48,7 @@
 
 #include "SkFontMgr.h"
 
+class SkString;
 class SkTypeface;
 
 namespace base {
@@ -277,6 +278,8 @@
   ~FontCachePurgePreventer() { FontCache::fontCache()->enablePurging(); }
 };
 
+AtomicString toAtomicString(const SkString&);
+
 }  // namespace blink
 
 #endif
diff --git a/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp b/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp
index 6ccaffc..e31e4dd4 100644
--- a/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp
+++ b/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp
@@ -40,11 +40,22 @@
 namespace blink {
 
 static AtomicString defaultFontFamily(SkFontMgr* fontManager) {
+  // Pass nullptr to get the default typeface. The default typeface in Android
+  // is "sans-serif" if exists, or the first entry in fonts.xml.
   sk_sp<SkTypeface> typeface(
       fontManager->legacyCreateTypeface(nullptr, SkFontStyle()));
-  SkString familyName;
-  typeface->getFamilyName(&familyName);
-  return familyName.c_str();
+  if (typeface) {
+    SkString familyName;
+    typeface->getFamilyName(&familyName);
+    if (familyName.size())
+      return toAtomicString(familyName);
+  }
+
+  // Some devices do not return the default typeface. There's not much we can
+  // do here, use "Arial", the value LayoutTheme uses for CSS system font
+  // keywords such as "menu".
+  NOTREACHED();
+  return "Arial";
 }
 
 static AtomicString defaultFontFamily() {
diff --git a/third_party/WebKit/Source/platform/fonts/skia/FontCacheSkia.cpp b/third_party/WebKit/Source/platform/fonts/skia/FontCacheSkia.cpp
index 6b19174..4d35816c 100644
--- a/third_party/WebKit/Source/platform/fonts/skia/FontCacheSkia.cpp
+++ b/third_party/WebKit/Source/platform/fonts/skia/FontCacheSkia.cpp
@@ -64,6 +64,10 @@
 
 namespace blink {
 
+AtomicString toAtomicString(const SkString& str) {
+  return AtomicString::fromUTF8(str.c_str(), str.size());
+}
+
 #if OS(ANDROID) || OS(LINUX)
 // Android special locale for retrieving the color emoji font
 // based on the proposed changes in UTR #51 for introducing
@@ -104,7 +108,7 @@
 
   SkString skiaFamilyName;
   typeface->getFamilyName(&skiaFamilyName);
-  return skiaFamilyName.c_str();
+  return toAtomicString(skiaFamilyName);
 }
 #endif
 
diff --git a/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp b/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp
index 8aebb5e..7b666ba 100644
--- a/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp
+++ b/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp
@@ -156,7 +156,7 @@
     if (typeface) {
       SkString skiaFamily;
       typeface->getFamilyName(&skiaFamily);
-      FontFaceCreationParams createByFamily(AtomicString(skiaFamily.c_str()));
+      FontFaceCreationParams createByFamily(toAtomicString(skiaFamily));
       data = getFontPlatformData(fontDescription, createByFamily);
     }
   }
@@ -229,7 +229,7 @@
 }
 
 static inline bool equalIgnoringCase(const AtomicString& a, const SkString& b) {
-  return equalIgnoringCase(a, AtomicString::fromUTF8(b.c_str()));
+  return equalIgnoringCase(a, toAtomicString(b));
 }
 
