diff --git a/DEPS b/DEPS
index 85dace1..7ed11363b 100644
--- a/DEPS
+++ b/DEPS

@@ -105,7 +105,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'b631742f0bff361efccf53687ddfad551a51e398',
+  'skia_revision': 'cf7258abac8980323362b65161700b5260f7f3a8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -117,7 +117,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'c1551dc2a7dcee0fd1309996e670342472ae7c56',
+  'angle_revision': '3fd614d06e50fb98d1434fabf31e8583516ad5c1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
@@ -129,7 +129,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '48ae3075a5c80e75923a60d4d0ba0b56d9b08c2a',
+  'pdfium_revision': '3e360453cded5f2f435195923ede0935f6847194',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -153,7 +153,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling NaCl
   # and whatever else without interference from each other.
-  'nacl_revision': '96088f46727b75b2f6a24e1b62e5cc59ddb4612d',
+  'nacl_revision': 'cadf5787452659b381450733c9260e065842fe05',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype
   # and whatever else without interference from each other.
@@ -165,7 +165,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': 'fc13545ed4c9205e9ce2ce26b00d58d80e828cbc',
+  'catapult_revision': 'f5981fb3c2b045ad90b1418a134cc49e76260d9d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -378,7 +378,7 @@
   },
 
   'src/third_party/android_ndk': {
-      'url': Var('chromium_git') + '/android_ndk.git' + '@' + '5cd86312e794bdf542a3685c6f10cbb96072990b',
+      'url': Var('chromium_git') + '/android_ndk.git' + '@' + '4e2cea441bfd43f0863d14f57b1e1844260b9884',
       'condition': 'checkout_android_native_support',
   },
 
@@ -552,7 +552,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '70284b596877a3a5538bb5d8b0ac526a7f298f3a',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '25c5ebd6302c7ed72f9475934ca8cacbbf5edbe9',
       'condition': 'checkout_linux',
   },
 
@@ -577,13 +577,13 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'ba883cb5ed14aac5d81d6105caabf505c3afe8c6',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '3d429cf5131a10f0e6ced89e8809820398ece78b',
 
   'src/third_party/devtools-node-modules':
     Var('chromium_git') + '/external/github.com/ChromeDevTools/devtools-node-modules' + '@' + Var('devtools_node_modules_revision'),
 
   'src/third_party/dom_distiller_js/dist':
-    Var('chromium_git') + '/chromium/dom-distiller/dist.git' + '@' + 'bdf359537190956aabf32826bf33a0ff05b574ac',
+    Var('chromium_git') + '/chromium/dom-distiller/dist.git' + '@' + '3093c3e238768ab27ff756bd7563ccbb12129d9f',
 
   'src/third_party/dynamicmodule': {
       'url': Var('chromium_git') + '/dynamicmodule' + '@' + 'c6d37ea1003931dd44b78f936ca0882956aa3107',
@@ -777,7 +777,7 @@
   },
 
   'src/third_party/leveldatabase/src':
-    Var('chromium_git') + '/external/leveldb.git' + '@' + '18683981505dc374ce29211c80a9552f8f2f4571',
+    Var('chromium_git') + '/external/leveldb.git' + '@' + 'f7b0e1d901da26ac5ce6ad7f0a9806ce1440197e',
 
   'src/third_party/libFuzzer/src':
     Var('chromium_git') + '/chromium/llvm-project/compiler-rt/lib/fuzzer.git' + '@' +  Var('libfuzzer_revision'),
@@ -1046,7 +1046,7 @@
     Var('chromium_git') + '/external/selenium/py.git' + '@' + '5fd78261a75fe08d27ca4835fb6c5ce4b42275bd',
 
   'src/third_party/webgl/src':
-    Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + '21dbf06b5aa6c7dc8cf56314d4a3f96f57956c53',
+    Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + '7ca87fb1d3da3b3d2060886e8c58e726d74c8219',
 
   'src/third_party/webrtc':
     Var('webrtc_git') + '/src.git' + '@' + 'b336c2784f5e1e6e2f59e62a18b2d0e21a555b41',
@@ -1083,7 +1083,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@f727862b7b843cd9164854b15690cce172e95f49',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@bb6c3f056b91997bc895ceb79884f1ab39975bc1',
     'condition': 'checkout_src_internal',
   },
 

diff --git a/android_webview/DEPS b/android_webview/DEPS
index 8ea0912d..0b24be7 100644
--- a/android_webview/DEPS
+++ b/android_webview/DEPS

@@ -31,7 +31,6 @@
   "+services/viz/public/interfaces",
   "+skia",
   "+third_party/skia/include",
-  "+third_party/boringssl/src/include",
   "+ui/android",
   "+ui/base",
   "+ui/gfx",

diff --git a/android_webview/browser/net/aw_url_request_context_getter.cc b/android_webview/browser/net/aw_url_request_context_getter.cc
index 6222725..9d28b87 100644
--- a/android_webview/browser/net/aw_url_request_context_getter.cc
+++ b/android_webview/browser/net/aw_url_request_context_getter.cc

@@ -38,7 +38,6 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/cache_type.h"
-#include "net/cert/cert_verifier.h"
 #include "net/cookies/cookie_store.h"
 #include "net/dns/mapped_host_resolver.h"
 #include "net/extras/sqlite/sqlite_channel_id_store.h"
@@ -177,6 +176,31 @@
   return job_factory;
 }
 
+// For Android WebView, do not enforce policies that are not consistent with
+// the underlying OS validator.
+// This means not enforcing the Legacy Symantec PKI policies outlined in
+// https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
+// or disabling SHA-1 for locally-installed trust anchors.
+class AwSSLConfigService : public net::SSLConfigService {
+ public:
+  AwSSLConfigService() {
+    default_config_.symantec_enforcement_disabled = true;
+    default_config_.sha1_local_anchors_enabled = true;
+  }
+
+  void GetSSLConfig(net::SSLConfig* config) override {
+    *config = default_config_;
+  }
+
+  bool CanShareConnectionWithClientCerts(
+      const std::string& hostname) const override {
+    return false;
+  }
+
+ private:
+  net::SSLConfig default_config_;
+};
+
 }  // namespace
 
 AwURLRequestContextGetter::AwURLRequestContextGetter(
@@ -320,18 +344,9 @@
       CreateAuthHandlerFactory(host_resolver.get()));
   builder.set_host_resolver(std::move(host_resolver));
 
+  builder.set_ssl_config_service(std::make_unique<AwSSLConfigService>());
+
   url_request_context_ = builder.Build();
-
-  // For Android WebView, do not enforce policies that are not consistent with
-  // the underlying OS validator.
-  // This means not enforcing the Legacy Symantec PKI policies outlined in
-  // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
-  // or disabling SHA-1 for locally-installed trust anchors.
-  net::CertVerifier::Config config;
-  config.enable_sha1_local_anchors = true;
-  config.disable_symantec_enforcement = true;
-  url_request_context_->cert_verifier()->SetConfig(config);
-
 #if DCHECK_IS_ON()
   g_created_url_request_context_builder = true;
 #endif

diff --git a/android_webview/browser/net/aw_url_request_context_getter_unittest.cc b/android_webview/browser/net/aw_url_request_context_getter_unittest.cc
index 1812b99..eb990c8 100644
--- a/android_webview/browser/net/aw_url_request_context_getter_unittest.cc
+++ b/android_webview/browser/net/aw_url_request_context_getter_unittest.cc

@@ -14,22 +14,16 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "net/base/net_errors.h"
-#include "net/base/test_completion_callback.h"
-#include "net/cert/cert_verifier.h"
-#include "net/cert/test_root_certs.h"
 #include "net/log/net_log.h"
-#include "net/log/net_log_with_source.h"
 #include "net/proxy_resolution/proxy_config_service.h"
 #include "net/proxy_resolution/proxy_config_service_android.h"
 #include "net/proxy_resolution/proxy_resolution_service.h"
-#include "net/test/cert_test_util.h"
-#include "net/test/gtest_util.h"
-#include "net/test/test_data_directory.h"
+#include "net/ssl/ssl_config.h"
+#include "net/ssl/ssl_config_service.h"
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/boringssl/src/include/openssl/pool.h"
 
 namespace android_webview {
 
@@ -101,33 +95,13 @@
 TEST_F(AwURLRequestContextGetterTest, SymantecPoliciesExempted) {
   net::URLRequestContext* context = getter_->GetURLRequestContext();
   ASSERT_TRUE(context);
+  net::SSLConfigService* config_service = context->ssl_config_service();
+  ASSERT_TRUE(config_service);
 
-  scoped_refptr<net::X509Certificate> cert =
-      net::CreateCertificateChainFromFile(net::GetTestCertsDirectory(),
-                                          "www.ahrn.com.pem",
-                                          net::X509Certificate::FORMAT_AUTO);
-  ASSERT_TRUE(cert);
-  ASSERT_EQ(2u, cert->intermediate_buffers().size());
-
-  scoped_refptr<net::X509Certificate> root =
-      net::X509Certificate::CreateFromBuffer(
-          bssl::UpRef(cert->intermediate_buffers().back()), {});
-  ASSERT_TRUE(root);
-  net::ScopedTestRoot test_root(root.get());
-
-  net::CertVerifyResult result;
-  int flags = 0;
-  net::TestCompletionCallback callback;
-  std::unique_ptr<net::CertVerifier::Request> request;
-  int error = context->cert_verifier()->Verify(
-      net::CertVerifier::RequestParams(cert, "www.ahrn.com", flags,
-                                       std::string(), net::CertificateList()),
-      nullptr, &result, callback.callback(), &request, net::NetLogWithSource());
-  EXPECT_THAT(error, net::test::IsError(net::ERR_IO_PENDING));
-  EXPECT_TRUE(request);
-
-  error = callback.WaitForResult();
-  EXPECT_THAT(error, net::test::IsError(net::OK));
+  net::SSLConfig config;
+  EXPECT_FALSE(config.symantec_enforcement_disabled);
+  config_service->GetSSLConfig(&config);
+  EXPECT_TRUE(config.symantec_enforcement_disabled);
 }
 
 // Tests that SHA-1 is still allowed for locally-installed trust anchors,
@@ -136,36 +110,13 @@
 TEST_F(AwURLRequestContextGetterTest, SHA1LocalAnchorsAllowed) {
   net::URLRequestContext* context = getter_->GetURLRequestContext();
   ASSERT_TRUE(context);
+  net::SSLConfigService* config_service = context->ssl_config_service();
+  ASSERT_TRUE(config_service);
 
-  net::CertificateList certs;
-  ASSERT_TRUE(net::LoadCertificateFiles(
-      {"weak_digest_sha1_ee.pem", "weak_digest_sha1_intermediate.pem",
-       "weak_digest_sha1_root.pem"},
-      &certs));
-  ASSERT_EQ(3u, certs.size());
-
-  std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> intermediates;
-  intermediates.push_back(bssl::UpRef(certs[1]->cert_buffer()));
-  scoped_refptr<net::X509Certificate> cert =
-      net::X509Certificate::CreateFromBuffer(
-          bssl::UpRef(certs[0]->cert_buffer()), std::move(intermediates));
-  ASSERT_TRUE(cert);
-
-  net::ScopedTestRoot test_root(certs[2].get());
-
-  net::CertVerifyResult result;
-  int flags = 0;
-  net::TestCompletionCallback callback;
-  std::unique_ptr<net::CertVerifier::Request> request;
-  int error = context->cert_verifier()->Verify(
-      net::CertVerifier::RequestParams(cert, "127.0.0.1", flags, std::string(),
-                                       net::CertificateList()),
-      nullptr, &result, callback.callback(), &request, net::NetLogWithSource());
-  EXPECT_THAT(error, net::test::IsError(net::ERR_IO_PENDING));
-  EXPECT_TRUE(request);
-
-  error = callback.WaitForResult();
-  EXPECT_THAT(error, net::test::IsError(net::OK));
+  net::SSLConfig config;
+  EXPECT_FALSE(config.sha1_local_anchors_enabled);
+  config_service->GetSSLConfig(&config);
+  EXPECT_TRUE(config.sha1_local_anchors_enabled);
 }
 
 }  // namespace android_webview

diff --git a/ash/app_list/BUILD.gn b/ash/app_list/BUILD.gn
index 685a736..5aaca986 100644
--- a/ash/app_list/BUILD.gn
+++ b/ash/app_list/BUILD.gn

@@ -101,6 +101,7 @@
     "//ash/app_menu",
     "//ash/assistant/ui:constants",
     "//ash/public/cpp/app_list/vector_icons",
+    "//ash/public/cpp/vector_icons",
     "//base",
     "//base:i18n",
     "//base/third_party/dynamic_annotations",

diff --git a/ash/app_list/app_list_controller_impl.cc b/ash/app_list/app_list_controller_impl.cc
index 39ec3b3..55980af0 100644
--- a/ash/app_list/app_list_controller_impl.cc
+++ b/ash/app_list/app_list_controller_impl.cc

@@ -13,11 +13,14 @@
 #include "ash/app_list/views/app_list_main_view.h"
 #include "ash/app_list/views/app_list_view.h"
 #include "ash/app_list/views/contents_view.h"
+#include "ash/assistant/assistant_controller.h"
+#include "ash/assistant/assistant_ui_controller.h"
 #include "ash/public/cpp/app_list/answer_card_contents_registry.h"
 #include "ash/public/cpp/app_list/app_list_features.h"
 #include "ash/public/cpp/config.h"
 #include "ash/session/session_controller.h"
 #include "ash/shell.h"
+#include "ash/voice_interaction/voice_interaction_controller.h"
 #include "ash/wallpaper/wallpaper_controller.h"
 #include "ash/wm/tablet_mode/tablet_mode_controller.h"
 #include "base/logging.h"
@@ -40,7 +43,8 @@
 
 AppListControllerImpl::AppListControllerImpl()
     : presenter_(std::make_unique<AppListPresenterDelegateImpl>(this)),
-      is_home_launcher_enabled_(app_list::features::IsHomeLauncherEnabled()) {
+      is_home_launcher_enabled_(app_list::features::IsHomeLauncherEnabled()),
+      voice_interaction_binding_(this) {
   model_.AddObserver(this);
 
   // Create only for non-mash. Mash uses window tree embed API to get a
@@ -62,6 +66,10 @@
   Shell::Get()->wallpaper_controller()->AddObserver(this);
   Shell::Get()->AddShellObserver(this);
   keyboard::KeyboardController::Get()->AddObserver(this);
+
+  mojom::VoiceInteractionObserverPtr ptr;
+  voice_interaction_binding_.Bind(mojo::MakeRequest(&ptr));
+  Shell::Get()->voice_interaction_controller()->AddObserver(std::move(ptr));
 }
 
 AppListControllerImpl::~AppListControllerImpl() {
@@ -524,6 +532,15 @@
   UpdateHomeLauncherVisibility();
 }
 
+void AppListControllerImpl::OnVoiceInteractionSettingsEnabled(bool enabled) {
+  UpdateAssistantVisibility();
+}
+
+void AppListControllerImpl::OnAssistantFeatureAllowedChanged(
+    mojom::AssistantAllowedState state) {
+  UpdateAssistantVisibility();
+}
+
 bool AppListControllerImpl::IsHomeLauncherEnabledInTabletMode() const {
   return is_home_launcher_enabled_ && Shell::Get()
                                           ->tablet_mode_controller()
@@ -533,6 +550,14 @@
 ////////////////////////////////////////////////////////////////////////////////
 // Methods of |client_|:
 
+void AppListControllerImpl::StartAssistant() {
+  if (!IsHomeLauncherEnabledInTabletMode())
+    DismissAppList();
+
+  ash::Shell::Get()->assistant_controller()->ui_controller()->ShowUi(
+      ash::AssistantSource::kLauncherSearchBox);
+}
+
 void AppListControllerImpl::StartSearch(const base::string16& raw_query) {
   last_raw_query_ = raw_query;
   if (client_) {
@@ -734,4 +759,11 @@
     presenter_.GetWindow()->Show();
 }
 
+void AppListControllerImpl::UpdateAssistantVisibility() {
+  auto* controller = Shell::Get()->voice_interaction_controller();
+  GetSearchModel()->search_box()->SetShowAssistantButton(
+      controller->settings_enabled() &&
+      controller->allowed_state() == mojom::AssistantAllowedState::ALLOWED);
+}
+
 }  // namespace ash

diff --git a/ash/app_list/app_list_controller_impl.h b/ash/app_list/app_list_controller_impl.h
index a682baa..31fbf7d 100644
--- a/ash/app_list/app_list_controller_impl.h
+++ b/ash/app_list/app_list_controller_impl.h

@@ -18,6 +18,7 @@
 #include "ash/ash_export.h"
 #include "ash/public/cpp/app_list/app_list_constants.h"
 #include "ash/public/interfaces/app_list.mojom.h"
+#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
 #include "ash/session/session_observer.h"
 #include "ash/shell_observer.h"
 #include "ash/wallpaper/wallpaper_controller_observer.h"
@@ -48,7 +49,8 @@
       public ash::ShellObserver,
       public TabletModeObserver,
       public keyboard::KeyboardControllerObserver,
-      public WallpaperControllerObserver {
+      public WallpaperControllerObserver,
+      public mojom::VoiceInteractionObserver {
  public:
   using AppListItemMetadataPtr = mojom::AppListItemMetadataPtr;
   using SearchResultMetadataPtr = mojom::SearchResultMetadataPtr;
@@ -137,6 +139,7 @@
   // app_list::AppListViewDelegate:
   app_list::AppListModel* GetModel() override;
   app_list::SearchModel* GetSearchModel() override;
+  void StartAssistant() override;
   void StartSearch(const base::string16& raw_query) override;
   void OpenSearchResult(const std::string& result_id, int event_flags) override;
   void InvokeSearchResultAction(const std::string& result_id,
@@ -185,6 +188,16 @@
   void OnWallpaperPreviewStarted() override;
   void OnWallpaperPreviewEnded() override;
 
+  // mojom::VoiceInteractionObserver:
+  void OnVoiceInteractionStatusChanged(
+      mojom::VoiceInteractionState state) override {}
+  void OnVoiceInteractionSettingsEnabled(bool enabled) override;
+  void OnVoiceInteractionContextEnabled(bool enabled) override {}
+  void OnVoiceInteractionHotwordEnabled(bool enabled) override {}
+  void OnVoiceInteractionSetupCompleted(bool completed) override {}
+  void OnAssistantFeatureAllowedChanged(
+      mojom::AssistantAllowedState state) override;
+
   bool onscreen_keyboard_shown() const { return onscreen_keyboard_shown_; }
 
   // Returns true if the home launcher is enabled in tablet mode.
@@ -200,6 +213,9 @@
   // in overview mode.
   void UpdateHomeLauncherVisibility();
 
+  // Update the visibility of Assistant functionality.
+  void UpdateAssistantVisibility();
+
   base::string16 last_raw_query_;
 
   mojom::AppListClientPtr client_;
@@ -232,6 +248,8 @@
   // should be hidden during wallpaper preview.
   bool in_wallpaper_preview_ = false;
 
+  mojo::Binding<mojom::VoiceInteractionObserver> voice_interaction_binding_;
+
   DISALLOW_COPY_AND_ASSIGN(AppListControllerImpl);
 };
 

diff --git a/ash/app_list/app_list_view_delegate.h b/ash/app_list/app_list_view_delegate.h
index ccca2b56..d3d34102 100644
--- a/ash/app_list/app_list_view_delegate.h
+++ b/ash/app_list/app_list_view_delegate.h

@@ -32,6 +32,9 @@
   // owned by the delegate, or owned elsewhere (e.g. a profile keyed service).
   virtual SearchModel* GetSearchModel() = 0;
 
+  // Invoked to start a new Google Assistant session.
+  virtual void StartAssistant() = 0;
+
   // Invoked to start a new search. This collects a list of search results
   // matching the raw query, which is an unhandled string typed into the search
   // box by the user.

diff --git a/ash/app_list/model/app_list_item_list.cc b/ash/app_list/model/app_list_item_list.cc
index cfc20ea..a50a0f5 100644
--- a/ash/app_list/model/app_list_item_list.cc
+++ b/ash/app_list/model/app_list_item_list.cc

@@ -129,11 +129,23 @@
   size_t previous_index;
   CHECK(FindItemIndex(previous_item->id(), &previous_index));
   CHECK(!previous_item->IsInFolder());
-  syncer::StringOrdinal position =
-      previous_index == item_count() - 1
-          ? previous_item->position().CreateAfter()
-          : previous_item->position().CreateBetween(
-                item_at(previous_index + 1)->position());
+
+  const size_t next_index = previous_index + 1;
+  const AppListItem* next_item =
+      next_index < item_count() ? item_at(next_index) : nullptr;
+  syncer::StringOrdinal position;
+  if (!next_item) {
+    position = previous_item->position().CreateAfter();
+  } else {
+    // It is possible that items were added with the same ordinal. To
+    // successfully add the page break item we need to fix this. We do not try
+    // to fix this when an item is added in order to avoid possible edge cases
+    // with sync.
+    if (previous_item->position().Equals(next_item->position()))
+      FixItemPosition(next_index);
+    position = previous_item->position().CreateBetween(next_item->position());
+  }
+
   auto page_break_item = std::make_unique<AppListItem>(base::GenerateGUID());
   page_break_item->set_position(position);
   page_break_item->set_is_page_break(true);

diff --git a/ash/app_list/model/app_list_item_list_unittest.cc b/ash/app_list/model/app_list_item_list_unittest.cc
index ded8740..cefbc0a5 100644
--- a/ash/app_list/model/app_list_item_list_unittest.cc
+++ b/ash/app_list/model/app_list_item_list_unittest.cc

@@ -366,4 +366,39 @@
   EXPECT_TRUE(VerifyItemOrder4(2, 0, 3, 1));
 }
 
+// Test adding a page break item between two items with different position.
+TEST_F(AppListItemListTest, AddPageBreakItem) {
+  AppListItem* item_0 = CreateAndAddItem(GetItemId(0));
+  AppListItem* item_1 = CreateAndAddItem(GetItemId(1));
+  EXPECT_EQ(item_0, item_list_.item_at(0));
+  EXPECT_EQ(item_1, item_list_.item_at(1));
+  EXPECT_TRUE(item_0->position().LessThan(item_1->position()));
+
+  AppListItem* page_break_item = item_list_.AddPageBreakItemAfter(item_0);
+  EXPECT_EQ(item_0, item_list_.item_at(0));
+  EXPECT_EQ(page_break_item, item_list_.item_at(1));
+  EXPECT_EQ(item_1, item_list_.item_at(2));
+  EXPECT_TRUE(item_0->position().LessThan(page_break_item->position()));
+  EXPECT_TRUE(page_break_item->position().LessThan(item_1->position()));
+}
+
+// Test adding a page break item between two items with the same position.
+TEST_F(AppListItemListTest, AddPageBreakItemWithSamePosition) {
+  AppListItem* item_0 = CreateAndAddItem(GetItemId(0));
+  AppListItem* item_1 = CreateAndAddItem(GetItemId(1));
+  item_list_.SetItemPosition(item_list_.item_at(1),
+                             item_list_.item_at(0)->position());
+  EXPECT_EQ(item_0, item_list_.item_at(0));
+  EXPECT_EQ(item_1, item_list_.item_at(1));
+  EXPECT_TRUE(item_0->position().Equals(item_1->position()));
+
+  // Position of items should be fixed.
+  AppListItem* page_break_item = item_list_.AddPageBreakItemAfter(item_0);
+  EXPECT_EQ(item_0, item_list_.item_at(0));
+  EXPECT_EQ(page_break_item, item_list_.item_at(1));
+  EXPECT_EQ(item_1, item_list_.item_at(2));
+  EXPECT_TRUE(item_0->position().LessThan(page_break_item->position()));
+  EXPECT_TRUE(page_break_item->position().LessThan(item_1->position()));
+}
+
 }  // namespace app_list

diff --git a/ash/app_list/model/search/search_box_model.cc b/ash/app_list/model/search/search_box_model.cc
index 0bea09d..ca8e19b 100644
--- a/ash/app_list/model/search/search_box_model.cc
+++ b/ash/app_list/model/search/search_box_model.cc

@@ -57,6 +57,14 @@
   UpdateAccessibleName();
 }
 
+void SearchBoxModel::SetShowAssistantButton(bool show) {
+  if (show_assistant_button_ == show)
+    return;
+  show_assistant_button_ = show;
+  for (auto& observer : observers_)
+    observer.ShowAssistantChanged();
+}
+
 void SearchBoxModel::SetSearchEngineIsGoogle(bool is_google) {
   if (is_google == search_engine_is_google_)
     return;

diff --git a/ash/app_list/model/search/search_box_model.h b/ash/app_list/model/search/search_box_model.h
index 6633b3f..9fa2a7a 100644
--- a/ash/app_list/model/search/search_box_model.h
+++ b/ash/app_list/model/search/search_box_model.h

@@ -52,6 +52,9 @@
   void SetTabletMode(bool is_tablet_mode);
   bool is_tablet_mode() const { return is_tablet_mode_; }
 
+  void SetShowAssistantButton(bool show);
+  bool show_assistant_button() const { return show_assistant_button_; }
+
   void SetSearchEngineIsGoogle(bool is_google);
   bool search_engine_is_google() const { return search_engine_is_google_; }
 
@@ -73,6 +76,7 @@
   base::string16 text_;
   bool search_engine_is_google_ = false;
   bool is_tablet_mode_ = false;
+  bool show_assistant_button_ = false;
 
   base::ObserverList<SearchBoxModelObserver> observers_;
 

diff --git a/ash/app_list/model/search/search_box_model_observer.h b/ash/app_list/model/search/search_box_model_observer.h
index 538d98085..26b7025e 100644
--- a/ash/app_list/model/search/search_box_model_observer.h
+++ b/ash/app_list/model/search/search_box_model_observer.h

@@ -23,6 +23,9 @@
   // Invoked when the search engine is changed.
   virtual void SearchEngineChanged() = 0;
 
+  // Invoked when whether to show Assistant is changed.
+  virtual void ShowAssistantChanged() = 0;
+
  protected:
   virtual ~SearchBoxModelObserver() {}
 };

diff --git a/ash/app_list/test/app_list_test_view_delegate.h b/ash/app_list/test/app_list_test_view_delegate.h
index 93fa1c2..40bf5a6 100644
--- a/ash/app_list/test/app_list_test_view_delegate.h
+++ b/ash/app_list/test/app_list_test_view_delegate.h

@@ -48,6 +48,7 @@
   // AppListViewDelegate overrides:
   AppListModel* GetModel() override;
   SearchModel* GetSearchModel() override;
+  void StartAssistant() override {}
   void StartSearch(const base::string16& raw_query) override {}
   void OpenSearchResult(const std::string& result_id, int event_flags) override;
   void InvokeSearchResultAction(const std::string& result_id,

diff --git a/ash/app_list/views/app_list_main_view.cc b/ash/app_list/views/app_list_main_view.cc
index 2c979af..a1be52b4 100644
--- a/ash/app_list/views/app_list_main_view.cc
+++ b/ash/app_list/views/app_list_main_view.cc

@@ -28,6 +28,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/strings/string_util.h"
+#include "chromeos/chromeos_switches.h"
 #include "ui/chromeos/search_box/search_box_view_base.h"
 #include "ui/gfx/geometry/insets.h"
 #include "ui/views/border.h"
@@ -192,6 +193,11 @@
   }
 }
 
+void AppListMainView::AssistantButtonPressed() {
+  DCHECK(chromeos::switches::IsAssistantEnabled());
+  delegate_->StartAssistant();
+}
+
 void AppListMainView::BackButtonPressed() {
   if (!contents_view_->Back())
     app_list_view_->Dismiss();

diff --git a/ash/app_list/views/app_list_main_view.h b/ash/app_list/views/app_list_main_view.h
index cabc99b8b..9c539c5 100644
--- a/ash/app_list/views/app_list_main_view.h
+++ b/ash/app_list/views/app_list_main_view.h

@@ -90,6 +90,7 @@
 
   // Overridden from SearchBoxViewDelegate:
   void QueryChanged(search_box::SearchBoxViewBase* sender) override;
+  void AssistantButtonPressed() override;
   void BackButtonPressed() override;
   void ActiveChanged(search_box::SearchBoxViewBase* sender) override;
 

diff --git a/ash/app_list/views/search_box_view.cc b/ash/app_list/views/search_box_view.cc
index a695b1e49..71f3662 100644
--- a/ash/app_list/views/search_box_view.cc
+++ b/ash/app_list/views/search_box_view.cc

@@ -23,9 +23,11 @@
 #include "ash/public/cpp/app_list/app_list_constants.h"
 #include "ash/public/cpp/app_list/app_list_features.h"
 #include "ash/public/cpp/app_list/vector_icons/vector_icons.h"
+#include "ash/public/cpp/vector_icons/vector_icons.h"
 #include "ash/public/cpp/wallpaper_types.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
+#include "chromeos/chromeos_switches.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/chromeos/search_box/search_box_constants.h"
@@ -59,6 +61,7 @@
     SkColorSetARGB(0x3D, 0xFF, 0xFF, 0xFF);
 
 constexpr int kSearchBoxBorderCornerRadiusSearchResult = 4;
+constexpr int kAssistantIconSize = 24;
 constexpr int kCloseIconSize = 24;
 constexpr int kSearchBoxFocusBorderCornerRadius = 28;
 
@@ -77,6 +80,12 @@
   return search_box::kPadding;
 }
 
+float GetAssistantButtonOpacityForState(ash::AppListState state) {
+  if (state == ash::AppListState::kStateSearchResults)
+    return .0f;
+  return 1.f;
+}
+
 }  // namespace
 
 SearchBoxView::SearchBoxView(search_box::SearchBoxViewDelegate* delegate,
@@ -130,6 +139,7 @@
 
   HintTextChanged();
   OnWallpaperColorsChanged();
+  ShowAssistantChanged();
 }
 
 void SearchBoxView::UpdateKeyboardVisibility() {
@@ -276,9 +286,16 @@
                                  ash::AppListState current_state,
                                  ash::AppListState target_state) {
   box_layout()->set_inside_border_insets(
-      gfx::Insets(0, gfx::Tween::LinearIntValueBetween(
-                         progress, GetBoxLayoutPaddingForState(current_state),
-                         GetBoxLayoutPaddingForState(target_state))));
+      gfx::Insets(0,
+                  gfx::Tween::LinearIntValueBetween(
+                      progress, GetBoxLayoutPaddingForState(current_state),
+                      GetBoxLayoutPaddingForState(target_state)),
+                  0, 0));
+  if (show_assistant_button()) {
+    assistant_button()->layer()->SetOpacity(gfx::Tween::LinearIntValueBetween(
+        progress, GetAssistantButtonOpacityForState(current_state),
+        GetAssistantButtonOpacityForState(target_state)));
+  }
   InvalidateLayout();
 }
 
@@ -537,7 +554,7 @@
 
 void SearchBoxView::Update() {
   search_box()->SetText(search_model_->search_box()->text());
-  UpdateCloseButtonVisisbility();
+  UpdateButtonsVisisbility();
   NotifyQueryChanged();
 }
 
@@ -545,4 +562,25 @@
   UpdateSearchIcon();
 }
 
+void SearchBoxView::ShowAssistantChanged() {
+  if (search_model_) {
+    SetShowAssistantButton(
+        search_model_->search_box()->show_assistant_button());
+  }
+}
+
+void SearchBoxView::SetupAssistantButton() {
+  if (search_model_ && !search_model_->search_box()->show_assistant_button()) {
+    return;
+  }
+
+  views::ImageButton* assistant = assistant_button();
+  assistant->SetImage(
+      views::ImageButton::STATE_NORMAL,
+      gfx::CreateVectorIcon(ash::kAssistantIcon, kAssistantIconSize,
+                            search_box_color()));
+  assistant->SetAccessibleName(
+      l10n_util::GetStringUTF16(IDS_APP_LIST_START_ASSISTANT));
+}
+
 }  // namespace app_list

diff --git a/ash/app_list/views/search_box_view.h b/ash/app_list/views/search_box_view.h
index cc9296e..3728e49 100644
--- a/ash/app_list/views/search_box_view.h
+++ b/ash/app_list/views/search_box_view.h

@@ -46,6 +46,7 @@
   void UpdateModel(bool initiated_by_user) override;
   void UpdateSearchIcon() override;
   void UpdateSearchBoxBorder() override;
+  void SetupAssistantButton() override;
   void SetupCloseButton() override;
   void SetupBackButton() override;
   void RecordSearchBoxActivationHistogram(ui::EventType event_type) override;
@@ -127,6 +128,7 @@
   void SelectionModelChanged() override;
   void Update() override;
   void SearchEngineChanged() override;
+  void ShowAssistantChanged() override;
 
   // The range of highlighted text for autocomplete.
   gfx::Range highlight_range_;

diff --git a/ash/app_list/views/search_box_view_unittest.cc b/ash/app_list/views/search_box_view_unittest.cc
index 8f38756..53bdc17 100644
--- a/ash/app_list/views/search_box_view_unittest.cc
+++ b/ash/app_list/views/search_box_view_unittest.cc

@@ -8,6 +8,7 @@
 #include <map>
 #include <memory>
 #include <string>
+#include <utility>
 
 #include "ash/app_list/test/app_list_test_view_delegate.h"
 #include "ash/app_list/views/app_list_view.h"
@@ -67,7 +68,7 @@
     app_list_view_ = new AppListView(&view_delegate_);
     AppListView::InitParams params;
     params.parent = GetContext();
-    app_list_view()->Initialize(params);
+    app_list_view_->Initialize(params);
 
     widget_ = CreateTopLevelPlatformWidget();
     view_ =
@@ -91,6 +92,7 @@
   views::Widget* widget() { return widget_; }
   SearchBoxView* view() { return view_.get(); }
   AppListView* app_list_view() { return app_list_view_; }
+  AppListTestViewDelegate* view_delegate() { return &view_delegate_; }
 
   void SetSearchEngineIsGoogle(bool is_google) {
     view_delegate_.SetSearchEngineIsGoogle(is_google);
@@ -114,6 +116,18 @@
     }
   }
 
+  void CreateSearchResult(ash::SearchResultDisplayType display_type,
+                          double display_score,
+                          const base::string16& title,
+                          const base::string16& details) {
+    auto search_result = std::make_unique<SearchResult>();
+    search_result->set_display_type(display_type);
+    search_result->set_display_score(display_score);
+    search_result->set_title(title);
+    search_result->set_details(details);
+    results()->Add(std::move(search_result));
+  }
+
   std::string GetLastQueryAndReset() {
     base::string16 query = last_query_;
     last_query_.clear();
@@ -126,6 +140,10 @@
     return result;
   }
 
+  SearchModel::SearchResults* results() {
+    return view_delegate_.GetSearchModel()->results();
+  }
+
  private:
   // Overridden from SearchBoxViewDelegate:
   void QueryChanged(search_box::SearchBoxViewBase* sender) override {
@@ -133,6 +151,7 @@
     last_query_ = sender->search_box()->text();
   }
 
+  void AssistantButtonPressed() override {}
   void BackButtonPressed() override {}
   void ActiveChanged(search_box::SearchBoxViewBase* sender) override {}
 
@@ -267,5 +286,185 @@
                                          *actual_icon.bitmap()));
 }
 
+// Tests that autocomplete suggestions are consistent with top SearchResult list
+// titles.
+TEST_F(SearchBoxViewTest, SearchBoxAutocompletesTopListResultTitle) {
+  // Add two SearchResults, one with higher ranking. Initialize their title
+  // field to a non-empty string.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0,
+                     base::ASCIIToUTF16("hello list"), base::string16());
+  CreateSearchResult(ash::SearchResultDisplayType::kTile, 0.5,
+                     base::ASCIIToUTF16("hello tile"), base::string16());
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello list"));
+  EXPECT_EQ(view()->search_box()->GetSelectedText(),
+            base::ASCIIToUTF16("llo list"));
+}
+
+// Tests that autocomplete suggestions are consistent with top SearchResult tile
+// titles.
+TEST_F(SearchBoxViewTest, SearchBoxAutocompletesTopTileResultTitle) {
+  // Add two SearchResults, one with higher ranking. Initialize their title
+  // field to a non-empty string.
+  CreateSearchResult(ash::SearchResultDisplayType::kTile, 1.0,
+                     base::ASCIIToUTF16("hello tile"), base::string16());
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 0.5,
+                     base::ASCIIToUTF16("hello list"), base::string16());
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello tile"));
+  EXPECT_EQ(view()->search_box()->GetSelectedText(),
+            base::ASCIIToUTF16("llo tile"));
+}
+
+// Tests that autocomplete suggestions are consistent with top SearchResult list
+// details.
+TEST_F(SearchBoxViewTest, SearchBoxAutocompletesTopListResultDetails) {
+  // Add two SearchResults, one with higher ranking. Initialize their details
+  // field to a non-empty string.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0, base::string16(),
+                     base::ASCIIToUTF16("hello list"));
+  CreateSearchResult(ash::SearchResultDisplayType::kTile, 0.5, base::string16(),
+                     base::ASCIIToUTF16("hello tile"));
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello list"));
+  EXPECT_EQ(view()->search_box()->GetSelectedText(),
+            base::ASCIIToUTF16("llo list"));
+}
+
+// Tests that autocomplete suggestions are consistent with top SearchResult tile
+// details.
+TEST_F(SearchBoxViewTest, SearchBoxAutocompletesTopTileResultDetails) {
+  // Add two SearchResults, one with higher ranking. Initialize their details
+  // field to a non-empty string.
+  CreateSearchResult(ash::SearchResultDisplayType::kTile, 1.0, base::string16(),
+                     base::ASCIIToUTF16("hello tile"));
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 0.5, base::string16(),
+                     base::ASCIIToUTF16("hello list"));
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello tile"));
+  EXPECT_EQ(view()->search_box()->GetSelectedText(),
+            base::ASCIIToUTF16("llo tile"));
+}
+
+// Tests that SearchBoxView's textfield text does not autocomplete if the top
+// result title or details do not have a matching prefix.
+TEST_F(SearchBoxViewTest, SearchBoxDoesNotAutocompleteWrongCharacter) {
+  // Add a search result with non-empty details and title fields.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0,
+                     base::ASCIIToUTF16("title"),
+                     base::ASCIIToUTF16("details"));
+
+  // Send Z to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_Z);
+  view()->ProcessAutocomplete();
+  // The text should not be autocompleted.
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("z"));
+}
+
+// Tests that autocomplete suggestion will remain if next key in the suggestion
+// is typed.
+TEST_F(SearchBoxViewTest, SearchBoxAutocompletesAcceptsNextChar) {
+  // Add a search result with a non-empty title field.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0,
+                     base::ASCIIToUTF16("hello world!"), base::string16());
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  // Forward the next key in the autocomplete suggestion to HandleKeyEvent(). We
+  // use HandleKeyEvent() because KeyPress() will replace the existing
+  // highlighted text.
+  ui::KeyEvent event(ui::ET_KEY_PRESSED, ui::VKEY_L, ui::EF_NONE);
+  static_cast<views::TextfieldController*>(view())->HandleKeyEvent(
+      view()->search_box(), event);
+  base::string16 selected_text = view()->search_box()->GetSelectedText();
+  // The autocomplete text should be preserved after hitting the next key in the
+  // suggestion.
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello world!"));
+  EXPECT_EQ(base::ASCIIToUTF16("lo world!"), selected_text);
+}
+
+// Tests that only the autocomplete suggestion text is deleted after hitting
+// backspace.
+TEST_F(SearchBoxViewTest, SearchBoxDeletesAutocompleteTextOnlyAfterBackspace) {
+  // Add a search result with a non-empty title field.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0,
+                     base::ASCIIToUTF16("hello world!"), base::string16());
+
+  // Send H, E to the SearchBoxView textfield, trigger an autocomplete, then hit
+  // backspace.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  KeyPress(ui::VKEY_BACK);
+  // The autocomplete suggestion should be deleted.
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("he"));
+  // Don't autocomplete because the last pressed key was backspace.
+  view()->ProcessAutocomplete();
+  // The autocomplete suggestion should still not be present.
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("he"));
+}
+
+class SearchBoxViewAutocompleteTest
+    : public SearchBoxViewTest,
+      public ::testing::WithParamInterface<ui::KeyboardCode> {
+ public:
+  SearchBoxViewAutocompleteTest() = default;
+  ~SearchBoxViewAutocompleteTest() = default;
+  ui::KeyboardCode key_code() const { return GetParam(); }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SearchBoxViewAutocompleteTest);
+};
+
+INSTANTIATE_TEST_CASE_P(,
+                        SearchBoxViewAutocompleteTest,
+                        ::testing::Values(ui::VKEY_TAB,
+                                          ui::VKEY_LEFT,
+                                          ui::VKEY_RIGHT,
+                                          ui::VKEY_UP,
+                                          ui::VKEY_DOWN));
+
+// Tests that autocomplete suggestion is accepted and displayed in SearchModel
+// after hitting certain control keys.
+TEST_P(SearchBoxViewAutocompleteTest,
+       SearchBoxAcceptsAutocompleteForLeftRightUpDownTab) {
+  // Add a search result with a non-empty title field.
+  CreateSearchResult(ash::SearchResultDisplayType::kList, 1.0,
+                     base::ASCIIToUTF16("hello world!"), base::string16());
+
+  // Send H, E to the SearchBoxView textfield, then trigger an autocomplete.
+  KeyPress(ui::VKEY_H);
+  KeyPress(ui::VKEY_E);
+  view()->ProcessAutocomplete();
+  // Forward the next parameter to HandleKeyEvent(). We use HandleKeyEvent()
+  // because KeyPress() will replace the existing highlighted text.
+  ui::KeyEvent event(ui::ET_KEY_PRESSED, key_code(), ui::EF_NONE);
+  static_cast<views::TextfieldController*>(view())->HandleKeyEvent(
+      view()->search_box(), event);
+  // Search box autocomplete suggestion is accepted and is reflected in
+  // SearchModel.
+  EXPECT_EQ(view()->search_box()->text(),
+            view_delegate()->GetSearchModel()->search_box()->text());
+  EXPECT_EQ(view()->search_box()->text(), base::ASCIIToUTF16("hello world!"));
+}
+
 }  // namespace test
 }  // namespace app_list

diff --git a/ash/assistant/model/assistant_ui_model.h b/ash/assistant/model/assistant_ui_model.h
index ec9a01a1..a73adf6 100644
--- a/ash/assistant/model/assistant_ui_model.h
+++ b/ash/assistant/model/assistant_ui_model.h

@@ -21,6 +21,7 @@
   kLongPressLauncher,
   kSetup,
   kStylus,
+  kLauncherSearchBox,
 };
 
 // Enumeration of Assistant UI modes.

diff --git a/ash/assistant/ui/assistant_mini_view.cc b/ash/assistant/ui/assistant_mini_view.cc
index 8bc6e5b..7f1a69f6 100644
--- a/ash/assistant/ui/assistant_mini_view.cc
+++ b/ash/assistant/ui/assistant_mini_view.cc

@@ -4,6 +4,7 @@
 
 #include "ash/assistant/ui/assistant_mini_view.h"
 
+#include <algorithm>
 #include <memory>
 
 #include "ash/assistant/assistant_controller.h"
@@ -11,7 +12,7 @@
 #include "ash/assistant/assistant_ui_controller.h"
 #include "ash/assistant/model/assistant_query.h"
 #include "ash/assistant/ui/assistant_ui_constants.h"
-#include "ash/resources/vector_icons/vector_icons.h"
+#include "ash/public/cpp/vector_icons/vector_icons.h"
 #include "ash/strings/grit/ash_strings.h"
 #include "base/strings/utf_string_conversions.h"
 #include "ui/base/l10n/l10n_util.h"

diff --git a/ash/components/shortcut_viewer/views/keyboard_shortcut_view.h b/ash/components/shortcut_viewer/views/keyboard_shortcut_view.h
index 14b72e7a9..b420a374 100644
--- a/ash/components/shortcut_viewer/views/keyboard_shortcut_view.h
+++ b/ash/components/shortcut_viewer/views/keyboard_shortcut_view.h

@@ -62,6 +62,7 @@
 
   // search_box::SearchBoxViewDelegate:
   void QueryChanged(search_box::SearchBoxViewBase* sender) override;
+  void AssistantButtonPressed() override {}
   void BackButtonPressed() override;
   void ActiveChanged(search_box::SearchBoxViewBase* sender) override;
 

diff --git a/ash/components/shortcut_viewer/views/ksv_search_box_view.h b/ash/components/shortcut_viewer/views/ksv_search_box_view.h
index a796f6b..dc44d80 100644
--- a/ash/components/shortcut_viewer/views/ksv_search_box_view.h
+++ b/ash/components/shortcut_viewer/views/ksv_search_box_view.h

@@ -39,6 +39,7 @@
   void UpdateModel(bool initiated_by_user) override {}
   void UpdateSearchIcon() override {}
   void UpdateSearchBoxBorder() override;
+  void SetupAssistantButton() override {}
   void SetupCloseButton() override;
   void SetupBackButton() override;
 

diff --git a/ash/message_center/ash_message_center_lock_screen_controller.cc b/ash/message_center/ash_message_center_lock_screen_controller.cc
index 48864e0..8df9bc6 100644
--- a/ash/message_center/ash_message_center_lock_screen_controller.cc
+++ b/ash/message_center/ash_message_center_lock_screen_controller.cc

@@ -33,8 +33,12 @@
   if (!features::IsLockScreenNotificationsEnabled())
     return Mode::HIDE;
 
+  // User prefs may be null in some tests.
   PrefService* user_prefs =
       Shell::Get()->session_controller()->GetLastActiveUserPrefService();
+  if (!user_prefs)
+    return Mode::HIDE;
+
   const std::string& mode =
       user_prefs->GetString(prefs::kMessageCenterLockScreenMode);
   if (mode == prefs::kMessageCenterLockScreenModeShow)

diff --git a/ash/public/cpp/ash_features.cc b/ash/public/cpp/ash_features.cc
index 857fb03..b331e481 100644
--- a/ash/public/cpp/ash_features.cc
+++ b/ash/public/cpp/ash_features.cc

@@ -26,14 +26,14 @@
     "KeyboardShortcutViewerApp", base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kLockScreenNotifications{"LockScreenNotifications",
-                                             base::FEATURE_DISABLED_BY_DEFAULT};
+                                             base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kLockScreenInlineReply{"LockScreenInlineReply",
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
 const base::Feature kLockScreenHideSensitiveNotificationsSupport{
     "LockScreenHideSensitiveNotificationsSupport",
-    base::FEATURE_ENABLED_BY_DEFAULT};
+    base::FEATURE_DISABLED_BY_DEFAULT};
 
 const base::Feature kNewWallpaperPicker{"NewWallpaperPicker",
                                         base::FEATURE_ENABLED_BY_DEFAULT};

diff --git a/ash/public/cpp/vector_icons/BUILD.gn b/ash/public/cpp/vector_icons/BUILD.gn
index 2f1fef1..7f15d7c0 100644
--- a/ash/public/cpp/vector_icons/BUILD.gn
+++ b/ash/public/cpp/vector_icons/BUILD.gn

@@ -9,6 +9,7 @@
   icon_directory = "."
 
   icons = [
+    "assistant.icon",
     "notification_assistant.icon",
     "notification_captive_portal.icon",
     "notification_cellular_alert.icon",

diff --git a/ash/resources/vector_icons/assistant.icon b/ash/public/cpp/vector_icons/assistant.icon
similarity index 100%
rename from ash/resources/vector_icons/assistant.icon
rename to ash/public/cpp/vector_icons/assistant.icon


diff --git a/ash/resources/vector_icons/BUILD.gn b/ash/resources/vector_icons/BUILD.gn
index 51b2ca96..b274e9b 100644
--- a/ash/resources/vector_icons/BUILD.gn
+++ b/ash/resources/vector_icons/BUILD.gn