 static bool typefacesMatchesFamily(const SkTypeface* tf,
diff --git a/third_party/WebKit/Source/platform/mediastream/MediaStreamComponent.cpp b/third_party/WebKit/Source/platform/mediastream/MediaStreamComponent.cpp
index 6ffd532..adfff70 100644
--- a/third_party/WebKit/Source/platform/mediastream/MediaStreamComponent.cpp
+++ b/third_party/WebKit/Source/platform/mediastream/MediaStreamComponent.cpp
@@ -106,8 +106,8 @@
     case WebMediaStreamTrack::ContentHintType::AudioMusic:
       DCHECK_EQ(MediaStreamSource::TypeAudio, source()->type());
       break;
-    case WebMediaStreamTrack::ContentHintType::VideoFluid:
-    case WebMediaStreamTrack::ContentHintType::VideoDetailed:
+    case WebMediaStreamTrack::ContentHintType::VideoMotion:
+    case WebMediaStreamTrack::ContentHintType::VideoDetail:
       DCHECK_EQ(MediaStreamSource::TypeVideo, source()->type());
       break;
   }
diff --git a/third_party/WebKit/Source/web/tests/WebFrameTest.cpp b/third_party/WebKit/Source/web/tests/WebFrameTest.cpp
index 853ab22..83d8911 100644
--- a/third_party/WebKit/Source/web/tests/WebFrameTest.cpp
+++ b/third_party/WebKit/Source/web/tests/WebFrameTest.cpp
@@ -6512,7 +6512,8 @@
       WebSettings::EditingBehaviorWin);
 
   element->focus();
-  frame->frame()->editor().replaceSelectionForSpellChecker("A");
+  frame->frame()->editor().replaceSelectionWithText(
+      "A", false, false, InputEvent::InputType::InsertReplacementText);
   frame->frame()->spellChecker().cancelCheck();
 }
 
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_bridge_bot.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_bridge_bot.py
deleted file mode 100644
index b549a287..0000000
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_bridge_bot.py
+++ /dev/null
@@ -1,549 +0,0 @@
-# Copyright 2016 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# DO NOT RUN THIS CODE. If this runs on multiple machines, we'll see
-# inconsistent behavior, and will mess up both of Chromium project and
-# web-platform-tests project.
-# We checked in this code to share a part of the code, and will remove this
-# later.
-
-# * Setting for Gerrit access
-#   1. Create a service account and get a JSON file including a private key.
-#   2. Put the JSON file to this directory as "wpt-chromium-bridge.json".
-#   2. Configure gerrit server so that the service account can
-#     - Add a comment
-#     - Update Verified label
-#     - Update Commit-Queue label on behalf of someone.
-#     - Abandon reviews
-#
-# * Setting for GitHub access via git
-#   Register ssh host "github-bot" to access github.com with an account who can
-#   push to the master WPT repository.
-#  e.g.
-#   1. Generate a ssh key pair as ~/.ssh/ghbotaccount_id_rsa* without passphrase
-#   2. ~/.ssh/config
-#     Host github-bot
-#         Hostname github.com
-#         User git
-#         IdentityFile ~/.ssh/ghbotaccount_id_rsa
-#   3. Register ghbotaccount_id_rsa.pub to a pushable account on github.com.
-#   4. Access github-bot once via git/ssh manually to register a host key of
-#     github.com.
-#
-# * Setting for GitHub access via REST API
-#   1. Obtain a personal access token.  See https://help.github.com/articles/creating-an-access-token-for-command-line-use/
-#   2. Put your GitHub account name and the access token to ./github-rest-account.json like
-#     { "name": "tkent-google", "token": "ABCDEF...."}
-
-import argparse
-import base64
-import httplib2
-import json
-import math
-import os
-import re
-import subprocess
-import tempfile
-import time
-
-from oauth2client.service_account import ServiceAccountCredentials
-
-# We should have a checkout on WORKING_COPY_DIR/web-platform-tests.
-# We check it out with a pushable account.
-# We may make unique tmp dir on every startup if this code runs for a long time.
-WORKING_COPY_DIR = "~/src"
-WPT_DIR = WORKING_COPY_DIR + "/web-platform-tests"
-
-PENDING_MERGE_FILE = "./pending_merge.json"
-
-STOP_FILE = "./STOP"
-
-GITHUB_REST_ACCOUNT_FILE = "./github-rest-account.json"
-
-# The list of people who has WPT push privilege and is a chromium committer.
-# https://github.com/orgs/w3c/teams/web-platform-testing
-OWNER_LIST = [
-    "dominicc@chromium.org",
-    "foolip@chromium.org",
-    "hayato@chromium.org",
-    "jsbell@chromium.org",
-    "kochi@chromium.org",
-    "kojii@chromium.org",
-    "mkwst@chromium.org",
-    "rbyers@chromium.org",
-    "tkent@chromium.org"
-]
-
-
-def create_owner_list(indent=''):
-    result = ''
-    for email in OWNER_LIST:
-        result += indent + email + "\n"
-    return result
-
-
-def is_owner_id(email):
-    for entry in OWNER_LIST:
-        if entry == email:
-            return True
-    return False
-
-
-def run_command_in_wpt_dir(argv):
-    return subprocess.call(argv, cwd=os.path.expanduser(WPT_DIR))
-
-
-def ensure_clean_checkout():
-    if not os.access(os.path.expanduser(WPT_DIR), os.R_OK):
-        print "ensure_clean_checkout: Full clone"
-        work_dir = os.path.expanduser(WORKING_COPY_DIR)
-        if not os.access(work_dir, os.R_OK):
-            os.mkdir(work_dir)
-        subprocess.call(["git", "clone", "--recursive", "github-bot:w3c/web-platform-tests.git"], cwd=work_dir)
-        return
-    print "EnsureCleanChckout: update"
-    run_command_in_wpt_dir(["git", "checkout", "-f", "master"])
-    run_command_in_wpt_dir(["git", "reset", "--hard", "HEAD"])
-    run_command_in_wpt_dir(["git", "pull"])
-    run_command_in_wpt_dir(["git", "submodule", "update", "--recursive"])
-
-
-# ================================================================
-# https://gerrit-review.googlesource.com/Documentation/rest-api-changes.html
-
-def gerrit_create_protocol():
-    #  https://gerrit-internal.git.corp.google.com/docs/+/master/users/from-gce.md
-    scopes = ['https://www.googleapis.com/auth/gerritcodereview']
-    credentials = ServiceAccountCredentials.from_json_keyfile_name(
-        './wpt-chromium-bridge.json', scopes=scopes)
-    return credentials.authorize(httplib2.Http())
-
-
-def gerrit_get_json(endpoint, method, request_json):
-    http = gerrit_create_protocol()
-    request_body = None
-    request_headers = {}
-    if request_json is not None:
-        request_body = json.JSONEncoder().encode(request_json)
-        request_headers["Content-Type"] = "application/json"
-    (headers, content) = http.request("https://chromium-review.googlesource.com/a/%s" % endpoint,
-                                      method,
-                                      body=request_body, headers=request_headers)
-    if headers["status"] != "200":
-        print content
-        raise Exception("An Gerrit error; status=%s" % headers["status"])
-    if content.startswith(")]}'\n"):
-        return json.loads(content[5:])
-    raise Exception("An Gerrit error; content=%s" % content)
-
-
-def gerrit_query_open_changes():
-    # can we limit branch=master by query?
-    return gerrit_get_json("changes/?q=project:external/w3c/web-platform-tests+status:open&o=LABELS&o=DETAILED_ACCOUNTS",
-                           "GET", None)
-
-