@@ -9,7 +9,6 @@
   icon_directory = "."
 
   icons = [
-    "assistant.icon",
     "auto_hide.icon",
     "captive_portal.icon",
     "check_circle.icon",

diff --git a/ash/shell.cc b/ash/shell.cc
index 86c192e..d48cd2fd 100644
--- a/ash/shell.cc
+++ b/ash/shell.cc

@@ -1108,6 +1108,8 @@
       display::Screen::GetScreen()->GetPrimaryDisplay());
 
   accelerator_controller_ = std::make_unique<AcceleratorController>(nullptr);
+  voice_interaction_controller_ =
+      std::make_unique<VoiceInteractionController>();
 
   // |app_list_controller_| is put after |tablet_mode_controller_| as the former
   // uses the latter in constructor.
@@ -1185,8 +1187,6 @@
   laser_pointer_controller_.reset(new LaserPointerController());
   partial_magnification_controller_.reset(new PartialMagnificationController());
   highlighter_controller_.reset(new HighlighterController());
-  voice_interaction_controller_ =
-      std::make_unique<VoiceInteractionController>();
 
   assistant_controller_ = chromeos::switches::IsAssistantEnabled()
                               ? std::make_unique<AssistantController>()

diff --git a/ash/shell/app_list.cc b/ash/shell/app_list.cc
index a088aa0..36e2c8af 100644
--- a/ash/shell/app_list.cc
+++ b/ash/shell/app_list.cc

@@ -235,6 +235,8 @@
     NOTIMPLEMENTED();
   }
 
+  void StartAssistant() override { NOTIMPLEMENTED(); }
+
   void StartSearch(const base::string16& raw_query) override {
     base::string16 query;
     base::TrimWhitespace(raw_query, base::TRIM_ALL, &query);

diff --git a/base/BUILD.gn b/base/BUILD.gn
index 81e8afe..272a365 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn

@@ -2344,6 +2344,7 @@
     "metrics/statistics_recorder_unittest.cc",
     "native_library_unittest.cc",
     "no_destructor_unittest.cc",
+    "observer_list_threadsafe_unittest.cc",
     "observer_list_unittest.cc",
     "optional_unittest.cc",
     "os_compat_android_unittest.cc",

diff --git a/base/build_time_unittest.cc b/base/build_time_unittest.cc
index 3a357363..a9cc44590 100644
--- a/base/build_time_unittest.cc
+++ b/base/build_time_unittest.cc

@@ -29,9 +29,3 @@
   EXPECT_LT(base::GetBuildTime(), base::Time::Now());
   EXPECT_LT(base::GetBuildTime(), base::Time::NowFromSystemTime());
 }
-
-TEST(BuildTime, NotTooFar) {
-  // BuildTime must be less than 45 days old.
-  base::Time cutoff(base::Time::Now() - base::TimeDelta::FromDays(45));
-  EXPECT_GT(base::GetBuildTime(), cutoff);
-}

diff --git a/base/memory/ref_counted.cc b/base/memory/ref_counted.cc
index 38cd495..f3d35cf57 100644
--- a/base/memory/ref_counted.cc
+++ b/base/memory/ref_counted.cc

@@ -32,7 +32,10 @@
 }
 #endif
 
-#if defined(ARCH_CPU_64_BIT)
+// This is a security check. In 32-bit-archs, an attacker would run out of
+// address space after allocating at most 2^32 scoped_refptrs. This replicates
+// that boundary for 64-bit-archs.
+#if defined(ARCH_CPU_64_BITS)
 void RefCountedBase::AddRefImpl() const {
   // Check if |ref_count_| overflow only on 64 bit archs since the number of
   // objects may exceed 2^32.

diff --git a/base/memory/ref_counted.h b/base/memory/ref_counted.h
index e1c78de9..e219ee15 100644
--- a/base/memory/ref_counted.h
+++ b/base/memory/ref_counted.h

@@ -12,6 +12,7 @@
 #include "base/atomic_ref_count.h"
 #include "base/base_export.h"
 #include "base/compiler_specific.h"
+#include "base/gtest_prod_util.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
@@ -114,6 +115,8 @@
   template <typename U>
   friend scoped_refptr<U> base::AdoptRef(U*);
 
+  FRIEND_TEST_ALL_PREFIXES(RefCountedDeathTest, TestOverflowCheck);
+
   void Adopted() const {
 #if DCHECK_IS_ON()
     DCHECK(needs_adopt_ref_);
@@ -121,7 +124,7 @@
 #endif
   }
 
-#if defined(ARCH_CPU_64_BIT)
+#if defined(ARCH_CPU_64_BITS)
   void AddRefImpl() const;
 #else
   void AddRefImpl() const { ++ref_count_; }

diff --git a/base/memory/ref_counted_unittest.cc b/base/memory/ref_counted_unittest.cc
index df1c30f..ff52d18 100644
--- a/base/memory/ref_counted_unittest.cc
+++ b/base/memory/ref_counted_unittest.cc

@@ -8,8 +8,11 @@
 #include <utility>
 
 #include "base/test/gtest_util.h"
+#include "build/build_config.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+namespace base {
+namespace subtle {
 namespace {
 
 class SelfAssign : public base::RefCounted<SelfAssign> {
@@ -173,7 +176,16 @@
   scoped_refptr<CheckRefptrNull>* ptr_ = nullptr;
 };
 
-}  // end namespace
+class Overflow : public base::RefCounted<Overflow> {
+ public:
+  Overflow() = default;
+
+ private:
+  friend class base::RefCounted<Overflow>;
+  ~Overflow() = default;
+};
+
+}  // namespace
 
 TEST(RefCountedUnitTest, TestSelfAssignment) {
   SelfAssign* p = new SelfAssign;
@@ -669,3 +681,16 @@
       base::MakeRefCounted<InitialRefCountIsOne>();
   EXPECT_DCHECK_DEATH(base::AdoptRef(obj.get()));
 }
+
+#if defined(ARCH_CPU_64_BITS)
+TEST(RefCountedDeathTest, TestOverflowCheck) {
+  EXPECT_DCHECK_DEATH({
+    auto p = base::MakeRefCounted<Overflow>();
+    p->ref_count_ = std::numeric_limits<uint32_t>::max();
+    p->AddRef();
+  });
+}
+#endif
+
+}  // namespace subtle
+}  // namespace base

diff --git a/base/observer_list_threadsafe_unittest.cc b/base/observer_list_threadsafe_unittest.cc
new file mode 100644
index 0000000..64e273b
--- /dev/null
+++ b/base/observer_list_threadsafe_unittest.cc

@@ -0,0 +1,555 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/observer_list_threadsafe.h"
+
+#include <memory>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/compiler_specific.h"
+#include "base/location.h"
+#include "base/memory/weak_ptr.h"
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "base/sequenced_task_runner.h"
+#include "base/single_thread_task_runner.h"
+#include "base/synchronization/waitable_event.h"
+#include "base/task/post_task.h"
+#include "base/task/task_scheduler/task_scheduler.h"
+#include "base/test/scoped_task_environment.h"
+#include "base/threading/platform_thread.h"
+#include "base/threading/thread_restrictions.h"
+#include "build/build_config.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace base {
+namespace {
+
+constexpr int kThreadRunTime = 2000;  // ms to run the multi-threaded test.
+
+class Foo {
+ public:
+  virtual void Observe(int x) = 0;
+  virtual ~Foo() = default;
+  virtual int GetValue() const { return 0; }
+};
+
+class Adder : public Foo {
+ public:
+  explicit Adder(int scaler) : total(0), scaler_(scaler) {}
+  ~Adder() override = default;
+
+  void Observe(int x) override { total += x * scaler_; }
+  int GetValue() const override { return total; }
+
+  int total;
+
+ private:
+  int scaler_;
+};
+
+class AddInObserve : public Foo {
+ public:
+  explicit AddInObserve(ObserverListThreadSafe<Foo>* observer_list)
+      : observer_list(observer_list), to_add_() {}
+
+  void SetToAdd(Foo* to_add) { to_add_ = to_add; }
+
+  void Observe(int x) override {
+    if (to_add_) {
+      observer_list->AddObserver(to_add_);
+      to_add_ = nullptr;
+    }
+  }
+
+  ObserverListThreadSafe<Foo>* observer_list;
+  Foo* to_add_;
+};
+
+// A thread for use in the ThreadSafeObserver test which will add and remove
+// itself from the notification list repeatedly.
+class AddRemoveThread : public PlatformThread::Delegate, public Foo {
+ public:
+  AddRemoveThread(ObserverListThreadSafe<Foo>* list,
+                  bool notify,
+                  WaitableEvent* ready)
+      : list_(list),
+        loop_(nullptr),
+        in_list_(false),
+        start_(Time::Now()),
+        count_observes_(0),
+        count_addtask_(0),
+        do_notifies_(notify),
+        ready_(ready),
+        weak_factory_(this) {}
+
+  ~AddRemoveThread() override = default;
+
+  void ThreadMain() override {
+    loop_ = new MessageLoop();  // Fire up a message loop.
+    loop_->task_runner()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&AddRemoveThread::AddTask, weak_factory_.GetWeakPtr()));
+    ready_->Signal();
+    // After ready_ is signaled, loop_ is only accessed by the main test thread
+    // (i.e. not this thread) in particular by Quit() which causes Run() to
+    // return, and we "control" loop_ again.
+    RunLoop run_loop;
+    quit_loop_ = run_loop.QuitClosure();
+    run_loop.Run();
+    delete loop_;
+    loop_ = reinterpret_cast<MessageLoop*>(0xdeadbeef);
+    delete this;
+  }
+
+  // This task just keeps posting to itself in an attempt to race with the
+  // notifier.
+  void AddTask() {
+    count_addtask_++;
+
+    if ((Time::Now() - start_).InMilliseconds() > kThreadRunTime) {
+      VLOG(1) << "DONE!";
+      return;
+    }
+
+    if (!in_list_) {
+      list_->AddObserver(this);
+      in_list_ = true;
+    }
+
+    if (do_notifies_) {
+      list_->Notify(FROM_HERE, &Foo::Observe, 10);
+    }
+
+    loop_->task_runner()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&AddRemoveThread::AddTask, weak_factory_.GetWeakPtr()));
+  }
+
+  // This function is only callable from the main thread.
+  void Quit() { std::move(quit_loop_).Run(); }
+
+  void Observe(int x) override {
+    count_observes_++;
+
+    // If we're getting called after we removed ourselves from the list, that is
+    // very bad!
+    DCHECK(in_list_);
+
+    // This callback should fire on the appropriate thread
+    EXPECT_EQ(loop_, MessageLoop::current());
+
+    list_->RemoveObserver(this);
+    in_list_ = false;
+  }
+
+ private:
+  ObserverListThreadSafe<Foo>* list_;
+  MessageLoop* loop_;
+  bool in_list_;  // Are we currently registered for notifications.
+                  // in_list_ is only used on |this| thread.
+  Time start_;    // The time we started the test.
+
+  int count_observes_;  // Number of times we observed.
+  int count_addtask_;   // Number of times thread AddTask was called
+  bool do_notifies_;    // Whether these threads should do notifications.
+  WaitableEvent* ready_;
+
+  base::OnceClosure quit_loop_;
+
+  base::WeakPtrFactory<AddRemoveThread> weak_factory_;
+};
+
+}  // namespace
+
+TEST(ObserverListThreadSafeTest, BasicTest) {
+  MessageLoop loop;
+
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+  Adder a(1);
+  Adder b(-1);
+  Adder c(1);
+  Adder d(-1);
+
+  observer_list->AddObserver(&a);
+  observer_list->AddObserver(&b);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+  RunLoop().RunUntilIdle();
+
+  observer_list->AddObserver(&c);
+  observer_list->AddObserver(&d);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+  observer_list->RemoveObserver(&c);
+  RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(20, a.total);
+  EXPECT_EQ(-20, b.total);
+  EXPECT_EQ(0, c.total);
+  EXPECT_EQ(-10, d.total);
+}
+
+TEST(ObserverListThreadSafeTest, RemoveObserver) {
+  MessageLoop loop;
+
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+  Adder a(1), b(1);
+
+  // A workaround for the compiler bug. See http://crbug.com/121960.
+  EXPECT_NE(&a, &b);
+
+  // Should do nothing.
+  observer_list->RemoveObserver(&a);
+  observer_list->RemoveObserver(&b);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+  RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(0, a.total);
+  EXPECT_EQ(0, b.total);
+
+  observer_list->AddObserver(&a);
+
+  // Should also do nothing.
+  observer_list->RemoveObserver(&b);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+  RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(10, a.total);
+  EXPECT_EQ(0, b.total);
+}
+
+TEST(ObserverListThreadSafeTest, WithoutSequence) {
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+
+  Adder a(1), b(1), c(1);
+
+  // No sequence, so these should not be added.
+  observer_list->AddObserver(&a);
+  observer_list->AddObserver(&b);
+
+  {
+    // Add c when there's a sequence.
+    MessageLoop loop;
+    observer_list->AddObserver(&c);
+
+    observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+    RunLoop().RunUntilIdle();
+
+    EXPECT_EQ(0, a.total);
+    EXPECT_EQ(0, b.total);
+    EXPECT_EQ(10, c.total);
+
+    // Now add a when there's a sequence.
+    observer_list->AddObserver(&a);
+
+    // Remove c when there's a sequence.
+    observer_list->RemoveObserver(&c);
+
+    // Notify again.
+    observer_list->Notify(FROM_HERE, &Foo::Observe, 20);
+    RunLoop().RunUntilIdle();
+
+    EXPECT_EQ(20, a.total);
+    EXPECT_EQ(0, b.total);
+    EXPECT_EQ(10, c.total);
+  }
+
+  // Removing should always succeed with or without a sequence.
+  observer_list->RemoveObserver(&a);
+
+  // Notifying should not fail but should also be a no-op.
+  MessageLoop loop;
+  observer_list->AddObserver(&b);
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 30);
+  RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(20, a.total);
+  EXPECT_EQ(30, b.total);
+  EXPECT_EQ(10, c.total);
+}
+
+class FooRemover : public Foo {
+ public:
+  explicit FooRemover(ObserverListThreadSafe<Foo>* list) : list_(list) {}
+  ~FooRemover() override = default;
+
+  void AddFooToRemove(Foo* foo) { foos_.push_back(foo); }
+
+  void Observe(int x) override {
+    std::vector<Foo*> tmp;
+    tmp.swap(foos_);
+    for (std::vector<Foo*>::iterator it = tmp.begin(); it != tmp.end(); ++it) {
+      list_->RemoveObserver(*it);
+    }
+  }
+
+ private:
+  const scoped_refptr<ObserverListThreadSafe<Foo>> list_;
+  std::vector<Foo*> foos_;
+};
+
+TEST(ObserverListThreadSafeTest, RemoveMultipleObservers) {
+  MessageLoop loop;
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+
+  FooRemover a(observer_list.get());
+  Adder b(1);
+
+  observer_list->AddObserver(&a);
+  observer_list->AddObserver(&b);
+
+  a.AddFooToRemove(&a);
+  a.AddFooToRemove(&b);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+  RunLoop().RunUntilIdle();
+}
+
+// A test driver for a multi-threaded notification loop.  Runs a number of
+// observer threads, each of which constantly adds/removes itself from the
+// observer list.  Optionally, if cross_thread_notifies is set to true, the
+// observer threads will also trigger notifications to all observers.
+static void ThreadSafeObserverHarness(int num_threads,
+                                      bool cross_thread_notifies) {
+  MessageLoop loop;
+
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+  Adder a(1);
+  Adder b(-1);
+
+  observer_list->AddObserver(&a);
+  observer_list->AddObserver(&b);
+
+  std::vector<AddRemoveThread*> threaded_observer;
+  std::vector<base::PlatformThreadHandle> threads(num_threads);
+  std::vector<std::unique_ptr<base::WaitableEvent>> ready;
+  threaded_observer.reserve(num_threads);
+  ready.reserve(num_threads);
+  for (int index = 0; index < num_threads; index++) {
+    ready.push_back(std::make_unique<WaitableEvent>(
+        WaitableEvent::ResetPolicy::MANUAL,
+        WaitableEvent::InitialState::NOT_SIGNALED));
+    threaded_observer.push_back(new AddRemoveThread(
+        observer_list.get(), cross_thread_notifies, ready.back().get()));
+    EXPECT_TRUE(
+        PlatformThread::Create(0, threaded_observer.back(), &threads[index]));
+  }
+  ASSERT_EQ(static_cast<size_t>(num_threads), threaded_observer.size());
+  ASSERT_EQ(static_cast<size_t>(num_threads), ready.size());
+
+  // This makes sure that threaded_observer has gotten to set loop_, so that we
+  // can call Quit() below safe-ish-ly.
+  for (int i = 0; i < num_threads; ++i)
+    ready[i]->Wait();
+
+  Time start = Time::Now();
+  while (true) {
+    if ((Time::Now() - start).InMilliseconds() > kThreadRunTime)
+      break;
+
+    observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
+
+    RunLoop().RunUntilIdle();
+  }
+
+  for (int index = 0; index < num_threads; index++) {
+    threaded_observer[index]->Quit();
+    PlatformThread::Join(threads[index]);
+  }
+}
+
+#if defined(OS_FUCHSIA)
+// TODO(crbug.com/738275): This is flaky on Fuchsia.
+#define MAYBE_CrossThreadObserver DISABLED_CrossThreadObserver
+#else
+#define MAYBE_CrossThreadObserver CrossThreadObserver
+#endif
+TEST(ObserverListThreadSafeTest, MAYBE_CrossThreadObserver) {
+  // Use 7 observer threads.  Notifications only come from the main thread.
+  ThreadSafeObserverHarness(7, false);
+}
+
+TEST(ObserverListThreadSafeTest, CrossThreadNotifications) {
+  // Use 3 observer threads.  Notifications will fire from the main thread and
+  // all 3 observer threads.
+  ThreadSafeObserverHarness(3, true);
+}
+
+TEST(ObserverListThreadSafeTest, OutlivesMessageLoop) {
+  MessageLoop* loop = new MessageLoop;
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>);
+
+  Adder a(1);
+  observer_list->AddObserver(&a);
+  delete loop;
+  // Test passes if we don't crash here.
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+}
+
+namespace {
+
+class SequenceVerificationObserver : public Foo {
+ public:
+  explicit SequenceVerificationObserver(
+      scoped_refptr<SequencedTaskRunner> task_runner)
+      : task_runner_(std::move(task_runner)) {}
+  ~SequenceVerificationObserver() override = default;
+
+  void Observe(int x) override {
+    called_on_valid_sequence_ = task_runner_->RunsTasksInCurrentSequence();
+  }
+
+  bool called_on_valid_sequence() const { return called_on_valid_sequence_; }
+
+ private:
+  const scoped_refptr<SequencedTaskRunner> task_runner_;
+  bool called_on_valid_sequence_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(SequenceVerificationObserver);
+};
+
+}  // namespace
+
+// Verify that observers are notified on the correct sequence.
+TEST(ObserverListThreadSafeTest, NotificationOnValidSequence) {
+  test::ScopedTaskEnvironment scoped_task_environment;
+
+  auto task_runner_1 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
+  auto task_runner_2 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
+
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
+
+  SequenceVerificationObserver observer_1(task_runner_1);
+  SequenceVerificationObserver observer_2(task_runner_2);
+
+  task_runner_1->PostTask(FROM_HERE,
+                          BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
+                                   observer_list, Unretained(&observer_1)));
+  task_runner_2->PostTask(FROM_HERE,
+                          BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
+                                   observer_list, Unretained(&observer_2)));
+
+  TaskScheduler::GetInstance()->FlushForTesting();
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+
+  TaskScheduler::GetInstance()->FlushForTesting();
+
+  EXPECT_TRUE(observer_1.called_on_valid_sequence());
+  EXPECT_TRUE(observer_2.called_on_valid_sequence());
+}
+
+// Verify that when an observer is added to a NOTIFY_ALL ObserverListThreadSafe
+// from a notification, it is itself notified.
+TEST(ObserverListThreadSafeTest, AddObserverFromNotificationNotifyAll) {
+  test::ScopedTaskEnvironment scoped_task_environment;
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
+
+  Adder observer_added_from_notification(1);
+
+  AddInObserve initial_observer(observer_list.get());
+  initial_observer.SetToAdd(&observer_added_from_notification);
+  observer_list->AddObserver(&initial_observer);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(1, observer_added_from_notification.GetValue());
+}
+
+namespace {
+
+class RemoveWhileNotificationIsRunningObserver : public Foo {
+ public:
+  RemoveWhileNotificationIsRunningObserver()
+      : notification_running_(WaitableEvent::ResetPolicy::AUTOMATIC,
+                              WaitableEvent::InitialState::NOT_SIGNALED),
+        barrier_(WaitableEvent::ResetPolicy::AUTOMATIC,
+                 WaitableEvent::InitialState::NOT_SIGNALED) {}
+  ~RemoveWhileNotificationIsRunningObserver() override = default;
+
+  void Observe(int x) override {
+    notification_running_.Signal();
+    ScopedAllowBaseSyncPrimitivesForTesting allow_base_sync_primitives;
+    barrier_.Wait();
+  }
+
+  void WaitForNotificationRunning() { notification_running_.Wait(); }
+  void Unblock() { barrier_.Signal(); }
+
+ private:
+  WaitableEvent notification_running_;
+  WaitableEvent barrier_;
+
+  DISALLOW_COPY_AND_ASSIGN(RemoveWhileNotificationIsRunningObserver);
+};
+
+}  // namespace
+
+// Verify that there is no crash when an observer is removed while it is being
+// notified.
+TEST(ObserverListThreadSafeTest, RemoveWhileNotificationIsRunning) {
+  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
+  RemoveWhileNotificationIsRunningObserver observer;
+
+  WaitableEvent task_running(WaitableEvent::ResetPolicy::AUTOMATIC,
+                             WaitableEvent::InitialState::NOT_SIGNALED);
+  WaitableEvent barrier(WaitableEvent::ResetPolicy::AUTOMATIC,
+                        WaitableEvent::InitialState::NOT_SIGNALED);
+
+  // This must be after the declaration of |barrier| so that tasks posted to
+  // TaskScheduler can safely use |barrier|.
+  test::ScopedTaskEnvironment scoped_task_environment;
+
+  CreateSequencedTaskRunnerWithTraits({})->PostTask(
+      FROM_HERE, base::BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
+                                observer_list, Unretained(&observer)));
+  TaskScheduler::GetInstance()->FlushForTesting();
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+  observer.WaitForNotificationRunning();
+  observer_list->RemoveObserver(&observer);
+
+  observer.Unblock();
+}
+
+// Same as ObserverListTest.Existing, but for ObserverListThreadSafe
+TEST(ObserverListThreadSafeTest, Existing) {
+  MessageLoop loop;
+  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
+      new ObserverListThreadSafe<Foo>(ObserverListPolicy::EXISTING_ONLY));
+  Adder a(1);
+  AddInObserve b(observer_list.get());
+  Adder c(1);
+  b.SetToAdd(&c);
+
+  observer_list->AddObserver(&a);
+  observer_list->AddObserver(&b);
+
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+  RunLoop().RunUntilIdle();
+
+  EXPECT_FALSE(b.to_add_);
+  // B's adder should not have been notified because it was added during
+  // notification.
+  EXPECT_EQ(0, c.total);
+
+  // Notify again to make sure b's adder is notified.
+  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
+  RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, c.total);
+}
+
+}  // namespace base

diff --git a/base/observer_list_unittest.cc b/base/observer_list_unittest.cc
index db1ff9a2..449aee5 100644
--- a/base/observer_list_unittest.cc
+++ b/base/observer_list_unittest.cc

@@ -3,27 +3,9 @@
 // found in the LICENSE file.
 
 #include "base/observer_list.h"
-#include "base/observer_list_threadsafe.h"
 
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "base/compiler_specific.h"
-#include "base/location.h"
-#include "base/memory/weak_ptr.h"
-#include "base/message_loop/message_loop.h"
-#include "base/run_loop.h"
-#include "base/sequenced_task_runner.h"
-#include "base/single_thread_task_runner.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/task/post_task.h"
-#include "base/task/task_scheduler/task_scheduler.h"
+#include "base/strings/string_piece.h"
 #include "base/test/gtest_util.h"
-#include "base/test/scoped_task_environment.h"
-#include "base/threading/platform_thread.h"
-#include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -78,10 +60,9 @@
   bool remove_self_;
 };
 
-template <typename ObserverListType>
 class AddInObserve : public Foo {
  public:
-  explicit AddInObserve(ObserverListType* observer_list)
+  explicit AddInObserve(ObserverList<Foo>* observer_list)
       : observer_list(observer_list), to_add_() {}
 
   void SetToAdd(Foo* to_add) { to_add_ = to_add; }
@@ -93,109 +74,10 @@
     }
   }
 
-  ObserverListType* observer_list;
+  ObserverList<Foo>* observer_list;
   Foo* to_add_;
 };
 
-
-static const int kThreadRunTime = 2000;  // ms to run the multi-threaded test.
-
-// A thread for use in the ThreadSafeObserver test
-// which will add and remove itself from the notification
-// list repeatedly.
-class AddRemoveThread : public PlatformThread::Delegate,
-                        public Foo {
- public:
-  AddRemoveThread(ObserverListThreadSafe<Foo>* list,
-                  bool notify,
-                  WaitableEvent* ready)
-      : list_(list),
-        loop_(nullptr),
-        in_list_(false),
-        start_(Time::Now()),
-        count_observes_(0),
-        count_addtask_(0),
-        do_notifies_(notify),
-        ready_(ready),
-        weak_factory_(this) {}
-
-  ~AddRemoveThread() override = default;
-
-  void ThreadMain() override {
-    loop_ = new MessageLoop();  // Fire up a message loop.
-    loop_->task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&AddRemoveThread::AddTask, weak_factory_.GetWeakPtr()));
-    ready_->Signal();
-    // After ready_ is signaled, loop_ is only accessed by the main test thread
-    // (i.e. not this thread) in particular by Quit() which causes Run() to
-    // return, and we "control" loop_ again.
-    RunLoop run_loop;
-    quit_loop_ = run_loop.QuitClosure();
-    run_loop.Run();
-    delete loop_;
-    loop_ = reinterpret_cast<MessageLoop*>(0xdeadbeef);
-    delete this;
-  }
-
-  // This task just keeps posting to itself in an attempt
-  // to race with the notifier.
-  void AddTask() {
-    count_addtask_++;
-
-    if ((Time::Now() - start_).InMilliseconds() > kThreadRunTime) {
-      VLOG(1) << "DONE!";
-      return;
-    }
-
-    if (!in_list_) {
-      list_->AddObserver(this);
-      in_list_ = true;
-    }
-
-    if (do_notifies_) {
-      list_->Notify(FROM_HERE, &Foo::Observe, 10);
-    }
-
-    loop_->task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&AddRemoveThread::AddTask, weak_factory_.GetWeakPtr()));
-  }
-
-  // This function is only callable from the main thread.
-  void Quit() { std::move(quit_loop_).Run(); }
-
-  void Observe(int x) override {
-    count_observes_++;
-
-    // If we're getting called after we removed ourselves from
-    // the list, that is very bad!
-    DCHECK(in_list_);
-
-    // This callback should fire on the appropriate thread
-    EXPECT_EQ(loop_, MessageLoop::current());
-
-    list_->RemoveObserver(this);
-    in_list_ = false;
-  }
-
- private:
-  ObserverListThreadSafe<Foo>* list_;
-  MessageLoop* loop_;
-  bool in_list_;        // Are we currently registered for notifications.
-                        // in_list_ is only used on |this| thread.
-  Time start_;          // The time we started the test.
-
-  int count_observes_;  // Number of times we observed.
-  int count_addtask_;   // Number of times thread AddTask was called
-  bool do_notifies_;    // Whether these threads should do notifications.
-  WaitableEvent* ready_;
-
-  base::OnceClosure quit_loop_;
-
-  base::WeakPtrFactory<AddRemoveThread> weak_factory_;
-};
-
 }  // namespace
 
 TEST(ObserverListTest, BasicTest) {
@@ -427,377 +309,10 @@
   EXPECT_EQ(-20, d.total);
 }
 
-TEST(ObserverListThreadSafeTest, BasicTest) {
-  MessageLoop loop;
-
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-  Adder a(1);
-  Adder b(-1);
-  Adder c(1);
-  Adder d(-1);
-
-  observer_list->AddObserver(&a);
-  observer_list->AddObserver(&b);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-  RunLoop().RunUntilIdle();
-
-  observer_list->AddObserver(&c);
-  observer_list->AddObserver(&d);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-  observer_list->RemoveObserver(&c);
-  RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(20, a.total);
-  EXPECT_EQ(-20, b.total);
-  EXPECT_EQ(0, c.total);
-  EXPECT_EQ(-10, d.total);
-}
-
-TEST(ObserverListThreadSafeTest, RemoveObserver) {
-  MessageLoop loop;
-
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-  Adder a(1), b(1);
-
-  // A workaround for the compiler bug. See http://crbug.com/121960.
-  EXPECT_NE(&a, &b);
-
-  // Should do nothing.
-  observer_list->RemoveObserver(&a);
-  observer_list->RemoveObserver(&b);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-  RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(0, a.total);
-  EXPECT_EQ(0, b.total);
-
-  observer_list->AddObserver(&a);
-
-  // Should also do nothing.
-  observer_list->RemoveObserver(&b);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-  RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(10, a.total);
-  EXPECT_EQ(0, b.total);
-}
-
-TEST(ObserverListThreadSafeTest, WithoutSequence) {
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-
-  Adder a(1), b(1), c(1);
-
-  // No sequence, so these should not be added.
-  observer_list->AddObserver(&a);
-  observer_list->AddObserver(&b);
-
-  {
-    // Add c when there's a sequence.
-    MessageLoop loop;
-    observer_list->AddObserver(&c);
-
-    observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-    RunLoop().RunUntilIdle();
-
-    EXPECT_EQ(0, a.total);
-    EXPECT_EQ(0, b.total);
-    EXPECT_EQ(10, c.total);
-
-    // Now add a when there's a sequence.
-    observer_list->AddObserver(&a);
-
-    // Remove c when there's a sequence.
-    observer_list->RemoveObserver(&c);
-
-    // Notify again.
-    observer_list->Notify(FROM_HERE, &Foo::Observe, 20);
-    RunLoop().RunUntilIdle();
-
-    EXPECT_EQ(20, a.total);
-    EXPECT_EQ(0, b.total);
-    EXPECT_EQ(10, c.total);
-  }
-
-  // Removing should always succeed with or without a sequence.
-  observer_list->RemoveObserver(&a);
-
-  // Notifying should not fail but should also be a no-op.
-  MessageLoop loop;
-  observer_list->AddObserver(&b);
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 30);
-  RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(20, a.total);
-  EXPECT_EQ(30, b.total);
-  EXPECT_EQ(10, c.total);
-}
-
-class FooRemover : public Foo {
- public:
-  explicit FooRemover(ObserverListThreadSafe<Foo>* list) : list_(list) {}
-  ~FooRemover() override = default;
-
-  void AddFooToRemove(Foo* foo) {
-    foos_.push_back(foo);
-  }
-
-  void Observe(int x) override {
-    std::vector<Foo*> tmp;
-    tmp.swap(foos_);
-    for (std::vector<Foo*>::iterator it = tmp.begin();
-         it != tmp.end(); ++it) {
-      list_->RemoveObserver(*it);
-    }
-  }
-
- private:
-  const scoped_refptr<ObserverListThreadSafe<Foo> > list_;
-  std::vector<Foo*> foos_;
-};
-
-TEST(ObserverListThreadSafeTest, RemoveMultipleObservers) {
-  MessageLoop loop;
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-
-  FooRemover a(observer_list.get());
-  Adder b(1);
-
-  observer_list->AddObserver(&a);
-  observer_list->AddObserver(&b);
-
-  a.AddFooToRemove(&a);
-  a.AddFooToRemove(&b);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-  RunLoop().RunUntilIdle();
-}
-
-// A test driver for a multi-threaded notification loop.  Runs a number
-// of observer threads, each of which constantly adds/removes itself
-// from the observer list.  Optionally, if cross_thread_notifies is set
-// to true, the observer threads will also trigger notifications to
-// all observers.
-static void ThreadSafeObserverHarness(int num_threads,
-                                      bool cross_thread_notifies) {
-  MessageLoop loop;
-
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-  Adder a(1);
-  Adder b(-1);
-
-  observer_list->AddObserver(&a);
-  observer_list->AddObserver(&b);
-
-  std::vector<AddRemoveThread*> threaded_observer;
-  std::vector<base::PlatformThreadHandle> threads(num_threads);
-  std::vector<std::unique_ptr<base::WaitableEvent>> ready;
-  threaded_observer.reserve(num_threads);
-  ready.reserve(num_threads);
-  for (int index = 0; index < num_threads; index++) {
-    ready.push_back(std::make_unique<WaitableEvent>(
-        WaitableEvent::ResetPolicy::MANUAL,
-        WaitableEvent::InitialState::NOT_SIGNALED));
-    threaded_observer.push_back(new AddRemoveThread(
-        observer_list.get(), cross_thread_notifies, ready.back().get()));
-    EXPECT_TRUE(
-        PlatformThread::Create(0, threaded_observer.back(), &threads[index]));
-  }
-  ASSERT_EQ(static_cast<size_t>(num_threads), threaded_observer.size());
-  ASSERT_EQ(static_cast<size_t>(num_threads), ready.size());
-
-  // This makes sure that threaded_observer has gotten to set loop_, so that we
-  // can call Quit() below safe-ish-ly.
-  for (int i = 0; i < num_threads; ++i)
-    ready[i]->Wait();
-
-  Time start = Time::Now();
-  while (true) {
-    if ((Time::Now() - start).InMilliseconds() > kThreadRunTime)
-      break;
-
-    observer_list->Notify(FROM_HERE, &Foo::Observe, 10);
-
-    RunLoop().RunUntilIdle();
-  }
-
-  for (int index = 0; index < num_threads; index++) {
-    threaded_observer[index]->Quit();
-    PlatformThread::Join(threads[index]);
-  }
-}
-
-#if defined(OS_FUCHSIA)
-// TODO(crbug.com/738275): This is flaky on Fuchsia.
-#define MAYBE_CrossThreadObserver DISABLED_CrossThreadObserver
-#else
-#define MAYBE_CrossThreadObserver CrossThreadObserver
-#endif
-TEST(ObserverListThreadSafeTest, MAYBE_CrossThreadObserver) {
-  // Use 7 observer threads.  Notifications only come from
-  // the main thread.
-  ThreadSafeObserverHarness(7, false);
-}
-
-TEST(ObserverListThreadSafeTest, CrossThreadNotifications) {
-  // Use 3 observer threads.  Notifications will fire from
-  // the main thread and all 3 observer threads.
-  ThreadSafeObserverHarness(3, true);
-}
-
-TEST(ObserverListThreadSafeTest, OutlivesMessageLoop) {
-  MessageLoop* loop = new MessageLoop;
-  scoped_refptr<ObserverListThreadSafe<Foo> > observer_list(
-      new ObserverListThreadSafe<Foo>);
-
-  Adder a(1);
-  observer_list->AddObserver(&a);
-  delete loop;
-  // Test passes if we don't crash here.
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-}
-
-namespace {
-
-class SequenceVerificationObserver : public Foo {
- public:
-  explicit SequenceVerificationObserver(
-      scoped_refptr<SequencedTaskRunner> task_runner)
-      : task_runner_(std::move(task_runner)) {}
-  ~SequenceVerificationObserver() override = default;
-
-  void Observe(int x) override {
-    called_on_valid_sequence_ = task_runner_->RunsTasksInCurrentSequence();
-  }
-
-  bool called_on_valid_sequence() const { return called_on_valid_sequence_; }
-
- private:
-  const scoped_refptr<SequencedTaskRunner> task_runner_;
-  bool called_on_valid_sequence_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(SequenceVerificationObserver);
-};
-
-}  // namespace
-
-// Verify that observers are notified on the correct sequence.
-TEST(ObserverListThreadSafeTest, NotificationOnValidSequence) {
-  test::ScopedTaskEnvironment scoped_task_environment;
-
-  auto task_runner_1 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
-  auto task_runner_2 = CreateSequencedTaskRunnerWithTraits(TaskTraits());
-
-  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
-
-  SequenceVerificationObserver observer_1(task_runner_1);
-  SequenceVerificationObserver observer_2(task_runner_2);
-
-  task_runner_1->PostTask(FROM_HERE,
-                          BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
-                                   observer_list, Unretained(&observer_1)));
-  task_runner_2->PostTask(FROM_HERE,
-                          BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
-                                   observer_list, Unretained(&observer_2)));
-
-  TaskScheduler::GetInstance()->FlushForTesting();
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-
-  TaskScheduler::GetInstance()->FlushForTesting();
-
-  EXPECT_TRUE(observer_1.called_on_valid_sequence());
-  EXPECT_TRUE(observer_2.called_on_valid_sequence());
-}
-
-// Verify that when an observer is added to a NOTIFY_ALL ObserverListThreadSafe
-// from a notification, it is itself notified.
-TEST(ObserverListThreadSafeTest, AddObserverFromNotificationNotifyAll) {
-  test::ScopedTaskEnvironment scoped_task_environment;
-  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
-
-  Adder observer_added_from_notification(1);
-
-  AddInObserve<ObserverListThreadSafe<Foo>> initial_observer(
-      observer_list.get());
-  initial_observer.SetToAdd(&observer_added_from_notification);
-  observer_list->AddObserver(&initial_observer);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-
-  base::RunLoop().RunUntilIdle();
-
-  EXPECT_EQ(1, observer_added_from_notification.GetValue());
-}
-
-namespace {
-
-class RemoveWhileNotificationIsRunningObserver : public Foo {
- public:
-  RemoveWhileNotificationIsRunningObserver()
-      : notification_running_(WaitableEvent::ResetPolicy::AUTOMATIC,
-                              WaitableEvent::InitialState::NOT_SIGNALED),
-        barrier_(WaitableEvent::ResetPolicy::AUTOMATIC,
-                 WaitableEvent::InitialState::NOT_SIGNALED) {}
-  ~RemoveWhileNotificationIsRunningObserver() override = default;
-
-  void Observe(int x) override {
-    notification_running_.Signal();
-    ScopedAllowBaseSyncPrimitivesForTesting allow_base_sync_primitives;
-    barrier_.Wait();
-  }
-
-  void WaitForNotificationRunning() { notification_running_.Wait(); }
-  void Unblock() { barrier_.Signal(); }
-
- private:
-  WaitableEvent notification_running_;
-  WaitableEvent barrier_;
-
-  DISALLOW_COPY_AND_ASSIGN(RemoveWhileNotificationIsRunningObserver);
-};
-
-}  // namespace
-
-// Verify that there is no crash when an observer is removed while it is being
-// notified.
-TEST(ObserverListThreadSafeTest, RemoveWhileNotificationIsRunning) {
-  auto observer_list = MakeRefCounted<ObserverListThreadSafe<Foo>>();
-  RemoveWhileNotificationIsRunningObserver observer;
-
-  WaitableEvent task_running(WaitableEvent::ResetPolicy::AUTOMATIC,
-                             WaitableEvent::InitialState::NOT_SIGNALED);
-  WaitableEvent barrier(WaitableEvent::ResetPolicy::AUTOMATIC,
-                        WaitableEvent::InitialState::NOT_SIGNALED);
-
-  // This must be after the declaration of |barrier| so that tasks posted to
-  // TaskScheduler can safely use |barrier|.
-  test::ScopedTaskEnvironment scoped_task_environment;
-
-  CreateSequencedTaskRunnerWithTraits({})->PostTask(
-      FROM_HERE, base::BindOnce(&ObserverListThreadSafe<Foo>::AddObserver,
-                                observer_list, Unretained(&observer)));
-  TaskScheduler::GetInstance()->FlushForTesting();
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-  observer.WaitForNotificationRunning();
-  observer_list->RemoveObserver(&observer);
-
-  observer.Unblock();
-}
-
 TEST(ObserverListTest, Existing) {
   ObserverList<Foo> observer_list(ObserverListPolicy::EXISTING_ONLY);
   Adder a(1);
-  AddInObserve<ObserverList<Foo> > b(&observer_list);
+  AddInObserve b(&observer_list);
   Adder c(1);
   b.SetToAdd(&c);
 
@@ -818,33 +333,6 @@
   EXPECT_EQ(1, c.total);
 }
 
-// Same as above, but for ObserverListThreadSafe
-TEST(ObserverListThreadSafeTest, Existing) {
-  MessageLoop loop;
-  scoped_refptr<ObserverListThreadSafe<Foo>> observer_list(
-      new ObserverListThreadSafe<Foo>(ObserverListPolicy::EXISTING_ONLY));
-  Adder a(1);
-  AddInObserve<ObserverListThreadSafe<Foo> > b(observer_list.get());
-  Adder c(1);
-  b.SetToAdd(&c);
-
-  observer_list->AddObserver(&a);
-  observer_list->AddObserver(&b);
-
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-  RunLoop().RunUntilIdle();
-
-  EXPECT_FALSE(b.to_add_);
-  // B's adder should not have been notified because it was added during
-  // notification.
-  EXPECT_EQ(0, c.total);
-
-  // Notify again to make sure b's adder is notified.
-  observer_list->Notify(FROM_HERE, &Foo::Observe, 1);
-  RunLoop().RunUntilIdle();
-  EXPECT_EQ(1, c.total);
-}
-
 class AddInClearObserve : public Foo {
  public:
   explicit AddInClearObserve(ObserverList<Foo>* list)
@@ -1212,10 +700,8 @@
 }
 
 TEST(ObserverListTest, AddObserverInTheLastObserve) {
-  using FooList = ObserverList<Foo>;
-  FooList observer_list;
-
-  AddInObserve<FooList> a(&observer_list);
+  ObserverList<Foo> observer_list;
+  AddInObserve a(&observer_list);
   Adder b(-1);
 
   a.SetToAdd(&b);

diff --git a/base/threading/thread_restrictions.h b/base/threading/thread_restrictions.h
index d1632b4e..c828375 100644
--- a/base/threading/thread_restrictions.h
+++ b/base/threading/thread_restrictions.h

@@ -127,10 +127,6 @@
 class WindowResizeHelperMac;
 }
 
-namespace views {
-class ScreenMus;
-}
-
 namespace viz {
 class HostGpuMemoryBufferManager;
 }
@@ -506,7 +502,6 @@
 #if !defined(OFFICIAL_BUILD)
   friend class content::SoftwareOutputDeviceMus;  // Interim non-production code
 #endif
-  friend class views::ScreenMus;
 // END USAGE THAT NEEDS TO BE FIXED.
 