-def gerrit_add_review(change_id, message, labels=None, on_behalf_of=None):
-    request = {"message": "=== WPT bridge bot ===\n" + message}
-    if labels is not None:
-        request["labels"] = labels
-    if on_behalf_of is not None:
-        request["on_behalf_of"] = on_behalf_of
-
-    print request
-    gerrit_get_json("changes/%d/revisions/current/review" % change_id, "POST", request)
-
-
-def gerrit_close(change_id, message):
-    request = {"message": "=== WPT bridge bot ===\n" + message}
-    print request
-    gerrit_get_json("changes/%d/abandon" % change_id, "POST", request)
-
-
-def gerrit_fetch_patch(change_id):
-    print "gerrit_fetch_patch:"
-    http = gerrit_create_protocol()
-    (headers, content) = http.request("https://chromium-review.googlesource.com/a/changes/%s/revisions/current/patch" % change_id,
-                                      "GET")
-    if headers["status"] != "200":
-        raise Exception("An Gerrit error; status=%s" % headers["status"])
-    return base64.b64decode(content)
-
-
-# ================================================================
-
-def github_auth_token():
-    with open(GITHUB_REST_ACCOUNT_FILE) as fh:
-        json_obj = json.loads(fh.read())
-        return base64.encodestring(json_obj["name"] + ':' + json_obj["token"])
-
-
-def github_create_pr(branch_name, desc_title, gerrit_review_url):
-    # https://developer.github.com/v3/pulls/#create-a-pull-request
-    conn = httplib2.Http()
-    headers = {
-        "Accept": "application/vnd.github.v3+json",
-        "Authorization": "Basic " + github_auth_token()
-    }
-    body = {
-        "title": desc_title,
-        "body": "Merge from %s\n\nA bot created this PR, and will merge this in some minutes.\n" +
-                "People don't need to review this.\n" % gerrit_review_url,
-        "head": branch_name,
-        "base": "master"
-    }
-    resp, content = conn.request("https://api.github.com/repos/w3c/web-platform-tests/pulls",
-                                 "POST", body=json.JSONEncoder().encode(body), headers=headers)
-    print "GitHub response:"
-    print content
-    if resp["status"] != "201":
-        return None
-    return json.loads(content)
-
-
-def github_merge(pr_number, desc_title, desc_body):
-    # https://developer.github.com/v3/pulls/#merge-a-pull-request-merge-button
-    headers = {
-        # commit_title and merge_method isn't avaiable in v3 API.
-        "Accept": "application/vnd.github.polaris-preview+json",
-        "Authorization": "Basic " + github_auth_token()
-    }
-    body = {
-        "commit_title": desc_title,
-        "commit_message": desc_body,
-        "merge_method": "squash"
-    }
-    conn = httplib2.Http()
-    resp, content = conn.request("https://api.github.com/repos/w3c/web-platform-tests/pulls/%d/merge" % pr_number,
-                                 "PUT", body=json.JSONEncoder().encode(body), headers=headers)
-    print resp
-    print content
-    status = resp["status"]
-    if status == "200" or status == "405" or status == "409":
-        return json.loads(content)
-    return None
-
-
-# ================================================================
-
-def apply_patch(patch):
-    temp = tempfile.NamedTemporaryFile(delete=False)
-    print "apply_patch: tmp=" + temp.name
-    temp.write(patch)
-    temp.close()
-    retcode = run_command_in_wpt_dir(["git", "apply", "--index", temp.name])
-    os.remove(temp.name)
-    return retcode == 0
-
-
-def do_chromium_presubmit(patch):
-    print "do_chromium_presubmit"
-    # TODO(tkent): Should check lines starting with '+'.
-    if re.search(r"\W(internals|testRunner|eventSender)\.", patch):
-        return False
-    return True
-
-
-def try_patch(change_id, patch, branch_name):
-    run_command_in_wpt_dir(["git", "checkout", "-b", branch_name])
-    # ChangeInfo.mergeable indicates whether we can apply the patch.  However we
-    # actually need to apply the patch because we run |lint|.
-    patch_result = apply_patch(patch)
-    lint_result = None
-    presubmit_result = None
-    if patch_result:
-        # TODO(tkent): Show lint output.
-        _, _, _, files = extract_description(patch, change_id)
-        print "try_patch: run lint"
-        command = ["python", "lint"]
-        command += files
-        lint_result = 0 == run_command_in_wpt_dir(command)
-        presubmit_result = do_chromium_presubmit(patch)
-    return (patch_result, lint_result, presubmit_result)
-
-
-def clean_branch(branch_name):
-    run_command_in_wpt_dir(["find", ".", "-name", "*.rej", "-delete"])
-    run_command_in_wpt_dir(["git", "reset", "--hard", "HEAD"])
-    run_command_in_wpt_dir(["git", "checkout", "master"])
-    run_command_in_wpt_dir(["git", "branch", "-D", branch_name])
-
-
-def verify_change(change_id, dry_run=False):
-    print ">>> Verifying %d ================================================================" % change_id
-    ensure_clean_checkout()
-    patch = gerrit_fetch_patch(change_id)
-    branch_name = "chromium-try-%d-%.0f" % (change_id, time.time())
-    (result, lint_result, presubmit_result) = try_patch(change_id, patch, branch_name)
-    clean_branch(branch_name)
-    lint_result_string = "N/A"
-    if lint_result:
-        lint_result_string = "OK"
-    elif lint_result is False:
-        lint_result_string = "NG"
-    presubmit_result_string = "N/A"
-    if presubmit_result:
-        presubmit_result_string = "OK"
-    elif presubmit_result is False:
-        presubmit_result_string = "NG"
-    status = "  Apply patch: %s\n  WPT lint: %s\n  Chromium-specific check: %s\n" % \
-             ("OK" if result else "NG", lint_result_string, presubmit_result_string)
-    message = None
-    labels = None
-    # TODO(tkent): Should show commit ID.
-    if result and lint_result and presubmit_result:
-        message = "Found no problems in this change:\n" + status + \
-                  "\nThis change needs Code-Review+2 from one of the following people if you are not one of them:\n" + \
-                  create_owner_list(indent='  ')
-        labels = {"Verified": 1}
-    else:
-        message = "Found this change had problems:\n%s" % status
-        labels = {"Verified": -1}
-    print "verify_change:"
-    print message, labels
-    if not dry_run:
-        gerrit_add_review(change_id, message, labels)
-
-
-def find_and_verify_changes(changes):
-    for change_info in changes:
-        if len(change_info["labels"]["Verified"]) == 0:
-            try:
-                verify_change(change_info["_number"], dry_run=False)
-            except Exception as ex:
-                print ex
-
-
-def split_description(cl_description):
-    linebreak = cl_description.find("\n")
-    if linebreak == -1:
-        return cl_description, ""
-    return cl_description[0:linebreak], cl_description[linebreak + 1:]
-
-
-def extract_description(patch, change_id):
-    author = re.search(r"^From: (.*)$", patch, re.MULTILINE).group(1)
-    match = re.search(r"^Subject: \[PATCH\] (.*)^(Change-Id: \w+\n)", patch, re.DOTALL | re.MULTILINE)
-    review_url = "https://chromium-review.googlesource.com/%d" % change_id
-
-    cl_description = match.group(1) + ("Author: %s\n" % author) + ("Review: %s\n\n" % review_url) + match.group(2)
-    title, body = split_description(cl_description)
-
-    files = []
-    for match in re.finditer(r"^\+\+\+ [^/]+/(.*?)$", patch, re.MULTILINE):
-        files.append(match.group(1))
-
-    return title, body, review_url, files
-
-
-def enqueue_merge_request(change_id, cq_setter, pr_number, branch_name, timestamp):
-    merge_record = {"change_id": change_id,
-                    "cq_setter": cq_setter,
-                    "pr_number": pr_number,
-                    "branch_name": branch_name,
-                    "pr_created": timestamp}
-    queue = load_merge_request_queue()
-    queue.append(merge_record)
-    save_merge_request_queue(queue)
-
-
-def load_merge_request_queue():
-    if os.access(PENDING_MERGE_FILE, os.R_OK):
-        with open(PENDING_MERGE_FILE) as fh:
-            return json.loads(fh.read())
-    return []
-
-
-def save_merge_request_queue(queue):
-    if os.access(PENDING_MERGE_FILE, os.R_OK):
-        backup = PENDING_MERGE_FILE + "~"
-        if os.access(backup, os.R_OK):
-            os.remove(backup)
-        os.rename(PENDING_MERGE_FILE, backup)
-    if len(queue) > 0:
-        with open(PENDING_MERGE_FILE, "wb") as fh:
-            fh.write(json.dumps(queue))
-
-
-def commit_change(change_info, dry_run=False):
-    change_id = change_info["_number"]
-    print ">>> Committing %d ================================================================" % change_id
-
-    cq_setter = change_info["labels"]["Commit-Queue"]["recommended"]["_account_id"]
-    # Verify approver
-    if "approved" not in change_info["labels"]["Code-Review"]:
-        gerrit_add_review(change_id, "This isn't approved yet.\n",
-                          labels={"Commit-Queue": 0}, on_behalf_of=cq_setter)
-        return
-    if not is_owner_id(change_info["labels"]["Code-Review"]["approved"]["email"]) and \
-       not is_owner_id(change_info["owner"]["email"]):
-        gerrit_add_review(change_id, "This isn't approved by an appropriate people.\n",
-                          labels={"Commit-Queue": 0}, on_behalf_of=cq_setter)
-        return
-
-    print ">> Passed owner check"
-    print change_info
-    ensure_clean_checkout()
-    patch = gerrit_fetch_patch(change_id)
-    branch_name = "chromium-review-%d-%.0f" % (change_id, math.floor(time.time()))
-    (result, lint_result, presubmit_result) = try_patch(change_id, patch, branch_name)
-    if result and lint_result and presubmit_result:
-        desc_title, desc_body, review_url, _ = extract_description(patch, change_id)
-        cl_description = desc_title + "\n" + desc_body
-        print "Change Description:\n" + cl_description
-        if dry_run:
-            print ">> dry_run: Aborted. branch_name='%s' title='%s' body='%s'\n" % (branch_name, desc_title, desc_body)
-            return
-        run_command_in_wpt_dir(["git", "commit", "-a", "-m", cl_description])
-        run_command_in_wpt_dir(["git", "push", "origin", branch_name])
-
-        # Make a PR on GitHub.
-        pr_result = github_create_pr(branch_name, desc_title, review_url)
-        if pr_result is None or "html_url" not in pr_result or "number" not in pr_result:
-            # TODO(tkent): The following command fails if Gerrit is offline, and
-            # the bot will try to make a new PR again.
-            gerrit_add_review(change_id, "Failed to create a pull request.\n",
-                              labels={"Commit-Queue": 0}, on_behalf_of=cq_setter)
-            clean_branch(branch_name)
-            run_command_in_wpt_dir(["git", "push", "--delete", "origin", branch_name])
-            return
-        clean_branch(branch_name)
-
-        # Merge immediately didn't work.  We need to wait for at least three minutes.
-        enqueue_merge_request(change_id, cq_setter, pr_result["number"], branch_name, math.floor(time.time()))
-        gerrit_add_review(change_id, "Created a pull request: " + pr_result["html_url"] + "\n")