 #if DCHECK_IS_ON()

diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 3672d45..e2191b9 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni

@@ -2796,6 +2796,7 @@
                                "data_deps",
                                "deps",
                                "dist_ijar_path",
+                               "dont_load_shared_libraries",
                                "emma_never_instrument",
                                "enable_chromium_linker_tests",
                                "enable_multidex",

diff --git a/build/fuchsia/qemu_target.py b/build/fuchsia/qemu_target.py
index 966f89c..beae59ac 100644
--- a/build/fuchsia/qemu_target.py
+++ b/build/fuchsia/qemu_target.py

@@ -56,7 +56,7 @@
 
   def Start(self):
     qemu_path = os.path.join(SDK_ROOT, 'qemu', 'bin',
-                             'qemu-system-' + self._GetTargetSdkArch())
+                             'qemu-system-' + self._GetTargetSdkLegacyArch())
     kernel_args = boot_data.GetKernelArgs(self._output_dir)
 
     # TERM=dumb tells the guest OS to not emit ANSI commands that trigger

diff --git a/build/fuchsia/target.py b/build/fuchsia/target.py
index 36c1ee7..db52f3a5 100644
--- a/build/fuchsia/target.py
+++ b/build/fuchsia/target.py

@@ -134,10 +134,8 @@
 
   def _GetTargetSdkArch(self):
     """Returns the Fuchsia SDK architecture name for the target CPU."""
-    if self._target_cpu == 'arm64':
-      return 'aarch64'
-    elif self._target_cpu == 'x64':
-      return 'x86_64'
+    if self._target_cpu == 'arm64' or self._target_cpu == 'x64':
+      return self._target_cpu
     raise FuchsiaTargetException('Unknown target_cpu:' + self._target_cpu)
 
   def _AssertIsStarted(self):
@@ -162,7 +160,9 @@
   def _GetSshConfigPath(self, path):
     raise NotImplementedError
 
-  def _GetTargetSdkArch(self):
+  # TODO: remove this once all instances of architecture names have been
+  # converted to the new naming pattern.
+  def _GetTargetSdkLegacyArch(self):
     """Returns the Fuchsia SDK architecture name for the target CPU."""
     if self._target_cpu == 'arm64':
       return 'aarch64'

diff --git a/cc/trees/layer_tree_host.cc b/cc/trees/layer_tree_host.cc
index 85d9e3d..ad02739 100644
--- a/cc/trees/layer_tree_host.cc
+++ b/cc/trees/layer_tree_host.cc

@@ -738,30 +738,28 @@
   gfx::Transform identity_transform;
   LayerList update_layer_list;
 
-  {
-    base::AutoReset<bool> update_property_trees(&in_update_property_trees_,
-                                                true);
+  // The non-layer-list mode is used when blink provides cc with a layer tree
+  // and cc needs to compute property trees from that.
+  // In layer lists mode, blink sends cc property trees directly so they do not
+  // need to be built here. Layer lists mode is used by BlinkGenPropertyTrees
+  // and SlimmingPaintV2.
+  if (!IsUsingLayerLists()) {
     TRACE_EVENT0("cc", "LayerTreeHost::UpdateLayers::BuildPropertyTrees");
     TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("cc.debug.cdp-perf"),
                  "LayerTreeHostCommon::ComputeVisibleRectsWithPropertyTrees");
-    PropertyTrees* property_trees = &property_trees_;
-    if (!IsUsingLayerLists()) {
-      // In SPv2 the property trees should have been built by the
-      // client already.
-      PropertyTreeBuilder::BuildPropertyTrees(
-          root_layer, page_scale_layer, inner_viewport_scroll_layer(),
-          outer_viewport_scroll_layer(), overscroll_elasticity_layer(),
-          elastic_overscroll_, page_scale_factor_, device_scale_factor_,
-          gfx::Rect(device_viewport_size_), identity_transform, property_trees);
-      TRACE_EVENT_INSTANT1("cc",
-                           "LayerTreeHost::UpdateLayers_BuiltPropertyTrees",
-                           TRACE_EVENT_SCOPE_THREAD, "property_trees",
-                           property_trees->AsTracedValue());
+    PropertyTreeBuilder::BuildPropertyTrees(
+        root_layer, page_scale_layer, inner_viewport_scroll_layer(),
+        outer_viewport_scroll_layer(), overscroll_elasticity_layer(),
+        elastic_overscroll_, page_scale_factor_, device_scale_factor_,
+        gfx::Rect(device_viewport_size_), identity_transform, &property_trees_);
+    TRACE_EVENT_INSTANT1("cc", "LayerTreeHost::UpdateLayers_BuiltPropertyTrees",
+                         TRACE_EVENT_SCOPE_THREAD, "property_trees",
+                         property_trees_.AsTracedValue());
     } else {
       TRACE_EVENT_INSTANT1("cc",
                            "LayerTreeHost::UpdateLayers_ReceivedPropertyTrees",
                            TRACE_EVENT_SCOPE_THREAD, "property_trees",
-                           property_trees->AsTracedValue());
+                           property_trees_.AsTracedValue());
     }
 
 #if DCHECK_IS_ON()
@@ -779,8 +777,8 @@
     }
 #endif
 
-    draw_property_utils::UpdatePropertyTrees(this, property_trees);
-    draw_property_utils::FindLayersThatNeedUpdates(this, property_trees,
+    draw_property_utils::UpdatePropertyTrees(this, &property_trees_);
+    draw_property_utils::FindLayersThatNeedUpdates(this, &property_trees_,
                                                    &update_layer_list);
 
     // Dump property trees useful for debugging --blink-gen-property-trees
@@ -789,7 +787,7 @@
       VLOG(3) << "CC Property Trees:";
       std::string out;
       base::JSONWriter::WriteWithOptions(
-          *property_trees->AsTracedValue()->ToBaseValue(),
+          *property_trees_.AsTracedValue()->ToBaseValue(),
           base::JSONWriter::OPTIONS_PRETTY_PRINT, &out);
       std::stringstream ss(out);
       while (!ss.eof()) {
@@ -798,7 +796,6 @@
         VLOG(3) << line;
       }
     }
-  }
 
   bool painted_content_has_slow_paths = false;
   bool painted_content_has_non_aa_paint = false;

diff --git a/cc/trees/layer_tree_host.h b/cc/trees/layer_tree_host.h
index ed6c4dd..3dea9db 100644
--- a/cc/trees/layer_tree_host.h
+++ b/cc/trees/layer_tree_host.h

@@ -382,7 +382,6 @@
   void UnregisterLayer(Layer* layer);
   Layer* LayerById(int id) const;
 
-  bool in_update_property_trees() const { return in_update_property_trees_; }
   bool PaintContent(const LayerList& update_layer_list,
                     bool* content_has_slow_paths,
                     bool* content_has_non_aa_paint);
@@ -701,7 +700,6 @@
   std::unordered_map<ElementId, Layer*, ElementIdHash> element_layers_map_;
 
   bool in_paint_layer_contents_ = false;
-  bool in_update_property_trees_ = false;
 
   // This is true if atleast one layer in the layer tree has a copy request. We
   // use this bool to decide whether we need to compute subtree has copy request

diff --git a/chrome/VERSION b/chrome/VERSION
index 932d39c..b619aba 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=70
 MINOR=0
-BUILD=3524
+BUILD=3525
 PATCH=0

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 8b450b6..f0f1e5c8 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -9131,6 +9131,11 @@
         To use most keys, simply press the button
      </message>
    </if>
+   <if expr="is_macosx">
+     <message name="IDS_WEBAUTHN_TOUCH_ID_TITLE" desc="Title of the dialog shown when the user tries to sign in with Touch ID." meaning="'Touch ID' is the fingerprint recognition feature in macOS. Try to refer Apple support documentation in the target language for the appropriate product name translation.">
+       Use Touch ID with <ph name="APP_NAME">$1<ex>example.com</ex></ph>
+     </message>
+   </if>
   </messages>
  </release>
 </grit>

diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index abbbf80..10fdfba 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp

@@ -2471,6 +2471,12 @@
   <message name="IDS_SETTINGS_WAKE_ON_WIFI_DESCRIPTION" desc="In the settings tab, the text next to the checkbox for enabling quickly reconnecting to known Wi-Fi SSIDs.">
     Keep Wi-Fi on during sleep
   </message>
+  <message name="IDS_SETTINGS_APP_LIST_CONTINUE_READING" desc="In the settings tab, the text next to the checkbox for enabling Continue Reading in Launcher.">
+    Continue Reading
+  </message>
+  <message name="IDS_SETTINGS_APP_LIST_CONTINUE_READING_DESCRIPTION" desc="Secondary, continued explanation of what is Launcher continue reading.">
+    Resume viewing sites from mobile on your Chromebook
+  </message>
   <message name="IDS_SETTINGS_MANAGE_CERTIFICATES" desc="Text for manage certificates button in Privacy options">
     Manage certificates
   </message>
@@ -2956,9 +2962,15 @@
   <message name="IDS_SETTINGS_SITE_SETTINGS_ALLOW_DEFAULT_MENU" desc="Label for the default menu item to allow a permission for a particular site.">
     Allow (default)
   </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_AUTOMATIC_DEFAULT_MENU" desc="Label for the default menu item to automatically control autoplay for a particular site.">
+    Automatic (default)
+  </message>
   <message name="IDS_SETTINGS_SITE_SETTINGS_BLOCK_DEFAULT_MENU" desc="Label for the default menu item to block a permission for a particular site.">
     Block (default)
   </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MUTE_DEFAULT_MENU" desc="Label for the default menu item to mute sound for a particular site.">
+    Mute (default)
+  </message>
   <!-- TODO(https://crbug.com/753173): Consolidate these strings with those used in the Page Info bubble. -->
   <message name="IDS_SETTINGS_SITE_SETTINGS_ALLOW_MENU" desc="Label for the menu item to allow permission for a particular site.">
     Allow
@@ -2969,6 +2981,9 @@
   <message name="IDS_SETTINGS_SITE_SETTINGS_ASK_MENU" desc="Label for the menu item to ask for permission for a particular site.">
     Ask
   </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MUTE_MENU" desc="Label for the menu item to mute sound for a particular site.">
+    Mute
+  </message>
   <message name="IDS_SETTINGS_SITE_SETTINGS_RESET_MENU" desc="Label for the menu item to remove the permission for a particular site (make it ask you again next time).">
     Remove
   </message>

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 3c2358ce..51effba 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -3065,6 +3065,7 @@
       "//ash/components/quick_launch/public/mojom:constants",
       "//ash/public/cpp",
       "//chrome/browser/chromeos",
+      "//chrome/browser/chromeos/android_sms:android_sms",
       "//chromeos/services/device_sync",
       "//chromeos/services/device_sync/public/mojom",
       "//chromeos/services/multidevice_setup",

diff --git a/chrome/browser/android/feedback/connectivity_checker.cc b/chrome/browser/android/feedback/connectivity_checker.cc
index 19a854b..5d61c1f0 100644
--- a/chrome/browser/android/feedback/connectivity_checker.cc
+++ b/chrome/browser/android/feedback/connectivity_checker.cc

@@ -141,10 +141,8 @@
   url_fetcher_->SetStopOnRedirect(true);
   url_fetcher_->SetAutomaticallyRetryOn5xx(false);
   url_fetcher_->SetAutomaticallyRetryOnNetworkChanges(0);
-  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE |
-                             net::LOAD_DO_NOT_SAVE_COOKIES |
-                             net::LOAD_DO_NOT_SEND_COOKIES |
-                             net::LOAD_DO_NOT_SEND_AUTH_DATA);
+  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE);
+  url_fetcher_->SetAllowCredentials(false);
   url_fetcher_->Start();
   expiration_timer_.reset(new base::OneShotTimer());
   expiration_timer_->Start(FROM_HERE, timeout_, this,

diff --git a/chrome/browser/android/rlz/rlz_ping_handler.cc b/chrome/browser/android/rlz/rlz_ping_handler.cc
index 892679161..0b503ab 100644
--- a/chrome/browser/android/rlz/rlz_ping_handler.cc
+++ b/chrome/browser/android/rlz/rlz_ping_handler.cc

@@ -113,9 +113,8 @@
 
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = request_url;
-  resource_request->load_flags =
-      net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SEND_AUTH_DATA |
-      net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SAVE_COOKIES;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->allow_credentials = false;
 
   simple_url_loader_ = network::SimpleURLLoader::Create(
       std::move(resource_request), traffic_annotation);

diff --git a/chrome/browser/android/webapk/webapk_installer.cc b/chrome/browser/android/webapk/webapk_installer.cc
index 23b4f8ac..510af09 100644
--- a/chrome/browser/android/webapk/webapk_installer.cc
+++ b/chrome/browser/android/webapk/webapk_installer.cc

@@ -647,8 +647,7 @@
       net::URLFetcher::Create(server_url_, net::URLFetcher::POST, this);
   url_fetcher_->SetRequestContext(GetRequestContext(browser_context_));
   url_fetcher_->SetUploadData(kProtoMimeType, *serialized_proto);
-  url_fetcher_->SetLoadFlags(
-      net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SEND_COOKIES |
-      net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_AUTH_DATA);
+  url_fetcher_->SetLoadFlags(net::LOAD_DISABLE_CACHE);
+  url_fetcher_->SetAllowCredentials(false);
   url_fetcher_->Start();
 }

diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
index 9462f9f..860c373 100644
--- a/chrome/browser/browser_resources.grd
+++ b/chrome/browser/browser_resources.grd

@@ -82,10 +82,12 @@
         <include name="IDR_WEBAUTHN_ILLUSTRATION_ERROR_BLUETOOTH_1X" file="resources\webauthn\error_bt.png" type="BINDATA" />
         <include name="IDR_WEBAUTHN_ILLUSTRATION_ERROR_TIMEOUT_1X" file="resources\webauthn\error_timeout.png" type="BINDATA" />
         <include name="IDR_WEBAUTHN_ILLUSTRATION_PHONE_1X" file="resources\webauthn\phone.png" type="BINDATA" />
-        <include name="IDR_WEBAUTHN_ILLUSTRATION_TOUCHID_1X" file="resources\webauthn\touchid.png" type="BINDATA" />
         <include name="IDR_WEBAUTHN_ILLUSTRATION_USB_1X" file="resources\webauthn\usb.png" type="BINDATA" />
         <include name="IDR_WEBAUTHN_ILLUSTRATION_WELCOME_1X" file="resources\webauthn\welcome.png" type="BINDATA" />
       </if>
+      <if expr="is_macosx">
+        <include name="IDR_WEBAUTHN_ILLUSTRATION_TOUCHID_1X" file="resources\webauthn\touchid.png" type="BINDATA" />
+      </if>
       <if expr="is_win">
         <include name="IDR_ABOUT_CONFLICTS_HTML" file="resources\conflicts\about_conflicts.html" flattenhtml="true" allowexternalscript="true" type="BINDATA" />
         <include name="IDR_ABOUT_CONFLICTS_JS" file="resources\conflicts\about_conflicts.js" type="BINDATA" />

diff --git a/chrome/browser/chromeos/BUILD.gn b/chrome/browser/chromeos/BUILD.gn
index 3d75b7d..0ed7b5f 100644
--- a/chrome/browser/chromeos/BUILD.gn
+++ b/chrome/browser/chromeos/BUILD.gn

@@ -2311,6 +2311,7 @@
     "//ash",
     "//ash/system/message_center/arc:test_support",
     "//base",
+    "//chrome/browser/chromeos/android_sms:unit_tests",
     "//chrome/browser/resources/chromeos/zip_archiver:char_coding",
     "//chrome/common",
     "//chromeos:login_manager_proto",

diff --git a/chrome/browser/chromeos/android_sms/BUILD.gn b/chrome/browser/chromeos/android_sms/BUILD.gn
new file mode 100644
index 0000000..16c6b539
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/BUILD.gn

@@ -0,0 +1,61 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+static_library("android_sms") {
+  sources = [
+    "android_sms_service.cc",
+    "android_sms_service.h",
+    "android_sms_service_factory.cc",
+    "android_sms_service_factory.h",
+    "android_sms_switches.cc",
+    "android_sms_switches.h",
+    "android_sms_urls.cc",
+    "android_sms_urls.h",
+    "connection_establisher.h",
+    "connection_establisher_impl.cc",
+    "connection_establisher_impl.h",
+    "connection_manager.cc",
+    "connection_manager.h",
+  ]
+
+  deps = [
+    "//base",
+    "//chrome/browser/chromeos:chromeos",
+    "//chromeos:chromeos",
+    "//components/keyed_service/content:content",
+    "//components/keyed_service/core:core",
+    "//components/session_manager/core:core",
+    "//content/public/browser",
+  ]
+}
+
+static_library("test_support") {
+  testonly = true
+
+  sources = [
+    "fake_connection_establisher.cc",
+    "fake_connection_establisher.h",
+  ]
+
+  deps = [
+    ":android_sms",
+    "//content/public/browser",
+  ]
+}
+
+source_set("unit_tests") {
+  testonly = true
+
+  sources = [
+    "connection_manager_unittest.cc",
+  ]
+
+  deps = [
+    ":android_sms",
+    ":test_support",
+    "//content/public/browser",
+    "//content/test:test_support",
+    "//testing/gtest",
+  ]
+}

diff --git a/chrome/browser/chromeos/android_sms/OWNERS b/chrome/browser/chromeos/android_sms/OWNERS
new file mode 100644
index 0000000..61b8bc2
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/OWNERS

@@ -0,0 +1,4 @@
+azeemarshad@chromium.org
+jlklein@chromium.org
+khorimoto@chromium.org
+jonmann@chromium.org
\ No newline at end of file

diff --git a/chrome/browser/chromeos/android_sms/android_sms_service.cc b/chrome/browser/chromeos/android_sms/android_sms_service.cc
new file mode 100644
index 0000000..420c7ca9
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_service.cc

@@ -0,0 +1,46 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/android_sms_service.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "chrome/browser/chromeos/android_sms/connection_establisher_impl.h"
+#include "components/session_manager/core/session_manager.h"
+#include "content/public/browser/storage_partition.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+AndroidSmsService::AndroidSmsService(content::BrowserContext* browser_context)
+    : browser_context_(browser_context) {
+  session_manager::SessionManager::Get()->AddObserver(this);
+}
+
+AndroidSmsService::~AndroidSmsService() = default;
+
+void AndroidSmsService::Shutdown() {
+  session_manager::SessionManager::Get()->RemoveObserver(this);
+}
+
+void AndroidSmsService::OnSessionStateChanged() {
+  // At most one ConnectionManager should be created.
+  if (connection_manager_)
+    return;
+
+  // ConnectionManager should not be created for blocked sessions.
+  if (session_manager::SessionManager::Get()->IsUserSessionBlocked())
+    return;
+
+  content::StoragePartition* storage_partition =
+      content::BrowserContext::GetStoragePartitionForSite(
+          browser_context_, GetAndroidMessagesURL());
+  content::ServiceWorkerContext* service_worker_context =
+      storage_partition->GetServiceWorkerContext();
+  connection_manager_ = std::make_unique<ConnectionManager>(
+      service_worker_context, std::make_unique<ConnectionEstablisherImpl>());
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/android_sms_service.h b/chrome/browser/chromeos/android_sms/android_sms_service.h
new file mode 100644
index 0000000..d7a900d
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_service.h

@@ -0,0 +1,43 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_H_
+
+#include <memory>
+#include "chrome/browser/chromeos/android_sms/connection_manager.h"
+#include "components/keyed_service/core/keyed_service.h"
+#include "components/session_manager/core/session_manager_observer.h"
+#include "content/public/browser/browser_context.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// Profile Keyed Service responsible for maintaining connection with
+// android web messages service worker and initiating pairing.
+class AndroidSmsService : public KeyedService,
+                          public session_manager::SessionManagerObserver {
+ public:
+  explicit AndroidSmsService(content::BrowserContext* context);
+  ~AndroidSmsService() override;
+
+ private:
+  // KeyedService:
+  void Shutdown() override;
+
+  // session_manager::SessionManagerObserver
+  void OnSessionStateChanged() override;
+
+  content::BrowserContext* browser_context_;
+  std::unique_ptr<ConnectionManager> connection_manager_;
+
+  DISALLOW_COPY_AND_ASSIGN(AndroidSmsService);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_H_

diff --git a/chrome/browser/chromeos/android_sms/android_sms_service_factory.cc b/chrome/browser/chromeos/android_sms/android_sms_service_factory.cc
new file mode 100644
index 0000000..30f78ae
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_service_factory.cc

@@ -0,0 +1,55 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/android_sms_service_factory.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
+#include "chromeos/chromeos_features.h"
+#include "components/keyed_service/content/browser_context_dependency_manager.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// static
+AndroidSmsServiceFactory* AndroidSmsServiceFactory::GetInstance() {
+  static base::NoDestructor<AndroidSmsServiceFactory> factory_instance;
+  return factory_instance.get();
+}
+
+// static
+AndroidSmsService* AndroidSmsServiceFactory::GetForBrowserContext(
+    content::BrowserContext* browser_context) {
+  return static_cast<AndroidSmsService*>(
+      AndroidSmsServiceFactory::GetInstance()->GetServiceForBrowserContext(
+          browser_context, true));
+}
+
+AndroidSmsServiceFactory::AndroidSmsServiceFactory()
+    : BrowserContextKeyedServiceFactory(
+          "AndroidSmsService",
+          BrowserContextDependencyManager::GetInstance()) {}
+
+AndroidSmsServiceFactory::~AndroidSmsServiceFactory() = default;
+
+KeyedService* AndroidSmsServiceFactory::BuildServiceInstanceFor(
+    content::BrowserContext* context) const {
+  if (!base::FeatureList::IsEnabled(
+          chromeos::features::kAndroidMessagesIntegration)) {
+    return nullptr;
+  }
+
+  Profile* profile = Profile::FromBrowserContext(context);
+  if (ProfileHelper::Get()->GetUserByProfile(profile) == nullptr)
+    return nullptr;
+
+  return new AndroidSmsService(context);
+}
+
+bool AndroidSmsServiceFactory::ServiceIsCreatedWithBrowserContext() const {
+  return true;
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/android_sms_service_factory.h b/chrome/browser/chromeos/android_sms/android_sms_service_factory.h
new file mode 100644
index 0000000..9fa1f1f
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_service_factory.h

@@ -0,0 +1,41 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_FACTORY_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_FACTORY_H_
+
+#include "base/no_destructor.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_service.h"
+#include "components/keyed_service/content/browser_context_keyed_service_factory.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+class AndroidSmsServiceFactory : public BrowserContextKeyedServiceFactory {
+ public:
+  static AndroidSmsServiceFactory* GetInstance();
+
+  static AndroidSmsService* GetForBrowserContext(
+      content::BrowserContext* browser_context);
+
+ private:
+  friend class base::NoDestructor<AndroidSmsServiceFactory>;
+
+  AndroidSmsServiceFactory();
+  ~AndroidSmsServiceFactory() override;
+
+  // BrowserContextKeyedServiceFactory:
+  KeyedService* BuildServiceInstanceFor(
+      content::BrowserContext* context) const override;
+  bool ServiceIsCreatedWithBrowserContext() const override;
+
+  DISALLOW_COPY_AND_ASSIGN(AndroidSmsServiceFactory);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SERVICE_FACTORY_H_

diff --git a/chrome/browser/chromeos/android_sms/android_sms_switches.cc b/chrome/browser/chromeos/android_sms/android_sms_switches.cc
new file mode 100644
index 0000000..19b460d
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_switches.cc

@@ -0,0 +1,11 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/android_sms_switches.h"
+
+namespace switches {
+
+const char kAlternateAndroidMessagesUrl[] = "alternate-android-messages-url";
+
+}  // namespace switches

diff --git a/chrome/browser/chromeos/android_sms/android_sms_switches.h b/chrome/browser/chromeos/android_sms/android_sms_switches.h
new file mode 100644
index 0000000..d8020ff
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_switches.h

@@ -0,0 +1,16 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SWITCHES_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SWITCHES_H_
+
+namespace switches {
+
+// When specified with a url string as parameter, the given url overrides the
+// Android Messages for Web url used by AndroidSmsService.
+extern const char kAlternateAndroidMessagesUrl[];
+
+}  // namespace switches
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_SWITCHES_H_

diff --git a/chrome/browser/chromeos/android_sms/android_sms_urls.cc b/chrome/browser/chromeos/android_sms/android_sms_urls.cc
new file mode 100644
index 0000000..8e0f028d
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_urls.cc

@@ -0,0 +1,34 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "base/command_line.h"
+#include "base/optional.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_switches.h"
+#include "url/gurl.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+namespace {
+
+const char kDefaultAndroidMessagesUrl[] = "https://messages.android.com";
+
+}  // namespace
+
+GURL GetAndroidMessagesURL() {
+  const base::CommandLine* command_line =
+      base::CommandLine::ForCurrentProcess();
+  GURL android_messages_url(command_line->GetSwitchValueASCII(
+      switches::kAlternateAndroidMessagesUrl));
+  if (android_messages_url.is_empty()) {
+    android_messages_url = GURL(kDefaultAndroidMessagesUrl);
+  }
+  return android_messages_url;
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/android_sms_urls.h b/chrome/browser/chromeos/android_sms/android_sms_urls.h
new file mode 100644
index 0000000..00180eb
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/android_sms_urls.h

@@ -0,0 +1,21 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_URLS_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_URLS_H_
+
+#include "url/gurl.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// Returns URL to Android Messages for Web page used by AndroidSmsService.
+GURL GetAndroidMessagesURL();
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_ANDROID_SMS_URLS_H_

diff --git a/chrome/browser/chromeos/android_sms/connection_establisher.h b/chrome/browser/chromeos/android_sms/connection_establisher.h
new file mode 100644
index 0000000..df74fbed
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_establisher.h

@@ -0,0 +1,35 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_H_
+
+#include "base/macros.h"
+#include "content/public/browser/service_worker_context.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// Establishes a background connection from the Android Messages for Web
+// service worker to the Tachyon server.
+class ConnectionEstablisher {
+ public:
+  virtual ~ConnectionEstablisher() = default;
+
+  virtual void EstablishConnection(
+      content::ServiceWorkerContext* service_worker_context) = 0;
+
+ protected:
+  ConnectionEstablisher() = default;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ConnectionEstablisher);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_H_

diff --git a/chrome/browser/chromeos/android_sms/connection_establisher_impl.cc b/chrome/browser/chromeos/android_sms/connection_establisher_impl.cc
new file mode 100644
index 0000000..04c5618
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_establisher_impl.cc

@@ -0,0 +1,25 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/connection_establisher_impl.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+ConnectionEstablisherImpl::ConnectionEstablisherImpl() = default;
+ConnectionEstablisherImpl::~ConnectionEstablisherImpl() = default;
+
+void ConnectionEstablisherImpl::EstablishConnection(
+    content::ServiceWorkerContext* service_worker_context) {
+  // TODO(azeemarshad): Send connection message to service worker using
+  // ServiceWorkerContext::StartServiceWorkerAndDispatchLongRunningMessage
+  // when https://chromium-review.googlesource.com/c/chromium/src/+/1119580
+  // is ready.
+  return;
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/connection_establisher_impl.h b/chrome/browser/chromeos/android_sms/connection_establisher_impl.h
new file mode 100644
index 0000000..b4d0fa0
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_establisher_impl.h

@@ -0,0 +1,36 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_IMPL_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_IMPL_H_
+
+#include "chrome/browser/chromeos/android_sms/connection_establisher.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// Concrete ConnectionEstablisher implementation that initiates a background
+// connection between the Android Messages for Web service worker and the
+// Tachyon server by dispatching a known message string to it.
+//
+// To allow the service worker to continue running past it's default timeout
+// this message is sent using a special long-running dispatch.
+class ConnectionEstablisherImpl : public ConnectionEstablisher {
+ public:
+  ConnectionEstablisherImpl();
+  ~ConnectionEstablisherImpl() override;
+
+  void EstablishConnection(
+      content::ServiceWorkerContext* service_worker_context) override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ConnectionEstablisherImpl);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_ESTABLISHER_IMPL_H_

diff --git a/chrome/browser/chromeos/android_sms/connection_manager.cc b/chrome/browser/chromeos/android_sms/connection_manager.cc
new file mode 100644
index 0000000..9021b0b
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_manager.cc

@@ -0,0 +1,68 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/connection_manager.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "components/session_manager/core/session_manager.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+ConnectionManager::ConnectionManager(
+    content::ServiceWorkerContext* service_worker_context,
+    std::unique_ptr<ConnectionEstablisher> connection_establisher)
+    : service_worker_context_(service_worker_context),
+      connection_establisher_(std::move(connection_establisher)) {
+  service_worker_context_->AddObserver(this);
+  connection_establisher_->EstablishConnection(service_worker_context_);
+}
+
+ConnectionManager::~ConnectionManager() {
+  service_worker_context_->RemoveObserver(this);
+}
+
+void ConnectionManager::OnVersionActivated(int64_t version_id,
+                                           const GURL& scope) {
+  if (!scope.EqualsIgnoringRef(GetAndroidMessagesURL()))
+    return;
+
+  prev_active_version_id_ = active_version_id_;
+  active_version_id_ = version_id;
+  connection_establisher_->EstablishConnection(service_worker_context_);
+}
+
+void ConnectionManager::OnVersionRedundant(int64_t version_id,
+                                           const GURL& scope) {
+  if (!scope.EqualsIgnoringRef(GetAndroidMessagesURL()))
+    return;
+
+  if (active_version_id_ != version_id)
+    return;
+
+  // If the active version is marked redundant then it cannot handle messages
+  // anymore, so stop tracking it.
+  prev_active_version_id_ = active_version_id_;
+  active_version_id_.reset();
+}
+
+void ConnectionManager::OnNoControllees(int64_t version_id, const GURL& scope) {
+  if (!scope.EqualsIgnoringRef(GetAndroidMessagesURL()))
+    return;
+
+  // Set active_version_id_ in case we missed version activated.
+  // This is unlikely but protects against a case where a Android Messages for
+  // Web page may have opened before the ConnectionManager is created.
+  if (!active_version_id_ && prev_active_version_id_ != version_id)
+    active_version_id_ = version_id;
+
+  if (active_version_id_ != version_id)
+    return;
+
+  connection_establisher_->EstablishConnection(service_worker_context_);
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/connection_manager.h b/chrome/browser/chromeos/android_sms/connection_manager.h
new file mode 100644
index 0000000..6b11077
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_manager.h

@@ -0,0 +1,67 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_MANAGER_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_MANAGER_H_
+
+#include "base/gtest_prod_util.h"
+#include "chrome/browser/chromeos/android_sms/connection_establisher.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/service_worker_context.h"
+#include "content/public/browser/service_worker_context_observer.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// ConnectionManager checks to see when the user has no Android Messages for Web
+// pages open (in a web page or PWA) and notifies the corresponding
+// service worker to start a background connection.
+//
+// This class is an observer for Android Messages for Web service worker
+// lifecycle events and uses ConnectionEstablisher to initiate a background
+// connection with Tachyon server when appropriate. Specifically, in the
+// following cases
+// 1. Startup.
+// 2. Activation: This occurs on service worker update, when a new updated
+//    version of the service worker replaces the current active version or on
+//    service worker cold start.
+// 3. NoControllees: When all pages controlled by the service worker are closed.
+// The connection establishment may be attempted in more cases than actually
+// required. It's left to the service worker to ignore or establish a background
+// connection as required. E.g., The service worker will not establish a
+// connection if it's is already connected to the Android Messages for Web page
+// or if a connection already exists.
+class ConnectionManager : public content::ServiceWorkerContextObserver {
+ public:
+  ConnectionManager(
+      content::ServiceWorkerContext* service_worker_context,
+      std::unique_ptr<ConnectionEstablisher> connection_establisher);
+  ~ConnectionManager() override;
+
+ private:
+  // content::ServiceWorkerContextObserver:
+  void OnVersionActivated(int64_t version_id, const GURL& scope) override;
+  void OnVersionRedundant(int64_t version_id, const GURL& scope) override;
+  void OnNoControllees(int64_t version_id, const GURL& scope) override;
+
+  content::ServiceWorkerContext* service_worker_context_;
+  std::unique_ptr<ConnectionEstablisher> connection_establisher_;
+
+  // Version ID of the Android Messages for Web service worker that's currently
+  // active i.e., capable of handling messages and controlling pages.
+  base::Optional<int64_t> active_version_id_;
+
+  // Version ID of the previously active Android Messages for Web
+  // service worker.
+  base::Optional<int64_t> prev_active_version_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(ConnectionManager);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_CONNECTION_MANAGER_H_

diff --git a/chrome/browser/chromeos/android_sms/connection_manager_unittest.cc b/chrome/browser/chromeos/android_sms/connection_manager_unittest.cc
new file mode 100644
index 0000000..c16bda7
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/connection_manager_unittest.cc

@@ -0,0 +1,139 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/connection_manager.h"
+#include "chrome/browser/chromeos/android_sms/android_sms_urls.h"
+#include "chrome/browser/chromeos/android_sms/fake_connection_establisher.h"
+#include "content/public/test/fake_service_worker_context.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+namespace {
+const int64_t kDummyVersionId = 123l;
+const int64_t kDummyVersionId2 = 456l;
+}  // namespace
+
+class ConnectionManagerTest : public testing::Test {
+ protected:
+  ConnectionManagerTest() = default;
+  ~ConnectionManagerTest() override = default;
+
+  void SetUp() override {
+    std::unique_ptr<FakeConnectionEstablisher> fake_connection_establisher =
+        std::make_unique<FakeConnectionEstablisher>();
+    fake_connection_establisher_ = fake_connection_establisher.get();
+    fake_service_worker_context_ =
+        std::make_unique<content::FakeServiceWorkerContext>();
+    connection_manager_ = std::make_unique<ConnectionManager>(
+        fake_service_worker_context_.get(),
+        std::move(fake_connection_establisher));
+  }
+
+  void VerifyNumEstablishConnectionCalls(size_t count) {
+    ASSERT_EQ(
+        count,
+        fake_connection_establisher_->establish_connection_calls().size());
+    for (content::ServiceWorkerContext* service_worker_context :
+         fake_connection_establisher_->establish_connection_calls())
+      EXPECT_EQ(fake_service_worker_context_.get(), service_worker_context);
+  }
+
+  content::FakeServiceWorkerContext* fake_service_worker_context() const {
+    return fake_service_worker_context_.get();
+  }
+
+ private:
+  FakeConnectionEstablisher* fake_connection_establisher_;
+  std::unique_ptr<content::FakeServiceWorkerContext>
+      fake_service_worker_context_;
+  std::unique_ptr<ConnectionManager> connection_manager_;
+  DISALLOW_COPY_AND_ASSIGN(ConnectionManagerTest);
+};
+
+TEST_F(ConnectionManagerTest, ConnectOnActivate) {
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, GetAndroidMessagesURL());
+
+  // Verify that connection establishing is attempted on startup and
+  // when a new version is activated.
+  // startup + activate.
+  VerifyNumEstablishConnectionCalls(2u);
+}
+
+TEST_F(ConnectionManagerTest, ConnectOnNoControllees) {
+  // Notify Activation so that Connection manager is tracking the version ID.
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, GetAndroidMessagesURL());
+
+  // Verify that connection establishing is attempted when there are no
+  // controllees.
+  fake_service_worker_context()->NotifyObserversOnNoControllees(
+      kDummyVersionId, GetAndroidMessagesURL());
+  // startup + activate + no controllees.
+  VerifyNumEstablishConnectionCalls(3u);
+}
+
+TEST_F(ConnectionManagerTest, IgnoreRedundantVersion) {
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, GetAndroidMessagesURL());
+
+  // Notify that current active version is now redundant.
+  fake_service_worker_context()->NotifyObserversOnVersionRedundant(
+      kDummyVersionId, GetAndroidMessagesURL());
+
+  // Verify that no connection establishing is attempted when there are no
+  // controllees for the redundant version.
+  fake_service_worker_context()->NotifyObserversOnNoControllees(
+      kDummyVersionId, GetAndroidMessagesURL());
+  // startup + activate only.
+  VerifyNumEstablishConnectionCalls(2u);
+}
+
+TEST_F(ConnectionManagerTest, ConnectOnNoControlleesWithNoActive) {
+  // Verify that connection establishing is attempted when there are no
+  // controllees for a version ID even if the activate notification was missed.
+  fake_service_worker_context()->NotifyObserversOnNoControllees(
+      kDummyVersionId, GetAndroidMessagesURL());
+  // startup + no controllees.
+  VerifyNumEstablishConnectionCalls(2u);
+}
+
+TEST_F(ConnectionManagerTest, IgnoreOnNoControlleesInvalidId) {
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, GetAndroidMessagesURL());
+
+  // Verify that OnNoControllees with different version id is ignored.
+  fake_service_worker_context()->NotifyObserversOnNoControllees(
+      kDummyVersionId2, GetAndroidMessagesURL());
+  // startup + activate only.
+  VerifyNumEstablishConnectionCalls(2u);
+}
+
+TEST_F(ConnectionManagerTest, InvalidScope) {
+  GURL invalid_scope("https://example.com");
+  // Verify that OnVersionActivated and OnNoControllees with invalid scope
+  // are ignored
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, invalid_scope);
+  fake_service_worker_context()->NotifyObserversOnNoControllees(kDummyVersionId,
+                                                                invalid_scope);
+  VerifyNumEstablishConnectionCalls(1u);  // startup only, ignore others.
+
+  // Verify that OnVersionRedundant with invalid scope is ignored
+  fake_service_worker_context()->NotifyObserversOnVersionActivated(
+      kDummyVersionId, GetAndroidMessagesURL());
+  fake_service_worker_context()->NotifyObserversOnVersionRedundant(
+      kDummyVersionId, invalid_scope);
+  fake_service_worker_context()->NotifyObserversOnNoControllees(
+      kDummyVersionId, GetAndroidMessagesURL());
+  // startup + activate + no controllees.
+  VerifyNumEstablishConnectionCalls(3u);
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/fake_connection_establisher.cc b/chrome/browser/chromeos/android_sms/fake_connection_establisher.cc
new file mode 100644
index 0000000..ba6c4e1
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/fake_connection_establisher.cc

@@ -0,0 +1,21 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/android_sms/fake_connection_establisher.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+FakeConnectionEstablisher::FakeConnectionEstablisher() = default;
+FakeConnectionEstablisher::~FakeConnectionEstablisher() = default;
+
+void FakeConnectionEstablisher::EstablishConnection(
+    content::ServiceWorkerContext* service_worker_context_) {
+  establish_connection_calls_.push_back(service_worker_context_);
+}
+
+}  // namespace android_sms
+
+}  // namespace chromeos

diff --git a/chrome/browser/chromeos/android_sms/fake_connection_establisher.h b/chrome/browser/chromeos/android_sms/fake_connection_establisher.h
new file mode 100644
index 0000000..ed765acf
--- /dev/null
+++ b/chrome/browser/chromeos/android_sms/fake_connection_establisher.h

@@ -0,0 +1,38 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ANDROID_SMS_FAKE_CONNECTION_ESTABLISHER_H_
+#define CHROME_BROWSER_CHROMEOS_ANDROID_SMS_FAKE_CONNECTION_ESTABLISHER_H_
+
+#include "chrome/browser/chromeos/android_sms/connection_establisher.h"
+
+namespace chromeos {
+
+namespace android_sms {
+
+// Test ConnectionEstablisher implementation.
+class FakeConnectionEstablisher : public ConnectionEstablisher {
+ public:
+  FakeConnectionEstablisher();
+  ~FakeConnectionEstablisher() override;
+
+  const std::vector<content::ServiceWorkerContext*>&
+  establish_connection_calls() const {
+    return establish_connection_calls_;
+  }
+
+ private:
+  // ConnectionEstablisher:
+  void EstablishConnection(
+      content::ServiceWorkerContext* service_worker_context_) override;
+
+  std::vector<content::ServiceWorkerContext*> establish_connection_calls_;
+  DISALLOW_COPY_AND_ASSIGN(FakeConnectionEstablisher);
+};
+
+}  // namespace android_sms
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ANDROID_SMS_FAKE_CONNECTION_ESTABLISHER_H_

diff --git a/chrome/browser/chromeos/arc/intent_helper/open_with_menu.cc b/chrome/browser/chromeos/arc/intent_helper/open_with_menu.cc
index 32255b31..775987f 100644
--- a/chrome/browser/chromeos/arc/intent_helper/open_with_menu.cc
+++ b/chrome/browser/chromeos/arc/intent_helper/open_with_menu.cc

@@ -5,10 +5,6 @@
 #include "chrome/browser/chromeos/arc/intent_helper/open_with_menu.h"
 
 #include <algorithm>
-#include <memory>
-#include <unordered_map>
-#include <utility>
-#include <vector>
 
 #include "base/strings/string_util.h"
 #include "chrome/app/chrome_command_ids.h"

diff --git a/chrome/browser/chromeos/customization/customization_document.cc b/chrome/browser/chromeos/customization/customization_document.cc
index a326f27..c18262f7c 100644
--- a/chrome/browser/chromeos/customization/customization_document.cc
+++ b/chrome/browser/chromeos/customization/customization_document.cc

@@ -573,10 +573,8 @@
   url_fetcher_ = net::URLFetcher::Create(url_, net::URLFetcher::GET, this);
   url_fetcher_->SetRequestContext(g_browser_process->system_request_context());
   url_fetcher_->AddExtraRequestHeader("Accept: application/json");
-  url_fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
-                             net::LOAD_DO_NOT_SAVE_COOKIES |
-                             net::LOAD_DISABLE_CACHE |
-                             net::LOAD_DO_NOT_SEND_AUTH_DATA);
+  url_fetcher_->SetLoadFlags(net::LOAD_DISABLE_CACHE);
+  url_fetcher_->SetAllowCredentials(false);
   url_fetcher_->Start();
 }
 

diff --git a/chrome/browser/chromeos/customization/customization_wallpaper_downloader.cc b/chrome/browser/chromeos/customization/customization_wallpaper_downloader.cc
index 9c56e242..24b7610 100644
--- a/chrome/browser/chromeos/customization/customization_wallpaper_downloader.cc
+++ b/chrome/browser/chromeos/customization/customization_wallpaper_downloader.cc

@@ -88,9 +88,8 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = wallpaper_url_;
   resource_request->load_flags =
-      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE |
-      net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES |
-      net::LOAD_DO_NOT_SEND_AUTH_DATA;
+      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE;
+  resource_request->allow_credentials = false;
   // TODO(crbug.com/833390): Add a real traffic annotation here.
   simple_loader_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                                     MISSING_TRAFFIC_ANNOTATION);

diff --git a/chrome/browser/chromeos/drive/drive_integration_service.cc b/chrome/browser/chromeos/drive/drive_integration_service.cc
index 459ce98..07997c6 100644
--- a/chrome/browser/chromeos/drive/drive_integration_service.cc
+++ b/chrome/browser/chromeos/drive/drive_integration_service.cc

@@ -699,15 +699,13 @@
     if (!drivefs_holder_)
       job_list()->CancelAllJobs();
 
-    for (auto& observer : observers_)
-      observer.OnFileSystemBeingUnmounted();
-
-    storage::ExternalMountPoints* const mount_points =
-        storage::ExternalMountPoints::GetSystemInstance();
-    DCHECK(mount_points);
-
-    mount_points->RevokeFileSystem(mount_point_name_);
-    logger_->Log(logging::LOG_INFO, "Drive mount point is removed");
+    if (storage::ExternalMountPoints::GetSystemInstance()->RevokeFileSystem(
+            mount_point_name_)) {
+      for (auto& observer : observers_) {
+        observer.OnFileSystemBeingUnmounted();
+      }
+      logger_->Log(logging::LOG_INFO, "Drive mount point is removed");
+    }
   }
   if (drivefs_holder_)
     drivefs_holder_->drivefs_host()->Unmount();

diff --git a/chrome/browser/chromeos/extensions/file_manager/event_router.cc b/chrome/browser/chromeos/extensions/file_manager/event_router.cc
index 922f91e..56661d2 100644
--- a/chrome/browser/chromeos/extensions/file_manager/event_router.cc
+++ b/chrome/browser/chromeos/extensions/file_manager/event_router.cc

@@ -175,8 +175,6 @@
           MOUNT_COMPLETED_STATUS_ERROR_UNSUPPORTED_FILESYSTEM;
     case chromeos::MOUNT_ERROR_INVALID_ARCHIVE:
       return file_manager_private::MOUNT_COMPLETED_STATUS_ERROR_INVALID_ARCHIVE;
-    case chromeos::MOUNT_ERROR_PATH_UNMOUNTED:
-      return file_manager_private::MOUNT_COMPLETED_STATUS_ERROR_PATH_UNMOUNTED;
   }
   NOTREACHED();
   return file_manager_private::MOUNT_COMPLETED_STATUS_NONE;

diff --git a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
index 6ec182a..e58c2a3 100644
--- a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
+++ b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc

@@ -17,7 +17,6 @@
 #include "base/run_loop.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_piece.h"
-#include "base/test/test_timeouts.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
 #include "chrome/browser/browser_process.h"
@@ -49,7 +48,6 @@
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/api/test/test_api.h"
 #include "extensions/browser/notification_types.h"
-#include "extensions/browser/process_manager.h"
 #include "google_apis/drive/drive_api_parser.h"
 #include "google_apis/drive/test_util.h"
 #include "media/base/media_switches.h"
@@ -1017,9 +1015,6 @@
   display_service_ =
       std::make_unique<NotificationDisplayServiceTester>(profile());
 
-  extensions::ProcessManager::SetEventPageIdleTimeForTesting(
-      TestTimeouts::action_max_timeout().InMilliseconds());
-
   // The test resources are setup: enable and add default ChromeOS component
   // extensions now and not before: crbug.com/831074, crbug.com/804413
   test::AddDefaultComponentExtensionsOnMainThread(profile());

diff --git a/chrome/browser/chromeos/login/saml/saml_offline_signin_limiter_unittest.cc b/chrome/browser/chromeos/login/saml/saml_offline_signin_limiter_unittest.cc
index 2623264..58467cd3 100644
--- a/chrome/browser/chromeos/login/saml/saml_offline_signin_limiter_unittest.cc
+++ b/chrome/browser/chromeos/login/saml/saml_offline_signin_limiter_unittest.cc

@@ -8,6 +8,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop/message_loop_current.h"
+#include "base/run_loop.h"
 #include "base/test/simple_test_clock.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/time/clock.h"
@@ -26,10 +27,10 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+using testing::_;
 using testing::Mock;
 using testing::Return;
 using testing::Sequence;
-using testing::_;
 
 namespace chromeos {
 
@@ -126,6 +127,8 @@
 
 void SAMLOfflineSigninLimiterTest::TearDown() {
   SAMLOfflineSigninLimiterFactory::SetClockForTesting(NULL);
+  // Clear any PostAfterStartupTask's to avoid hanging.
+  base::RunLoop().RunUntilIdle();
 }
 
 TEST_F(SAMLOfflineSigninLimiterTest, NoSAMLDefaultLimit) {

diff --git a/chrome/browser/chromeos/policy/policy_cert_verifier.cc b/chrome/browser/chromeos/policy/policy_cert_verifier.cc
index 1e160a9..53c8ccab 100644
--- a/chrome/browser/chromeos/policy/policy_cert_verifier.cc
+++ b/chrome/browser/chromeos/policy/policy_cert_verifier.cc

@@ -93,8 +93,4 @@
   return error;
 }
 
-void PolicyCertVerifier::SetConfig(const Config& config) {
-  delegate_->SetConfig(config);
-}
-
 }  // namespace policy

diff --git a/chrome/browser/chromeos/policy/policy_cert_verifier.h b/chrome/browser/chromeos/policy/policy_cert_verifier.h
index 4ade577..cb65173 100644
--- a/chrome/browser/chromeos/policy/policy_cert_verifier.h
+++ b/chrome/browser/chromeos/policy/policy_cert_verifier.h

@@ -50,7 +50,6 @@
              net::CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const net::NetLogWithSource& net_log) override;
-  void SetConfig(const Config& config) override;
 
  private:
   net::CertificateList trust_anchors_;

diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
index fafc05f6..1e10836 100644
--- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
+++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc

@@ -431,6 +431,10 @@
   (*s_whitelist)[ash::prefs::kDockedMagnifierScale] =
       settings_api::PrefType::PREF_TYPE_NUMBER;
 
+  // App list settings.
+  (*s_whitelist)[prefs::kAppListContinueReadingEnabled] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+
   // Input method settings.
   (*s_whitelist)[::prefs::kLanguagePreloadEngines] =
       settings_api::PrefType::PREF_TYPE_STRING;

diff --git a/chrome/browser/extensions/extension_unload_browsertest.cc b/chrome/browser/extensions/extension_unload_browsertest.cc
index 97e2420..45dfa255 100644
--- a/chrome/browser/extensions/extension_unload_browsertest.cc
+++ b/chrome/browser/extensions/extension_unload_browsertest.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/feature_list.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -10,6 +11,7 @@
 #include "content/public/test/browser_test_utils.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "services/network/public/cpp/features.h"
 #include "ui/base/window_open_disposition.h"
 
 namespace extensions {
@@ -47,6 +49,10 @@
 // After an extension is uninstalled, network requests from its content scripts
 // should fail but not kill the renderer process.
 IN_PROC_BROWSER_TEST_F(ExtensionUnloadBrowserTest, UnloadWithContentScripts) {
+  // https://crbug.com/862176
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService))
+    return;
+
   ASSERT_TRUE(embedded_test_server()->Start());
 
   // Load an extension with a content script that has a button to send XHRs.

diff --git a/chrome/browser/intranet_redirect_detector.cc b/chrome/browser/intranet_redirect_detector.cc
index 283d0c2..9951f1f 100644
--- a/chrome/browser/intranet_redirect_detector.cc
+++ b/chrome/browser/intranet_redirect_detector.cc

@@ -118,9 +118,8 @@
     resource_request->url = random_url;
     resource_request->method = "HEAD";
     // We don't want these fetches to affect existing state in the profile.
-    resource_request->load_flags =
-        net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES |
-        net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SEND_AUTH_DATA;
+    resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+    resource_request->allow_credentials = false;
     network::mojom::URLLoaderFactory* loader_factory =
         g_browser_process->system_network_context_manager()
             ->GetURLLoaderFactory();

diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index f29a64b..7ac138b 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc

@@ -135,12 +135,6 @@
     return g_cert_verifier_for_io_thread_testing->Verify(
         params, crl_set, verify_result, std::move(callback), out_req, net_log);
   }
-
-  void SetConfig(const Config& config) override {
-    if (!g_cert_verifier_for_io_thread_testing)
-      return;
-    return g_cert_verifier_for_io_thread_testing->SetConfig(config);
-  }
 };
 
 #if defined(OS_MACOSX)

diff --git a/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc b/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc
index a079242..2466831 100644
--- a/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc
+++ b/chrome/browser/media/router/discovery/dial/dial_url_fetcher.cc

@@ -111,12 +111,8 @@
   // net::LOAD_BYPASS_PROXY: Proxies almost certainly hurt more cases than they
   //     help.
   // net::LOAD_DISABLE_CACHE: The request should not touch the cache.
-  // net::LOAD_DO_NOT_{SAVE,SEND}_COOKIES: The request should not touch cookies.
-  // net::LOAD_DO_NOT_SEND_AUTH_DATA: The request should not send auth data.
-  request->load_flags = net::LOAD_BYPASS_PROXY | net::LOAD_DISABLE_CACHE |
-                        net::LOAD_DO_NOT_SAVE_COOKIES |
-                        net::LOAD_DO_NOT_SEND_COOKIES |
-                        net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  request->load_flags = net::LOAD_BYPASS_PROXY | net::LOAD_DISABLE_CACHE;
+  request->allow_credentials = false;
 
   loader_ = network::SimpleURLLoader::Create(std::move(request),
                                              kDialUrlFetcherTrafficAnnotation);

diff --git a/chrome/browser/net/trial_comparison_cert_verifier.cc b/chrome/browser/net/trial_comparison_cert_verifier.cc
index abec22e..b856e3d7 100644
--- a/chrome/browser/net/trial_comparison_cert_verifier.cc
+++ b/chrome/browser/net/trial_comparison_cert_verifier.cc

@@ -44,7 +44,9 @@
 
 namespace {
 
-bool CheckTrialEligibility(void* profile_id) {
+bool CheckTrialEligibility(void* profile_id,
+                           base::TimeDelta primary_latency,
+                           bool is_first_job) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
   // g_browser_process is valid until after all threads are stopped. So it must
@@ -57,12 +59,29 @@
   // Only allow on non-incognito profiles which have SBER2 (Scout) opt-in set.
   // See design doc for more details:
   // https://docs.google.com/document/d/1AM1CD42bC6LHWjKg-Hkid_RLr2DH6OMzstH9-pGSi-g
-  return !profile->IsOffTheRecord() && safe_browsing::IsScout(prefs) &&
-         safe_browsing::IsExtendedReportingEnabled(prefs);
+  bool allowed = !profile->IsOffTheRecord() && safe_browsing::IsScout(prefs) &&
+                 safe_browsing::IsExtendedReportingEnabled(prefs);
+
+  if (allowed) {
+    // Only record the TrialPrimary histograms for the same set of requests
+    // that TrialSecondary histograms will be recorded for, in order to get a
+    // direct comparison.
+    UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_Job_Latency_TrialPrimary",
+                               primary_latency,
+                               base::TimeDelta::FromMilliseconds(1),
+                               base::TimeDelta::FromMinutes(10), 100);
+    if (is_first_job) {
+      UMA_HISTOGRAM_CUSTOM_TIMES(
+          "Net.CertVerifier_First_Job_Latency_TrialPrimary", primary_latency,
+          base::TimeDelta::FromMilliseconds(1),
+          base::TimeDelta::FromMinutes(10), 100);
+    }
+  }
+
+  return allowed;
 }
 
 void SendTrialVerificationReport(void* profile_id,
-                                 const net::CertVerifier::Config& config,
                                  const net::CertVerifier::RequestParams& params,
                                  const net::CertVerifyResult& primary_result,
                                  const net::CertVerifyResult& trial_result) {
@@ -72,7 +91,7 @@
   Profile* profile = reinterpret_cast<Profile*>(profile_id);
 
   CertificateErrorReport report(params.hostname(), *params.certificate(),
-                                config, primary_result, trial_result);
+                                params.flags(), primary_result, trial_result);
 
   report.AddNetworkTimeInfo(g_browser_process->network_time_tracker());
   report.AddChromeChannel(chrome::GetChannel());
@@ -181,17 +200,14 @@
 
 class TrialComparisonCertVerifier::TrialVerificationJob {
  public:
-  TrialVerificationJob(const net::CertVerifier::Config& config,
-                       const net::CertVerifier::RequestParams& params,
+  TrialVerificationJob(const net::CertVerifier::RequestParams& params,
                        const net::NetLogWithSource& source_net_log,
                        scoped_refptr<net::CRLSet> crl_set,
                        TrialComparisonCertVerifier* cert_verifier,
                        int primary_error,
                        const net::CertVerifyResult& primary_result,
                        void* profile_id)
-      : config_(config),
-        config_changed_(false),
-        params_(params),
+      : params_(params),
         net_log_(net::NetLogWithSource::Make(
             source_net_log.net_log(),
             net::NetLogSourceType::TRIAL_CERT_VERIFIER_JOB)),
@@ -225,8 +241,6 @@
       OnJobCompleted(rv);
   }
 
-  void OnConfigChanged() { config_changed_ = true; }
-
   void Finish(bool is_success, TrialComparisonResult result_code) {
     TrialComparisonCertVerifier* cert_verifier = cert_verifier_;
     cert_verifier_ = nullptr;
@@ -242,9 +256,9 @@
         !base::GetFieldTrialParamByFeatureAsBool(
             features::kCertDualVerificationTrialFeature, "uma_only", false)) {
       content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::UI)
-          ->PostTask(FROM_HERE, base::BindOnce(&SendTrialVerificationReport,
-                                               profile_id_, config_, params_,
-                                               primary_result_, trial_result_));
+          ->PostTask(FROM_HERE,
+                     base::BindOnce(&SendTrialVerificationReport, profile_id_,
+                                    params_, primary_result_, trial_result_));
     }
 
     // |this| is deleted after RemoveJob returns.
@@ -290,21 +304,22 @@
 
 #if defined(OS_MACOSX)
     if (primary_error_ == net::ERR_CERT_REVOKED &&
-        !config_.enable_rev_checking &&
+        !(params_.flags() & net::CertVerifier::VERIFY_REV_CHECKING_ENABLED) &&
         !(primary_result_.cert_status &
           net::CERT_STATUS_REV_CHECKING_ENABLED) &&
         !(trial_result_.cert_status &
           (net::CERT_STATUS_REVOKED | net::CERT_STATUS_REV_CHECKING_ENABLED))) {
-      if (config_changed_) {
-        FinishSuccess(kIgnoredConfigurationChanged);
-        return;
-      }
       // CertVerifyProcMac does some revocation checking even if we didn't want
       // it. Try verifying with the trial verifier with revocation checking
       // enabled, see if it then returns REVOKED.
 