-    else:
-        # TODO(tkent): write a message about the failure.
-        gerrit_add_review(change_id, "Verification failure.\n",
-                          labels={"Commit-Queue": 0}, on_behalf_of=cq_setter)
-    return
-
-
-def find_and_commit_changes(changes):
-    for change_info in changes:
-        if "recommended" in change_info["labels"]["Commit-Queue"]:
-            try:
-                commit_change(change_info, dry_run=False)
-            except Exception as ex:
-                print ex
-
-
-def merge(request):
-    pr_number = request["pr_number"]
-    change_id = request["change_id"]
-    print "===> Merge PR#%d for gerrit/%d" % (pr_number, change_id)
-
-    try:
-        patch = gerrit_fetch_patch(change_id)
-        desc_title, desc_body, _, _ = extract_description(patch, change_id)
-        merge_result = github_merge(pr_number, desc_title, desc_body)
-        if merge_result is None:
-            gerrit_add_review(change_id, "Failed to merge the pull request.\n",
-                              labels={"Commit-Queue": 0}, on_behalf_of=request["cq_setter"])
-            # Should close the PR?
-        elif "merged" in merge_result:
-            # TODO(tkent): The following command fails if Gerrit is offline, and
-            # the bot will try to make a new PR again.
-            gerrit_close(change_id, "Merged the PR: https://github.com/w3c/web-platform-tests/commit/%s\n" +
-                         "Closing this review.\n" % merge_result["sha"])
-        elif re.search(r"pending", merge_result["message"]):
-            # Still need to wait.
-            return False
-        else:
-            gerrit_add_review(change_id, "Failed to merge the pull request: %s\n" % merge_result["message"],
-                              labels={"Commit-Queue": 0}, on_behalf_of=request["cq_setter"])
-            # TODO(tkent): Should close the PR?
-        run_command_in_wpt_dir(["git", "push", "--delete", "origin", request["branch_name"]])
-    except Exception as ex:
-        print ex
-        return False
-    return True
-
-
-def run_once_command(_):
-    queue = load_merge_request_queue()
-    # print "Loaded queue: ", queue
-    cloned_queue = queue[:]
-    for request in cloned_queue:
-        if merge(request):
-            queue.remove(request)
-    save_merge_request_queue(queue)
-
-    changes = gerrit_query_open_changes()
-    # Remove changes in |queue|.
-    cloned_changes = changes[:]
-    for change_info in cloned_changes:
-        if not change_info["branch"].endswith("master"):
-            changes.remove(change_info)
-            continue
-        for request in queue:
-            if change_info["_number"] == request["change_id"] or \
-               not change_info["branch"].endswith("master"):
-                changes.remove(change_info)
-                break
-    print "==> Target changes: at %s" % time.asctime()
-    for change_info in changes:
-        if "approved" in change_info["labels"]["Verified"]:
-            change_info["labels"]["Verified"]["approved"]["avatars"] = "***DELETED***"
-        change_info["owner"]["avatars"] = "***DELETED***"
-        print change_info
-    find_and_verify_changes(changes)
-    find_and_commit_changes(changes)
-
-
-def run_loop_command(options):
-    while not os.access(STOP_FILE, os.R_OK):
-        run_once_command(options)
-        print "==> Sleeping..."
-        time.sleep(5 * 60)
-    print "==> Found %s file.  Aborted." % STOP_FILE
-
-
-def fetch_patch_command(options):
-    patch = gerrit_fetch_patch(options.change_id)
-    print patch
-    desc_title, desc_body, _, files = extract_description(patch, options.change_id)
-    print ">> patch command: title='%s' body='%s'\nFiles:\n%s" % (desc_title, desc_body, "\n".join(files))
-
-
-def gerrit_comment_command(options):
-    labels = {}
-    if options.clear_cq:
-        labels["Submit"] = 1
-    gerrit_add_review(options.change_id, options.message, labels=labels)
-
-
-def gerrit_get_command(options):
-    print gerrit_get_json(options.endpoint, "GET", None)
-
-
-def main():
-    parser = argparse.ArgumentParser(description='WPT bridge bot')
-    sub_parsers = parser.add_subparsers()
-
-    sub_parser = sub_parsers.add_parser('once')
-    sub_parser.set_defaults(func=run_once_command)
-
-    sub_parser = sub_parsers.add_parser('loop')
-    sub_parser.set_defaults(func=run_loop_command)
-
-    sub_parser = sub_parsers.add_parser('patch')
-    sub_parser.add_argument('change_id', type=int)
-    sub_parser.set_defaults(func=fetch_patch_command)
-
-    sub_parser = sub_parsers.add_parser('gerrit-comment')
-    sub_parser.add_argument('change_id', type=int)
-    sub_parser.add_argument('message', type=str)
-    sub_parser.add_argument('--clear-cq', action='store_true')
-    sub_parser.set_defaults(func=gerrit_comment_command)
-
-    sub_parser = sub_parsers.add_parser('gerrit-get')
-    sub_parser.add_argument('endpoint', type=str)
-    sub_parser.set_defaults(func=gerrit_get_command)
-
-    options = parser.parse_args()
-    options.func(options)
-
-if __name__ == '__main__':
-    main()
diff --git a/third_party/WebKit/public/platform/WebMediaStreamTrack.h b/third_party/WebKit/public/platform/WebMediaStreamTrack.h
index d9191b7..419bc359 100644
--- a/third_party/WebKit/public/platform/WebMediaStreamTrack.h
+++ b/third_party/WebKit/public/platform/WebMediaStreamTrack.h
@@ -64,8 +64,8 @@
     None,
     AudioSpeech,
     AudioMusic,
-    VideoFluid,
-    VideoDetailed
+    VideoMotion,
+    VideoDetail
   };
 
   WebMediaStreamTrack() {}
diff --git a/tools/gn/xcode_writer.cc b/tools/gn/xcode_writer.cc
index 242f0b0..a780d80 100644
--- a/tools/gn/xcode_writer.cc
+++ b/tools/gn/xcode_writer.cc
@@ -170,18 +170,18 @@
   }
 
   // Call recursively on public and private deps.
-  for (const auto& target : target->public_deps()) {
-    SearchXCTestFiles(target.ptr, xctest_files_per_target);
+  for (const auto& t : target->public_deps()) {
+    SearchXCTestFiles(t.ptr, xctest_files_per_target);
     const Target::FileList& deps_xctest_files =
-        (*xctest_files_per_target)[target.ptr];
+        (*xctest_files_per_target)[t.ptr];
     xctest_files.insert(xctest_files.end(), deps_xctest_files.begin(),
                         deps_xctest_files.end());
   }
 
-  for (const auto& target : target->private_deps()) {
-    SearchXCTestFiles(target.ptr, xctest_files_per_target);
+  for (const auto& t : target->private_deps()) {
+    SearchXCTestFiles(t.ptr, xctest_files_per_target);
     const Target::FileList& deps_xctest_files =
-        (*xctest_files_per_target)[target.ptr];
+        (*xctest_files_per_target)[t.ptr];
     xctest_files.insert(xctest_files.end(), deps_xctest_files.begin(),
                         deps_xctest_files.end());
   }
diff --git a/tools/perf/page_sets/system_health/long_running_stories.py b/tools/perf/page_sets/system_health/long_running_stories.py
index 916e75c0..a32ea45 100644
--- a/tools/perf/page_sets/system_health/long_running_stories.py
+++ b/tools/perf/page_sets/system_health/long_running_stories.py
@@ -88,6 +88,7 @@
   NAME = 'long_running:tools:gmail-foreground'
 