-      int rv = cert_verifier_->revocation_trial_verifier()->Verify(
-          params_, crl_set_.get(), &reverification_result_,
+      RequestParams reverification_params(
+          params_.certificate(), params_.hostname(),
+          params_.flags() | net::CertVerifier::VERIFY_REV_CHECKING_ENABLED,
+          params_.ocsp_response(), params_.additional_trust_anchors());
+
+      int rv = cert_verifier_->trial_verifier()->Verify(
+          reverification_params, crl_set_.get(), &reverification_result_,
           base::BindOnce(
               &TrialVerificationJob::OnMacRevcheckingReverificationJobCompleted,
               base::Unretained(this)),
@@ -321,10 +336,6 @@
 
     if (!chains_equal &&
         (trial_error_ == net::OK || primary_error_ != net::OK)) {
-      if (config_changed_) {
-        FinishSuccess(kIgnoredConfigurationChanged);
-        return;
-      }
       // Chains were different, reverify the trial_result_.verified_cert chain
       // using the platform verifier and compare results again.
       RequestParams reverification_params(
@@ -425,8 +436,6 @@
   }
 
  private:
-  const net::CertVerifier::Config config_;
-  bool config_changed_;
   const net::CertVerifier::RequestParams params_;
   const net::NetLogWithSource net_log_;
   scoped_refptr<net::CRLSet> crl_set_;
@@ -474,20 +483,7 @@
                   &TrialComparisonCertVerifier::OnTrialVerifierComplete,
                   base::Unretained(this)),
               false /* should_record_histograms */)),
-      revocation_trial_verifier_(
-          net::MultiThreadedCertVerifier::CreateForDualVerificationTrial(
-              trial_verify_proc,
-              // Unretained is safe since the callback won't be called after
-              // |trial_verifier_| is destroyed.
-              base::BindRepeating(
-                  &TrialComparisonCertVerifier::OnTrialVerifierComplete,
-                  base::Unretained(this)),
-              false /* should_record_histograms */)),
-      weak_ptr_factory_(this) {
-  net::CertVerifier::Config config;
-  config.enable_rev_checking = true;
-  revocation_trial_verifier_->SetConfig(config);
-}
+      weak_ptr_factory_(this) {}
 
 TrialComparisonCertVerifier::~TrialComparisonCertVerifier() = default;
 
@@ -508,25 +504,6 @@
                                    std::move(callback), out_req, net_log);
 }
 
-void TrialComparisonCertVerifier::SetConfig(const Config& config) {
-  config_ = config;
-  config_id_++;
-
-  primary_verifier_->SetConfig(config);
-  primary_reverifier_->SetConfig(config);
-  trial_verifier_->SetConfig(config);
-
-  // Always enable revocation checking for the revocation trial verifier.
-  net::CertVerifier::Config config_with_revocation = config;
-  config_with_revocation.enable_rev_checking = true;
-  revocation_trial_verifier_->SetConfig(config_with_revocation);
-
-  // Notify all in-process jobs that the underlying configuration has changed.
-  for (auto& job : jobs_) {
-    job->OnConfigChanged();
-  }
-}
-
 void TrialComparisonCertVerifier::OnPrimaryVerifierComplete(
     const RequestParams& params,
     scoped_refptr<net::CRLSet> crl_set,
@@ -549,11 +526,12 @@
   base::PostTaskAndReplyWithResult(
       content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::UI)
           .get(),
-      FROM_HERE, base::BindOnce(CheckTrialEligibility, profile_id_),
+      FROM_HERE,
+      base::BindOnce(CheckTrialEligibility, profile_id_, primary_latency,
+                     is_first_job),
       base::BindOnce(&TrialComparisonCertVerifier::MaybeDoTrialVerification,
                      weak_ptr_factory_.GetWeakPtr(), params, std::move(crl_set),
-                     net_log, primary_error, primary_result, primary_latency,
-                     is_first_job, config_id_, profile_id_));
+                     net_log, primary_error, primary_result, profile_id_));
 }
 
 void TrialComparisonCertVerifier::OnTrialVerifierComplete(
@@ -583,35 +561,16 @@
     const net::NetLogWithSource& net_log,
     int primary_error,
     const net::CertVerifyResult& primary_result,
-    base::TimeDelta primary_latency,
-    bool is_first_job,
-    uint32_t config_id,
     void* profile_id,
     bool trial_allowed) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
 
-  // If the trial is not allowed, or the configuration has changed while
-  // determining if the trial is allowed, no need to continue.
-  if (!trial_allowed || config_id != config_id_)
+  if (!trial_allowed)
     return;
 
-  // Only record the TrialPrimary histograms for the same set of requests
-  // that TrialSecondary histograms will be recorded for, in order to get a
-  // direct comparison.
-  UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_Job_Latency_TrialPrimary",
-                             primary_latency,
-                             base::TimeDelta::FromMilliseconds(1),
-                             base::TimeDelta::FromMinutes(10), 100);
-  if (is_first_job) {
-    UMA_HISTOGRAM_CUSTOM_TIMES(
-        "Net.CertVerifier_First_Job_Latency_TrialPrimary", primary_latency,
-        base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(10),
-        100);
-  }
-
   std::unique_ptr<TrialVerificationJob> job =
       std::make_unique<TrialVerificationJob>(
-          config_, params, net_log, std::move(crl_set), this, primary_error,
+          params, net_log, std::move(crl_set), this, primary_error,
           primary_result, profile_id);
   TrialVerificationJob* job_ptr = job.get();
   jobs_.insert(std::move(job));

diff --git a/chrome/browser/net/trial_comparison_cert_verifier.h b/chrome/browser/net/trial_comparison_cert_verifier.h
index 08d0a88..b7bdea2 100644
--- a/chrome/browser/net/trial_comparison_cert_verifier.h
+++ b/chrome/browser/net/trial_comparison_cert_verifier.h

@@ -5,8 +5,6 @@
 #ifndef CHROME_BROWSER_NET_TRIAL_COMPARISON_CERT_VERIFIER_H_
 #define CHROME_BROWSER_NET_TRIAL_COMPARISON_CERT_VERIFIER_H_
 
-#include <stdint.h>
-
 #include "base/containers/unique_ptr_adapters.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -34,8 +32,7 @@
     kIgnoredMultipleEVPoliciesAndOneMatchesRoot = 7,
     kIgnoredDifferentPathReVerifiesEquivalent = 8,
     kIgnoredLocallyTrustedLeaf = 9,
-    kIgnoredConfigurationChanged = 10,
-    kMaxValue = kIgnoredConfigurationChanged
+    kMaxValue = kIgnoredLocallyTrustedLeaf
   };
 
   TrialComparisonCertVerifier(
@@ -56,7 +53,6 @@
              net::CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const net::NetLogWithSource& net_log) override;
-  void SetConfig(const Config& config) override;
 
   // Returns a CertVerifier using the primary CertVerifyProc, which will not
   // cause OnPrimaryVerifierComplete to be called. This can be used to
@@ -66,9 +62,6 @@
     return primary_reverifier_.get();
   }
   net::CertVerifier* trial_verifier() const { return trial_verifier_.get(); }
-  net::CertVerifier* revocation_trial_verifier() const {
-    return revocation_trial_verifier_.get();
-  }
 
  private:
   class TrialVerificationJob;
@@ -78,7 +71,7 @@
                                  const net::NetLogWithSource& net_log,
                                  int primary_error,
                                  const net::CertVerifyResult& primary_result,
-                                 base::TimeDelta primary_latency,
+                                 base::TimeDelta latency,
                                  bool is_first_job);
   void OnTrialVerifierComplete(const RequestParams& params,
                                scoped_refptr<net::CRLSet> crl_set,
@@ -92,9 +85,6 @@
                                 const net::NetLogWithSource& net_log,
                                 int primary_error,
                                 const net::CertVerifyResult& primary_result,
-                                base::TimeDelta primary_latency,
-                                bool is_first_job,
-                                uint32_t config_id,
                                 void* profile_id,
                                 bool trial_allowed);
 
@@ -104,17 +94,9 @@
   // accidentally using it on IO thread.
   void* profile_id_;
 
-  // Unique identifier for the current configuration, to determine if a
-  // configuration has changed in between primary and trial verifications.
-  uint32_t config_id_;
-  net::CertVerifier::Config config_;
-
   std::unique_ptr<net::CertVerifier> primary_verifier_;
   std::unique_ptr<net::CertVerifier> primary_reverifier_;
   std::unique_ptr<net::CertVerifier> trial_verifier_;
-  // Similar to |trial_verifier_|, except configured to always check
-  // revocation information.
-  std::unique_ptr<net::CertVerifier> revocation_trial_verifier_;
 
   std::set<std::unique_ptr<TrialVerificationJob>, base::UniquePtrComparator>
       jobs_;

diff --git a/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc b/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
index 7112634..a8d7432 100644
--- a/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc
+++ b/chrome/browser/net/trial_comparison_cert_verifier_unittest.cc

@@ -900,14 +900,12 @@
       base::MakeRefCounted<FakeCertVerifyProc>(net::OK, secondary_result);
 
   TrialComparisonCertVerifier verifier(profile(), verify_proc1, verify_proc2);
-  net::CertVerifier::Config config;
-  config.enable_rev_checking = true;
-  config.enable_sha1_local_anchors = true;
-  verifier.SetConfig(config);
 
-  net::CertVerifier::RequestParams params(leaf_cert_1_, "127.0.0.1", 0,
-                                          std::string() /* ocsp_response */,
-                                          {} /* additional_trust_anchors */);
+  net::CertVerifier::RequestParams params(
+      leaf_cert_1_, "127.0.0.1",
+      net::CertVerifier::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS |
+          net::CertVerifier::VERIFY_REV_CHECKING_ENABLED,
+      std::string() /* ocsp_response */, {} /* additional_trust_anchors */);
   net::CertVerifyResult result;
   net::TestCompletionCallback callback;
   std::unique_ptr<net::CertVerifier::Request> request;
@@ -1174,64 +1172,7 @@
   histograms_.ExpectTotalCount("Net.CertVerifier_TrialComparisonResult", 0);
 }
 
-TEST_F(TrialComparisonCertVerifierTest, DeletedBeforeTrialVerificationStarted) {
-  // Primary verifier returns an error status.
-  net::CertVerifyResult primary_result;
-  primary_result.verified_cert = cert_chain_1_;
-  primary_result.cert_status = net::CERT_STATUS_DATE_INVALID;
-  scoped_refptr<FakeCertVerifyProc> verify_proc1 =
-      base::MakeRefCounted<FakeCertVerifyProc>(net::ERR_CERT_DATE_INVALID,
-                                               primary_result);
-
-  // Trial verifier has ok status.
-  net::CertVerifyResult secondary_result;
-  secondary_result.verified_cert = cert_chain_1_;
-  scoped_refptr<NotCalledCertVerifyProc> verify_proc2 =
-      base::MakeRefCounted<NotCalledCertVerifyProc>();
-
-  auto verifier = std::make_unique<TrialComparisonCertVerifier>(
-      profile(), verify_proc1, verify_proc2);
-
-  net::CertVerifier::RequestParams params(
-      leaf_cert_1_, "127.0.0.1", 0 /* flags */,
-      std::string() /* ocsp_response */, {} /* additional_trust_anchors */);
-  net::CertVerifyResult result;
-  net::TestCompletionCallback callback;
-  std::unique_ptr<net::CertVerifier::Request> request;
-  int error =
-      verifier->Verify(params, nullptr /* crl_set */, &result,
-                       callback.callback(), &request, net::NetLogWithSource());
-  ASSERT_THAT(error, IsError(net::ERR_IO_PENDING));
-  EXPECT_TRUE(request);
-
-  // Wait for primary verifier to finish.
-  error = callback.WaitForResult();
-  EXPECT_THAT(error, IsError(net::ERR_CERT_DATE_INVALID));
-
-  // Delete the TrialComparisonCertVerifier.
-  verifier.reset();
-
-  // Trial verification has not yet started, as it was waiting on the profile
-  // to determine whether or not it would be permitted.
-
-  // Wait for any tasks to finish.
-  content::RunAllTasksUntilIdle();
-
-  // Expect no report.
-  reporting_service_test_helper()->ExpectNoRequests(service());
-
-  // The actual verification job should be completed, but neither the
-  // primary nor secondary job metrics should be recorded, as the verifier
-  // was deleted prior to determining whether a trial verification would be
-  // run.
-  histograms_.ExpectTotalCount("Net.CertVerifier_Job_Latency", 1);
-  histograms_.ExpectTotalCount("Net.CertVerifier_Job_Latency_TrialPrimary", 0);
-  histograms_.ExpectTotalCount("Net.CertVerifier_Job_Latency_TrialSecondary",
-                               0);
-  histograms_.ExpectTotalCount("Net.CertVerifier_TrialComparisonResult", 0);
-}
-
-TEST_F(TrialComparisonCertVerifierTest, DeletedAfterTrialVerificationStarted) {
+TEST_F(TrialComparisonCertVerifierTest, DeletedDuringTrialVerification) {
   // Primary verifier returns an error status.
   net::CertVerifyResult primary_result;
   primary_result.verified_cert = cert_chain_1_;
@@ -1265,23 +1206,7 @@
   error = callback.WaitForResult();
   EXPECT_THAT(error, IsError(net::ERR_CERT_DATE_INVALID));
 
-  // Allow the lookup on the UI thread for the profile to determine trial
-  // status.
-  std::unique_ptr<base::RunLoop> run_loop(std::make_unique<base::RunLoop>());
-  content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::UI)
-      ->PostTask(FROM_HERE, run_loop->QuitClosure());
-  run_loop->Run();
-
-  // Allow recording the metrics back on the IO thread, and starting the
-  // second verification, to run.
-  run_loop = std::make_unique<base::RunLoop>();
-  content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::IO)
-      ->PostTask(FROM_HERE, run_loop->QuitClosure());
-  run_loop->Run();
-
-  // Delete the TrialComparisonCertVerifier. The trial verification is still
-  // running on the task scheduler (or, depending on timing, has posted back
-  // to the IO thread after the Quit event).
+  // Delete the TrialComparisonCertVerifier.
   verifier.reset();
 
   // The callback to the trial verifier does not run. The verification task
@@ -1379,8 +1304,8 @@
   // ...unless it was called with REV_CHECKING_ENABLED.
   EXPECT_CALL(
       *verify_proc2,
-      VerifyInternal(_, _, _, net::CertVerifyProc::VERIFY_REV_CHECKING_ENABLED,
-                     _, _, _))
+      VerifyInternal(_, _, _, net::CertVerifier::VERIFY_REV_CHECKING_ENABLED, _,
+                     _, _))
       .WillRepeatedly(DoAll(SetArgPointee<6>(revoked_result),
                             Return(net::ERR_CERT_REVOKED)));
 

diff --git a/chrome/browser/prefs/pref_service_incognito_whitelist.cc b/chrome/browser/prefs/pref_service_incognito_whitelist.cc
index e5bd2dde..df1b7a9 100644
--- a/chrome/browser/prefs/pref_service_incognito_whitelist.cc
+++ b/chrome/browser/prefs/pref_service_incognito_whitelist.cc

@@ -26,7 +26,6 @@
 #include "components/ukm/ukm_pref_names.h"
 #include "components/variations/pref_names.h"
 #include "components/web_resource/web_resource_pref_names.h"
-#include "services/preferences/public/cpp/tracked/pref_names.h"
 
 #if defined(OS_ANDROID)
 #include "components/feed/buildflags.h"
@@ -169,15 +168,6 @@
 // audited, checked with owners, and removed or transfered to
 // |kPersistentPrefNames|.
 const char* const kTemporaryIncognitoWhitelist[] = {
-// ash/public/cpp/ash_pref_names.h
-#if defined(OS_CHROMEOS)
-    ash::prefs::kDetachableBaseDevices, ash::prefs::kEnableStylusTools,
-    ash::prefs::kHasSeenStylus,
-
-    // TODO(https://crbug.com/861722):  Check with mukai@ before removing.
-    ash::prefs::kTouchpadEnabled, ash::prefs::kTouchscreenEnabled,
-#endif  // defined(OS_CHROMEOS)
-
 // chrome/browser/accessibility/animation_policy_prefs.h
 #if !defined(OS_ANDROID)
     kAnimationPolicyAllowed, kAnimationPolicyOnce, kAnimationPolicyNone,
@@ -703,18 +693,6 @@
     prefs::kClipboardLastModifiedTime,
 #endif
 
-#if BUILDFLAG(ENABLE_OFFLINE_PAGES)
-    prefs::kOfflinePrefetchBackoff, prefs::kOfflineUsageStartObserved,
-    prefs::kOfflineUsageOnlineObserved, prefs::kOfflineUsageOfflineObserved,
-    prefs::kPrefetchUsageEnabledObserved, prefs::kPrefetchUsageFetchObserved,
-    prefs::kPrefetchUsageOpenObserved, prefs::kOfflineUsageTrackingDay,
-    prefs::kOfflineUsageUnusedCount, prefs::kOfflineUsageStartedCount,
-    prefs::kOfflineUsageOfflineCount, prefs::kOfflineUsageOnlineCount,
-    prefs::kOfflineUsageMixedCount, prefs::kPrefetchUsageEnabledCount,
-    prefs::kPrefetchUsageFetchedCount, prefs::kPrefetchUsageOpenedCount,
-    prefs::kPrefetchUsageMixedCount,
-#endif
-
     prefs::kMediaEngagementSchemaVersion,
 
     // Preferences for recording metrics about tab and window usage.
@@ -795,9 +773,6 @@
     // components/web_resource/web_resource_pref_names.h
     prefs::kEulaAccepted,
 
-    // services/preferences/public/cpp/tracked/pref_names.h
-    user_prefs::kPreferenceResetTime,
-
 // ui/base/ime/chromeos/extension_ime_util.h
 #if defined(OS_CHROMEOS)
     chromeos::extension_ime_util::kBrailleImeExtensionId,

diff --git a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc
index 47732c8..f686c829 100644
--- a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc
+++ b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc

@@ -105,6 +105,7 @@
 #endif
 
 #if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/android_sms/android_sms_service_factory.h"
 #include "chrome/browser/chromeos/crostini/crostini_registry_service_factory.h"
 #include "chrome/browser/chromeos/cryptauth/chrome_cryptauth_service_factory.h"
 #include "chrome/browser/chromeos/ownership/owner_settings_service_chromeos_factory.h"
@@ -226,6 +227,7 @@
   ChromeBrowsingDataRemoverDelegateFactory::GetInstance();
 #if defined(OS_CHROMEOS)
   chromeos::ChromeCryptAuthServiceFactory::GetInstance();
+  chromeos::android_sms::AndroidSmsServiceFactory::GetInstance();
 #endif
   ChromeSigninClientFactory::GetInstance();
 #if BUILDFLAG(ENABLE_PRINT_PREVIEW) && !defined(OS_CHROMEOS)

diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index 3bf4c0fd..65dc6d3a 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc

@@ -204,11 +204,6 @@
     return g_cert_verifier_for_profile_io_data_testing->Verify(
         params, crl_set, verify_result, std::move(callback), out_req, net_log);
   }
-  void SetConfig(const Config& config) override {
-    if (!g_cert_verifier_for_profile_io_data_testing)
-      return;
-    return g_cert_verifier_for_profile_io_data_testing->SetConfig(config);
-  }
 };
 
 #if BUILDFLAG(DEBUG_DEVTOOLS)

diff --git a/chrome/browser/renderer_host/site_per_process_text_input_browsertest.cc b/chrome/browser/renderer_host/site_per_process_text_input_browsertest.cc
index fbe1a47b..f6facedc5 100644
--- a/chrome/browser/renderer_host/site_per_process_text_input_browsertest.cc
+++ b/chrome/browser/renderer_host/site_per_process_text_input_browsertest.cc

@@ -1311,17 +1311,11 @@
   DISALLOW_COPY_AND_ASSIGN(ShowDefinitionForWordObserver);
 };
 
-#if defined(OS_MACOSX)
-#define MAYBE_LookUpStringForRangeRoutesToFocusedWidget \
-  DISABLED_LookUpStringForRangeRoutesToFocusedWidget
-#else
-#define MAYBE_LookUpStringForRangeRoutesToFocusedWidget \
-  LookUpStringForRangeRoutesToFocusedWidget
-#endif
+// Flakey (https:://crbug.com/874417).
 // This test verifies that requests for dictionary lookup based on selection
 // range are routed to the focused RenderWidgetHost.
 IN_PROC_BROWSER_TEST_F(SitePerProcessTextInputManagerTest,
-                       MAYBE_LookUpStringForRangeRoutesToFocusedWidget) {
+                       DISABLED_LookUpStringForRangeRoutesToFocusedWidget) {
   CreateIframePage("a(b)");
   std::vector<content::RenderFrameHost*> frames{GetFrame(IndexVector{}),
                                                 GetFrame(IndexVector{0})};

diff --git a/chrome/browser/resources/chromeos/chromevox/BUILD.gn b/chrome/browser/resources/chromeos/chromevox/BUILD.gn
index ca12acf..bb56b7f 100644
--- a/chrome/browser/resources/chromeos/chromevox/BUILD.gn
+++ b/chrome/browser/resources/chromeos/chromevox/BUILD.gn

@@ -132,6 +132,7 @@
   "cvox2/background/earcon_engine.js",
   "cvox2/background/editing.js",
   "cvox2/background/event_source.js",
+  "cvox2/background/event_stream_logger.js",
   "cvox2/background/find_handler.js",
   "cvox2/background/gesture_command_data.js",
   "cvox2/background/gesture_command_handler.js",

diff --git a/chrome/browser/resources/chromeos/chromevox/chromevox/background/background.js b/chrome/browser/resources/chromeos/chromevox/chromevox/background/background.js
index fd29544..a0d94d7 100644
--- a/chrome/browser/resources/chromeos/chromevox/chromevox/background/background.js
+++ b/chrome/browser/resources/chromeos/chromevox/chromevox/background/background.js

@@ -9,6 +9,7 @@
 goog.provide('cvox.ChromeVoxBackground');
 
 goog.require('ChromeVoxState');
+goog.require('EventStreamLogger');
 goog.require('Msgs');
 goog.require('constants');
 goog.require('cvox.AbstractEarcons');

diff --git a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.css b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.css
index 40cbfd1..764dc12 100644
--- a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.css
+++ b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.css

@@ -99,3 +99,15 @@
     margin-left: 20px;
     padding: 0 20px;
 }
+
+.option-eventstream {
+    background-color: #fff;
+    border: 1px solid #ddd;
+    font-size: 13px;
+    line-height: 30px;
+    min-height: 30px;
+    padding: 0 20px;
+    vertical-align: middle;
+    width: 646px;
+}
+

diff --git a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.html b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.html
index e25ca5c..f614d8c2 100644
--- a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.html
+++ b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.html

@@ -143,6 +143,275 @@
     </label>
   </div>
 
+  <div class="option" id="developerEventStream">
+    <label>
+      <input id="enableEventStreamLogging" type="checkbox" class="checkbox pref"
+             name="enableEventStreamLogging">
+      <span class="i18n" msgid="options_event_stream_logging">
+        Enable event stream logging
+      </span>
+    </label>
+    <button id="toggleEventStreamFilters"></button>
+  </div>
+  <div id="eventStreamFilters" hidden>
+    <label><div class="option-eventstream">
+      <input name="activedescendantchanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>activedescendantchanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="alert" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>alert</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="ariaAttributeChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>ariaAttributeChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="autocorrectionOccured" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>autocorrectionOccured</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="blur" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>blur</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="checkedStateChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>checkedStateChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="childrenChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>childrenChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="clicked" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>clicked</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="documentSelectionChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>documentSelectionChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="documentTitleChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>documentTitleChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="expandedChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>expandedChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="focus" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>focus</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="focusContext" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>focusContext</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="imageFrameUpdated" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>imageFrameUpdated</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="hide" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>hide</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="hitTestResult" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>hitTestResult</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="hover" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>hover</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="invalidStatusChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>invalidStatusChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="layoutComplete" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>layoutComplete</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="liveRegionCreated" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>liveRegionCreated</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="liveRegionChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>liveRegionChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="loadComplete" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>loadComplete</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="locationChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>locationChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mediaStartedPlaying" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mediaStartedPlaying</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mediaStoppedPlaying" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mediaStoppedPlaying</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuEnd" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuEnd</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuListItemSelected" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuListItemSelected</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuListValueChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuListValueChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuPopupEnd" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuPopupEnd</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuPopupStart" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuPopupStart</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="menuStart" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>menuStart</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mouseCanceled" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mouseCanceled</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mouseDragged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mouseDragged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mouseMoved" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mouseMoved</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mousePressed" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mousePressed</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="mouseReleased" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>mouseReleased</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="rowCollapsed" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>rowCollapsed</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="rowCountChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>rowCountChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="rowExpanded" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>rowExpanded</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="scrollPositionChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>scrollPositionChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="scrolledToAnchor" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>scrolledToAnchor</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="selectedChildrenChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>selectedChildrenChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="selection" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>selection</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="selectionAdd" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>selectionAdd</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="selectionRemove" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>selectionRemove</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="show" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>show</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="stateChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>stateChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="textChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>textChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="textSelectionChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>textSelectionChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="treeChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>treeChanged</span>
+    </div></label>
+    <label><div class="option-eventstream">
+      <input name="valueChanged" type="checkbox"
+             class="checkbox pref eventstream">
+      <span>valueChanged</span>
+    </div></label>
+  </div>
+  </div>
+
   <div id="status" role="live" aria-live="assertive">
   </div>
 

diff --git a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.js b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.js
index 0e3fb31..17162d0 100644
--- a/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.js
+++ b/chrome/browser/resources/chromeos/chromevox/chromevox/background/options.js

@@ -9,6 +9,7 @@
 
 goog.provide('cvox.OptionsPage');
 
+goog.require('EventStreamLogger');
 goog.require('Msgs');
 goog.require('PanelCommand');
 goog.require('cvox.BrailleTable');
@@ -83,6 +84,12 @@
       currentlyDisplayingSideBySide :
       currentlyDisplayingInterleave;
 
+  var showEventStreamFilters = Msgs.getMsg('options_show_event_stream_filters');
+  var hideEventStreamFilters = Msgs.getMsg('options_hide_event_stream_filters');
+  $('toggleEventStreamFilters').textContent = showEventStreamFilters;
+  cvox.OptionsPage.disableEventStreamFilterCheckBoxes(
+      localStorage['enableEventStreamLogging'] == 'false');
+
   chrome.commandLinePrivate.hasSwitch('enable-audio-focus', function(result) {
     if (!result) {
       $('audioStrategy').hidden = true;
@@ -97,12 +104,27 @@
     }
   });
 
+  var registerEventStreamFiltersListener = function() {
+    $('toggleEventStreamFilters').addEventListener('click', function(evt) {
+      if ($('eventStreamFilters').hidden) {
+        $('eventStreamFilters').hidden = false;
+        $('toggleEventStreamFilters').textContent = hideEventStreamFilters;
+      } else {
+        $('eventStreamFilters').hidden = true;
+        $('toggleEventStreamFilters').textContent = showEventStreamFilters;
+      }
+    });
+  };
+
   chrome.commandLinePrivate.hasSwitch(
       'enable-chromevox-developer-option', function(enable) {
         if (!enable) {
           $('developerDescription').hidden = true;
           $('developerSpeechLogging').hidden = true;
+          $('developerEventStream').hidden = true;
+          return;
         }
+        registerEventStreamFiltersListener();
       });
 
   Msgs.addTranslatedMessagesToDom(document);
@@ -348,6 +370,17 @@
 };
 
 /**
+ * Disable event stream logging filter check boxes.
+ * Check boxes should be disabled when event stream logging is disabled.
+ * @param {boolean} disable
+ */
+cvox.OptionsPage.disableEventStreamFilterCheckBoxes = function(disable) {
+  var filters = document.querySelectorAll('.option-eventstream > input');
+  for (var i = 0; i < filters.length; i++)
+    filters[i].disabled = disable;
+};
+
+/**
  * Event listener, called when an event occurs in the page that might
  * affect one of the preference controls.
  * @param {Event} event The event.
@@ -361,6 +394,17 @@
     } else if (target.name == 'enableSpeechLogging') {
       cvox.OptionsPage.consoleTts.setEnabled(target.checked);
       cvox.OptionsPage.prefs.setPref(target.name, target.checked);
+    } else if (target.id == 'enableEventStreamLogging') {
+      cvox.OptionsPage.prefs.setPref(target.name, target.checked);
+      chrome.extension.getBackgroundPage()
+          .EventStreamLogger.instance.notifyEventStreamFilterChangedAll(
+              target.checked);
+      cvox.OptionsPage.disableEventStreamFilterCheckBoxes(!target.checked);
+    } else if (target.className.indexOf('eventstream') != -1) {
+      cvox.OptionsPage.prefs.setPref(target.name, target.checked);
+      chrome.extension.getBackgroundPage()
+          .EventStreamLogger.instance.notifyEventStreamFilterChanged(
+              target.name, target.checked);
     } else if (target.classList.contains('pref')) {
       if (target.tagName == 'INPUT' && target.type == 'checkbox') {
         cvox.OptionsPage.prefs.setPref(target.name, target.checked);

diff --git a/chrome/browser/resources/chromeos/chromevox/chromevox/background/prefs.js b/chrome/browser/resources/chromeos/chromevox/chromevox/background/prefs.js
index d6cc1f0..8b35a9b 100644
--- a/chrome/browser/resources/chromeos/chromevox/chromevox/background/prefs.js
+++ b/chrome/browser/resources/chromeos/chromevox/chromevox/background/prefs.js

@@ -74,6 +74,7 @@
   'cvoxKey': '',
   'enableSpeechLogging': true,
   'earcons': true,
+  'enableEventStreamLogging': false,
   'focusFollowsMouse': false,
   'granularity': undefined,
   'position': '{}',
@@ -87,6 +88,59 @@
   'useIBeamCursor': cvox.ChromeVox.isMac,
   'useClassic': false,
   'useVerboseMode': true,
+
+  // eventStreamFilters
+  'activedescendantchanged': true,
+  'alert': true,
+  'ariaAttributeChanged': true,
+  'autocorrectionOccured': true,
+  'blur': true,
+  'checkedStateChanged': true,
+  'childrenChanged': true,
+  'clicked': true,
+  'documentSelectionChanged': true,
+  'documentTitleChanged': true,
+  'expandedChanged': true,
+  'focus': true,
+  'focusContext': true,
+  'imageFrameUpdated': true,
+  'hide': true,
+  'hitTestResult': true,
+  'hover': true,
+  'invalidStatusChanged': true,
+  'layoutComplete': true,
+  'liveRegionCreated': true,
+  'liveRegionChanged': true,
+  'loadComplete': true,
+  'locationChanged': true,
+  'mediaStartedPlaying': true,
+  'mediaStoppedPlaying': true,
+  'menuEnd': true,
+  'menuListItemSelected': true,
+  'menuListValueChanged': true,
+  'menuPopupEnd': true,
+  'menuPopupStart': true,
+  'menuStart': true,
+  'mouseCanceled': true,
+  'mouseDragged': true,
+  'mouseMoved': true,
+  'mousePressed': true,
+  'mouseReleased': true,
+  'rowCollapsed': true,
+  'rowCountChanged': true,
+  'rowExpanded': true,
+  'scrollPositionChanged': true,
+  'scrolledToAnchor': true,
+  'selectedChildrenChanged': true,
+  'selection': true,
+  'selectionAdd': true,
+  'selectionRemove': true,
+  'show': true,
+  'stateChanged': true,
+  'textChanged': true,
+  'textSelectionChanged': true,
+  'treeChanged': true,
+  'valueChanged': true
 };
 
 

diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/event_stream_logger.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/event_stream_logger.js
new file mode 100644
index 0000000..9fdb01d
--- /dev/null
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/event_stream_logger.js

@@ -0,0 +1,180 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Creates event stream logger.
+ */
+
+goog.provide('EventStreamLogger');
+
+goog.scope(function() {
+var AutomationEvent = chrome.automation.AutomationEvent;
+var AutomationNode = chrome.automation.AutomationNode;
+var EventType = chrome.automation.EventType;
+
+/**
+ * @constructor
+ */
+EventStreamLogger = function(node) {
+  /**
+   * @type {!AutomationNode}
+   */
+  this.node_ = node;
+
+  /**
+   * @type {function(!AutomationEvent): void}
+   * @private
+   */
+  this.watcher_ = this.eventStreamLogging.bind(this);
+};
+
+EventStreamLogger.prototype = {
+  /**
+   * Adds eventStreamLogging to this handler.
+   * @param {chrome.automation.EventType} eventType
+   * @protected
+   */
+  addWatcher_: function(eventType) {
+    this.node_.addEventListener(eventType, this.watcher_, false);
+  },
+
+  /**
+   * Removes eventStreamLogging from this handler.
+   * @param {chrome.automation.EventType} eventType
+   * @protected
+   */
+  removeWatcher_: function(eventType) {
+    this.node_.removeEventListener(eventType, this.watcher_, false);
+  },
+
+  /**
+   * @param {!AutomationNode} target
+   */
+  isDescendantOfConsole: function(target) {
+    if (target.docUrl && target.docUrl.indexOf('chrome-devtools://') == 0)
+      return true;
+
+    if (!target.parent)
+      return false;
+
+    return this.isDescendantOfConsole(target.parent);
+  },
+
+  /**
+   * @param {!AutomationEvent} evt
+   */
+  eventStreamLogging: function(evt) {
+    /**
+     * If evt is dispatched to console, don't show.
+     * Console event log are unnecessary for developers.
+     */
+    if (this.isDescendantOfConsole(evt.target))
+      return;
+
+    var logStr = 'EventType = ' + evt.type;
+    logStr += ', TargetName = ' + evt.target.name;
+    logStr += ', RootName = ' + evt.target.root.name;
+    logStr += ', DocumentURL = ' + evt.target.docUrl;
+
+    console.log(logStr);
+  },
+
+  /**
+   * @param {chrome.automation.EventType} eventType
+   * @param {boolean} checked
+   */
+  notifyEventStreamFilterChanged: function(eventType, checked) {
+    if (checked) {
+      this.addWatcher_(eventType);
+    } else {
+      this.removeWatcher_(eventType);
+    }
+  },
+
+  /**
+   * @param {boolean} checked
+   */
+  notifyEventStreamFilterChangedAll: function(checked) {
+    var EventTypeList = [
+      EventType.ACTIVEDESCENDANTCHANGED,
+      EventType.ALERT,
+      EventType.ARIA_ATTRIBUTE_CHANGED,
+      EventType.AUTOCORRECTION_OCCURED,
+      EventType.BLUR,
+      EventType.CHECKED_STATE_CHANGED,
+      EventType.CHILDREN_CHANGED,
+      EventType.CLICKED,
+      EventType.DOCUMENT_SELECTION_CHANGED,
+      EventType.DOCUMENT_TITLE_CHANGED,
+      EventType.EXPANDED_CHANGED,
+      EventType.FOCUS,
+      EventType.FOCUS_CONTEXT,
+      EventType.IMAGE_FRAME_UPDATED,
+      EventType.HIDE,
+      EventType.HIT_TEST_RESULT,
+      EventType.HOVER,
+      EventType.INVALID_STATUS_CHANGED,
+      EventType.LAYOUT_COMPLETE,
+      EventType.LIVE_REGION_CREATED,
+      EventType.LIVE_REGION_CHANGED,
+      EventType.LOAD_COMPLETE,
+      EventType.LOCATION_CHANGED,
+      EventType.MEDIA_STARTED_PLAYING,
+      EventType.MEDIA_STOPPED_PLAYING,
+      EventType.MENU_END,
+      EventType.MENU_LIST_ITEM_SELECTED,
+      EventType.MENU_LIST_VALUE_CHANGED,
+      EventType.MENU_POPUP_END,
+      EventType.MENU_POPUP_START,
+      EventType.MENU_START,
+      EventType.MOUSE_CANCELED,
+      EventType.MOUSE_DRAGGED,
+      EventType.MOUSE_MOVED,
+      EventType.MOUSE_PRESSED,
+      EventType.MOUSE_RELEASED,
+      EventType.ROW_COLLAPSED,
+      EventType.ROW_COUNT_CHANGED,
+      EventType.ROW_EXPANDED,
+      EventType.SCROLL_POSITION_CHANGED,
+      EventType.SCROLLED_TO_ANCHOR,
+      EventType.SELECTED_CHILDREN_CHANGED,
+      EventType.SELECTION,
+      EventType.SELECTION_ADD,
+      EventType.SELECTION_REMOVE,
+      EventType.SHOW,
+      EventType.STATE_CHANGED,
+      EventType.TEXT_CHANGED,
+      EventType.TEXT_SELECTION_CHANGED,
+      EventType.TREE_CHANGED,
+      EventType.VALUE_CHANGED
+    ];
+
+    for (var evtType of EventTypeList) {
+      if (localStorage[evtType] == 'true')
+        this.notifyEventStreamFilterChanged(evtType, checked);
+    }
+  },
+};
+
+/**
+ * Global instance.
+ * @type {EventStreamLogger}
+ */
+EventStreamLogger.instance;
+
+/**
+ * Initializes global state for EventStreamLogger.
+ * @private
+ */
+EventStreamLogger.init_ = function() {
+  chrome.automation.getDesktop(function(desktop) {
+    EventStreamLogger.instance = new EventStreamLogger(desktop);
+    EventStreamLogger.instance.notifyEventStreamFilterChangedAll(
+        localStorage['enableEventStreamLogging'] == 'true');
+  });
+};
+
+EventStreamLogger.init_();
+
+});  // goog.scope

diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel.js
index f9e9c3f6..9d7cae1ce 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel.js

@@ -270,6 +270,12 @@
  * @param {*=} opt_activateMenuTitle Title msg id of menu to open.
  */
 Panel.onOpenMenus = function(opt_event, opt_activateMenuTitle) {
+  // If the menu was already open, close it now and exit early.
+  if (Panel.mode_ != Panel.Mode.COLLAPSED) {
+    Panel.setMode(Panel.Mode.COLLAPSED);
+    return;
+  }
+
   // Eat the event so that a mousedown isn't turned into a drag, allowing
   // users to click-drag-release to select a menu item.
   if (opt_event) {

diff --git a/chrome/browser/resources/chromeos/chromevox/strings/chromevox_strings.grd b/chrome/browser/resources/chromeos/chromevox/strings/chromevox_strings.grd
index a30644f..7e7bb42 100644
--- a/chrome/browser/resources/chromeos/chromevox/strings/chromevox_strings.grd
+++ b/chrome/browser/resources/chromeos/chromevox/strings/chromevox_strings.grd

@@ -565,6 +565,15 @@
       <message desc="Enable chromevox speech logging." name="IDS_CHROMEVOX_OPTIONS_DEVELOPER_SPEECH_LOGGING">
         Enable speech logging
       </message>
+      <message desc="Enable event stream logging in chromevox for developer options." name="IDS_CHROMEVOX_OPTIONS_EVENT_STREAM_LOGGING">
+        Enable event stream logging
+      </message>
+      <message desc="Show event stream filters options for event stream logging." name="IDS_CHROMEVOX_OPTIONS_SHOW_EVENT_STREAM_FILTERS">
+        Show event stream filters
+      </message>
+      <message desc="Hide event stream filters options for event stream logging." name="IDS_CHROMEVOX_OPTIONS_HIDE_EVENT_STREAM_FILTERS">
+        Hide event stream filters
+      </message>
       <message desc="The title of ChromeVox Learn Mode page.  The keyboard explorer voices the name of each key when the user presses it." name="IDS_CHROMEVOX_KBEXPLORER_TITLE">
         ChromeVox Learn Mode
       </message>

diff --git a/chrome/browser/resources/chromeos/login/app_downloading.css b/chrome/browser/resources/chromeos/login/app_downloading.css
index bc4f90d0..86c4bf1 100644
--- a/chrome/browser/resources/chromeos/login/app_downloading.css
+++ b/chrome/browser/resources/chromeos/login/app_downloading.css

@@ -17,3 +17,8 @@
 #app-downloading-video-container {
   margin: 80px auto auto;
 }
+
+#app-downloading-video-container video {
+  height: 204px;
+  width: 230px;
+}

diff --git a/chrome/browser/resources/chromeos/login/app_downloading.html b/chrome/browser/resources/chromeos/login/app_downloading.html
index 23195f4..bf9db148 100644
--- a/chrome/browser/resources/chromeos/login/app_downloading.html
+++ b/chrome/browser/resources/chromeos/login/app_downloading.html

@@ -22,7 +22,13 @@
         [[i18nDynamic(locale, 'appDownloadingScreenDescription')]]
       </div>
       <div id="app-downloading-video-container" slot="footer">
-        <!-- TODO(rsgingerrs): add the app downloading video -->
+        <if expr="chromeos and _google_chrome">
+          <video loop="loop" autoplay="autoplay" muted>
+            <source
+                src="../../../internal/resources/arc_support/videos/app_downloading.mp4"
+                type="video/mp4">
+          </video>
+        </if>
       </div>
       <div slot="bottom-buttons" class="layout horizontal end-justified">
         <oobe-next-button id="app-downloading-continue-setup-button"

diff --git a/chrome/browser/resources/local_ntp/most_visited_single.js b/chrome/browser/resources/local_ntp/most_visited_single.js
index 72886ff..25c791a 100644
--- a/chrome/browser/resources/local_ntp/most_visited_single.js
+++ b/chrome/browser/resources/local_ntp/most_visited_single.js

@@ -793,6 +793,11 @@
   mdTitle.className = CLASSES.MD_TITLE;
   mdTitle.innerText = data.title;
   mdTitle.style.direction = data.direction || 'ltr';
+  // Font weight on Mac and ChromeOS is heavier and needs to be reduced.
+  if (navigator.userAgent.indexOf('Mac') > -1 ||
+      navigator.userAgent.indexOf('CrOS') > -1) {
+    mdTitle.style.fontWeight = 400;
+  }
   mdTitleContainer.appendChild(mdTitle);
   mdTileInner.appendChild(mdTitleContainer);
   mdTile.appendChild(mdTileInner);

diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/chrome/browser/resources/settings/privacy_page/privacy_page.html
index f69b0ba..f8efec9 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page.html
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page.html

@@ -146,6 +146,13 @@
                 aria-describedby="clearBrowsingDataSecondary"></button>
           </paper-icon-button-light>
         </div>
+<if expr="chromeos">
+        <settings-toggle-button
+            pref="{{prefs.app_list.continue_reading_enabled}}"
+            label="$i18n{enableAppListContinueReading}"
+            sub-label="$i18n{enableAppListContinueReadingDescription}">
+        </settings-toggle-button>
+</if>
         <div class="settings-box" on-click="onMoreSettingsBoxClicked_"
             hidden="[[!unifiedConsentEnabled_]]">
           <div class="start">$i18nRaw{syncAndPersonalizationLink}</div>
@@ -477,7 +484,10 @@
       </template>
       <template is="dom-if" route-path="/content/siteDetails" no-search>
         <settings-subpage page-title="[[pageTitle]]">
-          <site-details page-title="{{pageTitle}}"></site-details>
+          <site-details
+            page-title="{{pageTitle}}"
+            block-autoplay-enabled="[[blockAutoplayStatus_.pref.value]]">
+          </site-details>
         </settings-subpage>
       </template>
       <template is="dom-if" route-path="/cookies/detail" no-search>

diff --git a/chrome/browser/resources/settings/site_settings/BUILD.gn b/chrome/browser/resources/settings/site_settings/BUILD.gn
index ac2e54be..d1d7f626 100644
--- a/chrome/browser/resources/settings/site_settings/BUILD.gn
+++ b/chrome/browser/resources/settings/site_settings/BUILD.gn