 
+@decorators.Disabled('all')  # crbug.com/681839
 class LongRunningGmailDesktopForegroundStory(_LongRunningGmailDesktopBase):
   NAME = 'long_running:tools:gmail-foreground'
 
diff --git a/ui/android/java/src/org/chromium/ui/DropdownAdapter.java b/ui/android/java/src/org/chromium/ui/DropdownAdapter.java
index ce74633..3f502c6c 100644
--- a/ui/android/java/src/org/chromium/ui/DropdownAdapter.java
+++ b/ui/android/java/src/org/chromium/ui/DropdownAdapter.java
@@ -141,6 +141,14 @@
             ApiCompatibilityUtils.setMarginStart(layoutParams, labelMargin);
             ApiCompatibilityUtils.setMarginEnd(layoutParams, labelMargin);
             labelView.setLayoutParams(layoutParams);
+            if (item.isMultilineLabel()) {
+                // If there is a multiline label, we add extra padding top and bottom because
+                // WRAP_CONTENT, defined above for multiline labels, leaves none.
+                int existingStart = ApiCompatibilityUtils.getPaddingStart(labelView);
+                int existingEnd = ApiCompatibilityUtils.getPaddingEnd(labelView);
+                ApiCompatibilityUtils.setPaddingRelative(
+                        labelView, existingStart, labelMargin, existingEnd, labelMargin);
+            }
         }
 
         labelView.setEnabled(item.isEnabled());
diff --git a/ui/ozone/demo/ozone_demo.cc b/ui/ozone/demo/ozone_demo.cc
index 9f0f3ce..109aa53e 100644
--- a/ui/ozone/demo/ozone_demo.cc
+++ b/ui/ozone/demo/ozone_demo.cc
@@ -11,6 +11,7 @@
 #include "base/memory/scoped_vector.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "base/task_scheduler/task_scheduler.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "ui/display/types/display_snapshot.h"
 #include "ui/display/types/native_display_delegate.h"
@@ -337,6 +338,9 @@
   // Build UI thread message loop. This is used by platform
   // implementations for event polling & running background tasks.
   base::MessageLoopForUI message_loop;
+  constexpr int kMaxTaskSchedulerThreads = 3;
+  base::TaskScheduler::CreateAndSetSimpleTaskScheduler(
+      kMaxTaskSchedulerThreads);
 
   ui::OzonePlatform::InitializeForUI();
   ui::KeyboardLayoutEngineManager::GetKeyboardLayoutEngine()