@@ -181,6 +181,7 @@
     ":site_settings_behavior",
     "//ui/webui/resources/js:assert",
     "//ui/webui/resources/js:cr",
+    "//ui/webui/resources/js:i18n_behavior",
     "//ui/webui/resources/js:load_time_data",
     "//ui/webui/resources/js:web_ui_listener_behavior",
   ]

diff --git a/chrome/browser/resources/settings/site_settings/site_details.html b/chrome/browser/resources/settings/site_settings/site_details.html
index 27d00d2..730957b 100644
--- a/chrome/browser/resources/settings/site_settings/site_details.html
+++ b/chrome/browser/resources/settings/site_settings/site_details.html

@@ -148,7 +148,8 @@
       </site-details-permission>
       <site-details-permission category="{{ContentSettingsTypes.SOUND}}"
           icon="settings:volume-up" id="sound"
-          label="$i18n{siteSettingsSound}">
+          label="$i18n{siteSettingsSound}"
+          use-automatic-label="[[blockAutoplayEnabled]]">
       </site-details-permission>
       <site-details-permission
           category="{{ContentSettingsTypes.AUTOMATIC_DOWNLOADS}}"

diff --git a/chrome/browser/resources/settings/site_settings/site_details.js b/chrome/browser/resources/settings/site_settings/site_details.js
index 155cc28..8906a2a 100644
--- a/chrome/browser/resources/settings/site_settings/site_details.js
+++ b/chrome/browser/resources/settings/site_settings/site_details.js

@@ -17,6 +17,11 @@
 
   properties: {
     /**
+     * Whether unified autoplay blocking is enabled.
+     */
+    blockAutoplayEnabled: Boolean,
+
+    /**
      * The origin that this widget is showing details for.
      * @private
      */
@@ -72,6 +77,9 @@
     this.addWebUIListener(
         'prefEnableDrmChanged', this.prefEnableDrmChanged_.bind(this));
     // </if>
+
+    // Refresh block autoplay status from the backend.
+    this.browserProxy.fetchBlockAutoplayStatus();
   },
 
   /** @override */

diff --git a/chrome/browser/resources/settings/site_settings/site_details_permission.html b/chrome/browser/resources/settings/site_settings/site_details_permission.html
index 3e305be01..9da49da8 100644
--- a/chrome/browser/resources/settings/site_settings/site_details_permission.html
+++ b/chrome/browser/resources/settings/site_settings/site_details_permission.html

@@ -3,6 +3,7 @@
 <link rel="import" href="chrome://resources/html/md_select_css.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/html/web_ui_listener_behavior.html">
+<link rel="import" href="chrome://resources/html/i18n_behavior.html">
 <link rel="import" href="../settings_shared_css.html">
 <link rel="import" href="../settings_vars_css.html">
 <link rel="import" href="constants.html">
@@ -53,16 +54,18 @@
           <option id="default" value$="[[ContentSetting.DEFAULT]]">
             [[defaultSettingString_(
                 defaultSetting_,
-                '$i18nPolymer{siteSettingsActionAskDefault}',
-                '$i18nPolymer{siteSettingsActionAllowDefault}',
-                '$i18nPolymer{siteSettingsActionBlockDefault}')]]
+                category,
+                useAutomaticLabel)]]
           </option>
           <option id="allow" value$="[[ContentSetting.ALLOW]]"
               hidden$="[[!showAllowedSetting_(category)]]">
             $i18n{siteSettingsActionAllow}
           </option>
           <option id="block" value$="[[ContentSetting.BLOCK]]">
-            $i18n{siteSettingsActionBlock}
+            [[blockSettingString_(
+                category,
+                '$i18n{siteSettingsActionBlock}',
+                '$i18n{siteSettingsActionMute}')]]
           </option>
           <option id="ask" value$="[[ContentSetting.ASK]]"
               hidden$="[[!showAskSetting_(category, site.setting,

diff --git a/chrome/browser/resources/settings/site_settings/site_details_permission.js b/chrome/browser/resources/settings/site_settings/site_details_permission.js
index d559c00b..8802f15 100644
--- a/chrome/browser/resources/settings/site_settings/site_details_permission.js
+++ b/chrome/browser/resources/settings/site_settings/site_details_permission.js

@@ -10,10 +10,17 @@
 Polymer({
   is: 'site-details-permission',
 
-  behaviors: [SiteSettingsBehavior, WebUIListenerBehavior],
+  behaviors: [I18nBehavior, SiteSettingsBehavior, WebUIListenerBehavior],
 
   properties: {
     /**
+     * If this is a sound content setting, then this controls whether it
+     * should use "Automatic" instead of "Allow" as the default setting
+     * allow label.
+     */
+    useAutomaticLabel: {type: Boolean, value: false},
+
+    /**
      * The site that this widget is showing details for.
      * @type {RawSiteException}
      */
@@ -99,30 +106,63 @@
   },
 
   /**
+   * Returns if we should use the custom labels for the sound type.
+   * @param {!settings.ContentSettingsTypes} category The permission type.
+   * @return {boolean}
+   * @private
+   */
+  useCustomSoundLabels_: function(category) {
+    return category == settings.ContentSettingsTypes.SOUND &&
+        loadTimeData.getBoolean('enableBlockAutoplayContentSetting');
+  },
+
+  /**
    * Updates the string used for this permission category's default setting.
    * @param {!settings.ContentSetting} defaultSetting Value of the default
    *     setting for this permission category.
-   * @param {string} askString 'Ask' label, e.g. 'Ask (default)'.
-   * @param {string} allowString 'Allow' label, e.g. 'Allow (default)'.
-   * @param {string} blockString 'Block' label, e.g. 'Blocked (default)'.
+   * @param {!settings.ContentSettingsTypes} category The permission type.
+   * @param {boolean} useAutomaticLabel Whether to use the automatic label
+   *     if the default setting value is allow.
    * @return {string}
    * @private
    */
-  defaultSettingString_: function(
-      defaultSetting, askString, allowString, blockString) {
+  defaultSettingString_: function(defaultSetting, category, useAutomaticLabel) {
+    if (defaultSetting == undefined || category == undefined ||
+        useAutomaticLabel == undefined) {
+      return '';
+    }
+
     if (defaultSetting == settings.ContentSetting.ASK ||
         defaultSetting == settings.ContentSetting.IMPORTANT_CONTENT) {
-      return askString;
+      return this.i18n('siteSettingsActionAskDefault');
     } else if (defaultSetting == settings.ContentSetting.ALLOW) {
-      return allowString;
+      if (this.useCustomSoundLabels_(category) && useAutomaticLabel)
+        return this.i18n('siteSettingsActionAutomaticDefault');
+      return this.i18n('siteSettingsActionAllowDefault');
     } else if (defaultSetting == settings.ContentSetting.BLOCK) {
-      return blockString;
+      if (this.useCustomSoundLabels_(category))
+        return this.i18n('siteSettingsActionMuteDefault');
+      return this.i18n('siteSettingsActionBlockDefault');
     }
     assertNotReached(
         `No string for ${this.category}'s default of ${defaultSetting}`);
   },
 
   /**
+   * Updates the string used for this permission category's block setting.
+   * @param {!settings.ContentSettingsTypes} category The permission type.
+   * @param {string} blockString 'Block' label.
+   * @param {string} muteString 'Mute' label.
+   * @return {string}
+   * @private
+   */
+  blockSettingString_: function(category, blockString, muteString) {
+    if (this.useCustomSoundLabels_(category))
+      return muteString;
+    return blockString;
+  },
+
+  /**
    * Returns true if there's a string to display that provides more information
    * about this permission's setting. Currently, this only gets called when
    * |this.site| is updated.

diff --git a/chrome/browser/resources/settings/site_settings/site_settings_prefs_browser_proxy.js b/chrome/browser/resources/settings/site_settings/site_settings_prefs_browser_proxy.js
index c4a59ce..eaad4f2 100644
--- a/chrome/browser/resources/settings/site_settings/site_settings_prefs_browser_proxy.js
+++ b/chrome/browser/resources/settings/site_settings/site_settings_prefs_browser_proxy.js

@@ -317,6 +317,12 @@
      */
     showAndroidManageAppLinks() {}
     // </if>
+
+    /**
+     * Fetches the current block autoplay state. Returns the results via
+     * onBlockAutoplayStatusChanged.
+     */
+    fetchBlockAutoplayStatus() {}
   }
 
   /**
@@ -459,6 +465,11 @@
       chrome.send('showAndroidManageAppLinks');
     }
     // </if>
+
+    /** @override */
+    fetchBlockAutoplayStatus() {
+      chrome.send('fetchBlockAutoplayStatus');
+    }
   }
 
   // The singleton instance_ is replaced with a test version of this wrapper

diff --git a/chrome/browser/ssl/certificate_error_report.cc b/chrome/browser/ssl/certificate_error_report.cc
index 2d8e6d6f..2942cf64 100644
--- a/chrome/browser/ssl/certificate_error_report.cc
+++ b/chrome/browser/ssl/certificate_error_report.cc

@@ -75,24 +75,18 @@
 }
 
 void AddVerifyFlagsToReport(
-    const net::CertVerifier::Config& config,
+    int verify_flags,
     ::google::protobuf::RepeatedField<int>* report_flags) {
-  if (config.enable_rev_checking) {
-    report_flags->Add(
-        chrome_browser_ssl::TrialVerificationInfo::VERIFY_REV_CHECKING_ENABLED);
-  }
-  if (config.require_rev_checking_local_anchors) {
-    report_flags->Add(chrome_browser_ssl::TrialVerificationInfo::
-                          VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS);
-  }
-  if (config.enable_sha1_local_anchors) {
-    report_flags->Add(chrome_browser_ssl::TrialVerificationInfo::
-                          VERIFY_ENABLE_SHA1_LOCAL_ANCHORS);
-  }
-  if (config.disable_symantec_enforcement) {
-    report_flags->Add(chrome_browser_ssl::TrialVerificationInfo::
-                          VERIFY_DISABLE_SYMANTEC_ENFORCEMENT);
-  }
+#define COPY_VERIFY_FLAGS(flag)                        \
+  if (verify_flags & net::CertVerifier::VERIFY_##flag) \
+    report_flags->Add(chrome_browser_ssl::TrialVerificationInfo::VERIFY_##flag);
+
+  COPY_VERIFY_FLAGS(REV_CHECKING_ENABLED);
+  COPY_VERIFY_FLAGS(REV_CHECKING_REQUIRED_LOCAL_ANCHORS);
+  COPY_VERIFY_FLAGS(ENABLE_SHA1_LOCAL_ANCHORS);
+  COPY_VERIFY_FLAGS(DISABLE_SYMANTEC_ENFORCEMENT);
+
+#undef COPY_VERIFY_FLAGS
 }
 
 bool CertificateChainToString(const net::X509Certificate& cert,
@@ -123,7 +117,7 @@
 CertificateErrorReport::CertificateErrorReport(
     const std::string& hostname,
     const net::X509Certificate& unverified_cert,
-    const net::CertVerifier::Config& verifier_config,
+    int verify_flags,
     const net::CertVerifyResult& primary_result,
     const net::CertVerifyResult& trial_result)
     : CertificateErrorReport(hostname,
@@ -145,7 +139,7 @@
                               trial_report->mutable_cert_error());
   AddCertStatusToReportStatus(trial_result.cert_status,
                               trial_report->mutable_cert_status());
-  AddVerifyFlagsToReport(verifier_config, trial_report->mutable_verify_flags());
+  AddVerifyFlagsToReport(verify_flags, trial_report->mutable_verify_flags());
 }
 
 CertificateErrorReport::~CertificateErrorReport() {}

diff --git a/chrome/browser/ssl/certificate_error_report.h b/chrome/browser/ssl/certificate_error_report.h
index ab66e3a..e163e839 100644
--- a/chrome/browser/ssl/certificate_error_report.h
+++ b/chrome/browser/ssl/certificate_error_report.h

@@ -11,7 +11,6 @@
 #include "chrome/browser/ssl/cert_logger.pb.h"
 #include "components/version_info/version_info.h"
 #include "net/cert/cert_status_flags.h"
-#include "net/cert/cert_verifier.h"
 
 namespace base {
 class Time;
@@ -63,7 +62,7 @@
   // TODO(mattm): remove this when the trial is done. (https://crbug.com/649026)
   CertificateErrorReport(const std::string& hostname,
                          const net::X509Certificate& unverified_cert,
-                         const net::CertVerifier::Config& config,
+                         int verify_flags,
                          const net::CertVerifyResult& primary_result,
                          const net::CertVerifyResult& trial_result);
 

diff --git a/chrome/browser/ssl/common_name_mismatch_handler.cc b/chrome/browser/ssl/common_name_mismatch_handler.cc
index 37db7700..b873a1a2 100644
--- a/chrome/browser/ssl/common_name_mismatch_handler.cc
+++ b/chrome/browser/ssl/common_name_mismatch_handler.cc

@@ -75,13 +75,11 @@
         })");
 
   auto resource_request = std::make_unique<network::ResourceRequest>();
-  // Can't safely use net::LOAD_DISABLE_CERT_NETWORK_FETCHES here,
+  // Can't safely use net::LOAD_DISABLE_CERT_REVOCATION_CHECKING here,
   // since then the connection may be reused without checking the cert.
   resource_request->url = check_url_;
   resource_request->method = "HEAD";
-  resource_request->load_flags = net::LOAD_DO_NOT_SAVE_COOKIES |
-                                 net::LOAD_DO_NOT_SEND_COOKIES |
-                                 net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->allow_credentials = false;
 
   simple_url_loader_ = network::SimpleURLLoader::Create(
       std::move(resource_request), traffic_annotation);

diff --git a/chrome/browser/ssl/ssl_browsertest.cc b/chrome/browser/ssl/ssl_browsertest.cc
index e334c12..d884e614 100644
--- a/chrome/browser/ssl/ssl_browsertest.cc
+++ b/chrome/browser/ssl/ssl_browsertest.cc

@@ -7331,9 +7331,11 @@
 
   // Adds a dynamic interstitial to |config_proto| and returns it. All of the
   // fields in the dynamic intersitial matches with |https_server_|'s
-  // SSL info.
+  // SSL info. Optionally set the flag for triggering dynamic interstitials
+  // only on non-overridable errors.
   chrome_browser_ssl::DynamicInterstitial* AddMatchingDynamicInterstitial(
-      chrome_browser_ssl::SSLErrorAssistantConfig* config_proto) {
+      chrome_browser_ssl::SSLErrorAssistantConfig* config_proto,
+      bool show_only_for_nonoverridable_errors = false) {
     chrome_browser_ssl::DynamicInterstitial* filter =
         config_proto->add_dynamic_interstitial();
     filter->set_interstitial_type(chrome_browser_ssl::DynamicInterstitial::
@@ -7356,6 +7358,10 @@
     filter->set_mitm_software_name(kTestMITMSoftwareName);
 
     filter->set_support_url("https://google.com");
+
+    filter->set_show_only_for_nonoverridable_errors(
+        show_only_for_nonoverridable_errors);
+
     return filter;
   }
 
@@ -7630,6 +7636,39 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(SSLUIDynamicInterstitialTest, MismatchWhenOverridable) {
+  ASSERT_TRUE(https_server()->Start());
+
+  SetUpCertVerifier();
+
+  WebContents* tab = browser()->tab_strip_model()->GetActiveWebContents();
+
+  {
+    std::unique_ptr<chrome_browser_ssl::SSLErrorAssistantConfig> config_proto =
+        CreateSSLErrorAssistantConfig();
+    AddMismatchDynamicInterstitial(config_proto.get());
+
+    // Add a matching dynamic interstitial, except for the
+    // show_only_for_nonoverridable_errors flag is set to true.
+    chrome_browser_ssl::DynamicInterstitial* match =
+        AddMatchingDynamicInterstitial(config_proto.get(), true);
+    match->set_cert_error(
+        chrome_browser_ssl::DynamicInterstitial::UNKNOWN_CERT_ERROR);
+
+    SSLErrorHandler::SetErrorAssistantProto(std::move(config_proto));
+    ASSERT_TRUE(SSLErrorHandler::GetErrorAssistantProtoVersionIdForTesting() >
+                0);
+
+    ui_test_utils::NavigateToURL(browser(), https_server()->GetURL("/"));
+    WaitForInterstitial(tab);
+
+    InterstitialPage* interstitial_page = tab->GetInterstitialPage();
+    ASSERT_TRUE(interstitial_page);
+    EXPECT_NE(CaptivePortalBlockingPage::kTypeForTesting,
+              interstitial_page->GetDelegateForTesting()->GetTypeForTesting());
+  }
+}
+
 using SSLHPKPBrowserTest = CertVerifierBrowserTest;
 
 // Test case where an HPKP report is sent.

diff --git a/chrome/browser/ssl/ssl_config_service_manager_pref.cc b/chrome/browser/ssl/ssl_config_service_manager_pref.cc
index bf28ee9..f95bd9dd 100644
--- a/chrome/browser/ssl/ssl_config_service_manager_pref.cc
+++ b/chrome/browser/ssl/ssl_config_service_manager_pref.cc

@@ -24,7 +24,6 @@
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "mojo/public/cpp/bindings/interface_ptr_set.h"
-#include "net/cert/cert_verifier.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_config_service.h"
 #include "url/url_canon.h"
@@ -229,18 +228,14 @@
 // static
 void SSLConfigServiceManagerPref::RegisterPrefs(PrefRegistrySimple* registry) {
   net::SSLConfig default_config;
-  net::CertVerifier::Config default_verifier_config;
   registry->RegisterBooleanPref(prefs::kCertRevocationCheckingEnabled,
-                                default_verifier_config.enable_rev_checking);
+                                default_config.rev_checking_enabled);
   registry->RegisterBooleanPref(
       prefs::kCertRevocationCheckingRequiredLocalAnchors,
-      default_verifier_config.require_rev_checking_local_anchors);
-  registry->RegisterBooleanPref(
-      prefs::kCertEnableSha1LocalAnchors,
-      default_verifier_config.enable_sha1_local_anchors);
-  registry->RegisterBooleanPref(
-      prefs::kCertEnableSymantecLegacyInfrastructure,
-      default_verifier_config.disable_symantec_enforcement);
+      default_config.rev_checking_required_local_anchors);
+  registry->RegisterBooleanPref(prefs::kCertEnableSha1LocalAnchors, false);
+  registry->RegisterBooleanPref(prefs::kCertEnableSymantecLegacyInfrastructure,
+                                default_config.symantec_enforcement_disabled);
   registry->RegisterStringPref(prefs::kSSLVersionMin, std::string());
   registry->RegisterStringPref(prefs::kSSLVersionMax, std::string());
   registry->RegisterStringPref(prefs::kTLS13Variant, std::string());

diff --git a/chrome/browser/ssl/ssl_config_service_manager_pref_unittest.cc b/chrome/browser/ssl/ssl_config_service_manager_pref_unittest.cc
index bbba430..74cadbc2 100644
--- a/chrome/browser/ssl/ssl_config_service_manager_pref_unittest.cc
+++ b/chrome/browser/ssl/ssl_config_service_manager_pref_unittest.cc

@@ -16,7 +16,6 @@
 #include "components/prefs/testing_pref_service.h"
 #include "components/variations/variations_params_manager.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "net/cert/cert_verifier.h"
 #include "net/ssl/ssl_config.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/ssl_config.mojom.h"
@@ -365,7 +364,7 @@
 
   // By default, SHA-1 local trust anchors should not be enabled when not
   // not using any pref service.
-  EXPECT_FALSE(net::CertVerifier::Config().enable_sha1_local_anchors);
+  EXPECT_FALSE(net::SSLConfig().sha1_local_anchors_enabled);
   EXPECT_FALSE(network::mojom::SSLConfig::New()->sha1_local_anchors_enabled);
 
   // Using a pref service without any preference set should result in
@@ -403,7 +402,7 @@
 
   // By default, Symantec's legacy infrastructure should be disabled when
   // not using any pref service.
-  EXPECT_FALSE(net::CertVerifier::Config().disable_symantec_enforcement);
+  EXPECT_FALSE(net::SSLConfig().symantec_enforcement_disabled);
   EXPECT_FALSE(network::mojom::SSLConfig::New()->symantec_enforcement_disabled);
 
   // Using a pref service without any preference set should result in

diff --git a/chrome/browser/ssl/ssl_error_assistant.cc b/chrome/browser/ssl/ssl_error_assistant.cc
index 2ff236a..6b37592 100644
--- a/chrome/browser/ssl/ssl_error_assistant.cc
+++ b/chrome/browser/ssl/ssl_error_assistant.cc

@@ -116,7 +116,8 @@
         HashesFromDynamicInterstitial(entry), entry.issuer_common_name_regex(),
         entry.issuer_organization_regex(), entry.mitm_software_name(),
         entry.interstitial_type(), MapToCertStatus(entry.cert_error()),
-        GURL(entry.support_url())));
+        GURL(entry.support_url()),
+        entry.show_only_for_nonoverridable_errors()));
   }
 
   return dynamic_interstitial_list;
@@ -178,14 +179,17 @@
     chrome_browser_ssl::DynamicInterstitial::InterstitialPageType
         interstitial_type,
     int cert_error,
-    const GURL& support_url)
+    const GURL& support_url,
+    bool show_only_for_nonoverridable_errors)
     : spki_hashes(spki_hashes),
       issuer_common_name_regex(issuer_common_name_regex),
       issuer_organization_regex(issuer_organization_regex),
       mitm_software_name(mitm_software_name),
       interstitial_type(interstitial_type),
       cert_error(cert_error),
-      support_url(support_url) {}
+      support_url(support_url),
+      show_only_for_nonoverridable_errors(show_only_for_nonoverridable_errors) {
+}
 
 DynamicInterstitialInfo::~DynamicInterstitialInfo() {}
 
@@ -210,7 +214,8 @@
 }
 
 base::Optional<DynamicInterstitialInfo>
-SSLErrorAssistant::MatchDynamicInterstitial(const net::SSLInfo& ssl_info) {
+SSLErrorAssistant::MatchDynamicInterstitial(const net::SSLInfo& ssl_info,
+                                            bool is_overridable) {
   // Load the dynamic interstitial data from SSL error assistant proto if it's
   // not already loaded.
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
@@ -244,6 +249,12 @@
       continue;
     }
 
+    // Don't match the entry if it's only intended for non-overridable
+    // errors, but the current error is overridable.
+    if (data.show_only_for_nonoverridable_errors && is_overridable) {
+      continue;
+    }
+
     return data;
   }
 

diff --git a/chrome/browser/ssl/ssl_error_assistant.h b/chrome/browser/ssl/ssl_error_assistant.h
index e517f26..a52d364 100644
--- a/chrome/browser/ssl/ssl_error_assistant.h
+++ b/chrome/browser/ssl/ssl_error_assistant.h

@@ -41,7 +41,8 @@
       chrome_browser_ssl::DynamicInterstitial::InterstitialPageType
           interstitial_type,
       int cert_error,
-      const GURL& support_url);
+      const GURL& support_url,
+      bool show_only_for_nonoverridable_errors);
 
   DynamicInterstitialInfo(const DynamicInterstitialInfo& other);
 
@@ -55,6 +56,7 @@
       interstitial_type;
   const int cert_error;
   const GURL support_url;
+  bool show_only_for_nonoverridable_errors;
 };
 
 // Helper class for SSLErrorHandler. This class is responsible for reading in
@@ -80,7 +82,8 @@
   // matches with |ssl_info|. If there is no match, returns null. Loads
   // |dynamic_interstitial_list_| on the first use.
   base::Optional<DynamicInterstitialInfo> MatchDynamicInterstitial(
-      const net::SSLInfo& ssl_info);
+      const net::SSLInfo& ssl_info,
+      bool is_overridable = false);
 
   void SetErrorAssistantProto(
       std::unique_ptr<chrome_browser_ssl::SSLErrorAssistantConfig> proto);

diff --git a/chrome/browser/ssl/ssl_error_assistant.proto b/chrome/browser/ssl/ssl_error_assistant.proto
index 252745af..cbd7746 100644
--- a/chrome/browser/ssl/ssl_error_assistant.proto
+++ b/chrome/browser/ssl/ssl_error_assistant.proto

@@ -106,6 +106,10 @@
 
   // The support URL that will be displayed on the interstitial.
   optional string support_url = 7;
+
+  // If true, dynamic interstitials will be displayed only for non-overridable
+  // errors.
+  optional bool show_only_for_nonoverridable_errors = 8;
 }
 
 message SSLErrorAssistantConfig {

diff --git a/chrome/browser/ssl/ssl_error_assistant_unittest.cc b/chrome/browser/ssl/ssl_error_assistant_unittest.cc
index 6575c50..88b9e0b 100644
--- a/chrome/browser/ssl/ssl_error_assistant_unittest.cc
+++ b/chrome/browser/ssl/ssl_error_assistant_unittest.cc

@@ -612,3 +612,36 @@
   error_assistant()->SetErrorAssistantProto(std::move(config_proto));
   EXPECT_FALSE(error_assistant()->MatchDynamicInterstitial(ssl_info()));
 }
+
+// Tests that a dynamic interstitial is not triggered if the error thrown
+// is overridable and the show_only_for_nonoverridable_errors flag is set.
+TEST_F(SSLErrorAssistantTest, DynamicInterstitialListOverridable) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  EXPECT_EQ(1u, ssl_info().public_key_hashes.size());
+
+  auto config_proto =
+      std::make_unique<chrome_browser_ssl::SSLErrorAssistantConfig>();
+  config_proto->set_version_id(kLargeVersionId);
+
+  // Add a dynamic interstitial that would match, except that the
+  // show_only_for_nonoverridable_errors flag is set.
+  chrome_browser_ssl::DynamicInterstitial* filter =
+      config_proto->add_dynamic_interstitial();
+  filter->set_interstitial_type(
+      chrome_browser_ssl::DynamicInterstitial::INTERSTITIAL_PAGE_SSL);
+  filter->set_cert_error(
+      chrome_browser_ssl::DynamicInterstitial::ERR_CERT_COMMON_NAME_INVALID);
+  filter->add_sha256_hash("sha256/nuthatch");
+  filter->add_sha256_hash(ssl_info().public_key_hashes[0].ToString());
+  filter->add_sha256_hash("sha256/treecreeper");
+
+  filter->set_mitm_software_name("UwS");
+  filter->set_issuer_common_name_regex("[0-9]+.0.[0-9]+.1");
+  filter->set_issuer_organization_regex("T[a-z]+t CA");
+
+  filter->set_show_only_for_nonoverridable_errors(true);
+
+  error_assistant()->SetErrorAssistantProto(std::move(config_proto));
+
+  EXPECT_FALSE(error_assistant()->MatchDynamicInterstitial(ssl_info(), true));
+}

diff --git a/chrome/browser/ssl/ssl_error_handler.cc b/chrome/browser/ssl/ssl_error_handler.cc
index 4e239ed9..8a66c87 100644
--- a/chrome/browser/ssl/ssl_error_handler.cc
+++ b/chrome/browser/ssl/ssl_error_handler.cc

@@ -216,7 +216,8 @@
   // Returns a DynamicInterstitialInfo that matches with |ssl_info|. If is no
   // match, return null.
   base::Optional<DynamicInterstitialInfo> MatchDynamicInterstitial(
-      const net::SSLInfo& ssl_info);
+      const net::SSLInfo& ssl_info,
+      bool is_overridable);
 
   // Testing methods:
   void ResetForTesting();
@@ -407,8 +408,10 @@
 }
 
 base::Optional<DynamicInterstitialInfo>
-ConfigSingleton::MatchDynamicInterstitial(const net::SSLInfo& ssl_info) {
-  return ssl_error_assistant_->MatchDynamicInterstitial(ssl_info);
+ConfigSingleton::MatchDynamicInterstitial(const net::SSLInfo& ssl_info,
+                                          bool is_overridable) {
+  return ssl_error_assistant_->MatchDynamicInterstitial(ssl_info,
+                                                        is_overridable);
 }
 
 class SSLErrorHandlerDelegateImpl : public SSLErrorHandler::Delegate {
@@ -760,7 +763,8 @@
   }
 
   base::Optional<DynamicInterstitialInfo> dynamic_interstitial =
-      g_config.Pointer()->MatchDynamicInterstitial(ssl_info_);
+      g_config.Pointer()->MatchDynamicInterstitial(
+          ssl_info_, delegate_->IsErrorOverridable());
   if (dynamic_interstitial) {
     ShowDynamicInterstitial(dynamic_interstitial.value());
     return;

diff --git a/chrome/browser/ui/views/hover_button.cc b/chrome/browser/ui/views/hover_button.cc
index e49bfde..66d3d6f 100644
--- a/chrome/browser/ui/views/hover_button.cc
+++ b/chrome/browser/ui/views/hover_button.cc

@@ -69,6 +69,7 @@
     : views::MenuButton(text, this, false),
       title_(nullptr),
       subtitle_(nullptr),
+      icon_view_(nullptr),
       secondary_icon_view_(nullptr),
       listener_(button_listener) {
   SetFocusBehavior(FocusBehavior::ALWAYS);
@@ -142,6 +143,7 @@
   taken_width_ = GetInsets().width() + icon_view->GetPreferredSize().width() +
                  icon_label_spacing;
 
+  icon_view_ = icon_view.get();
   // Make sure hovering over the icon also hovers the |HoverButton|.
   icon_view->set_can_process_events_within_subtree(false);
   // Don't cover |icon_view| when the ink drops are being painted. |MenuButton|

diff --git a/chrome/browser/ui/views/hover_button.h b/chrome/browser/ui/views/hover_button.h
index caab4f7..0adccde 100644
--- a/chrome/browser/ui/views/hover_button.h
+++ b/chrome/browser/ui/views/hover_button.h

@@ -107,9 +107,13 @@
   views::View* GetTooltipHandlerForPoint(const gfx::Point& point) override;
   void OnBoundsChanged(const gfx::Rect& previous_bounds) override;
 
+  views::StyledLabel* title() const { return title_; }
+  views::View* icon_view() const { return icon_view_; }
+
  private:
   views::StyledLabel* title_;
   views::Label* subtitle_;
+  views::View* icon_view_;
   views::View* secondary_icon_view_;
 
   // The horizontal space the padding and icon take up. Used for calculating the

diff --git a/chrome/browser/ui/views/media_router/cast_dialog_sink_button.cc b/chrome/browser/ui/views/media_router/cast_dialog_sink_button.cc
index 2e8814e..8c0edfe 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_sink_button.cc
+++ b/chrome/browser/ui/views/media_router/cast_dialog_sink_button.cc

@@ -14,6 +14,7 @@
 #include "ui/gfx/color_palette.h"
 #include "ui/gfx/paint_vector_icon.h"
 #include "ui/views/animation/ink_drop_impl.h"
+#include "ui/views/controls/styled_label.h"
 #include "ui/views/controls/throbber.h"
 #include "ui/views/vector_icons.h"
 
@@ -25,7 +26,7 @@
 
 namespace {
 
-gfx::ImageSkia CreateSinkIcon(SinkIconType icon_type) {
+gfx::ImageSkia CreateSinkIcon(SinkIconType icon_type, bool enabled = true) {
   const gfx::VectorIcon* vector_icon;
   switch (icon_type) {
     case SinkIconType::CAST_AUDIO_GROUP:
@@ -56,9 +57,13 @@
       vector_icon = &kTvIcon;
       break;
   }
-  return gfx::CreateVectorIcon(*vector_icon,
-                               CastDialogSinkButton::kPrimaryIconSize,
-                               gfx::kChromeIconGrey);
+  SkColor icon_color = enabled ? gfx::kChromeIconGrey : gfx::kGoogleGrey500;
+  return gfx::CreateVectorIcon(
+      *vector_icon, CastDialogSinkButton::kPrimaryIconSize, icon_color);
+}
+
+gfx::ImageSkia CreateDisabledSinkIcon(SinkIconType icon_type) {
+  return CreateSinkIcon(icon_type, false);
 }
 
 std::unique_ptr<views::View> CreatePrimaryIconForSink(const UIMediaSink& sink) {
@@ -92,6 +97,8 @@
 }
 
 base::string16 GetStatusTextForSink(const UIMediaSink& sink) {
+  if (sink.issue)
+    return base::UTF8ToUTF16(sink.issue->info().title);
   if (!sink.status_text.empty())
     return sink.status_text;
   switch (sink.state) {
@@ -158,6 +165,26 @@
   return handled_event;
 }
 
+void CastDialogSinkButton::OnEnabledChanged() {
+  HoverButton::OnEnabledChanged();
+  SkColor background_color = GetNativeTheme()->GetSystemColor(
+      ui::NativeTheme::kColorId_ProminentButtonColor);
+  if (enabled()) {
+    SetTitleTextStyle(views::style::STYLE_PRIMARY, background_color);
+    if (sink_.state == UIMediaSinkState::AVAILABLE) {
+      static_cast<views::ImageView*>(icon_view())
+          ->SetImage(CreateSinkIcon(sink_.icon_type));
+    }
+  } else {
+    SetTitleTextStyle(views::style::STYLE_DISABLED, background_color);
+    if (sink_.state == UIMediaSinkState::AVAILABLE) {
+      static_cast<views::ImageView*>(icon_view())
+          ->SetImage(CreateDisabledSinkIcon(sink_.icon_type));
+    }
+  }
+  title()->Layout();
+}
+
 std::unique_ptr<views::InkDrop> CastDialogSinkButton::CreateInkDrop() {
   auto ink_drop = HoverButton::CreateInkDrop();
   // Without overriding this value, the ink drop would fade in (as opposed to

diff --git a/chrome/browser/ui/views/media_router/cast_dialog_sink_button.h b/chrome/browser/ui/views/media_router/cast_dialog_sink_button.h
index 2a86cd6..1871c726 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_sink_button.h
+++ b/chrome/browser/ui/views/media_router/cast_dialog_sink_button.h

@@ -38,6 +38,9 @@
   bool OnMousePressed(const ui::MouseEvent& event) override;
   void OnMouseReleased(const ui::MouseEvent& event) override;
   bool OnKeyPressed(const ui::KeyEvent& event) override;
+  void OnEnabledChanged() override;
+
+  // views::InkDropHostView:
   std::unique_ptr<views::InkDrop> CreateInkDrop() override;
 
   // Returns the text that should be shown on the main action button of the Cast

diff --git a/chrome/browser/ui/views/media_router/cast_dialog_view.cc b/chrome/browser/ui/views/media_router/cast_dialog_view.cc
index 13f6020..835f6b6 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_view.cc
+++ b/chrome/browser/ui/views/media_router/cast_dialog_view.cc

@@ -48,15 +48,6 @@
 // presenting and mirroring a tab.
 constexpr int kTabSource = PRESENTATION | TAB_MIRROR;
 
-bool SupportsTabSource(const UIMediaSink& sink) {
-  return base::ContainsKey(sink.cast_modes, PRESENTATION) ||
-         base::ContainsKey(sink.cast_modes, TAB_MIRROR);
-}
-
-bool SupportsDesktopSource(const UIMediaSink& sink) {
-  return base::ContainsKey(sink.cast_modes, DESKTOP_MIRROR);
-}
-
 }  // namespace
 
 // static
@@ -142,15 +133,12 @@
     controller_->StopCasting(sink.route_id);
     metrics_.OnStopCasting();
   } else {
-    // Go through cast modes in the order of preference to find one that is
-    // supported and selected.
-    for (MediaCastMode cast_mode : {PRESENTATION, TAB_MIRROR, DESKTOP_MIRROR}) {
-      if ((cast_mode & selected_source_) &&
-          base::ContainsKey(sink.cast_modes, cast_mode)) {
-        controller_->StartCasting(sink.id, cast_mode);
-        metrics_.OnStartCasting(base::Time::Now(), selected_sink_index_);
-        break;
-      }
+    base::Optional<MediaCastMode> cast_mode = GetCastModeToUse(sink);
+    // TODO(takumif): Once we allow casting by clicking on a sink button,
+    // |cast_mode| should always be set, so no check would be necessary.
+    if (cast_mode) {
+      controller_->StartCasting(sink.id, cast_mode.value());
+      metrics_.OnStartCasting(base::Time::Now(), selected_sink_index_);
     }
   }
   return false;
@@ -164,6 +152,8 @@
   if (model.media_sinks().empty()) {
     scroll_position_ = 0;
     ShowNoSinksView();
+    if (sources_button_)
+      sources_button_->SetEnabled(false);
   } else {
     // If |sink_buttons_| is empty, the sink list was empty before this update.
     // In that case, select the first active sink, so that its session can be
@@ -177,6 +167,9 @@
     PopulateScrollView(model.media_sinks());
     RestoreSinkListState();
     metrics_.OnSinksLoaded(base::Time::Now());
+    if (sources_button_)
+      sources_button_->SetEnabled(true);
+    DisableUnsupportedSinks();
   }
   dialog_title_ = model.dialog_header();
   MaybeSizeToContents();
@@ -218,6 +211,7 @@
 
 void CastDialogView::ExecuteCommand(int command_id, int event_flags) {
   selected_source_ = command_id;
+  DisableUnsupportedSinks();
   metrics_.OnCastModeSelected();
 }
 
@@ -339,14 +333,11 @@
 }
 
 void CastDialogView::ShowSourcesMenu() {
-  sources_menu_model_ = std::make_unique<ui::SimpleMenuModel>(this);
-  const UIMediaSink& sink = GetSelectedSink();
+  if (!sources_menu_model_) {
+    sources_menu_model_ = std::make_unique<ui::SimpleMenuModel>(this);
 
-  if (SupportsTabSource(sink)) {
     sources_menu_model_->AddCheckItemWithStringId(
         kTabSource, IDS_MEDIA_ROUTER_TAB_MIRROR_CAST_MODE);
-  }
-  if (SupportsDesktopSource(sink)) {
     sources_menu_model_->AddCheckItemWithStringId(
         DESKTOP_MIRROR, IDS_MEDIA_ROUTER_DESKTOP_MIRROR_CAST_MODE);
   }
@@ -359,16 +350,6 @@
                                   ui::MENU_SOURCE_MOUSE);
 }
 
-void CastDialogView::UpdateSourcesMenu(const UIMediaSink& sink) {
-  bool supports_desktop_source = SupportsDesktopSource(sink);
-  // If desktop mirroring is supported, show the sources menu button so that
-  // the user can switch sources.
-  if (sources_button_)
-    sources_button_->SetEnabled(supports_desktop_source);
-  if (!supports_desktop_source && selected_source_ == DESKTOP_MIRROR)
-    selected_source_ = kTabSource;
-}
-
 void CastDialogView::SelectSinkAtIndex(size_t index) {
   if (selected_sink_index_ != index &&
       selected_sink_index_ < sink_buttons_.size()) {
@@ -378,7 +359,6 @@
   selected_button->SetSelected(true);
   selected_sink_index_ = index;
 
-  UpdateSourcesMenu(selected_button->sink());
   // Update the text on the main action button.
   DialogModelChanged();
 }
@@ -394,6 +374,25 @@
     SizeToContents();
 }
 
+base::Optional<MediaCastMode> CastDialogView::GetCastModeToUse(
+    const UIMediaSink& sink) const {
+  // Go through cast modes in the order of preference to find one that is
+  // supported and selected.
+  for (MediaCastMode cast_mode : {PRESENTATION, TAB_MIRROR, DESKTOP_MIRROR}) {
+    if ((cast_mode & selected_source_) &&
+        base::ContainsKey(sink.cast_modes, cast_mode)) {
+      return cast_mode;
+    }
+  }
+  return base::nullopt;
+}
+
+void CastDialogView::DisableUnsupportedSinks() {
+  for (CastDialogSinkButton* sink_button : sink_buttons_) {
+    sink_button->SetEnabled(GetCastModeToUse(sink_button->sink()).has_value());
+  }
+}
+
 void CastDialogView::RecordSinkCountWithDelay() {
   // Record the number of sinks after three seconds. This is consistent with the
   // WebUI dialog.

diff --git a/chrome/browser/ui/views/media_router/cast_dialog_view.h b/chrome/browser/ui/views/media_router/cast_dialog_view.h
index 2d87c302..7dadce1 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_view.h
+++ b/chrome/browser/ui/views/media_router/cast_dialog_view.h

@@ -138,15 +138,20 @@
   // Shows the sources menu that allows the user to choose a source to cast.
   void ShowSourcesMenu();
 
-  // Populates the sources menu with the sources supported by |sink|.
-  void UpdateSourcesMenu(const UIMediaSink& sink);
-
   void SelectSinkAtIndex(size_t index);
 
   const UIMediaSink& GetSelectedSink() const;
 
   void MaybeSizeToContents();
 
+  // Returns the cast mode that is selected in the sources menu and supported by
+  // |sink|. Returns nullopt if no such cast mode exists.
+  base::Optional<MediaCastMode> GetCastModeToUse(const UIMediaSink& sink) const;
+
+  // Disables sink buttons for sinks that do not support the currently selected
+  // source.
+  void DisableUnsupportedSinks();
+
   // Posts a delayed task to record the number of sinks shown with the metrics
   // recorder.
   void RecordSinkCountWithDelay();

diff --git a/chrome/browser/ui/views/media_router/cast_dialog_view_unittest.cc b/chrome/browser/ui/views/media_router/cast_dialog_view_unittest.cc
index 15d6bf1..91e98b4 100644
--- a/chrome/browser/ui/views/media_router/cast_dialog_view_unittest.cc
+++ b/chrome/browser/ui/views/media_router/cast_dialog_view_unittest.cc

@@ -113,13 +113,17 @@
   void SelectSinkAtIndex(int index) {
     ui::MouseEvent mouse_event(ui::ET_MOUSE_PRESSED, gfx::Point(0, 0),
                                gfx::Point(0, 0), ui::EventTimeForNow(), 0, 0);
-    dialog_->ButtonPressed(dialog_->sink_buttons_for_test()[1], mouse_event);
+    dialog_->ButtonPressed(sink_buttons().at(index), mouse_event);
   }
 
   size_t selected_sink_index() {
     return dialog_->selected_sink_index_for_test();
   }
 
+  const std::vector<CastDialogSinkButton*>& sink_buttons() {
+    return dialog_->sink_buttons_for_test();
+  }
+
   views::ScrollView* scroll_view() { return dialog_->scroll_view_for_test(); }
 
   views::View* no_sinks_view() { return dialog_->no_sinks_view_for_test(); }
@@ -226,7 +230,7 @@
   dialog_->Accept();
 }
 
-TEST_F(CastDialogViewTest, ShowAlternativeSources) {
+TEST_F(CastDialogViewTest, ShowSourcesMenu) {
   std::vector<UIMediaSink> media_sinks = {CreateAvailableSink()};
   media_sinks[0].cast_modes = {TAB_MIRROR, PRESENTATION, DESKTOP_MIRROR};
   CastDialogModel model = CreateModelWithSinks(media_sinks);
@@ -239,10 +243,8 @@
   EXPECT_EQ(PRESENTATION | TAB_MIRROR, sources_menu_model()->GetCommandIdAt(0));
   EXPECT_EQ(DESKTOP_MIRROR, sources_menu_model()->GetCommandIdAt(1));
 
-  // When there are no alternative sources, the sources button should be
-  // disabled.
-  media_sinks[0].cast_modes = {TAB_MIRROR};
-  model.set_media_sinks(std::move(media_sinks));
+  // When there are no sinks, the sources button should be disabled.
+  model.set_media_sinks({});
   dialog_->OnModelUpdated(model);
   EXPECT_FALSE(sources_button()->enabled());
 }
@@ -267,19 +269,29 @@
   dialog_->Accept();
 }
 
-TEST_F(CastDialogViewTest, DisableAlternativeSourcesPicker) {
-  CastDialogModel model;
+TEST_F(CastDialogViewTest, DisableUnsupportedSinks) {
+  std::vector<UIMediaSink> media_sinks = {CreateAvailableSink(),
+                                          CreateAvailableSink()};
+  media_sinks[1].id = "sink_2";
+  media_sinks[0].cast_modes = {TAB_MIRROR};
+  media_sinks[1].cast_modes = {PRESENTATION, DESKTOP_MIRROR};
+  CastDialogModel model = CreateModelWithSinks(std::move(media_sinks));
   InitializeDialogWithModel(model);
-  // The picker should be disabled when there are no sinks.
-  EXPECT_FALSE(sources_button()->enabled());
 
-  std::vector<UIMediaSink> media_sinks = {CreateConnectedSink()};
-  media_sinks[0].cast_modes = {TAB_MIRROR, PRESENTATION};
-  model.set_media_sinks(std::move(media_sinks));
-  dialog_->OnModelUpdated(model);
-  // The picker should be disabled if the selected sink doesn't support non-tab
-  // sources.
-  EXPECT_FALSE(sources_button()->enabled());
+  dialog_->ButtonPressed(sources_button(), CreateMouseEvent());
+  EXPECT_EQ(DESKTOP_MIRROR, sources_menu_model()->GetCommandIdAt(1));
+  sources_menu_model()->ActivatedAt(1);
+  // Sink at index 0 doesn't support desktop mirroring, so it should be
+  // disabled.
+  EXPECT_FALSE(sink_buttons().at(0)->enabled());
+  EXPECT_TRUE(sink_buttons().at(1)->enabled());
+
+  dialog_->ButtonPressed(sources_button(), CreateMouseEvent());
+  EXPECT_EQ(PRESENTATION | TAB_MIRROR, sources_menu_model()->GetCommandIdAt(0));
+  sources_menu_model()->ActivatedAt(0);
+  // Both sinks support tab or presentation casting, so they should be enabled.
+  EXPECT_TRUE(sink_buttons().at(0)->enabled());
+  EXPECT_TRUE(sink_buttons().at(1)->enabled());
 }
 
 TEST_F(CastDialogViewTest, ShowNoDeviceView) {

diff --git a/chrome/browser/ui/views/webauthn/sheet_view_factory.cc b/chrome/browser/ui/views/webauthn/sheet_view_factory.cc
index b02567c2..8511661 100644
--- a/chrome/browser/ui/views/webauthn/sheet_view_factory.cc
+++ b/chrome/browser/ui/views/webauthn/sheet_view_factory.cc

@@ -90,6 +90,10 @@
       sheet_view = std::make_unique<AuthenticatorRequestSheetView>(
           std::make_unique<AuthenticatorBleActivateSheetModel>(dialog_model));
       break;
+    case Step::kTouchId:
+      sheet_view = std::make_unique<AuthenticatorRequestSheetView>(
+          std::make_unique<AuthenticatorTouchIdSheetModel>(dialog_model));
+      break;
     case Step::kCompleted:
     case Step::kBlePowerOnAutomatic:
       sheet_view = std::make_unique<AuthenticatorRequestSheetView>(

diff --git a/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc b/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc
index 3475c22..a91aaf11 100644
--- a/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc
+++ b/chrome/browser/ui/webauthn/authenticator_dialog_browsertest.cc

@@ -64,6 +64,8 @@
     } else if (name == "ble_activate") {
       model->SetCurrentStep(
           AuthenticatorRequestDialogModel::Step::kBleActivate);
+    } else if (name == "touchid") {
+      model->SetCurrentStep(AuthenticatorRequestDialogModel::Step::kTouchId);
     }
 
     ShowAuthenticatorRequestDialog(
@@ -129,3 +131,7 @@
 IN_PROC_BROWSER_TEST_F(AuthenticatorDialogTest, InvokeUi_ble_activate) {
   ShowAndVerifyUi();
 }
+
+IN_PROC_BROWSER_TEST_F(AuthenticatorDialogTest, InvokeUi_touchid) {
+  ShowAndVerifyUi();
+}

diff --git a/chrome/browser/ui/webauthn/sheet_models.cc b/chrome/browser/ui/webauthn/sheet_models.cc
index ee3b277..b18cf28 100644
--- a/chrome/browser/ui/webauthn/sheet_models.cc
+++ b/chrome/browser/ui/webauthn/sheet_models.cc

@@ -8,6 +8,7 @@
 
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
+#include "build/build_config.h"
 #include "chrome/grit/browser_resources.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/strings/grit/components_strings.h"
@@ -354,3 +355,30 @@
 base::string16 AuthenticatorBleActivateSheetModel::GetStepDescription() const {
   return l10n_util::GetStringUTF16(IDS_WEBAUTHN_BLE_ACTIVATE_DESCRIPTION);
 }
+
+// AuthenticatorTouchIdSheetModel -----------------------------------------
+
+gfx::ImageSkia* AuthenticatorTouchIdSheetModel::GetStepIllustration() const {
+#if defined(OS_MACOSX)
+  return GetImage(IDR_WEBAUTHN_ILLUSTRATION_TOUCHID_1X);
+#else
+  // Avoid bundling the PNG on platforms where it's not needed.
+  return nullptr;
+#endif  // defined(OS_MACOSX)
+}
+
+base::string16 AuthenticatorTouchIdSheetModel::GetStepTitle() const {
+#if defined(OS_MACOSX)
+  // TODO(martinkr): Insert actual domain name from model to
+  // |application_name|.
+  base::string16 application_name = base::UTF8ToUTF16("example.com");
+  return l10n_util::GetStringFUTF16(IDS_WEBAUTHN_TOUCH_ID_TITLE,
+                                    application_name);
+#else
+  return base::string16();
+#endif  // defined(OS_MACOSX)
+}
+
+base::string16 AuthenticatorTouchIdSheetModel::GetStepDescription() const {
+  return base::string16();
+}

diff --git a/chrome/browser/ui/webauthn/sheet_models.h b/chrome/browser/ui/webauthn/sheet_models.h
index 59073d6..4a81dedf 100644
--- a/chrome/browser/ui/webauthn/sheet_models.h
+++ b/chrome/browser/ui/webauthn/sheet_models.h

@@ -208,4 +208,15 @@
   base::string16 GetStepDescription() const override;
 };
 
+class AuthenticatorTouchIdSheetModel : public AuthenticatorSheetModelBase {
+ public:
+  using AuthenticatorSheetModelBase::AuthenticatorSheetModelBase;
+
+ private:
+  // AuthenticatorSheetModelBase:
+  gfx::ImageSkia* GetStepIllustration() const override;
+  base::string16 GetStepTitle() const override;
+  base::string16 GetStepDescription() const override;
+};
+
 #endif  // CHROME_BROWSER_UI_WEBAUTHN_SHEET_MODELS_H_

diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index fd023e9..563b0c5 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

@@ -1937,6 +1937,9 @@
       {"enableContentProtectionAttestation",
        IDS_SETTINGS_ENABLE_CONTENT_PROTECTION_ATTESTATION},
       {"wakeOnWifi", IDS_SETTINGS_WAKE_ON_WIFI_DESCRIPTION},
+      {"enableAppListContinueReading", IDS_SETTINGS_APP_LIST_CONTINUE_READING},
+      {"enableAppListContinueReadingDescription",
+       IDS_SETTINGS_APP_LIST_CONTINUE_READING_DESCRIPTION},
       {"manageCertificates", IDS_SETTINGS_MANAGE_CERTIFICATES},
       {"manageCertificatesDescription",
        IDS_SETTINGS_MANAGE_CERTIFICATES_DESCRIPTION},
@@ -2350,11 +2353,16 @@
      IDS_SETTINGS_SITE_SETTINGS_ASK_DEFAULT_MENU},
     {"siteSettingsActionAllowDefault",
      IDS_SETTINGS_SITE_SETTINGS_ALLOW_DEFAULT_MENU},
+    {"siteSettingsActionAutomaticDefault",
+     IDS_SETTINGS_SITE_SETTINGS_AUTOMATIC_DEFAULT_MENU},
     {"siteSettingsActionBlockDefault",
      IDS_SETTINGS_SITE_SETTINGS_BLOCK_DEFAULT_MENU},
+    {"siteSettingsActionMuteDefault",
+     IDS_SETTINGS_SITE_SETTINGS_MUTE_DEFAULT_MENU},
     {"siteSettingsActionAllow", IDS_SETTINGS_SITE_SETTINGS_ALLOW_MENU},
     {"siteSettingsActionBlock", IDS_SETTINGS_SITE_SETTINGS_BLOCK_MENU},
     {"siteSettingsActionAsk", IDS_SETTINGS_SITE_SETTINGS_ASK_MENU},
+    {"siteSettingsActionMute", IDS_SETTINGS_SITE_SETTINGS_MUTE_MENU},
     {"siteSettingsActionReset", IDS_SETTINGS_SITE_SETTINGS_RESET_MENU},
     {"siteSettingsActionSessionOnly",
      IDS_SETTINGS_SITE_SETTINGS_SESSION_ONLY_MENU},

diff --git a/chrome/browser/ui/webui/settings/site_settings_handler.cc b/chrome/browser/ui/webui/settings/site_settings_handler.cc
index 002c2cc..04422c78 100644
--- a/chrome/browser/ui/webui/settings/site_settings_handler.cc
+++ b/chrome/browser/ui/webui/settings/site_settings_handler.cc

@@ -277,6 +277,10 @@
       "setBlockAutoplayEnabled",
       base::BindRepeating(&SiteSettingsHandler::HandleSetBlockAutoplayEnabled,
                           base::Unretained(this)));
+  web_ui()->RegisterMessageCallback(
+      "fetchBlockAutoplayStatus",
+      base::BindRepeating(&SiteSettingsHandler::HandleFetchBlockAutoplayStatus,
+                          base::Unretained(this)));
 }
 
 void SiteSettingsHandler::OnJavascriptAllowed() {
@@ -1140,6 +1144,12 @@
   host_zoom_map->SetZoomLevelForHost(origin, default_level);
 }
 
+void SiteSettingsHandler::HandleFetchBlockAutoplayStatus(
+    const base::ListValue* args) {
+  AllowJavascript();
+  SendBlockAutoplayStatus();
+}
+
 void SiteSettingsHandler::SendBlockAutoplayStatus() {
   if (!IsJavascriptAllowed())
     return;

diff --git a/chrome/browser/ui/webui/settings/site_settings_handler.h b/chrome/browser/ui/webui/settings/site_settings_handler.h
index 086433e7..7a5f9c9b 100644
--- a/chrome/browser/ui/webui/settings/site_settings_handler.h
+++ b/chrome/browser/ui/webui/settings/site_settings_handler.h

@@ -91,6 +91,8 @@
   FRIEND_TEST_ALL_PREFIXES(SiteSettingsHandlerInfobarTest,
                            SettingPermissionsTriggersInfobar);
   FRIEND_TEST_ALL_PREFIXES(SiteSettingsHandlerTest, SessionOnlyException);
+  FRIEND_TEST_ALL_PREFIXES(SiteSettingsHandlerTest,
+                           BlockAutoplay_SendOnRequest);
   FRIEND_TEST_ALL_PREFIXES(SiteSettingsHandlerTest, BlockAutoplay_Update);
 
   // Asynchronously fetches the usage for a given origin. Replies back with
@@ -162,6 +164,9 @@
   // Removes a particular zoom level for a given host.
   void HandleRemoveZoomLevel(const base::ListValue* args);
 
+  // Handles the request to send block autoplay state.
+  void HandleFetchBlockAutoplayStatus(const base::ListValue* args);
+
   // Notifies the JS side about the state of the block autoplay toggle.
   void SendBlockAutoplayStatus();
 

diff --git a/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc b/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc
index a546cec1..301b05f 100644
--- a/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc
+++ b/chrome/browser/ui/webui/settings/site_settings_handler_unittest.cc

@@ -1264,6 +1264,14 @@
   histograms.ExpectTotalCount(uma_base + ".SessionOnly", 1);
 }
 
+TEST_F(SiteSettingsHandlerTest, BlockAutoplay_SendOnRequest) {
+  base::ListValue args;
+  handler()->HandleFetchBlockAutoplayStatus(&args);
+
+  // Check that we are checked and enabled.
+  ValidateBlockAutoplay(true, true);
+}
+
 TEST_F(SiteSettingsHandlerTest, BlockAutoplay_SoundSettingUpdate) {
   SetSoundContentSettingDefault(CONTENT_SETTING_BLOCK);
   base::RunLoop().RunUntilIdle();

diff --git a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.cc b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.cc
index 578e237..0109c0b 100644
--- a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.cc
+++ b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.cc

@@ -6,19 +6,26 @@
 
 #include <vector>
 
+#include "base/bind.h"
 #include "base/values.h"
 #include "chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_constants.h"
 #include "chrome/browser/web_applications/extensions/pending_bookmark_app_manager.h"
 #include "chrome/common/pref_names.h"
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_service.h"
+#include "content/public/browser/browser_thread.h"
 
 namespace web_app {
 
 WebAppPolicyManager::WebAppPolicyManager(PrefService* pref_service,
                                          PendingAppManager* pending_app_manager)
     : pref_service_(pref_service), pending_app_manager_(pending_app_manager) {
-  pending_app_manager_->ProcessAppOperations(GetAppsToInstall());
+  content::BrowserThread::PostAfterStartupTask(
+      FROM_HERE,
+      content::BrowserThread::GetTaskRunnerForThread(
+          content::BrowserThread::UI),
+      base::BindOnce(&WebAppPolicyManager::RefreshPolicyInstalledApps,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
 WebAppPolicyManager::~WebAppPolicyManager() = default;
@@ -29,8 +36,7 @@
   registry->RegisterListPref(prefs::kWebAppInstallForceList);
 }
 
-std::vector<PendingAppManager::AppInfo>
-WebAppPolicyManager::GetAppsToInstall() {
+void WebAppPolicyManager::RefreshPolicyInstalledApps() {
   const base::Value* web_apps =
       pref_service_->GetList(prefs::kWebAppInstallForceList);
 
@@ -48,7 +54,8 @@
             ? PendingAppManager::LaunchContainer::kWindow
             : PendingAppManager::LaunchContainer::kTab);
   }
-  return apps_to_install;
+  pending_app_manager_->InstallApps(std::move(apps_to_install),
+                                    base::DoNothing());
 }
 
 }  // namespace web_app

diff --git a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.h b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.h
index e1d29e2..ec83957 100644
--- a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.h
+++ b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager.h

@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "chrome/browser/web_applications/components/pending_app_manager.h"
 #include "url/gurl.h"
 
@@ -34,13 +35,15 @@
   static void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry);
 
  private:
-  std::vector<PendingAppManager::AppInfo> GetAppsToInstall();
+  void RefreshPolicyInstalledApps();
 
   PrefService* pref_service_;
 
   // Used to install, uninstall, and update apps. Should outlive this class.
   PendingAppManager* pending_app_manager_;
 
+  base::WeakPtrFactory<WebAppPolicyManager> weak_ptr_factory_{this};
+
   DISALLOW_COPY_AND_ASSIGN(WebAppPolicyManager);
 };
 

diff --git a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc
index 106c228b..6a992ee 100644
--- a/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc
+++ b/chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_manager_unittest.cc

@@ -8,12 +8,14 @@
 #include <utility>
 #include <vector>
 
+#include "base/run_loop.h"
 #include "base/values.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/browser/web_applications/bookmark_apps/policy/web_app_policy_constants.h"
 #include "chrome/browser/web_applications/components/pending_app_manager.h"
 #include "chrome/common/pref_names.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
+#include "content/public/test/test_browser_thread_bundle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -30,11 +32,16 @@
 
 class WebAppPolicyManagerTest : public testing::Test {
  public:
-  class TestPendingAppManager;
+  WebAppPolicyManagerTest() = default;
+  ~WebAppPolicyManagerTest() override = default;
+
+ private:
+  content::TestBrowserThreadBundle thread_bundle_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebAppPolicyManagerTest);
 };
 
-class WebAppPolicyManagerTest::TestPendingAppManager
-    : public PendingAppManager {
+class TestPendingAppManager : public PendingAppManager {
  public:
   TestPendingAppManager() = default;
   ~TestPendingAppManager() override = default;
@@ -42,7 +49,8 @@
   void Install(AppInfo app_to_install,
                PendingAppManager::OnceInstallCallback callback) override {}
 
-  void ProcessAppOperations(std::vector<AppInfo> apps_to_install) override {
+  void InstallApps(std::vector<AppInfo> apps_to_install,
+                   const RepeatingInstallCallback& callback) override {
     last_apps_to_install_ = std::move(apps_to_install);
   }
 
@@ -63,8 +71,9 @@
   auto pending_app_manager = std::make_unique<TestPendingAppManager>();
   WebAppPolicyManager web_app_policy_manager(prefs.get(),
                                              pending_app_manager.get());
-  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
+  base::RunLoop().RunUntilIdle();
 
+  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
   EXPECT_TRUE(apps_to_install.empty());
 }
 
@@ -78,8 +87,9 @@
   auto pending_app_manager = std::make_unique<TestPendingAppManager>();
   WebAppPolicyManager web_app_policy_manager(prefs.get(),
                                              pending_app_manager.get());
-  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
+  base::RunLoop().RunUntilIdle();
 
+  const auto& apps_to_install = pending_app_manager->last_apps_to_install();
   EXPECT_TRUE(apps_to_install.empty());
 }
 
@@ -107,6 +117,8 @@
   auto pending_app_manager = std::make_unique<TestPendingAppManager>();
   WebAppPolicyManager web_app_policy_manager(prefs.get(),
                                              pending_app_manager.get());
+  base::RunLoop().RunUntilIdle();
+
   const auto& apps_to_install = pending_app_manager->last_apps_to_install();
 
   std::vector<PendingAppManager::AppInfo> expected_apps_to_install;

diff --git a/chrome/browser/web_applications/components/pending_app_manager.h b/chrome/browser/web_applications/components/pending_app_manager.h
index f26da19..08f5a47a 100644
--- a/chrome/browser/web_applications/components/pending_app_manager.h
+++ b/chrome/browser/web_applications/components/pending_app_manager.h

@@ -24,6 +24,8 @@
  public:
   using OnceInstallCallback =
       base::OnceCallback<void(const GURL& app_url, const std::string&)>;
+  using RepeatingInstallCallback =
+      base::RepeatingCallback<void(const GURL& app_url, const std::string&)>;
 
   // How the app will be launched after installation.
   enum class LaunchContainer {
@@ -58,8 +60,13 @@
   virtual void Install(AppInfo app_to_install,
                        OnceInstallCallback callback) = 0;
 
-  // Adds |apps_to_install| to the queue of operations.
-  virtual void ProcessAppOperations(std::vector<AppInfo> apps_to_install) = 0;
+  // Adds |apps_to_install| to the queue of operations. Runs |callback|
+  // with the URL of the corresponding AppInfo in |apps_to_install| and with the
+  // id of the installed app or an empty string if the installation fails. Runs
+  // |callback| for every completed installation - whether or not the
+  // installation actually succeeded.
+  virtual void InstallApps(std::vector<AppInfo> apps_to_install,
+                           const RepeatingInstallCallback& callback) = 0;
 
   DISALLOW_COPY_AND_ASSIGN(PendingAppManager);
 };

diff --git a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.cc b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.cc
index 7cd58c85..9ad396a 100644
--- a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.cc
+++ b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.cc

@@ -64,7 +64,7 @@
     }
   }
 
-  installation_queue_.push_back(std::make_unique<Installation>(
+  installation_queue_.push_front(std::make_unique<Installation>(
       std::move(app_to_install), std::move(callback)));
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -73,8 +73,19 @@
                      weak_ptr_factory_.GetWeakPtr()));
 }
 
-void PendingBookmarkAppManager::ProcessAppOperations(
-    std::vector<AppInfo> apps_to_install) {}
+void PendingBookmarkAppManager::InstallApps(
+    std::vector<AppInfo> apps_to_install,
+    const RepeatingInstallCallback& callback) {
+  for (auto& app_to_install : apps_to_install) {
+    installation_queue_.push_back(
+        std::make_unique<Installation>(std::move(app_to_install), callback));
+  }
+
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&PendingBookmarkAppManager::MaybeStartNextInstallation,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
 
 void PendingBookmarkAppManager::SetFactoriesForTesting(
     WebContentsFactory web_contents_factory,

diff --git a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.h b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.h
index fc9064a..5cb7fd4 100644
--- a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.h
+++ b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager.h

@@ -46,7 +46,8 @@
 
   // web_app::PendingAppManager
   void Install(AppInfo app_to_install, OnceInstallCallback callback) override;
-  void ProcessAppOperations(std::vector<AppInfo> apps_to_install) override;
+  void InstallApps(std::vector<AppInfo> apps_to_install,
+                   const RepeatingInstallCallback& callback) override;
 
   void SetFactoriesForTesting(WebContentsFactory web_contents_factory,
                               TaskFactory task_factory);

diff --git a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager_unittest.cc b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager_unittest.cc
index 69607dd4..aa89fdc0 100644
--- a/chrome/browser/web_applications/extensions/pending_bookmark_app_manager_unittest.cc
+++ b/chrome/browser/web_applications/extensions/pending_bookmark_app_manager_unittest.cc

@@ -27,6 +27,7 @@
 
 const char kFooWebAppUrl[] = "https://foo.example";
 const char kBarWebAppUrl[] = "https://bar.example";
+const char kQuxWebAppUrl[] = "https://qux.example";
 
 const char kWrongUrl[] = "https://foobar.example";
 
@@ -41,6 +42,12 @@
       web_app::PendingAppManager::LaunchContainer::kWindow);
 }
 
+web_app::PendingAppManager::AppInfo GetQuxAppInfo() {
+  return web_app::PendingAppManager::AppInfo(
+      GURL(kQuxWebAppUrl),
+      web_app::PendingAppManager::LaunchContainer::kWindow);
+}
+
 }  // namespace
 
 class TestBookmarkAppShortcutInstallationTask
@@ -140,6 +147,19 @@
     return failing_installation_task_creator_;
   }
 
+  std::unique_ptr<PendingBookmarkAppManager>
+  GetPendingBookmarkAppManagerWithTestFactories() {
+    auto manager = std::make_unique<PendingBookmarkAppManager>(profile());
+    manager->SetFactoriesForTesting(test_web_contents_creator(),
+                                    successful_installation_task_creator());
+    return manager;
+  }
+
+  void SuccessfullyLoad(const GURL& url) {
+    web_contents_tester_->NavigateAndCommit(url);
+    web_contents_tester_->TestDidFinishLoad(url);
+  }
+
   content::WebContentsTester* web_contents_tester() {
     return web_contents_tester_;
   }
@@ -161,153 +181,168 @@
 };
 
 TEST_F(PendingBookmarkAppManagerTest, Install_Succeeds) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kFooWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kFooWebAppUrl));
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
 }
 
 TEST_F(PendingBookmarkAppManagerTest, Install_SucceedsTwice) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kFooWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kFooWebAppUrl));
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
   ResetResults();
 
-  pending_app_manager.Install(
+  pending_app_manager->Install(
       GetBarAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kBarWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kBarWebAppUrl));
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
 }
 
-TEST_F(PendingBookmarkAppManagerTest, Install_PendingSuccessfulTask) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+TEST_F(PendingBookmarkAppManagerTest, Install_ConcurrentCalls) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
-  pending_app_manager.Install(
+  pending_app_manager->Install(
+      GetBarAppInfo(),
+      base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
+                     base::Unretained(this)));
+
+  // The last call to Install gets higher priority.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  ResetResults();
+
+  // Then the first call to Install gets processed.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, Install_PendingSuccessfulTask) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
+      GetFooAppInfo(),
+      base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
+                     base::Unretained(this)));
+  // Make sure the installation has started.
+  base::RunLoop().RunUntilIdle();
+
+  pending_app_manager->Install(
       GetBarAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   // Finish the first install.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kFooWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kFooWebAppUrl));
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
   ResetResults();
 
   // Finish the second install.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kBarWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kBarWebAppUrl));
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
 }
 
 TEST_F(PendingBookmarkAppManagerTest, Install_PendingFailingTask) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
-  pending_app_manager.Install(
+  // Make sure the installation has started.
+  base::RunLoop().RunUntilIdle();
+
+  pending_app_manager->Install(
       GetBarAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   // Fail the first install.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kBarWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kBarWebAppUrl));
+  SuccessfullyLoad(GURL(kWrongUrl));
+
   EXPECT_FALSE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
   ResetResults();
 
   // Finish the second install.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kBarWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kBarWebAppUrl));
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
 }
 
 TEST_F(PendingBookmarkAppManagerTest, Install_ReentrantCallback) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
   // Call install with a callback that tries to install another app.
-  pending_app_manager.Install(
+  pending_app_manager->Install(
       GetFooAppInfo(),
-      base::BindLambdaForTesting([&](const GURL& provided_url,
-                                     const std::string& app_id) {
-        InstallCallback(provided_url, app_id);
-        pending_app_manager.Install(
-            GetBarAppInfo(),
-            base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
-                           base::Unretained(this)));
-      }));
+      base::BindLambdaForTesting(
+          [&](const GURL& provided_url, const std::string& app_id) {
+            InstallCallback(provided_url, app_id);
+            pending_app_manager->Install(
+                GetBarAppInfo(),
+                base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
+                               base::Unretained(this)));
+          }));
+
   // Finish the first install.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kFooWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kFooWebAppUrl));
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
   ResetResults();
 
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kBarWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kBarWebAppUrl));
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
 }
 
 TEST_F(PendingBookmarkAppManagerTest, Install_FailsSameInstallPending) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
-  pending_app_manager.Install(
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
@@ -319,27 +354,207 @@
 
   // The original install should still be able to succeed.
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kFooWebAppUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kFooWebAppUrl));
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
   EXPECT_TRUE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
 }
 
 TEST_F(PendingBookmarkAppManagerTest, Install_FailsLoadIncorrectURL) {
-  PendingBookmarkAppManager pending_app_manager(profile());
-  pending_app_manager.SetFactoriesForTesting(
-      test_web_contents_creator(), successful_installation_task_creator());
-
-  pending_app_manager.Install(
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  pending_app_manager->Install(
       GetFooAppInfo(),
       base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
                      base::Unretained(this)));
 
   base::RunLoop().RunUntilIdle();
-  web_contents_tester()->NavigateAndCommit(GURL(kWrongUrl));
-  web_contents_tester()->TestDidFinishLoad(GURL(kWrongUrl));
+  SuccessfullyLoad(GURL(kWrongUrl));
   EXPECT_FALSE(install_succeeded());
   EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
 }
 
+TEST_F(PendingBookmarkAppManagerTest, InstallApps_Succeeds) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+  apps_to_install.push_back(GetFooAppInfo());
+
+  pending_app_manager->InstallApps(
+      std::move(apps_to_install),
+      base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                          base::Unretained(this)));
+
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, InstallApps_Fails) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+  apps_to_install.push_back(GetFooAppInfo());
+
+  pending_app_manager->InstallApps(
+      std::move(apps_to_install),
+      base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                          base::Unretained(this)));
+
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kWrongUrl));
+
+  EXPECT_FALSE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, InstallApps_Multiple) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+
+  std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+  apps_to_install.push_back(GetFooAppInfo());
+  apps_to_install.push_back(GetBarAppInfo());
+
+  pending_app_manager->InstallApps(
+      std::move(apps_to_install),
+      base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                          base::Unretained(this)));
+
+  // Finish the first install.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+  ResetResults();
+
+  // Finish the second install.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, InstallApps_PendingInstallApps) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+
+  {
+    std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+    apps_to_install.push_back(GetFooAppInfo());
+
+    pending_app_manager->InstallApps(
+        std::move(apps_to_install),
+        base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                            base::Unretained(this)));
+  }
+
+  {
+    std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+    apps_to_install.push_back(GetBarAppInfo());
+
+    pending_app_manager->InstallApps(
+        std::move(apps_to_install),
+        base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                            base::Unretained(this)));
+  }
+
+  // Finish the first install.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+  ResetResults();
+
+  // Finish the second install.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, Install_PendingMulitpleInstallApps) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+
+  std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+  apps_to_install.push_back(GetFooAppInfo());
+  apps_to_install.push_back(GetBarAppInfo());
+
+  // Queue through InstallApps.
+  pending_app_manager->InstallApps(
+      std::move(apps_to_install),
+      base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                          base::Unretained(this)));
+
+  // Queue through Install.
+  pending_app_manager->Install(
+      GetQuxAppInfo(),
+      base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
+                     base::Unretained(this)));
+
+  // The install request from Install should be processed first.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kQuxWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kQuxWebAppUrl), install_callback_url());
+  ResetResults();
+
+  // The install requests from InstallApps should be processed next.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+  ResetResults();
+
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
+}
+
+TEST_F(PendingBookmarkAppManagerTest, InstallApps_PendingInstall) {
+  auto pending_app_manager = GetPendingBookmarkAppManagerWithTestFactories();
+  // Queue through Install.
+  pending_app_manager->Install(
+      GetQuxAppInfo(),
+      base::BindOnce(&PendingBookmarkAppManagerTest::InstallCallback,
+                     base::Unretained(this)));
+
+  // Queue through InstallApps.
+  std::vector<web_app::PendingAppManager::AppInfo> apps_to_install;
+  apps_to_install.push_back(GetFooAppInfo());
+  apps_to_install.push_back(GetBarAppInfo());
+
+  pending_app_manager->InstallApps(
+      std::move(apps_to_install),
+      base::BindRepeating(&PendingBookmarkAppManagerTest::InstallCallback,
+                          base::Unretained(this)));
+
+  // The install request from Install should be processed first.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kQuxWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kQuxWebAppUrl), install_callback_url());
+  ResetResults();
+
+  // The install requests from InstallApps should be processed next.
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kFooWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kFooWebAppUrl), install_callback_url());
+  ResetResults();
+
+  base::RunLoop().RunUntilIdle();
+  SuccessfullyLoad(GURL(kBarWebAppUrl));
+
+  EXPECT_TRUE(install_succeeded());
+  EXPECT_EQ(GURL(kBarWebAppUrl), install_callback_url());
+}
+
 }  // namespace extensions

diff --git a/chrome/browser/web_applications/web_app_provider.cc b/chrome/browser/web_applications/web_app_provider.cc
index 4e98d973..82362a7 100644
--- a/chrome/browser/web_applications/web_app_provider.cc
+++ b/chrome/browser/web_applications/web_app_provider.cc

@@ -104,7 +104,7 @@
 void WebAppProvider::ScanForExternalWebAppsCallback(
     std::vector<web_app::PendingAppManager::AppInfo> app_infos) {
 #if defined(OS_CHROMEOS)
-  pending_app_manager_->ProcessAppOperations(std::move(app_infos));
+  pending_app_manager_->InstallApps(std::move(app_infos), base::DoNothing());
 #endif
 }
 

diff --git a/chrome/browser/webauthn/authenticator_request_dialog_model.cc b/chrome/browser/webauthn/authenticator_request_dialog_model.cc
index ae64ce49..82dc77c5 100644
--- a/chrome/browser/webauthn/authenticator_request_dialog_model.cc
+++ b/chrome/browser/webauthn/authenticator_request_dialog_model.cc

@@ -42,6 +42,9 @@
     case AuthenticatorTransport::kBluetoothLowEnergy:
       SetCurrentStep(Step::kBlePowerOnManual);
       break;
+    case AuthenticatorTransport::kInternal:
+      SetCurrentStep(Step::kTouchId);
+      break;
     default:
       break;
   }
@@ -73,6 +76,10 @@
   DCHECK_EQ(current_step(), Step::kUsbInsertAndActivateOnRegister);
 }
 
+void AuthenticatorRequestDialogModel::TryTouchId() {
+  DCHECK_EQ(current_step(), Step::kTouchId);
+}
+
 void AuthenticatorRequestDialogModel::Cancel() {
   for (auto& observer : observers_)
     observer.OnCancelRequest();

diff --git a/chrome/browser/webauthn/authenticator_request_dialog_model.h b/chrome/browser/webauthn/authenticator_request_dialog_model.h
index fbc545d..630de4ef 100644
--- a/chrome/browser/webauthn/authenticator_request_dialog_model.h
+++ b/chrome/browser/webauthn/authenticator_request_dialog_model.h

@@ -44,6 +44,9 @@
 
     kBleActivate,
     kBleVerifying,
+
+    // Touch ID.
+    kTouchId,
   };
 
   // Encapsulates information about authenticators that have been found but are
@@ -123,6 +126,12 @@
   // Valid action when at step: kUsbInsert.
   void TryUsbDevice();
 
+  // Tries to use Touch ID -- either because the request requires it or because
+  // the user told us to.
+  //
+  // Valid action when at step: kTouchId.
+  void TryTouchId();
+
   // Cancels the flow as a result of the user clicking `Cancel` on the UI.
   //
   // Valid action at all steps.

diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index 0f7a761..b3f3f3d 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc

@@ -660,7 +660,8 @@
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enable USBGuard at the lockscreen on Chrome OS.
-const base::Feature kUsbguard{"USBGuard", base::FEATURE_DISABLED_BY_DEFAULT};
+// TODO(crbug.com/874630): Remove this kill-switch
+const base::Feature kUsbguard{"USBGuard", base::FEATURE_ENABLED_BY_DEFAULT};
 #endif  // defined(OS_CHROMEOS)
 
 #if !defined(OS_ANDROID)

diff --git a/chrome/common/extensions/api/_permission_features.json b/chrome/common/extensions/api/_permission_features.json
index 0c2892a0..74ec02d 100644
--- a/chrome/common/extensions/api/_permission_features.json
+++ b/chrome/common/extensions/api/_permission_features.json

@@ -48,7 +48,7 @@
     ]
   },
   "arcAppsPrivate": {
-    "channel": "trunk",
+    "channel": "stable",
     "extension_types": ["platform_app"],
     "whitelist": [
       "46578A13607D38F1DC8E280C4F499FB0A2F9565C", // http://crbug.com/819404
@@ -494,7 +494,9 @@
         "9FDE6E7F06FCFA11D9A05041C7FF6D8AE662F5D1",  // Spark release.
         "50B4A905D522C06E27CA6D099E3E54BDA1F152C5",  // Spark Beta channel.
         "BA0C8BB92084C9741312D90D3EA882526853455F",  // Spark dev channel.
-        "5F57A9AE8DFF5D6BB09DF8606270402612E871E5"   // http://crbug.com/422624
+        "5F57A9AE8DFF5D6BB09DF8606270402612E871E5",  // http://crbug.com/422624
+        "46578A13607D38F1DC8E280C4F499FB0A2F9565C",  // http://crbug.com/819404
+        "898FB5A39687D210766B8998BA4530B99C9E6586"   // http://crbug.com/819404
       ]
     },
     {

diff --git a/chrome/common/extensions/api/file_manager_private.idl b/chrome/common/extensions/api/file_manager_private.idl
index 33dd5b1..58fbdd9 100644
--- a/chrome/common/extensions/api/file_manager_private.idl
+++ b/chrome/common/extensions/api/file_manager_private.idl

@@ -43,8 +43,7 @@
   error_invalid_device_path,
   error_unknown_filesystem,
   error_unsupported_filesystem,
-  error_invalid_archive,
-  error_path_unmounted
+  error_invalid_archive
 };
 
 // File transfer progress state.

diff --git a/chrome/test/data/webui/settings/quick_unlock_authenticate_browsertest_chromeos.js b/chrome/test/data/webui/settings/quick_unlock_authenticate_browsertest_chromeos.js
index a77ac9a..fcf0744 100644
--- a/chrome/test/data/webui/settings/quick_unlock_authenticate_browsertest_chromeos.js
+++ b/chrome/test/data/webui/settings/quick_unlock_authenticate_browsertest_chromeos.js

@@ -246,11 +246,18 @@
         CrSettingsPrefs.deferInitialization = true;
 
         // Build pref fakes.
-        const fakePrefs = [{
-          key: ENABLE_LOCK_SCREEN_PREF,
-          type: chrome.settingsPrivate.PrefType.BOOLEAN,
-          value: true
-        }];
+        const fakePrefs = [
+          {
+            key: ENABLE_LOCK_SCREEN_PREF,
+            type: chrome.settingsPrivate.PrefType.BOOLEAN,
+            value: true
+          },
+          {
+            key: 'ash.message_center.lock_screen_mode',
+            type: chrome.settingsPrivate.PrefType.STRING,
+            value: 'hide'
+          }
+        ];
         fakeSettings = new settings.FakeSettingsPrivate(fakePrefs);
         fakeUma = new settings.FakeQuickUnlockUma();
         setLockScreenPref(true);

diff --git a/chrome/test/data/webui/settings/site_details_permission_tests.js b/chrome/test/data/webui/settings/site_details_permission_tests.js
index ecc421b4..62cbaa1 100644
--- a/chrome/test/data/webui/settings/site_details_permission_tests.js
+++ b/chrome/test/data/webui/settings/site_details_permission_tests.js

@@ -28,6 +28,8 @@
             settings.ContentSettingsTypes.CAMERA,
             [test_util.createRawSiteException('https://www.example.com')])]);
 
+    loadTimeData.overrideValues({enableBlockAutoplayContentSetting: true});
+
     browserProxy = new TestSiteSettingsPrefsBrowserProxy();
     settings.SiteSettingsPrefsBrowserProxyImpl.instance_ = browserProxy;
     PolymerTest.clearBody();
@@ -310,4 +312,83 @@
     assertFalse(testElement.$.permissionItem.classList.contains('two-line'));
     assertFalse(testElement.$.permission.disabled);
   });
+
+  test('sound setting default string is correct', function() {
+    const origin = 'https://www.example.com';
+    browserProxy.setPrefs(prefs);
+    testElement.category = settings.ContentSettingsTypes.SOUND;
+    testElement.label = 'Sound';
+    testElement.site = {
+      origin: origin,
+      embeddingOrigin: '',
+      setting: settings.ContentSetting.ALLOW,
+      source: settings.SiteSettingSource.PREFERENCE,
+    };
+
+    return browserProxy.whenCalled('getDefaultValueForContentType')
+        .then((args) => {
+          // Check getDefaultValueForContentType was called for sound category.
+          assertEquals(settings.ContentSettingsTypes.SOUND, args);
+
+          // The default option will always be the first in the menu.
+          assertEquals(
+              'Allow (default)', testElement.$.permission.options[0].text,
+              'Default setting string should match prefs');
+          browserProxy.resetResolver('getDefaultValueForContentType');
+          const defaultPrefs = test_util.createSiteSettingsPrefs(
+              [test_util.createContentSettingTypeToValuePair(
+                  settings.ContentSettingsTypes.SOUND,
+                  test_util.createDefaultContentSetting(
+                      {setting: settings.ContentSetting.BLOCK}))],
+              []);
+          browserProxy.setPrefs(defaultPrefs);
+          return browserProxy.whenCalled('getDefaultValueForContentType');
+        })
+        .then((args) => {
+          assertEquals(settings.ContentSettingsTypes.SOUND, args);
+          assertEquals(
+              'Mute (default)', testElement.$.permission.options[0].text,
+              'Default setting string should match prefs');
+          browserProxy.resetResolver('getDefaultValueForContentType');
+          testElement.useAutomaticLabel = true;
+          const defaultPrefs = test_util.createSiteSettingsPrefs(
+              [test_util.createContentSettingTypeToValuePair(
+                  settings.ContentSettingsTypes.SOUND,
+                  test_util.createDefaultContentSetting(
+                      {setting: settings.ContentSetting.ALLOW}))],
+              []);
+          browserProxy.setPrefs(defaultPrefs);
+          return browserProxy.whenCalled('getDefaultValueForContentType');
+        })
+        .then((args) => {
+          assertEquals(settings.ContentSettingsTypes.SOUND, args);
+          assertEquals(
+              'Automatic (default)', testElement.$.permission.options[0].text,
+              'Default setting string should match prefs');
+        });
+  });
+
+  test('sound setting block string is correct', function() {
+    const origin = 'https://www.example.com';
+    browserProxy.setPrefs(prefs);
+    testElement.category = settings.ContentSettingsTypes.SOUND;
+    testElement.label = 'Sound';
+    testElement.site = {
+      origin: origin,
+      embeddingOrigin: '',
+      setting: settings.ContentSetting.ALLOW,
+      source: settings.SiteSettingSource.PREFERENCE,
+    };
+
+    return browserProxy.whenCalled('getDefaultValueForContentType')
+        .then((args) => {
+          // Check getDefaultValueForContentType was called for sound category.
+          assertEquals(settings.ContentSettingsTypes.SOUND, args);
+
+          // The block option will always be the third in the menu.
+          assertEquals(
+              'Mute', testElement.$.permission.options[2].text,
+              'Block setting string should match prefs');
+        });
+  });
 });

diff --git a/chrome/test/data/webui/settings/site_details_tests.js b/chrome/test/data/webui/settings/site_details_tests.js
index 4ad95b9..a1b71bf 100644
--- a/chrome/test/data/webui/settings/site_details_tests.js
+++ b/chrome/test/data/webui/settings/site_details_tests.js

@@ -443,4 +443,12 @@
         });
   });
 
+  test('call fetch block autoplay status', function() {
+    const origin = 'https://foo.com:443';
+    browserProxy.setPrefs(prefs);
+    loadTimeData.overrideValues({enableSiteSettings: true});
+    testElement = createSiteDetails(origin);
+    return browserProxy.whenCalled('fetchBlockAutoplayStatus');
+  });
+
 });

diff --git a/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js b/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js
index ba9b354..d36e75a 100644
--- a/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js
+++ b/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js

@@ -44,6 +44,7 @@
       'setOriginPermissions',
       'setProtocolDefault',
       'updateIncognitoStatus',
+      'fetchBlockAutoplayStatus',
     ]);
 
     /** @private {boolean} */
@@ -386,4 +387,9 @@
   updateIncognitoStatus() {
     this.methodCalled('updateIncognitoStatus', arguments);
   }
+
+  /** @override */
+  fetchBlockAutoplayStatus() {
+    this.methodCalled('fetchBlockAutoplayStatus');
+  }
 }

diff --git a/chromeos/dbus/cros_disks_client.cc b/chromeos/dbus/cros_disks_client.cc
index cb30136..08cec66 100644
--- a/chromeos/dbus/cros_disks_client.cc
+++ b/chromeos/dbus/cros_disks_client.cc

@@ -73,6 +73,52 @@
   }
 }
 
+MountError CrosDisksMountErrorToChromeMountError(
+    cros_disks::MountErrorType mount_error) {
+  switch (mount_error) {
+    case cros_disks::MOUNT_ERROR_NONE:
+      return MOUNT_ERROR_NONE;
+    case cros_disks::MOUNT_ERROR_UNKNOWN:
+      return MOUNT_ERROR_UNKNOWN;
+    case cros_disks::MOUNT_ERROR_INTERNAL:
+      return MOUNT_ERROR_INTERNAL;
+    case cros_disks::MOUNT_ERROR_INVALID_ARGUMENT:
+      return MOUNT_ERROR_INVALID_ARGUMENT;
+    case cros_disks::MOUNT_ERROR_INVALID_PATH:
+      return MOUNT_ERROR_INVALID_PATH;
+    case cros_disks::MOUNT_ERROR_PATH_ALREADY_MOUNTED:
+      return MOUNT_ERROR_PATH_ALREADY_MOUNTED;
+    case cros_disks::MOUNT_ERROR_PATH_NOT_MOUNTED:
+      return MOUNT_ERROR_PATH_NOT_MOUNTED;
+    case cros_disks::MOUNT_ERROR_DIRECTORY_CREATION_FAILED:
+      return MOUNT_ERROR_DIRECTORY_CREATION_FAILED;
+    case cros_disks::MOUNT_ERROR_INVALID_MOUNT_OPTIONS:
+      return MOUNT_ERROR_INVALID_MOUNT_OPTIONS;
+    case cros_disks::MOUNT_ERROR_INVALID_UNMOUNT_OPTIONS:
+      return MOUNT_ERROR_INVALID_UNMOUNT_OPTIONS;
+    case cros_disks::MOUNT_ERROR_INSUFFICIENT_PERMISSIONS:
+      return MOUNT_ERROR_INSUFFICIENT_PERMISSIONS;
+    case cros_disks::MOUNT_ERROR_MOUNT_PROGRAM_NOT_FOUND:
+      return MOUNT_ERROR_MOUNT_PROGRAM_NOT_FOUND;
+    case cros_disks::MOUNT_ERROR_MOUNT_PROGRAM_FAILED:
+      return MOUNT_ERROR_MOUNT_PROGRAM_FAILED;
+    case cros_disks::MOUNT_ERROR_INVALID_DEVICE_PATH:
+      return MOUNT_ERROR_INVALID_DEVICE_PATH;
+    case cros_disks::MOUNT_ERROR_UNKNOWN_FILESYSTEM:
+      return MOUNT_ERROR_UNKNOWN_FILESYSTEM;
+    case cros_disks::MOUNT_ERROR_UNSUPPORTED_FILESYSTEM:
+      return MOUNT_ERROR_UNSUPPORTED_FILESYSTEM;
+    case cros_disks::MOUNT_ERROR_INVALID_ARCHIVE:
+      return MOUNT_ERROR_INVALID_ARCHIVE;
+    case cros_disks::MOUNT_ERROR_UNSUPPORTED_ARCHIVE:
+      // TODO(amistry): Add MOUNT_ERROR_UNSUPPORTED_ARCHIVE.
+      return MOUNT_ERROR_UNKNOWN;
+    default:
+      NOTREACHED() << "Unrecognised mount error code " << mount_error;
+      return MOUNT_ERROR_UNKNOWN;
+  }
+}
+
 bool ReadMountEntryFromDbus(dbus::MessageReader* reader, MountEntry* entry) {
   uint32_t error_code = 0;
   std::string source_path;
@@ -84,8 +130,10 @@
       !reader->PopString(&mount_path)) {
     return false;
   }
-  *entry = MountEntry(static_cast<MountError>(error_code), source_path,
-                      static_cast<MountType>(mount_type), mount_path);
+  *entry =
+      MountEntry(CrosDisksMountErrorToChromeMountError(
+                     static_cast<cros_disks::MountErrorType>(error_code)),
+                 source_path, static_cast<MountType>(mount_type), mount_path);
   return true;
 }
 
@@ -293,7 +341,9 @@
     dbus::MessageReader reader(response);
     uint32_t error_code = 0;
     if (reader.PopUint32(&error_code) &&
-        static_cast<MountError>(error_code) != MOUNT_ERROR_NONE) {
+        CrosDisksMountErrorToChromeMountError(
+            static_cast<cros_disks::MountErrorType>(error_code)) !=
+            MOUNT_ERROR_NONE) {
       std::move(callback).Run(false);
       return;
     }

diff --git a/chromeos/dbus/cros_disks_client.h b/chromeos/dbus/cros_disks_client.h
index e1a89d3..dc3f76c 100644
--- a/chromeos/dbus/cros_disks_client.h
+++ b/chromeos/dbus/cros_disks_client.h

@@ -50,27 +50,25 @@
 };
 
 // Mount error code used by cros-disks.
+// These values are not the same as cros_disks::MountErrorType.
 enum MountError {
-  MOUNT_ERROR_NONE = 0,
-  MOUNT_ERROR_UNKNOWN = 1,
-  MOUNT_ERROR_INTERNAL = 2,
-  MOUNT_ERROR_INVALID_ARGUMENT = 3,
-  MOUNT_ERROR_INVALID_PATH = 4,
-  MOUNT_ERROR_PATH_ALREADY_MOUNTED = 5,
-  MOUNT_ERROR_PATH_NOT_MOUNTED = 6,
-  MOUNT_ERROR_DIRECTORY_CREATION_FAILED = 7,
-  MOUNT_ERROR_INVALID_MOUNT_OPTIONS = 8,
-  MOUNT_ERROR_INVALID_UNMOUNT_OPTIONS = 9,
-  MOUNT_ERROR_INSUFFICIENT_PERMISSIONS = 10,
-  MOUNT_ERROR_MOUNT_PROGRAM_NOT_FOUND = 11,
-  MOUNT_ERROR_MOUNT_PROGRAM_FAILED = 12,
-  MOUNT_ERROR_INVALID_DEVICE_PATH = 100,
-  MOUNT_ERROR_UNKNOWN_FILESYSTEM = 101,
-  MOUNT_ERROR_UNSUPPORTED_FILESYSTEM = 102,
-  MOUNT_ERROR_INVALID_ARCHIVE = 201,
-  MOUNT_ERROR_PATH_UNMOUNTED = 901,
-  // TODO(tbarzic): Add more error codes as they get added to cros-disks and
-  // consider doing explicit translation from cros-disks error_types.
+  MOUNT_ERROR_NONE,
+  MOUNT_ERROR_UNKNOWN,
+  MOUNT_ERROR_INTERNAL,
+  MOUNT_ERROR_INVALID_ARGUMENT,
+  MOUNT_ERROR_INVALID_PATH,
+  MOUNT_ERROR_PATH_ALREADY_MOUNTED,
+  MOUNT_ERROR_PATH_NOT_MOUNTED,
+  MOUNT_ERROR_DIRECTORY_CREATION_FAILED,
+  MOUNT_ERROR_INVALID_MOUNT_OPTIONS,
+  MOUNT_ERROR_INVALID_UNMOUNT_OPTIONS,
+  MOUNT_ERROR_INSUFFICIENT_PERMISSIONS,
+  MOUNT_ERROR_MOUNT_PROGRAM_NOT_FOUND,
+  MOUNT_ERROR_MOUNT_PROGRAM_FAILED,
+  MOUNT_ERROR_INVALID_DEVICE_PATH,
+  MOUNT_ERROR_UNKNOWN_FILESYSTEM,
+  MOUNT_ERROR_UNSUPPORTED_FILESYSTEM,
+  MOUNT_ERROR_INVALID_ARCHIVE,
 };
 
 // Rename error reported by cros-disks.

diff --git a/chromeos/geolocation/simple_geolocation_request.cc b/chromeos/geolocation/simple_geolocation_request.cc
index 9ea2ded..362a27e1 100644
--- a/chromeos/geolocation/simple_geolocation_request.cc
+++ b/chromeos/geolocation/simple_geolocation_request.cc

@@ -440,11 +440,8 @@
       net::URLFetcher::Create(request_url_, net::URLFetcher::POST, this);
   url_fetcher_->SetRequestContext(url_context_getter_.get());
   url_fetcher_->SetUploadData("application/json", request_body);
-  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE |
-                             net::LOAD_DISABLE_CACHE |
-                             net::LOAD_DO_NOT_SAVE_COOKIES |
-                             net::LOAD_DO_NOT_SEND_COOKIES |
-                             net::LOAD_DO_NOT_SEND_AUTH_DATA);
+  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE);
+  url_fetcher_->SetAllowCredentials(false);
 
   // Call test hook before asynchronous request actually starts.
   if (g_test_request_hook)

diff --git a/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.cc b/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.cc
index e15ddf4..f5812fa 100644
--- a/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.cc
+++ b/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.cc

@@ -14,6 +14,8 @@
   DCHECK(get_eligible_host_devices_callback_queue_.empty());
   DCHECK(set_host_device_id_and_callback_queue_.empty());
   DCHECK(get_host_status_callback_queue_.empty());
+  DCHECK(set_feature_enabled_state_args_queue_.empty());
+  DCHECK(get_feature_states_args_queue_.empty());
   DCHECK(retry_set_host_now_callback_queue_.empty());
   DCHECK(trigger_event_for_debugging_type_and_callback_queue_.empty());
 }
@@ -42,6 +44,23 @@
   get_host_status_callback_queue_.pop();
 }
 
+void FakeMultiDeviceSetupClient::InvokePendingSetFeatureEnabledStateCallback(
+    mojom::Feature expected_feature,
+    bool expected_enabled,
+    bool success) {
+  auto& tuple = set_feature_enabled_state_args_queue_.front();
+  DCHECK_EQ(expected_feature, std::get<0>(tuple));
+  DCHECK_EQ(expected_enabled, std::get<1>(tuple));
+  std::move(std::get<2>(tuple)).Run(success);
+  set_feature_enabled_state_args_queue_.pop();
+}
+
+void FakeMultiDeviceSetupClient::InvokePendingGetFeatureStatesCallback(
+    const FeatureStatesMap& feature_states_map) {
+  std::move(get_feature_states_args_queue_.front()).Run(feature_states_map);
+  get_feature_states_args_queue_.pop();
+}
+
 void FakeMultiDeviceSetupClient::InvokePendingRetrySetHostNowCallback(
     bool success) {
   std::move(retry_set_host_now_callback_queue_.front()).Run(success);
@@ -78,6 +97,19 @@
   get_host_status_callback_queue_.push(std::move(callback));
 }
 
+void FakeMultiDeviceSetupClient::SetFeatureEnabledState(
+    mojom::Feature feature,
+    bool enabled,
+    mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback callback) {
+  set_feature_enabled_state_args_queue_.emplace(feature, enabled,
+                                                std::move(callback));
+}
+
+void FakeMultiDeviceSetupClient::GetFeatureStates(
+    mojom::MultiDeviceSetup::GetFeatureStatesCallback callback) {
+  get_feature_states_args_queue_.emplace(std::move(callback));
+}
+
 void FakeMultiDeviceSetupClient::RetrySetHostNow(
     mojom::MultiDeviceSetup::RetrySetHostNowCallback callback) {
   retry_set_host_now_callback_queue_.push(std::move(callback));

diff --git a/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.h b/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.h
index aa10cd27..0763115 100644
--- a/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.h
+++ b/chromeos/services/multidevice_setup/public/cpp/fake_multidevice_setup_client.h

@@ -8,6 +8,7 @@
 #include <memory>
 #include <queue>
 #include <string>
+#include <tuple>
 
 #include "base/callback.h"
 #include "base/macros.h"
@@ -33,6 +34,12 @@
   void InvokePendingGetHostStatusCallback(
       mojom::HostStatus host_status,
       const base::Optional<cryptauth::RemoteDeviceRef>& host_device);
+  void InvokePendingSetFeatureEnabledStateCallback(
+      mojom::Feature expected_feature,
+      bool expected_enabled,
+      bool success);
+  void InvokePendingGetFeatureStatesCallback(
+      const FeatureStatesMap& feature_states_map);
   void InvokePendingRetrySetHostNowCallback(bool success);
   void InvokePendingTriggerEventForDebuggingCallback(
       mojom::EventTypeForDebugging expected_type,
@@ -43,6 +50,7 @@
   }
 
   using MultiDeviceSetupClient::NotifyHostStatusChanged;
+  using MultiDeviceSetupClient::NotifyFeatureStateChanged;
 
  private:
   void GetEligibleHostDevices(GetEligibleHostDevicesCallback callback) override;
@@ -51,6 +59,13 @@
       mojom::MultiDeviceSetup::SetHostDeviceCallback callback) override;
   void RemoveHostDevice() override;
   void GetHostStatus(GetHostStatusCallback callback) override;
+  void SetFeatureEnabledState(
+      mojom::Feature feature,
+      bool enabled,
+      mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback callback)
+      override;
+  void GetFeatureStates(
+      mojom::MultiDeviceSetup::GetFeatureStatesCallback callback) override;
   void RetrySetHostNow(
       mojom::MultiDeviceSetup::RetrySetHostNowCallback callback) override;
   void TriggerEventForDebugging(
@@ -66,6 +81,13 @@
       std::pair<std::string, mojom::MultiDeviceSetup::SetHostDeviceCallback>>
       set_host_device_id_and_callback_queue_;
   std::queue<GetHostStatusCallback> get_host_status_callback_queue_;
+  std::queue<
+      std::tuple<mojom::Feature,
+                 bool,
+                 mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback>>
+      set_feature_enabled_state_args_queue_;
+  std::queue<mojom::MultiDeviceSetup::GetFeatureStatesCallback>
+      get_feature_states_args_queue_;
   std::queue<mojom::MultiDeviceSetup::RetrySetHostNowCallback>
       retry_set_host_now_callback_queue_;
   std::queue<

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.cc b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.cc
index e774391..e69abae2 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.cc
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.cc

@@ -27,6 +27,12 @@
     observer.OnHostStatusChanged(host_status, host_device);
 }
 
+void MultiDeviceSetupClient::NotifyFeatureStateChanged(
+    const FeatureStatesMap& feature_states_map) {
+  for (auto& observer : observer_list_)
+    observer.OnFeatureStatesChanged(feature_states_map);
+}
+
 }  // namespace multidevice_setup
 
 }  // namespace chromeos

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.h b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.h
index 5ae6b2b..8636ab0 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.h
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client.h

@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/callback.h"
+#include "base/containers/flat_map.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "base/optional.h"
@@ -22,6 +23,8 @@
 // Provides clients access to the MultiDeviceSetup API.
 class MultiDeviceSetupClient {
  public:
+  using FeatureStatesMap = base::flat_map<mojom::Feature, mojom::FeatureState>;
+
   class Observer {
    public:
     // Called whenever the host status changes. If the host status is
@@ -29,7 +32,11 @@
     // HostStatus::kEligibleHostExistsButNoHostSet, |host_device| is null.
     virtual void OnHostStatusChanged(
         mojom::HostStatus host_status,
-        const base::Optional<cryptauth::RemoteDeviceRef>& host_device) = 0;
+        const base::Optional<cryptauth::RemoteDeviceRef>& host_device) {}
+
+    // Called whenever the state of any feature has changed.
+    virtual void OnFeatureStatesChanged(
+        const FeatureStatesMap& feature_states_map) {}
 
    protected:
     virtual ~Observer() = default;
@@ -54,6 +61,12 @@
       mojom::MultiDeviceSetup::SetHostDeviceCallback callback) = 0;
   virtual void RemoveHostDevice() = 0;
   virtual void GetHostStatus(GetHostStatusCallback callback) = 0;
+  virtual void SetFeatureEnabledState(
+      mojom::Feature feature,
+      bool enabled,
+      mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback callback) = 0;
+  virtual void GetFeatureStates(
+      mojom::MultiDeviceSetup::GetFeatureStatesCallback callback) = 0;
   virtual void RetrySetHostNow(
       mojom::MultiDeviceSetup::RetrySetHostNowCallback callback) = 0;
   virtual void TriggerEventForDebugging(
@@ -64,6 +77,7 @@
   void NotifyHostStatusChanged(
       mojom::HostStatus host_status,
       const base::Optional<cryptauth::RemoteDeviceRef>& host_device);
+  void NotifyFeatureStateChanged(const FeatureStatesMap& feature_states_map);
 
  private:
   base::ObserverList<Observer> observer_list_;

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.cc b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.cc
index 60ce25b..8283d7c 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.cc
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.cc

@@ -47,11 +47,15 @@
 
 MultiDeviceSetupClientImpl::MultiDeviceSetupClientImpl(
     service_manager::Connector* connector)
-    : binding_(this),
+    : host_status_observer_binding_(this),
+      feature_state_observer_binding_(this),
       remote_device_cache_(
           cryptauth::RemoteDeviceCache::Factory::Get()->BuildInstance()) {
   connector->BindInterface(mojom::kServiceName, &multidevice_setup_ptr_);
-  multidevice_setup_ptr_->AddHostStatusObserver(GenerateInterfacePtr());
+  multidevice_setup_ptr_->AddHostStatusObserver(
+      GenerateHostStatusObserverInterfacePtr());
+  multidevice_setup_ptr_->AddFeatureStateObserver(
+      GenerateFeatureStatesObserverInterfacePtr());
 }
 
 MultiDeviceSetupClientImpl::~MultiDeviceSetupClientImpl() = default;
@@ -79,6 +83,19 @@
                      base::Unretained(this), std::move(callback)));
 }
 
+void MultiDeviceSetupClientImpl::SetFeatureEnabledState(
+    mojom::Feature feature,
+    bool enabled,
+    mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback callback) {
+  multidevice_setup_ptr_->SetFeatureEnabledState(feature, enabled,
+                                                 std::move(callback));
+}
+
+void MultiDeviceSetupClientImpl::GetFeatureStates(
+    mojom::MultiDeviceSetup::GetFeatureStatesCallback callback) {
+  multidevice_setup_ptr_->GetFeatureStates(std::move(callback));
+}
+
 void MultiDeviceSetupClientImpl::RetrySetHostNow(
     mojom::MultiDeviceSetup::RetrySetHostNowCallback callback) {
   multidevice_setup_ptr_->RetrySetHostNow(std::move(callback));
@@ -102,6 +119,11 @@
   }
 }
 
+void MultiDeviceSetupClientImpl::OnFeatureStatesChanged(
+    const FeatureStatesMap& feature_states_map) {
+  NotifyFeatureStateChanged(feature_states_map);
+}
+
 void MultiDeviceSetupClientImpl::OnGetEligibleHostDevicesCompleted(
     GetEligibleHostDevicesCallback callback,
     const cryptauth::RemoteDeviceList& eligible_host_devices) {
@@ -132,9 +154,16 @@
 }
 
 mojom::HostStatusObserverPtr
-MultiDeviceSetupClientImpl::GenerateInterfacePtr() {
+MultiDeviceSetupClientImpl::GenerateHostStatusObserverInterfacePtr() {
   mojom::HostStatusObserverPtr interface_ptr;
-  binding_.Bind(mojo::MakeRequest(&interface_ptr));
+  host_status_observer_binding_.Bind(mojo::MakeRequest(&interface_ptr));
+  return interface_ptr;
+}
+
+mojom::FeatureStateObserverPtr
+MultiDeviceSetupClientImpl::GenerateFeatureStatesObserverInterfacePtr() {
+  mojom::FeatureStateObserverPtr interface_ptr;
+  feature_state_observer_binding_.Bind(mojo::MakeRequest(&interface_ptr));
   return interface_ptr;
 }
 

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.h b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.h
index f266f2b..6dcfd82 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.h
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl.h

@@ -28,7 +28,8 @@
 
 // Concrete implementation of MultiDeviceSetupClient.
 class MultiDeviceSetupClientImpl : public MultiDeviceSetupClient,
-                                   public mojom::HostStatusObserver {
+                                   public mojom::HostStatusObserver,
+                                   public mojom::FeatureStateObserver {
  public:
   class Factory {
    public:
@@ -51,6 +52,13 @@
       mojom::MultiDeviceSetup::SetHostDeviceCallback callback) override;
   void RemoveHostDevice() override;
   void GetHostStatus(GetHostStatusCallback callback) override;
+  void SetFeatureEnabledState(
+      mojom::Feature feature,
+      bool enabled,
+      mojom::MultiDeviceSetup::SetFeatureEnabledStateCallback callback)
+      override;
+  void GetFeatureStates(
+      mojom::MultiDeviceSetup::GetFeatureStatesCallback callback) override;
   void RetrySetHostNow(
       mojom::MultiDeviceSetup::RetrySetHostNowCallback callback) override;
   void TriggerEventForDebugging(
@@ -63,6 +71,10 @@
       mojom::HostStatus host_status,
       const base::Optional<cryptauth::RemoteDevice>& host_device) override;
 
+  // mojom::FeatureStateObserver:
+  void OnFeatureStatesChanged(
+      const FeatureStatesMap& feature_states_map) override;
+
  private:
   friend class MultiDeviceSetupClientImplTest;
 
@@ -76,12 +88,14 @@
       mojom::HostStatus host_status,
       const base::Optional<cryptauth::RemoteDevice>& host_device);
 
-  mojom::HostStatusObserverPtr GenerateInterfacePtr();
+  mojom::HostStatusObserverPtr GenerateHostStatusObserverInterfacePtr();
+  mojom::FeatureStateObserverPtr GenerateFeatureStatesObserverInterfacePtr();
 
   void FlushForTesting();
 
   mojom::MultiDeviceSetupPtr multidevice_setup_ptr_;
-  mojo::Binding<mojom::HostStatusObserver> binding_;
+  mojo::Binding<mojom::HostStatusObserver> host_status_observer_binding_;
+  mojo::Binding<mojom::FeatureStateObserver> feature_state_observer_binding_;
   std::unique_ptr<cryptauth::RemoteDeviceCache> remote_device_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(MultiDeviceSetupClientImpl);

diff --git a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc
index 264579d..3cecf25 100644
--- a/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc
+++ b/chromeos/services/multidevice_setup/public/cpp/multidevice_setup_client_impl_unittest.cc

@@ -217,6 +217,57 @@
     }
   }
 
+  void CallSetFeatureEnabledState(mojom::Feature feature,
+                                  bool enabled,
+                                  bool should_succeed) {
+    size_t num_set_feature_enabled_args_before_call =
+        fake_multidevice_setup_->set_feature_enabled_args().size();
+
+    base::RunLoop run_loop;
+    client_->SetFeatureEnabledState(
+        feature, enabled,
+        base::BindOnce(
+            &MultiDeviceSetupClientImplTest::OnSetFeatureEnabledStateCompleted,
+            base::Unretained(this), run_loop.QuitClosure()));
+    SendPendingMojoMessages();
+
+    EXPECT_EQ(num_set_feature_enabled_args_before_call + 1u,
+              fake_multidevice_setup_->set_feature_enabled_args().size());
+    EXPECT_EQ(feature,
+              std::get<0>(
+                  fake_multidevice_setup_->set_feature_enabled_args().back()));
+    EXPECT_EQ(enabled,
+              std::get<1>(
+                  fake_multidevice_setup_->set_feature_enabled_args().back()));
+    std::move(
+        std::get<2>(fake_multidevice_setup_->set_feature_enabled_args().back()))
+        .Run(should_succeed /* success */);
+
+    run_loop.Run();
+    EXPECT_EQ(should_succeed, *set_feature_enabled_state_success_);
+  }
+
+  void CallGetFeatureStates(
+      const base::flat_map<mojom::Feature, mojom::FeatureState>&
+          expected_feature_states_map) {
+    size_t num_get_feature_states_args_before_call =
+        fake_multidevice_setup_->get_feature_states_args().size();
+
+    base::RunLoop run_loop;
+    client_->GetFeatureStates(base::BindOnce(
+        &MultiDeviceSetupClientImplTest::OnGetFeatureStatesCompleted,
+        base::Unretained(this), run_loop.QuitClosure()));
+    SendPendingMojoMessages();
+
+    EXPECT_EQ(num_get_feature_states_args_before_call + 1u,
+              fake_multidevice_setup_->get_feature_states_args().size());
+    std::move(fake_multidevice_setup_->get_feature_states_args().back())
+        .Run(expected_feature_states_map);
+
+    run_loop.Run();
+    EXPECT_EQ(expected_feature_states_map, *get_feature_states_result_);
+  }
+
   void CallRetrySetHostNow(bool expect_success) {
     base::RunLoop run_loop;
 
@@ -305,6 +356,20 @@
     std::move(quit_closure).Run();
   }
 
+  void OnSetFeatureEnabledStateCompleted(base::OnceClosure quit_closure,
+                                         bool success) {
+    set_feature_enabled_state_success_ = success;
+    std::move(quit_closure).Run();
+  }
+
+  void OnGetFeatureStatesCompleted(
+      base::OnceClosure quit_closure,
+      const base::flat_map<mojom::Feature, mojom::FeatureState>&
+          feature_states_map) {
+    get_feature_states_result_ = feature_states_map;
+    std::move(quit_closure).Run();
+  }
+
   void OnRetrySetHostNowCompleted(base::OnceClosure quit_closure,
                                   bool success) {
     retry_set_host_now_success_ = success;
@@ -330,6 +395,9 @@
   base::Optional<
       std::pair<mojom::HostStatus, base::Optional<cryptauth::RemoteDeviceRef>>>
       get_host_status_result_;
+  base::Optional<bool> set_feature_enabled_state_success_;
+  base::Optional<base::flat_map<mojom::Feature, mojom::FeatureState>>
+      get_feature_states_result_;
   base::Optional<bool> retry_set_host_now_success_;
   base::Optional<bool> trigger_event_for_debugging_success_;
 
@@ -374,6 +442,19 @@
                     base::nullopt /* expected_host_device */);
 }
 
+TEST_F(MultiDeviceSetupClientImplTest, SetFeatureEnabledState) {
+  CallSetFeatureEnabledState(mojom::Feature::kBetterTogetherSuite,
+                             true /* enabled */, true /* should_succeed */);
+  CallSetFeatureEnabledState(mojom::Feature::kBetterTogetherSuite,
+                             false /* enabled */, false /* should_succeed */);
+  CallSetFeatureEnabledState(mojom::Feature::kBetterTogetherSuite,
+                             false /* enabled */, true /* should_succeed */);
+}
+
+TEST_F(MultiDeviceSetupClientImplTest, GetFeatureState) {
+  CallGetFeatureStates(base::flat_map<mojom::Feature, mojom::FeatureState>());
+}
+
 TEST_F(MultiDeviceSetupClientImplTest, TestRetrySetHostNow_Success) {
   CallRetrySetHostNow(true /* expect_success */);
 }

diff --git a/chromeos/timezone/timezone_request.cc b/chromeos/timezone/timezone_request.cc
index c711dfbf..5da4219 100644
--- a/chromeos/timezone/timezone_request.cc
+++ b/chromeos/timezone/timezone_request.cc

@@ -340,11 +340,8 @@
   url_fetcher_ =
       net::URLFetcher::Create(request_url_, net::URLFetcher::GET, this);
   url_fetcher_->SetRequestContext(url_context_getter_.get());
-  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE |
-                             net::LOAD_DISABLE_CACHE |
-                             net::LOAD_DO_NOT_SAVE_COOKIES |
-                             net::LOAD_DO_NOT_SEND_COOKIES |
-                             net::LOAD_DO_NOT_SEND_AUTH_DATA);
+  url_fetcher_->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE);
+  url_fetcher_->SetAllowCredentials(false);
   url_fetcher_->Start();
 }
 

diff --git a/components/captive_portal/captive_portal_detector.cc b/components/captive_portal/captive_portal_detector.cc
index cf142c1..cb15424 100644
--- a/components/captive_portal/captive_portal_detector.cc
+++ b/components/captive_portal/captive_portal_detector.cc

@@ -38,11 +38,10 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = url;
 
-  // Can't safely use net::LOAD_DISABLE_CERT_NETWORK_FETCHES here,
+  // Can't safely use net::LOAD_DISABLE_CERT_REVOCATION_CHECKING here,
   // since then the connection may be reused without checking the cert.
-  resource_request->load_flags =
-      net::LOAD_BYPASS_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES |
-      net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->load_flags = net::LOAD_BYPASS_CACHE;
+  resource_request->allow_credentials = false;
 
   // TODO(jam): switch to using ServiceURLLoader to track data measurement once
   // https://crbug.com/808498 is fixed.

diff --git a/components/cast_channel/cast_socket.cc b/components/cast_channel/cast_socket.cc
index 8aaff00..a7b3206 100644
--- a/components/cast_channel/cast_socket.cc
+++ b/components/cast_channel/cast_socket.cc

@@ -85,7 +85,6 @@
     verify_result->verified_cert = params.certificate();
     return net::OK;
   }
-  void SetConfig(const Config& config) override {}
 };
 
 }  // namespace

diff --git a/components/cronet/ios/Cronet.mm b/components/cronet/ios/Cronet.mm
index 28b05fb..6f061d1 100644
--- a/components/cronet/ios/Cronet.mm
+++ b/components/cronet/ios/Cronet.mm

@@ -86,7 +86,6 @@
     verify_result->cert_status = net::MapNetErrorToCertStatus(result);
     return result;
   }
-  void SetConfig(const Config& config) override {}
 };
 
 // net::HTTPProtocolHandlerDelegate for Cronet.

diff --git a/components/dom_distiller/core/javascript/dom_distiller_viewer.js b/components/dom_distiller/core/javascript/dom_distiller_viewer.js
index 61ef521..8030cb1 100644
--- a/components/dom_distiller/core/javascript/dom_distiller_viewer.js
+++ b/components/dom_distiller/core/javascript/dom_distiller_viewer.js

@@ -204,8 +204,8 @@
   function restoreCenter() {
     var rect = focusElement.getBoundingClientRect();
     var targetTop = focusPos * (rect.bottom - rect.top) + rect.top +
-        document.body.scrollTop - (initClientMid.y + shiftY);
-    document.body.scrollTop = targetTop;
+        document.scrollingElement.scrollTop - (initClientMid.y + shiftY);
+    document.scrollingElement.scrollTop = targetTop;
   }
 
   function endPinch() {
@@ -361,7 +361,11 @@
   };
 }());
 
-window.addEventListener('touchstart', pincher.handleTouchStart, false);
-window.addEventListener('touchmove', pincher.handleTouchMove, false);
-window.addEventListener('touchend', pincher.handleTouchEnd, false);
-window.addEventListener('touchcancel', pincher.handleTouchCancel, false);
+window.addEventListener(
+  'touchstart', pincher.handleTouchStart, {passive: false});
+window.addEventListener(
+  'touchmove', pincher.handleTouchMove, {passive: false});
+window.addEventListener(
+  'touchend', pincher.handleTouchEnd, {passive: false});
+window.addEventListener(
+  'touchcancel', pincher.handleTouchCancel, {passive: false});

diff --git a/components/drive/chromeos/change_list_processor.cc b/components/drive/chromeos/change_list_processor.cc
index 5657eda..4e9d502 100644
--- a/components/drive/chromeos/change_list_processor.cc
+++ b/components/drive/chromeos/change_list_processor.cc

@@ -164,19 +164,42 @@
     }
   }
 
+  // Update the resource ID of the entry, if required.
+
+  // Multiple team drives can have the same root_entry_path_, so try looking up
+  // via the team_drive_id first.
   ResourceEntry root;
-  // Update the resource ID of the entry for "My Drive" directory.
-  FileError error =
-      resource_metadata_->GetResourceEntryByPath(root_entry_path_, &root);
-  if (error != FILE_ERROR_OK) {
-    LOG(ERROR) << "Failed to get root entry: " << FileErrorToString(error);
-    return error;
+  FileError error = FILE_ERROR_OK;
+  if (!team_drive_id_.empty()) {
+    std::string local_id;
+    error = resource_metadata_->GetIdByResourceId(team_drive_id_, &local_id);
+    if (error != FILE_ERROR_OK) {
+      LOG(ERROR) << "Failed to get team drive local id: "
+                 << FileErrorToString(error);
+      return error;
+    }
+    error = resource_metadata_->GetResourceEntryById(local_id, &root);
+    if (error != FILE_ERROR_OK) {
+      LOG(ERROR) << "Failed to get team drive root entry: "
+                 << FileErrorToString(error);
+      return error;
+    }
+  } else {
+    error = resource_metadata_->GetResourceEntryByPath(root_entry_path_, &root);
+    if (error != FILE_ERROR_OK) {
+      LOG(ERROR) << "Failed to get root entry: " << FileErrorToString(error);
+      return error;
+    }
   }
-  root.set_resource_id(root_resource_id);
-  error = resource_metadata_->RefreshEntry(root);
-  if (error != FILE_ERROR_OK) {
-    LOG(ERROR) << "Failed to update root entry: " << FileErrorToString(error);
-    return error;
+  // Only update if the root resource id has changed. This will happen for the
+  // default corpus on the first load, as we obtain the resource id lazily.
+  if (root_resource_id != root.resource_id()) {
+    root.set_resource_id(root_resource_id);
+    error = resource_metadata_->RefreshEntry(root);
+    if (error != FILE_ERROR_OK) {
+      LOG(ERROR) << "Failed to update root entry: " << FileErrorToString(error);
+      return error;
+    }
   }
 
   ChangeListToEntryMapUMAStats uma_stats;

diff --git a/components/drive/chromeos/file_system.cc b/components/drive/chromeos/file_system.cc
index 857a41cb..787c9cca 100644
--- a/components/drive/chromeos/file_system.cc
+++ b/components/drive/chromeos/file_system.cc

@@ -663,9 +663,11 @@
   DCHECK(completion_callback);
 
   if (util::GetDriveTeamDrivesRootPath().IsParent(directory_path)) {
-    // TODO(slangley): It would be nice to cache the result, rather than needing
-    // to iterate every time. But then most users have very few team drives so
-    // in general this is fine.
+    // If we do not match a single team drive then we will run the default
+    // corpus loader to read the directory. More than one team drive may match
+    // the path so we loop through all of them (team drive roots may have the
+    // same name).
+    bool matched_team_drive = false;
     for (auto& team_drive_loader : team_drive_change_list_loaders_) {
       const base::FilePath& team_drive_path =
           team_drive_loader.second->root_entry_path();
@@ -673,10 +675,14 @@
           team_drive_path.IsParent(directory_path)) {
         team_drive_loader.second->ReadDirectory(
             directory_path, entries_callback, completion_callback);
-        return;
+        matched_team_drive = true;
       }
     }
-    DVLOG(1) << "No team drive loader for path, " << directory_path;
+    if (matched_team_drive) {
+      return;
+    } else {
+      DVLOG(1) << "No team drive loader for path, " << directory_path;
+    }
   }
   // Fall through to the default corpus loader if no team drive loader is found.
   // We do not refresh the list of team drives from the server until the first

diff --git a/components/drive/file_system_unittest.cc b/components/drive/file_system_unittest.cc
index 0f2ce34..f617406 100644
--- a/components/drive/file_system_unittest.cc
+++ b/components/drive/file_system_unittest.cc

@@ -337,6 +337,7 @@
   bool SetupTeamDrives() {
     fake_drive_service_->AddTeamDrive("td_id_1", "team_drive_1", "");
     fake_drive_service_->AddTeamDrive("td_id_2", "team_drive_2", "");
+    fake_drive_service_->AddTeamDrive("td_id_2_2", "team_drive_2", "");
 
     google_apis::DriveApiErrorCode error = google_apis::DRIVE_OTHER_ERROR;
     std::unique_ptr<google_apis::FileResource> entry;
@@ -395,6 +396,15 @@
     if (error != google_apis::HTTP_CREATED)
       return false;
 
+    fake_drive_service_->AddNewFileWithResourceId(
+        "td_2_2_dir_1_resource_id", util::kDriveFolderMimeType, std::string(),
+        "td_id_2_2", "dir1",
+        false,  // shared_with_me
+        google_apis::test_util::CreateCopyResultCallback(&error, &entry));
+    base::RunLoop().RunUntilIdle();
+    if (error != google_apis::HTTP_CREATED)
+      return false;
+
     return true;
   }
 
@@ -802,7 +812,6 @@
                     util::kDriveTeamDrivesDirName)));
 }
 
-// TODO(slamgley): Add more tests for team drives.
 TEST_F(FileSystemTest, ReadDirectory_TeamDrivesRoot) {
   ASSERT_NO_FATAL_FAILURE(SetUpTestFileSystem(USE_SERVER_TIMESTAMP));
   ASSERT_TRUE(SetupTeamDrives());
@@ -815,17 +824,17 @@
       ReadDirectorySync(base::FilePath::FromUTF8Unsafe("drive/team_drives")));
   // The root directory should be read correctly.
   ASSERT_TRUE(entries);
-  ASSERT_EQ(2U, entries->size());
+  ASSERT_EQ(3U, entries->size());
 
-  std::set<base::FilePath> found;
+  std::multiset<base::FilePath> found;
   for (size_t i = 0; i < entries->size(); ++i) {
     found.insert(base::FilePath::FromUTF8Unsafe((*entries)[i].title()));
   }
-  EXPECT_EQ(2U, found.size());
+  EXPECT_EQ(3U, found.size());
   EXPECT_EQ(1U, found.count(base::FilePath::FromUTF8Unsafe("team_drive_1")));
-  EXPECT_EQ(1U, found.count(base::FilePath::FromUTF8Unsafe("team_drive_2")));
+  EXPECT_EQ(2U, found.count(base::FilePath::FromUTF8Unsafe("team_drive_2")));
   EXPECT_EQ(1, fake_drive_service_->team_drive_list_load_count());
-  EXPECT_EQ(2, fake_drive_service_->file_list_load_count());
+  EXPECT_EQ(3, fake_drive_service_->file_list_load_count());
 
   // We should be able to read from drive/team_drives/team_drive_1
   std::unique_ptr<ResourceEntryVector> team_drive_1_entries(ReadDirectorySync(
@@ -898,11 +907,11 @@
       ReadDirectorySync(base::FilePath::FromUTF8Unsafe("drive/team_drives/")));
   // The root directory should be read correctly.
   ASSERT_TRUE(entries);
-  std::set<base::FilePath> found;
+  std::multiset<base::FilePath> found;
   for (size_t i = 0; i < entries->size(); ++i) {
     found.insert(base::FilePath::FromUTF8Unsafe((*entries)[i].title()));
   }
-  EXPECT_EQ(3U, found.size());
+  EXPECT_EQ(4U, found.size());
   EXPECT_EQ(1U, found.count(base::FilePath::FromUTF8Unsafe("team_drive_3")));
 
   // Add a new entry to drive/team_drives/team_drive_3
@@ -1337,24 +1346,32 @@
   EXPECT_LE(now, default_corpus_metadata.last_update_check_time);
   EXPECT_FALSE(default_corpus_metadata.refreshing);
   EXPECT_EQ(FILE_ERROR_OK, default_corpus_metadata.last_update_check_error);
-  EXPECT_EQ("654339", default_corpus_metadata.start_page_token);
+  EXPECT_EQ("654340", default_corpus_metadata.start_page_token);
 
-  EXPECT_EQ(2UL, team_drive_metadata.size());
+  EXPECT_EQ(3UL, team_drive_metadata.size());
   EXPECT_FALSE(team_drive_metadata["td_id_1"].refreshing);
   EXPECT_EQ(util::GetDriveTeamDrivesRootPath().Append("team_drive_1").value(),
             team_drive_metadata["td_id_1"].path);
   EXPECT_LE(now, team_drive_metadata["td_id_1"].last_update_check_time);
-  EXPECT_EQ("654344", team_drive_metadata["td_id_1"].start_page_token);
+  EXPECT_EQ("654345", team_drive_metadata["td_id_1"].start_page_token);
   EXPECT_EQ(FILE_ERROR_OK,
             team_drive_metadata["td_id_1"].last_update_check_error);
 
   EXPECT_FALSE(team_drive_metadata["td_id_2"].refreshing);
   EXPECT_EQ(util::GetDriveTeamDrivesRootPath().Append("team_drive_2").value(),
             team_drive_metadata["td_id_2"].path);
-  EXPECT_LE(now, team_drive_metadata["td_id_1"].last_update_check_time);
-  EXPECT_EQ("654345", team_drive_metadata["td_id_2"].start_page_token);
+  EXPECT_LE(now, team_drive_metadata["td_id_2"].last_update_check_time);
+  EXPECT_EQ("654346", team_drive_metadata["td_id_2"].start_page_token);
   EXPECT_EQ(FILE_ERROR_OK,
             team_drive_metadata["td_id_2"].last_update_check_error);
+
+  EXPECT_FALSE(team_drive_metadata["td_id_2_2"].refreshing);
+  EXPECT_EQ(util::GetDriveTeamDrivesRootPath().Append("team_drive_2").value(),
+            team_drive_metadata["td_id_2_2"].path);
+  EXPECT_LE(now, team_drive_metadata["td_id_2_2"].last_update_check_time);
+  EXPECT_EQ("654347", team_drive_metadata["td_id_2_2"].start_page_token);
+  EXPECT_EQ(FILE_ERROR_OK,
+            team_drive_metadata["td_id_2_2"].last_update_check_error);
 }
 
 }   // namespace drive

diff --git a/components/feed/core/feed_networking_host.cc b/components/feed/core/feed_networking_host.cc
index e40bc2d..510ce96 100644
--- a/components/feed/core/feed_networking_host.cc
+++ b/components/feed/core/feed_networking_host.cc

@@ -174,9 +174,8 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = url;
 
-  resource_request->load_flags =
-      net::LOAD_BYPASS_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES |
-      net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->load_flags = net::LOAD_BYPASS_CACHE;
+  resource_request->allow_credentials = false;
   resource_request->headers = headers;
   resource_request->method = request_type_;
 

diff --git a/components/metrics/BUILD.gn b/components/metrics/BUILD.gn
index 78d7f46..dd6af90 100644
--- a/components/metrics/BUILD.gn
+++ b/components/metrics/BUILD.gn

@@ -261,6 +261,8 @@
   sources = [
     "call_stack_profile_builder.cc",
     "call_stack_profile_builder.h",
+    "call_stack_profile_encoding.cc",
+    "call_stack_profile_encoding.h",
     "call_stack_profile_params.h",
   ]
 

diff --git a/components/metrics/call_stack_profile_builder.cc b/components/metrics/call_stack_profile_builder.cc
index d2b76a7..14b0cf2 100644
--- a/components/metrics/call_stack_profile_builder.cc
+++ b/components/metrics/call_stack_profile_builder.cc

@@ -12,6 +12,7 @@
 #include "base/logging.h"
 #include "base/metrics/metrics_hashes.h"
 #include "base/stl_util.h"
+#include "components/metrics/call_stack_profile_encoding.h"
 
 namespace metrics {
 
@@ -114,70 +115,6 @@
   }
 }
 
-// Translates CallStackProfileParams's process to the corresponding execution
-// context Process.
-Process ToExecutionContextProcess(CallStackProfileParams::Process process) {
-  switch (process) {
-    case CallStackProfileParams::UNKNOWN_PROCESS:
-      return UNKNOWN_PROCESS;
-    case CallStackProfileParams::BROWSER_PROCESS:
-      return BROWSER_PROCESS;
-    case CallStackProfileParams::RENDERER_PROCESS:
-      return RENDERER_PROCESS;
-    case CallStackProfileParams::GPU_PROCESS:
-      return GPU_PROCESS;
-    case CallStackProfileParams::UTILITY_PROCESS:
-      return UTILITY_PROCESS;
-    case CallStackProfileParams::ZYGOTE_PROCESS:
-      return ZYGOTE_PROCESS;
-    case CallStackProfileParams::SANDBOX_HELPER_PROCESS:
-      return SANDBOX_HELPER_PROCESS;
-    case CallStackProfileParams::PPAPI_PLUGIN_PROCESS:
-      return PPAPI_PLUGIN_PROCESS;
-    case CallStackProfileParams::PPAPI_BROKER_PROCESS:
-      return PPAPI_BROKER_PROCESS;
-  }
-  NOTREACHED();
-  return UNKNOWN_PROCESS;
-}
-
-// Translates CallStackProfileParams's thread to the corresponding
-// SampledProfile Thread.
-Thread ToExecutionContextThread(CallStackProfileParams::Thread thread) {
-  switch (thread) {
-    case CallStackProfileParams::UNKNOWN_THREAD:
-      return UNKNOWN_THREAD;
-    case CallStackProfileParams::MAIN_THREAD:
-      return MAIN_THREAD;
-    case CallStackProfileParams::IO_THREAD:
-      return IO_THREAD;
-    case CallStackProfileParams::COMPOSITOR_THREAD:
-      return COMPOSITOR_THREAD;
-  }
-  NOTREACHED();
-  return UNKNOWN_THREAD;
-}
-
-// Translates CallStackProfileParams's trigger to the corresponding
-// SampledProfile TriggerEvent.
-SampledProfile::TriggerEvent ToSampledProfileTriggerEvent(
-    CallStackProfileParams::Trigger trigger) {
-  switch (trigger) {
-    case CallStackProfileParams::UNKNOWN:
-      return SampledProfile::UNKNOWN_TRIGGER_EVENT;
-    case CallStackProfileParams::PROCESS_STARTUP:
-      return SampledProfile::PROCESS_STARTUP;
-    case CallStackProfileParams::JANKY_TASK:
-      return SampledProfile::JANKY_TASK;
-    case CallStackProfileParams::THREAD_HUNG:
-      return SampledProfile::THREAD_HUNG;
-    case CallStackProfileParams::PERIODIC_COLLECTION:
-      return SampledProfile::PERIODIC_COLLECTION;
-  }
-  NOTREACHED();
-  return SampledProfile::UNKNOWN_TRIGGER_EVENT;
-}
-
 }  // namespace
 
 // CallStackProfileBuilder::Frame ---------------------------------------------

diff --git a/components/metrics/call_stack_profile_collector.cc b/components/metrics/call_stack_profile_collector.cc
index 8666aa88..38633314 100644
--- a/components/metrics/call_stack_profile_collector.cc
+++ b/components/metrics/call_stack_profile_collector.cc

@@ -7,42 +7,12 @@
 #include <memory>
 #include <utility>
 
+#include "components/metrics/call_stack_profile_encoding.h"
 #include "components/metrics/call_stack_profile_metrics_provider.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 
 namespace metrics {
 
-namespace {
-
-// Translates CallStackProfileParams's process to the corresponding execution
-// context Process.
-Process ToExecutionContextProcess(CallStackProfileParams::Process process) {
-  switch (process) {
-    case CallStackProfileParams::UNKNOWN_PROCESS:
-      return UNKNOWN_PROCESS;
-    case CallStackProfileParams::BROWSER_PROCESS:
-      return BROWSER_PROCESS;
-    case CallStackProfileParams::RENDERER_PROCESS:
-      return RENDERER_PROCESS;
-    case CallStackProfileParams::GPU_PROCESS:
-      return GPU_PROCESS;
-    case CallStackProfileParams::UTILITY_PROCESS:
-      return UTILITY_PROCESS;
-    case CallStackProfileParams::ZYGOTE_PROCESS:
-      return ZYGOTE_PROCESS;
-    case CallStackProfileParams::SANDBOX_HELPER_PROCESS:
-      return SANDBOX_HELPER_PROCESS;
-    case CallStackProfileParams::PPAPI_PLUGIN_PROCESS:
-      return PPAPI_PLUGIN_PROCESS;
-    case CallStackProfileParams::PPAPI_BROKER_PROCESS:
-      return PPAPI_BROKER_PROCESS;
-  }
-  NOTREACHED();
-  return UNKNOWN_PROCESS;
-}
-
-}  // namespace
-
 CallStackProfileCollector::CallStackProfileCollector(
     CallStackProfileParams::Process expected_process)
     : expected_process_(expected_process) {}

diff --git a/components/metrics/call_stack_profile_encoding.cc b/components/metrics/call_stack_profile_encoding.cc
new file mode 100644
index 0000000..5d6a111b8
--- /dev/null
+++ b/components/metrics/call_stack_profile_encoding.cc

@@ -0,0 +1,67 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/metrics/call_stack_profile_encoding.h"
+
+namespace metrics {
+
+Process ToExecutionContextProcess(CallStackProfileParams::Process process) {
+  switch (process) {
+    case CallStackProfileParams::UNKNOWN_PROCESS:
+      return UNKNOWN_PROCESS;
+    case CallStackProfileParams::BROWSER_PROCESS:
+      return BROWSER_PROCESS;
+    case CallStackProfileParams::RENDERER_PROCESS:
+      return RENDERER_PROCESS;
+    case CallStackProfileParams::GPU_PROCESS:
+      return GPU_PROCESS;
+    case CallStackProfileParams::UTILITY_PROCESS:
+      return UTILITY_PROCESS;
+    case CallStackProfileParams::ZYGOTE_PROCESS:
+      return ZYGOTE_PROCESS;
+    case CallStackProfileParams::SANDBOX_HELPER_PROCESS:
+      return SANDBOX_HELPER_PROCESS;
+    case CallStackProfileParams::PPAPI_PLUGIN_PROCESS:
+      return PPAPI_PLUGIN_PROCESS;
+    case CallStackProfileParams::PPAPI_BROKER_PROCESS:
+      return PPAPI_BROKER_PROCESS;
+  }
+  NOTREACHED();
+  return UNKNOWN_PROCESS;
+}
+
+Thread ToExecutionContextThread(CallStackProfileParams::Thread thread) {
+  switch (thread) {
+    case CallStackProfileParams::UNKNOWN_THREAD:
+      return UNKNOWN_THREAD;
+    case CallStackProfileParams::MAIN_THREAD:
+      return MAIN_THREAD;
+    case CallStackProfileParams::IO_THREAD:
+      return IO_THREAD;
+    case CallStackProfileParams::COMPOSITOR_THREAD:
+      return COMPOSITOR_THREAD;
+  }
+  NOTREACHED();
+  return UNKNOWN_THREAD;
+}
+
+SampledProfile::TriggerEvent ToSampledProfileTriggerEvent(
+    CallStackProfileParams::Trigger trigger) {
+  switch (trigger) {
+    case CallStackProfileParams::UNKNOWN:
+      return SampledProfile::UNKNOWN_TRIGGER_EVENT;
+    case CallStackProfileParams::PROCESS_STARTUP:
+      return SampledProfile::PROCESS_STARTUP;
+    case CallStackProfileParams::JANKY_TASK:
+      return SampledProfile::JANKY_TASK;
+    case CallStackProfileParams::THREAD_HUNG:
+      return SampledProfile::THREAD_HUNG;
+    case CallStackProfileParams::PERIODIC_COLLECTION:
+      return SampledProfile::PERIODIC_COLLECTION;
+  }
+  NOTREACHED();
+  return SampledProfile::UNKNOWN_TRIGGER_EVENT;
+}
+
+}  // namespace metrics

diff --git a/components/metrics/call_stack_profile_encoding.h b/components/metrics/call_stack_profile_encoding.h
new file mode 100644
index 0000000..c71ace7
--- /dev/null
+++ b/components/metrics/call_stack_profile_encoding.h

@@ -0,0 +1,28 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_METRICS_CALL_STACK_PROFILE_ENCODING_H_
+#define COMPONENTS_METRICS_CALL_STACK_PROFILE_ENCODING_H_
+
+#include "components/metrics/call_stack_profile_params.h"
+#include "third_party/metrics_proto/sampled_profile.pb.h"
+
+namespace metrics {
+
+// Translates CallStackProfileParams's process to the corresponding execution
+// context Process.
+Process ToExecutionContextProcess(CallStackProfileParams::Process process);
+
+// Translates CallStackProfileParams's thread to the corresponding
+// SampledProfile Thread.
+Thread ToExecutionContextThread(CallStackProfileParams::Thread thread);
+
+// Translates CallStackProfileParams's trigger to the corresponding
+// SampledProfile TriggerEvent.
+SampledProfile::TriggerEvent ToSampledProfileTriggerEvent(
+    CallStackProfileParams::Trigger trigger);
+
+}  // namespace metrics
+
+#endif  // COMPONENTS_METRICS_CALL_STACK_PROFILE_ENCODING_H_

diff --git a/components/metrics/call_stack_profile_metrics_provider.cc b/components/metrics/call_stack_profile_metrics_provider.cc
index 91a73f6..e73d9ec2 100644
--- a/components/metrics/call_stack_profile_metrics_provider.cc
+++ b/components/metrics/call_stack_profile_metrics_provider.cc

@@ -166,14 +166,6 @@
 
 // Functions to process completed profile ------------------------------------
 
-// Will be invoked on either the main thread or the profiler's thread. Provides
-// the profile to PendingProfiles to append, if the collecting state allows.
-void ReceiveCompletedProfileImpl(base::TimeTicks start_timestamp,
-                                 SampledProfile profile) {
-  PendingProfiles::GetInstance()->CollectProfilesIfCollectionEnabled(
-      ProfileState(start_timestamp, std::move(profile)));
-}
-
 // Invoked on an arbitrary thread. Ignores the provided profile.
 void IgnoreCompletedProfile(SampledProfile profile) {}
 
@@ -188,6 +180,7 @@
 
 CallStackProfileMetricsProvider::~CallStackProfileMetricsProvider() {}
 
+// static
 CallStackProfileBuilder::CompletedCallback
 CallStackProfileMetricsProvider::GetProfilerCallbackForBrowserProcess() {
   // Ignore the profile if the collection is disabled. If the collection state
@@ -196,15 +189,17 @@
   if (!PendingProfiles::GetInstance()->IsCollectionEnabled())
     return base::BindRepeating(&IgnoreCompletedProfile);
 
-  return base::BindRepeating(&ReceiveCompletedProfileImpl,
-                             base::TimeTicks::Now());
+  return base::BindRepeating(
+      &CallStackProfileMetricsProvider::ReceiveCompletedProfile,
+      base::TimeTicks::Now());
 }
 
 // static
 void CallStackProfileMetricsProvider::ReceiveCompletedProfile(
     base::TimeTicks profile_start_time,
     SampledProfile profile) {
-  ReceiveCompletedProfileImpl(profile_start_time, std::move(profile));
+  PendingProfiles::GetInstance()->CollectProfilesIfCollectionEnabled(
+      ProfileState(profile_start_time, std::move(profile)));
 }
 
 void CallStackProfileMetricsProvider::OnRecordingEnabled() {

diff --git a/components/metrics/call_stack_profile_metrics_provider.h b/components/metrics/call_stack_profile_metrics_provider.h
index 978b4d2..2a78666e 100644
--- a/components/metrics/call_stack_profile_metrics_provider.h
+++ b/components/metrics/call_stack_profile_metrics_provider.h

@@ -29,10 +29,14 @@
   static CallStackProfileBuilder::CompletedCallback
   GetProfilerCallbackForBrowserProcess();
 
-  // Provides completed stack profile to the metrics provider. Intended for use
-  // when receiving profiles over IPC. In-process StackSamplingProfiler users
-  // should instead use a variant of GetProfilerCallback*(). |profile| is not
-  // const& because it must be passed with std::move.
+  // Will be invoked on either the main thread or the profiler's thread.
+  // Provides the profile to PendingProfiles to append, if the collecting state
+  // allows.
+  //
+  // Intended for use when receiving profiles over IPC. In-process
+  // StackSamplingProfiler users should instead use
+  // GetProfilerCallbackForBrowserProcess(). |profile| is not const& because it
+  // must be passed with std::move.
   static void ReceiveCompletedProfile(base::TimeTicks profile_start_time,
                                       SampledProfile profile);
 

diff --git a/components/metrics/net/net_metrics_log_uploader.cc b/components/metrics/net/net_metrics_log_uploader.cc
index a213b92..0d937ce 100644
--- a/components/metrics/net/net_metrics_log_uploader.cc
+++ b/components/metrics/net/net_metrics_log_uploader.cc

@@ -200,9 +200,7 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = url;
   // Drop cookies and auth data.
-  resource_request->load_flags = net::LOAD_DO_NOT_SEND_AUTH_DATA |
-                                 net::LOAD_DO_NOT_SEND_COOKIES |
-                                 net::LOAD_DO_NOT_SAVE_COOKIES;
+  resource_request->allow_credentials = false;
   resource_request->method = "POST";
 
   std::string reporting_info_string = SerializeReportingInfo(reporting_info);

diff --git a/components/network_time/network_time_tracker.cc b/components/network_time/network_time_tracker.cc
index fe7cc5eb..34386ad 100644
--- a/components/network_time/network_time_tracker.cc
+++ b/components/network_time/network_time_tracker.cc

@@ -472,9 +472,8 @@
   resource_request->url = url;
   // Not expecting any cookies, but just in case.
   resource_request->load_flags =
-      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE |
-      net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES |
-      net::LOAD_DO_NOT_SEND_AUTH_DATA;
+      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE;
+  resource_request->allow_credentials = false;
   // This cancels any outstanding fetch.
   time_fetcher_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                                    traffic_annotation);

diff --git a/components/quirks/quirks_client.cc b/components/quirks/quirks_client.cc
index ce0aa65..ca3c65b 100644
--- a/components/quirks/quirks_client.cc
+++ b/components/quirks/quirks_client.cc

@@ -88,9 +88,8 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GURL(url);
   resource_request->load_flags =
-      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE |
-      net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES |
-      net::LOAD_DO_NOT_SEND_AUTH_DATA;
+      net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE;
+  resource_request->allow_credentials = false;
 
   net::NetworkTrafficAnnotationTag traffic_annotation =
       net::DefineNetworkTrafficAnnotation("quirks_display_fetcher", R"(

diff --git a/components/variations/service/variations_service.cc b/components/variations/service/variations_service.cc
index 8195705..369b12ac 100644
--- a/components/variations/service/variations_service.cc
+++ b/components/variations/service/variations_service.cc

@@ -516,9 +516,7 @@
         })");
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = url;
-  resource_request->load_flags = net::LOAD_DO_NOT_SEND_COOKIES |
-                                 net::LOAD_DO_NOT_SEND_AUTH_DATA |
-                                 net::LOAD_DO_NOT_SAVE_COOKIES;
+  resource_request->allow_credentials = false;
   bool enable_deltas = false;
   std::string serial_number =
       field_trial_creator_.seed_store()->GetLatestSerialNumber();

diff --git a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
index 177753c..a821cd5 100644
--- a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc
+++ b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.cc

@@ -140,6 +140,13 @@
     synthetic_begin_frame_source_->OnUpdateVSyncParameters(timebase, interval);
 }
 
+#if defined(OS_ANDROID)
+void RootCompositorFrameSinkImpl::SetVSyncPaused(bool paused) {
+  if (external_begin_frame_source_)
+    external_begin_frame_source_->OnSetBeginFrameSourcePaused(paused);
+}
+#endif  // defined(OS_ANDROID)
+
 void RootCompositorFrameSinkImpl::SetNeedsBeginFrame(bool needs_begin_frame) {
   support_->SetNeedsBeginFrame(needs_begin_frame);
 }

diff --git a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.h b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.h
index 99eb2b4..94f3bb5e 100644
--- a/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.h
+++ b/components/viz/service/frame_sinks/root_compositor_frame_sink_impl.h

@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "build/build_config.h"
 #include "components/viz/common/surfaces/frame_sink_id.h"
 #include "components/viz/common/surfaces/local_surface_id.h"
 #include "components/viz/service/display/display_client.h"
@@ -49,6 +50,9 @@
   void SetAuthoritativeVSyncInterval(base::TimeDelta interval) override;
   void SetDisplayVSyncParameters(base::TimeTicks timebase,
                                  base::TimeDelta interval) override;
+#if defined(OS_ANDROID)
+  void SetVSyncPaused(bool paused) override;
+#endif
 
   // mojom::CompositorFrameSink:
   void SetNeedsBeginFrame(bool needs_begin_frame) override;

diff --git a/content/browser/DEPS b/content/browser/DEPS
index c1e6ddc..396a613d 100644
--- a/content/browser/DEPS
+++ b/content/browser/DEPS

@@ -103,7 +103,6 @@
   "+third_party/blink/public/platform/mac/web_scrollbar_theme.h",
   "+third_party/blink/public/platform/modules/font_unique_name_lookup/font_unique_name_lookup.mojom.h",
   "+third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h",
-  "+third_party/blink/public/platform/modules/indexeddb/web_idb_types.h",
   "+third_party/blink/public/platform/modules/locks/lock_manager.mojom.h",
   "+third_party/blink/public/platform/modules/notifications/web_notification_constants.h",
   "+third_party/blink/public/platform/modules/service_worker/web_service_worker_error.h",

diff --git a/content/browser/android/overscroll_controller_android_unittest.cc b/content/browser/android/overscroll_controller_android_unittest.cc
index 29fb140..707084f 100644
--- a/content/browser/android/overscroll_controller_android_unittest.cc
+++ b/content/browser/android/overscroll_controller_android_unittest.cc

@@ -48,6 +48,7 @@
     return nullptr;
   }
   bool IsDrawingFirstVisibleFrame() const override { return false; }
+  void SetVSyncPaused(bool paused) override {}
 };
 
 class MockGlowClient : public OverscrollGlowClient {

diff --git a/content/browser/find_in_page_client.cc b/content/browser/find_in_page_client.cc
index 6fc87f7..7812fe0c 100644
--- a/content/browser/find_in_page_client.cc
+++ b/content/browser/find_in_page_client.cc

@@ -23,10 +23,36 @@
     int request_id,
     unsigned int number_of_matches,
     blink::mojom::FindMatchUpdateType update_type) {
+  if (find_request_manager_->ShouldIgnoreReply(frame_, request_id))
+    return;
   const int old_matches = number_of_matches_;
   number_of_matches_ = number_of_matches;
   find_request_manager_->UpdatedFrameNumberOfMatches(frame_, old_matches,
                                                      number_of_matches);
+  HandleUpdateType(request_id, update_type);
+}
+
+void FindInPageClient::SetActiveMatch(
+    int request_id,
+    const gfx::Rect& active_match_rect,
+    int active_match_ordinal,
+    blink::mojom::FindMatchUpdateType update_type) {
+  if (find_request_manager_->ShouldIgnoreReply(frame_, request_id))
+    return;
+  find_request_manager_->SetActiveMatchRect(active_match_rect);
+  find_request_manager_->SetActiveMatchOrdinal(frame_, request_id,
+                                               active_match_ordinal);
+  HandleUpdateType(request_id, update_type);
+}
+
+void FindInPageClient::ActivateNearestFindResult(int request_id,
+                                                 const gfx::PointF& point) {
+  frame_->GetFindInPage()->ActivateNearestFindResult(request_id, point);
+}
+
+void FindInPageClient::HandleUpdateType(
+    int request_id,
+    blink::mojom::FindMatchUpdateType update_type) {
   // If this is the final update for this frame, it might be the final update
   // for the find request out of all the frames, so we need to handle it.
   // Otherwise just notify directly while saying this is not the final update
@@ -38,18 +64,4 @@
                                            false /* final_update */);
 }
 
-void FindInPageClient::SetActiveMatch(int request_id,
-                                      const gfx::Rect& active_match_rect,
-                                      int active_match_ordinal) {
-  find_request_manager_->SetActiveMatchRect(active_match_rect);
-  find_request_manager_->SetActiveMatchOrdinal(frame_, request_id,
-                                               active_match_ordinal);
-  find_request_manager_->HandleFinalUpdateForFrame(frame_, request_id);
-}
-
-void FindInPageClient::ActivateNearestFindResult(int request_id,
-                                                 const gfx::PointF& point) {
-  frame_->GetFindInPage()->ActivateNearestFindResult(request_id, point);
-}
-
 }  // namespace content

diff --git a/content/browser/find_in_page_client.h b/content/browser/find_in_page_client.h
index ecd3c472..083e457 100644
--- a/content/browser/find_in_page_client.h
+++ b/content/browser/find_in_page_client.h

@@ -31,13 +31,16 @@
 
   void SetNumberOfMatches(int request_id,
                           unsigned int current_number_of_matches,
-                          blink::mojom::FindMatchUpdateType final_update) final;
+                          blink::mojom::FindMatchUpdateType update_type) final;
 
   void SetActiveMatch(int request_id,
                       const gfx::Rect& active_match_rect,
-                      int active_match_ordinal) final;
+                      int active_match_ordinal,
+                      blink::mojom::FindMatchUpdateType update_type) final;
 
  private:
+  void HandleUpdateType(int request_id,
+                        blink::mojom::FindMatchUpdateType update_type);
   RenderFrameHostImpl* const frame_;
   FindRequestManager* const find_request_manager_;
   mojo::Binding<blink::mojom::FindInPageClient> binding_;

diff --git a/content/browser/find_request_manager.cc b/content/browser/find_request_manager.cc
index b9dc318..d35cb22 100644
--- a/content/browser/find_request_manager.cc
+++ b/content/browser/find_request_manager.cc

@@ -288,49 +288,11 @@
 #endif
 }
 
-void FindRequestManager::OnFindReply(RenderFrameHostImpl* rfh,
-                                     int request_id,
-                                     int number_of_matches,
-                                     const gfx::Rect& selection_rect,
-                                     int active_match_ordinal,
-                                     bool final_update) {
+bool FindRequestManager::ShouldIgnoreReply(RenderFrameHostImpl* rfh,
+                                           int request_id) {
   // Ignore stale replies from abandoned find sessions or dead frames.
-  if (current_session_id_ == kInvalidId ||
-      request_id < current_session_id_ ||
-      !CheckFrame(rfh)) {
-    return;
-  }
-
-  // Update the stored find results.
-
-  DCHECK_GE(number_of_matches, -1);
-  DCHECK_GE(active_match_ordinal, -1);
-
-  // Check for an update to the selection rect.
-  if (!selection_rect.IsEmpty())
-    SetActiveMatchRect(selection_rect);
-
-  // Check for an update to the active match ordinal.
-  if (active_match_ordinal > 0)
-    SetActiveMatchOrdinal(rfh, request_id, active_match_ordinal);
-
-  if (number_of_matches != -1) {
-    auto client_it = find_in_page_clients_.find(rfh);
-    client_it->second->SetNumberOfMatches(
-        request_id, number_of_matches,
-        final_update ? blink::mojom::FindMatchUpdateType::kFinalUpdate
-                     : blink::mojom::FindMatchUpdateType::kMoreUpdatesComing);
-    // Since |final_update| is handled already in SetNumberOfMatches, we should
-    // return.
-    // TODO(rakina): Remove this confusing part when mojoifying FindInPage::Find
-    return;
-  }
-
-  if (!final_update) {
-    NotifyFindReply(request_id, false /* final_update */);
-    return;
-  }
-  HandleFinalUpdateForFrame(rfh, request_id);
+  return current_session_id_ == kInvalidId ||
+         request_id < current_session_id_ || !CheckFrame(rfh);
 }
 
 void FindRequestManager::HandleFinalUpdateForFrame(RenderFrameHostImpl* rfh,
@@ -379,6 +341,16 @@
 void FindRequestManager::SetActiveMatchOrdinal(RenderFrameHostImpl* rfh,
                                                int request_id,
                                                int active_match_ordinal) {
+  if (active_match_ordinal > 0) {
+    // Call SetFocusedFrame on the WebContents associated with |rfh| (which
+    // might not be the same as |contents_|, as a WebContents might have
+    // inner WebContents). We need to focus on the frame where the active
+    // match is in, which should be in the |rfh|'s associated WebContents.
+    WebContentsImpl* web_contents =
+        static_cast<WebContentsImpl*>(WebContents::FromRenderFrameHost(rfh));
+    web_contents->GetFocusedWebContents()->SetFocusedFrame(
+        rfh->frame_tree_node(), rfh->GetSiteInstance());
+  }
   if (rfh == active_frame_) {
     active_match_ordinal_ +=
         active_match_ordinal - relative_active_match_ordinal_;
@@ -589,7 +561,7 @@
     if (!target_rfh || !CheckFrame(target_rfh))
       target_rfh = GetInitialFrame(request.options.forward);
 
-    SendFindIPC(request, target_rfh);
+    SendFindRequest(request, target_rfh);
     current_request_ = request;
     pending_active_match_ordinal_ = true;
     return;
@@ -616,8 +588,8 @@
     FindInternal(find_request_queue_.front());
 }
 
-void FindRequestManager::SendFindIPC(const FindRequest& request,
-                                     RenderFrameHost* rfh) {
+void FindRequestManager::SendFindRequest(const FindRequest& request,
+                                         RenderFrameHost* rfh) {
   DCHECK(CheckFrame(rfh));
   DCHECK(rfh->IsRenderFrameLive());
 
@@ -626,8 +598,13 @@
   else
     pending_initial_replies_.insert(rfh);
 
-  rfh->Send(new FrameMsg_Find(rfh->GetRoutingID(), request.id,
-                              request.search_text, request.options));
+  blink::mojom::FindOptionsPtr options(blink::mojom::FindOptions::New());
+  options->forward = request.options.forward;
+  options->match_case = request.options.match_case;
+  options->find_next = request.options.find_next;
+  options->force = request.options.force;
+  static_cast<RenderFrameHostImpl*>(rfh)->GetFindInPage()->Find(
+      request.id, base::UTF16ToUTF8(request.search_text), std::move(options));
 }
 
 void FindRequestManager::NotifyFindReply(int request_id, bool final_update) {
@@ -697,7 +674,7 @@
   request.id = current_session_id_;
   request.options.find_next = false;
   request.options.force = force;
-  SendFindIPC(request, rfh);
+  SendFindRequest(request, rfh);
 }
 
 bool FindRequestManager::CheckFrame(RenderFrameHost* rfh) const {
@@ -777,7 +754,7 @@
   NotifyFindReply(request_id, false /* final_update */);
 
   current_request_.options.find_next = true;
-  SendFindIPC(current_request_, target_rfh);
+  SendFindRequest(current_request_, target_rfh);
 }
 
 #if defined(OS_ANDROID)

diff --git a/content/browser/find_request_manager.h b/content/browser/find_request_manager.h
index 788d4f6..62050f46 100644
--- a/content/browser/find_request_manager.h
+++ b/content/browser/find_request_manager.h

@@ -47,15 +47,6 @@
   // activated, cleared, or remain highlighted.
   void StopFinding(StopFindAction action);
 
-  // Called when a reply is received from a frame with the results from a
-  // find request.
-  void OnFindReply(RenderFrameHostImpl* rfh,
-                   int request_id,
-                   int number_of_matches,
-                   const gfx::Rect& selection_rect,
-                   int active_match_ordinal,
-                   bool final_update);
-
   // Handles the final update from |rfh| for the find request with id
   // |request_id|.
   void HandleFinalUpdateForFrame(RenderFrameHostImpl* rfh, int request_id);
@@ -67,6 +58,8 @@
                                    unsigned int old_count,
                                    unsigned int new_count);
 
+  bool ShouldIgnoreReply(RenderFrameHostImpl* rfh, int request_id);
+
   void SetActiveMatchRect(const gfx::Rect& active_match_rect);
 
   void SetActiveMatchOrdinal(RenderFrameHostImpl* rfh,
@@ -143,9 +136,9 @@
   // with ID |request_id|. Advances the |find_request_queue_| if appropriate.
   void AdvanceQueue(int request_id);
 
-  // Sends a find IPC containing the find request |request| to the RenderFrame
-  // associated with |rfh|.
-  void SendFindIPC(const FindRequest& request, RenderFrameHost* rfh);
+  // Sends find request |request| through mojo to the RenderFrame associated
+  // with |rfh|.
+  void SendFindRequest(const FindRequest& request, RenderFrameHost* rfh);
 
   // Returns the initial frame in search order. This will be either the first
   // frame, if searching forward, or the last frame, if searching backward.

diff --git a/content/browser/indexed_db/cursor_impl.cc b/content/browser/indexed_db/cursor_impl.cc
index 6506a21..02fd7a4 100644
--- a/content/browser/indexed_db/cursor_impl.cc
+++ b/content/browser/indexed_db/cursor_impl.cc

@@ -9,6 +9,8 @@
 #include "content/browser/indexed_db/indexed_db_cursor.h"
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 
 // Expected to be constructed on IO thread, and used/destroyed on IDB sequence.

diff --git a/content/browser/indexed_db/cursor_impl.h b/content/browser/indexed_db/cursor_impl.h
index 99f831d..8819ad2 100644
--- a/content/browser/indexed_db/cursor_impl.h
+++ b/content/browser/indexed_db/cursor_impl.h

@@ -9,6 +9,8 @@
 
 #include "base/memory/ref_counted.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -18,7 +20,6 @@
 
 class IndexedDBCursor;
 class IndexedDBDispatcherHost;
-class IndexedDBKey;
 
 // Expected to be constructed, called, and destructed on the IO thread.
 class CursorImpl : public ::indexed_db::mojom::Cursor {
@@ -34,8 +35,8 @@
       uint32_t count,
       ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks) override;
   void Continue(
-      const IndexedDBKey& key,
-      const IndexedDBKey& primary_key,
+      const blink::IndexedDBKey& key,
+      const blink::IndexedDBKey& primary_key,
       ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks) override;
   void Prefetch(
       int32_t count,

diff --git a/content/browser/indexed_db/database_impl.cc b/content/browser/indexed_db/database_impl.cc
index d9c8efb..ea267675 100644
--- a/content/browser/indexed_db/database_impl.cc
+++ b/content/browser/indexed_db/database_impl.cc

@@ -21,6 +21,8 @@
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
 
+using blink::IndexedDBIndexKeys;
+using blink::IndexedDBKey;
 using std::swap;
 
 namespace content {
@@ -77,7 +79,7 @@
               scoped_refptr<IndexedDBCallbacks> callbacks);
   void Put(int64_t transaction_id,
            int64_t object_store_id,
-           ::indexed_db::mojom::ValuePtr value,
+           ::blink::mojom::IDBValuePtr value,
            std::vector<IndexedDBBlobInfo> blob_info,
            const IndexedDBKey& key,
            blink::WebIDBPutMode mode,
@@ -268,7 +270,7 @@
 void DatabaseImpl::Put(
     int64_t transaction_id,
     int64_t object_store_id,
-    ::indexed_db::mojom::ValuePtr value,
+    ::blink::mojom::IDBValuePtr value,
     const IndexedDBKey& key,
     blink::WebIDBPutMode mode,
     const std::vector<IndexedDBIndexKeys>& index_keys,
@@ -283,7 +285,7 @@
   base::CheckedNumeric<uint64_t> total_blob_size = 0;
   std::vector<IndexedDBBlobInfo> blob_info(value->blob_or_file_info.size());
   for (size_t i = 0; i < value->blob_or_file_info.size(); ++i) {
-    ::indexed_db::mojom::BlobInfoPtr& info = value->blob_or_file_info[i];
+    ::blink::mojom::IDBBlobInfoPtr& info = value->blob_or_file_info[i];
 
     std::unique_ptr<storage::BlobDataHandle> handle =
         dispatcher_host_->blob_storage_context()->GetBlobDataFromUUID(
@@ -653,7 +655,7 @@
 void DatabaseImpl::IDBSequenceHelper::Put(
     int64_t transaction_id,
     int64_t object_store_id,
-    ::indexed_db::mojom::ValuePtr mojo_value,
+    ::blink::mojom::IDBValuePtr mojo_value,
     std::vector<IndexedDBBlobInfo> blob_info,
     const IndexedDBKey& key,
     blink::WebIDBPutMode mode,

diff --git a/content/browser/indexed_db/database_impl.h b/content/browser/indexed_db/database_impl.h
index f0030a6..491dbb5 100644
--- a/content/browser/indexed_db/database_impl.h
+++ b/content/browser/indexed_db/database_impl.h

@@ -8,6 +8,8 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -66,15 +68,16 @@
       ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks) override;
   void Put(int64_t transaction_id,
            int64_t object_store_id,
-           ::indexed_db::mojom::ValuePtr value,
-           const IndexedDBKey& key,
+           ::blink::mojom::IDBValuePtr value,
+           const blink::IndexedDBKey& key,
            blink::WebIDBPutMode mode,
-           const std::vector<IndexedDBIndexKeys>& index_keys,
+           const std::vector<blink::IndexedDBIndexKeys>& index_keys,
            ::indexed_db::mojom::CallbacksAssociatedPtrInfo callbacks) override;
-  void SetIndexKeys(int64_t transaction_id,
-                    int64_t object_store_id,
-                    const IndexedDBKey& primary_key,
-                    const std::vector<IndexedDBIndexKeys>& index_keys) override;
+  void SetIndexKeys(
+      int64_t transaction_id,
+      int64_t object_store_id,
+      const blink::IndexedDBKey& primary_key,
+      const std::vector<blink::IndexedDBIndexKeys>& index_keys) override;
   void SetIndexesReady(int64_t transaction_id,
                        int64_t object_store_id,
                        const std::vector<int64_t>& index_ids) override;

diff --git a/content/browser/indexed_db/indexed_db_backing_store.cc b/content/browser/indexed_db/indexed_db_backing_store.cc
index ba773f3..07e63ff2a 100644
--- a/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store.cc

@@ -38,7 +38,6 @@
 #include "content/browser/indexed_db/leveldb/leveldb_factory.h"
 #include "content/browser/indexed_db/leveldb/leveldb_iterator.h"
 #include "content/browser/indexed_db/leveldb/leveldb_transaction.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/common/indexed_db/indexed_db_key_range.h"
 #include "content/public/browser/browser_thread.h"
@@ -52,11 +51,12 @@
 #include "storage/browser/fileapi/local_file_stream_writer.h"
 #include "storage/common/database/database_identifier.h"
 #include "storage/common/fileapi/file_system_mount_option.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/leveldatabase/env_chromium.h"
 
 using base::FilePath;
 using base::StringPiece;
+using blink::IndexedDBKey;
 using leveldb::Status;
 using storage::FileWriterDelegate;
 using url::Origin;

diff --git a/content/browser/indexed_db/indexed_db_backing_store.h b/content/browser/indexed_db/indexed_db_backing_store.h
index a473d7b..c5442dc 100644
--- a/content/browser/indexed_db/indexed_db_backing_store.h
+++ b/content/browser/indexed_db/indexed_db_backing_store.h

@@ -31,11 +31,11 @@
 #include "content/browser/indexed_db/leveldb/leveldb_iterator.h"
 #include "content/browser/indexed_db/leveldb/leveldb_transaction.h"
 #include "content/common/content_export.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/common/indexed_db/indexed_db_key_range.h"
 #include "content/common/indexed_db/indexed_db_metadata.h"
 #include "storage/browser/blob/blob_data_handle.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/leveldatabase/src/include/leveldb/status.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -315,22 +315,22 @@
       bool unique;
     };
 
-    const IndexedDBKey& key() const { return *current_key_; }
+    const blink::IndexedDBKey& key() const { return *current_key_; }
     bool Continue(leveldb::Status* s) { return Continue(NULL, NULL, SEEK, s); }
-    bool Continue(const IndexedDBKey* key,
+    bool Continue(const blink::IndexedDBKey* key,
                   IteratorState state,
                   leveldb::Status* s) {
       return Continue(key, NULL, state, s);
     }
-    bool Continue(const IndexedDBKey* key,
-                  const IndexedDBKey* primary_key,
+    bool Continue(const blink::IndexedDBKey* key,
+                  const blink::IndexedDBKey* primary_key,
                   IteratorState state,
                   leveldb::Status*);
     bool Advance(uint32_t count, leveldb::Status*);
     bool FirstSeek(leveldb::Status*);
 
     virtual std::unique_ptr<Cursor> Clone() const = 0;
-    virtual const IndexedDBKey& primary_key() const;
+    virtual const blink::IndexedDBKey& primary_key() const;
     virtual IndexedDBValue* value() = 0;
     virtual const RecordIdentifier& record_identifier() const;
     virtual bool LoadCurrentRow(leveldb::Status* s) = 0;
@@ -342,9 +342,9 @@
            const CursorOptions& cursor_options);
     explicit Cursor(const IndexedDBBackingStore::Cursor* other);
 
-    virtual std::string EncodeKey(const IndexedDBKey& key) = 0;
-    virtual std::string EncodeKey(const IndexedDBKey& key,
-                                  const IndexedDBKey& primary_key) = 0;
+    virtual std::string EncodeKey(const blink::IndexedDBKey& key) = 0;
+    virtual std::string EncodeKey(const blink::IndexedDBKey& key,
+                                  const blink::IndexedDBKey& primary_key) = 0;
 
     bool IsPastBounds() const;
     bool HaveEnteredRange() const;
@@ -354,22 +354,22 @@
     int64_t database_id_;
     const CursorOptions cursor_options_;
     std::unique_ptr<LevelDBIterator> iterator_;
-    std::unique_ptr<IndexedDBKey> current_key_;
+    std::unique_ptr<blink::IndexedDBKey> current_key_;
     IndexedDBBackingStore::RecordIdentifier record_identifier_;
 
    private:
     enum class ContinueResult { LEVELDB_ERROR, DONE, OUT_OF_BOUNDS };
 
     // For cursors with direction Next or NextNoDuplicate.
-    ContinueResult ContinueNext(const IndexedDBKey* key,
-                                const IndexedDBKey* primary_key,
+    ContinueResult ContinueNext(const blink::IndexedDBKey* key,
+                                const blink::IndexedDBKey* primary_key,
                                 IteratorState state,
                                 leveldb::Status*);
     // For cursors with direction Prev or PrevNoDuplicate. The PrevNoDuplicate
     // case has additional complexity of not being symmetric with
     // NextNoDuplicate.
-    ContinueResult ContinuePrevious(const IndexedDBKey* key,
-                                    const IndexedDBKey* primary_key,
+    ContinueResult ContinuePrevious(const blink::IndexedDBKey* key,
+                                    const blink::IndexedDBKey* primary_key,
                                     IteratorState state,
                                     leveldb::Status*);
 
@@ -442,13 +442,13 @@
       IndexedDBBackingStore::Transaction* transaction,
       int64_t database_id,
       int64_t object_store_id,
-      const IndexedDBKey& key,
+      const blink::IndexedDBKey& key,
       IndexedDBValue* record) WARN_UNUSED_RESULT;
   virtual leveldb::Status PutRecord(
       IndexedDBBackingStore::Transaction* transaction,
       int64_t database_id,
       int64_t object_store_id,
-      const IndexedDBKey& key,
+      const blink::IndexedDBKey& key,
       IndexedDBValue* value,
       RecordIdentifier* record) WARN_UNUSED_RESULT;
   virtual leveldb::Status ClearObjectStore(
@@ -480,7 +480,7 @@
       IndexedDBBackingStore::Transaction* transaction,
       int64_t database_id,
       int64_t object_store_id,
-      const IndexedDBKey& key,
+      const blink::IndexedDBKey& key,
       RecordIdentifier* found_record_identifier,
       bool* found) WARN_UNUSED_RESULT;
 
@@ -494,22 +494,22 @@
       int64_t database_id,
       int64_t object_store_id,
       int64_t index_id,
-      const IndexedDBKey& key,
+      const blink::IndexedDBKey& key,
       const RecordIdentifier& record) WARN_UNUSED_RESULT;
   virtual leveldb::Status GetPrimaryKeyViaIndex(
       IndexedDBBackingStore::Transaction* transaction,
       int64_t database_id,
       int64_t object_store_id,
       int64_t index_id,
-      const IndexedDBKey& key,
-      std::unique_ptr<IndexedDBKey>* primary_key) WARN_UNUSED_RESULT;
+      const blink::IndexedDBKey& key,
+      std::unique_ptr<blink::IndexedDBKey>* primary_key) WARN_UNUSED_RESULT;
   virtual leveldb::Status KeyExistsInIndex(
       IndexedDBBackingStore::Transaction* transaction,
       int64_t database_id,
       int64_t object_store_id,
       int64_t index_id,
-      const IndexedDBKey& key,
-      std::unique_ptr<IndexedDBKey>* found_primary_key,
+      const blink::IndexedDBKey& key,
+      std::unique_ptr<blink::IndexedDBKey>* found_primary_key,
       bool* exists) WARN_UNUSED_RESULT;
 
   // Public for IndexedDBActiveBlobRegistry::ReleaseBlobRef.
@@ -645,7 +645,7 @@
       int64_t database_id,
       int64_t object_store_id,
       int64_t index_id,
-      const IndexedDBKey& key,
+      const blink::IndexedDBKey& key,
       std::string* found_encoded_primary_key,
       bool* found);
 

diff --git a/content/browser/indexed_db/indexed_db_backing_store_unittest.cc b/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
index f65bd17..f04bfc1 100644
--- a/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store_unittest.cc

@@ -36,9 +36,10 @@
 #include "storage/browser/test/mock_quota_manager_proxy.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 using base::ASCIIToUTF16;
+using blink::IndexedDBKey;
 using url::Origin;
 
 namespace content {

diff --git a/content/browser/indexed_db/indexed_db_callbacks.cc b/content/browser/indexed_db/indexed_db_callbacks.cc
index 5c8e725..c18aefb 100644
--- a/content/browser/indexed_db/indexed_db_callbacks.cc
+++ b/content/browser/indexed_db/indexed_db_callbacks.cc

@@ -37,6 +37,7 @@
 #include "storage/browser/blob/shareable_file_reference.h"
 #include "storage/browser/quota/quota_manager.h"
 
+using blink::IndexedDBKey;
 using indexed_db::mojom::CallbacksAssociatedPtrInfo;
 using std::swap;
 using storage::ShareableFileReference;
@@ -92,17 +93,17 @@
 
 void ConvertBlobInfo(
     const std::vector<IndexedDBBlobInfo>& blob_info,
-    std::vector<::indexed_db::mojom::BlobInfoPtr>* blob_or_file_info) {
+    std::vector<::blink::mojom::IDBBlobInfoPtr>* blob_or_file_info) {
   blob_or_file_info->reserve(blob_info.size());
   for (const auto& iter : blob_info) {
     if (!iter.mark_used_callback().is_null())
       iter.mark_used_callback().Run();
 
-    auto info = ::indexed_db::mojom::BlobInfo::New();
+    auto info = ::blink::mojom::IDBBlobInfo::New();
     info->mime_type = iter.type();
     info->size = iter.size();
     if (iter.is_file()) {
-      info->file = ::indexed_db::mojom::FileInfo::New();
+      info->file = ::blink::mojom::IDBFileInfo::New();
       info->file->name = iter.file_name();
       info->file->path = iter.file_path();
       info->file->last_modified = iter.last_modified();
@@ -115,7 +116,7 @@
 ::indexed_db::mojom::ReturnValuePtr ConvertReturnValue(
     IndexedDBReturnValue* value) {
   auto mojo_value = ::indexed_db::mojom::ReturnValue::New();
-  mojo_value->value = ::indexed_db::mojom::Value::New();
+  mojo_value->value = ::blink::mojom::IDBValue::New();
   if (value->primary_key.IsValid()) {
     mojo_value->primary_key = value->primary_key;
     mojo_value->key_path = value->key_path;
@@ -150,19 +151,19 @@
   void SendSuccessCursor(SafeIOThreadCursorWrapper cursor,
                          const IndexedDBKey& key,
                          const IndexedDBKey& primary_key,
-                         ::indexed_db::mojom::ValuePtr value,
+                         ::blink::mojom::IDBValuePtr value,
                          const std::vector<IndexedDBBlobInfo>& blob_info);
   void SendSuccessValue(::indexed_db::mojom::ReturnValuePtr value,
                         const std::vector<IndexedDBBlobInfo>& blob_info);
   void SendSuccessCursorContinue(
       const IndexedDBKey& key,
       const IndexedDBKey& primary_key,
-      ::indexed_db::mojom::ValuePtr value,
+      ::blink::mojom::IDBValuePtr value,
       const std::vector<IndexedDBBlobInfo>& blob_info);
   void SendSuccessCursorPrefetch(
       const std::vector<IndexedDBKey>& keys,
       const std::vector<IndexedDBKey>& primary_keys,
-      std::vector<::indexed_db::mojom::ValuePtr> mojo_values,
+      std::vector<::blink::mojom::IDBValuePtr> mojo_values,
       const std::vector<IndexedDBValue>& values);
   void SendSuccessArray(
       std::vector<::indexed_db::mojom::ReturnValuePtr> mojo_values,
@@ -175,7 +176,7 @@
       const IndexedDBBlobInfo& blob_info);
   bool CreateAllBlobs(
       const std::vector<IndexedDBBlobInfo>& blob_info,
-      std::vector<::indexed_db::mojom::BlobInfoPtr>* blob_or_file_info);
+      std::vector<::blink::mojom::IDBBlobInfoPtr>* blob_or_file_info);
   void OnConnectionError();
 
  private:
@@ -188,9 +189,9 @@
 };
 
 // static
-::indexed_db::mojom::ValuePtr IndexedDBCallbacks::ConvertAndEraseValue(
+::blink::mojom::IDBValuePtr IndexedDBCallbacks::ConvertAndEraseValue(
     IndexedDBValue* value) {
-  auto mojo_value = ::indexed_db::mojom::Value::New();
+  auto mojo_value = ::blink::mojom::IDBValue::New();
   if (!value->empty())
     swap(mojo_value->bits, value->bits);
   ConvertBlobInfo(value->blob_info, &mojo_value->blob_or_file_info);
@@ -340,7 +341,7 @@
 
   DCHECK_EQ(blink::kWebIDBDataLossNone, data_loss_);
 
-  ::indexed_db::mojom::ValuePtr mojo_value;
+  ::blink::mojom::IDBValuePtr mojo_value;
   std::vector<IndexedDBBlobInfo> blob_info;
   if (value) {
     mojo_value = ConvertAndEraseValue(value);
@@ -367,7 +368,7 @@
 
   DCHECK_EQ(blink::kWebIDBDataLossNone, data_loss_);
 
-  ::indexed_db::mojom::ValuePtr mojo_value;
+  ::blink::mojom::IDBValuePtr mojo_value;
   std::vector<IndexedDBBlobInfo> blob_info;
   if (value) {
     mojo_value = ConvertAndEraseValue(value);
@@ -394,7 +395,7 @@
 
   DCHECK_EQ(blink::kWebIDBDataLossNone, data_loss_);
 
-  std::vector<::indexed_db::mojom::ValuePtr> mojo_values;
+  std::vector<::blink::mojom::IDBValuePtr> mojo_values;
   mojo_values.reserve(values->size());
   for (size_t i = 0; i < values->size(); ++i)
     mojo_values.push_back(ConvertAndEraseValue(&(*values)[i]));
@@ -598,7 +599,7 @@
     SafeIOThreadCursorWrapper cursor,
     const IndexedDBKey& key,
     const IndexedDBKey& primary_key,
-    ::indexed_db::mojom::ValuePtr value,
+    ::blink::mojom::IDBValuePtr value,
     const std::vector<IndexedDBBlobInfo>& blob_info) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!callbacks_)
@@ -660,7 +661,7 @@
 void IndexedDBCallbacks::IOThreadHelper::SendSuccessCursorContinue(
     const IndexedDBKey& key,
     const IndexedDBKey& primary_key,
-    ::indexed_db::mojom::ValuePtr value,
+    ::blink::mojom::IDBValuePtr value,
     const std::vector<IndexedDBBlobInfo>& blob_info) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!callbacks_)
@@ -677,7 +678,7 @@
 void IndexedDBCallbacks::IOThreadHelper::SendSuccessCursorPrefetch(
     const std::vector<IndexedDBKey>& keys,
     const std::vector<IndexedDBKey>& primary_keys,
-    std::vector<::indexed_db::mojom::ValuePtr> mojo_values,
+    std::vector<::blink::mojom::IDBValuePtr> mojo_values,
     const std::vector<IndexedDBValue>& values) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK_EQ(mojo_values.size(), values.size());
@@ -762,7 +763,7 @@
 
 bool IndexedDBCallbacks::IOThreadHelper::CreateAllBlobs(
     const std::vector<IndexedDBBlobInfo>& blob_info,
-    std::vector<::indexed_db::mojom::BlobInfoPtr>* blob_or_file_info) {
+    std::vector<::blink::mojom::IDBBlobInfoPtr>* blob_or_file_info) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!dispatcher_host_) {
     OnConnectionError();

diff --git a/content/browser/indexed_db/indexed_db_callbacks.h b/content/browser/indexed_db/indexed_db_callbacks.h
index f654d0e1..31253f7 100644
--- a/content/browser/indexed_db/indexed_db_callbacks.h
+++ b/content/browser/indexed_db/indexed_db_callbacks.h

@@ -19,9 +19,10 @@
 #include "content/browser/indexed_db/indexed_db_database_error.h"
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/public/browser/browser_thread.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "url/origin.h"
 
 namespace base {
@@ -42,7 +43,7 @@
     : public base::RefCounted<IndexedDBCallbacks> {
  public:
   // Destructively converts an IndexedDBValue to a Mojo Value.
-  static ::indexed_db::mojom::ValuePtr ConvertAndEraseValue(
+  static ::blink::mojom::IDBValuePtr ConvertAndEraseValue(
       IndexedDBValue* value);
 
   IndexedDBCallbacks(
@@ -70,19 +71,19 @@
 
   // IndexedDBDatabase::OpenCursor
   virtual void OnSuccess(std::unique_ptr<IndexedDBCursor> cursor,
-                         const IndexedDBKey& key,
-                         const IndexedDBKey& primary_key,
+                         const blink::IndexedDBKey& key,
+                         const blink::IndexedDBKey& primary_key,
                          IndexedDBValue* value);
 
   // IndexedDBCursor::Continue / Advance
-  virtual void OnSuccess(const IndexedDBKey& key,
-                         const IndexedDBKey& primary_key,
+  virtual void OnSuccess(const blink::IndexedDBKey& key,
+                         const blink::IndexedDBKey& primary_key,
                          IndexedDBValue* value);
 
   // IndexedDBCursor::PrefetchContinue
   virtual void OnSuccessWithPrefetch(
-      const std::vector<IndexedDBKey>& keys,
-      const std::vector<IndexedDBKey>& primary_keys,
+      const std::vector<blink::IndexedDBKey>& keys,
+      const std::vector<blink::IndexedDBKey>& primary_keys,
       std::vector<IndexedDBValue>* values);
 
   // IndexedDBDatabase::Get
@@ -93,7 +94,7 @@
   virtual void OnSuccessArray(std::vector<IndexedDBReturnValue>* values);
 
   // IndexedDBDatabase::Put / IndexedDBCursor::Update
-  virtual void OnSuccess(const IndexedDBKey& key);
+  virtual void OnSuccess(const blink::IndexedDBKey& key);
 
   // IndexedDBDatabase::Count
   // IndexedDBFactory::DeleteDatabase

diff --git a/content/browser/indexed_db/indexed_db_class_factory.h b/content/browser/indexed_db/indexed_db_class_factory.h
index 21fc4381..a33b2f1 100644
--- a/content/browser/indexed_db/indexed_db_class_factory.h
+++ b/content/browser/indexed_db/indexed_db_class_factory.h

@@ -15,7 +15,7 @@
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_database.h"
 #include "content/common/content_export.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace leveldb {
 class Iterator;

diff --git a/content/browser/indexed_db/indexed_db_cursor.cc b/content/browser/indexed_db/indexed_db_cursor.cc
index bd12dd6..6a940b1 100644
--- a/content/browser/indexed_db/indexed_db_cursor.cc
+++ b/content/browser/indexed_db/indexed_db_cursor.cc

@@ -17,6 +17,8 @@
 #include "content/browser/indexed_db/indexed_db_value.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 namespace {
 // This should never be script visible: the cursor should either be closed when

diff --git a/content/browser/indexed_db/indexed_db_cursor.h b/content/browser/indexed_db/indexed_db_cursor.h
index d0cc7e74..d7da6e3 100644
--- a/content/browser/indexed_db/indexed_db_cursor.h
+++ b/content/browser/indexed_db/indexed_db_cursor.h

@@ -17,7 +17,7 @@
 #include "content/browser/indexed_db/indexed_db_database.h"
 #include "content/browser/indexed_db/indexed_db_transaction.h"
 #include "content/common/indexed_db/indexed_db_key_range.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 
@@ -30,15 +30,17 @@
   ~IndexedDBCursor();
 
   void Advance(uint32_t count, scoped_refptr<IndexedDBCallbacks> callbacks);
-  void Continue(std::unique_ptr<IndexedDBKey> key,
-                std::unique_ptr<IndexedDBKey> primary_key,
+  void Continue(std::unique_ptr<blink::IndexedDBKey> key,
+                std::unique_ptr<blink::IndexedDBKey> primary_key,
                 scoped_refptr<IndexedDBCallbacks> callbacks);
   void PrefetchContinue(int number_to_fetch,
                         scoped_refptr<IndexedDBCallbacks> callbacks);
   leveldb::Status PrefetchReset(int used_prefetches, int unused_prefetches);
 
-  const IndexedDBKey& key() const { return cursor_->key(); }
-  const IndexedDBKey& primary_key() const { return cursor_->primary_key(); }
+  const blink::IndexedDBKey& key() const { return cursor_->key(); }
+  const blink::IndexedDBKey& primary_key() const {
+    return cursor_->primary_key();
+  }
   IndexedDBValue* Value() const {
     return (cursor_type_ == indexed_db::CURSOR_KEY_ONLY) ? NULL
                                                          : cursor_->value();
@@ -47,8 +49,8 @@
   void Close();
 
   leveldb::Status CursorIterationOperation(
-      std::unique_ptr<IndexedDBKey> key,
-      std::unique_ptr<IndexedDBKey> primary_key,
+      std::unique_ptr<blink::IndexedDBKey> key,
+      std::unique_ptr<blink::IndexedDBKey> primary_key,
       scoped_refptr<IndexedDBCallbacks> callbacks,
       IndexedDBTransaction* transaction);
   leveldb::Status CursorAdvanceOperation(

diff --git a/content/browser/indexed_db/indexed_db_data_loss_info.h b/content/browser/indexed_db/indexed_db_data_loss_info.h
index 8c36dd38..318f04e 100644
--- a/content/browser/indexed_db/indexed_db_data_loss_info.h
+++ b/content/browser/indexed_db/indexed_db_data_loss_info.h

@@ -7,7 +7,7 @@
 
 #include <string>
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 

diff --git a/content/browser/indexed_db/indexed_db_database.cc b/content/browser/indexed_db/indexed_db_database.cc
index 7d16b23..e4c6d79 100644
--- a/content/browser/indexed_db/indexed_db_database.cc
+++ b/content/browser/indexed_db/indexed_db_database.cc

@@ -42,6 +42,8 @@
 
 using base::ASCIIToUTF16;
 using base::Int64ToString16;
+using blink::IndexedDBIndexKeys;
+using blink::IndexedDBKey;
 using blink::kWebIDBKeyTypeNumber;
 using leveldb::Status;
 
@@ -831,7 +833,7 @@
           changes->observations.size() - 1);
       if (observer->include_transaction() &&
           !base::ContainsKey(changes->transaction_map, observer->id())) {
-        auto mojo_transaction = ::indexed_db::mojom::ObserverTransaction::New();
+        auto mojo_transaction = ::blink::mojom::IDBObserverTransaction::New();
         mojo_transaction->id = connection->NewObserverTransactionId();
         mojo_transaction->scope.insert(mojo_transaction->scope.end(),
                                        observer->object_store_ids().begin(),

diff --git a/content/browser/indexed_db/indexed_db_database.h b/content/browser/indexed_db/indexed_db_database.h
index a3c8f43..a40d05e 100644
--- a/content/browser/indexed_db/indexed_db_database.h
+++ b/content/browser/indexed_db/indexed_db_database.h

@@ -29,7 +29,8 @@
 #include "content/browser/indexed_db/list_set.h"
 #include "content/common/content_export.h"
 #include "content/common/indexed_db/indexed_db_metadata.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace url {
 class Origin;
@@ -40,7 +41,6 @@
 class IndexedDBConnection;
 class IndexedDBDatabaseCallbacks;
 class IndexedDBFactory;
-class IndexedDBKey;
 class IndexedDBKeyPath;
 class IndexedDBKeyRange;
 class IndexedDBMetadataCoding;
@@ -167,14 +167,14 @@
   void Put(IndexedDBTransaction* transaction,
            int64_t object_store_id,
            IndexedDBValue* value,
-           std::unique_ptr<IndexedDBKey> key,
+           std::unique_ptr<blink::IndexedDBKey> key,
            blink::WebIDBPutMode mode,
            scoped_refptr<IndexedDBCallbacks> callbacks,
-           const std::vector<IndexedDBIndexKeys>& index_keys);
+           const std::vector<blink::IndexedDBIndexKeys>& index_keys);
   void SetIndexKeys(IndexedDBTransaction* transaction,
                     int64_t object_store_id,
-                    std::unique_ptr<IndexedDBKey> primary_key,
-                    const std::vector<IndexedDBIndexKeys>& index_keys);
+                    std::unique_ptr<blink::IndexedDBKey> primary_key,
+                    const std::vector<blink::IndexedDBIndexKeys>& index_keys);
   void SetIndexesReady(IndexedDBTransaction* transaction,
                        int64_t object_store_id,
                        const std::vector<int64_t>& index_ids);

diff --git a/content/browser/indexed_db/indexed_db_database_callbacks.h b/content/browser/indexed_db/indexed_db_database_callbacks.h
index 86160968..fee6e15 100644
--- a/content/browser/indexed_db/indexed_db_database_callbacks.h
+++ b/content/browser/indexed_db/indexed_db_database_callbacks.h

@@ -13,6 +13,7 @@
 #include "content/common/content_export.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "content/public/browser/browser_thread.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace content {
 class IndexedDBContextImpl;

diff --git a/content/browser/indexed_db/indexed_db_database_unittest.cc b/content/browser/indexed_db/indexed_db_database_unittest.cc
index 69ac503..6ab05d69 100644
--- a/content/browser/indexed_db/indexed_db_database_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_database_unittest.cc

@@ -32,6 +32,8 @@
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::ASCIIToUTF16;
+using blink::IndexedDBIndexKeys;
+using blink::IndexedDBKey;
 
 namespace {
 const int kFakeChildProcessId = 0;

diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.h b/content/browser/indexed_db/indexed_db_dispatcher_host.h
index df583047bc..ce7ad7d 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.h
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.h

@@ -23,6 +23,7 @@
 #include "mojo/public/cpp/bindings/associated_binding_set.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding_set.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace base {
 class SequencedTaskRunner;

diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc b/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
index 1ad304b72..6f94fb51 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc

@@ -32,9 +32,14 @@
 #include "storage/browser/test/mock_special_storage_policy.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
 #include "url/origin.h"
 
+using blink::mojom::IDBValue;
+using blink::mojom::IDBValuePtr;
+using blink::IndexedDBIndexKeys;
+using blink::IndexedDBKey;
 using indexed_db::mojom::Callbacks;
 using indexed_db::mojom::CallbacksAssociatedPtrInfo;
 using indexed_db::mojom::DatabaseAssociatedPtr;
@@ -45,8 +50,6 @@
 using indexed_db::mojom::Factory;
 using indexed_db::mojom::FactoryPtr;
 using indexed_db::mojom::KeyPath;
-using indexed_db::mojom::Value;
-using indexed_db::mojom::ValuePtr;
 using mojo::StrongAssociatedBindingPtr;
 using testing::_;
 using testing::StrictMock;
@@ -421,17 +424,17 @@
                                            base::UTF8ToUTF16(kObjectStoreName),
                                            content::IndexedDBKeyPath(), false);
     // Call Put with an invalid blob.
-    std::vector<::indexed_db::mojom::BlobInfoPtr> blobs;
+    std::vector<::blink::mojom::IDBBlobInfoPtr> blobs;
     blink::mojom::BlobPtrInfo blob;
     // Ignore the result of MakeRequest, to end up with an invalid blob.
     mojo::MakeRequest(&blob);
-    blobs.push_back(::indexed_db::mojom::BlobInfo::New(
+    blobs.push_back(::blink::mojom::IDBBlobInfo::New(
         std::move(blob), "fakeUUID", base::string16(), 100, nullptr));
     connection.database->Put(kTransactionId, kObjectStoreId,
-                             Value::New("hello", std::move(blobs)),
-                             content::IndexedDBKey(base::UTF8ToUTF16("hello")),
+                             IDBValue::New("hello", std::move(blobs)),
+                             IndexedDBKey(base::UTF8ToUTF16("hello")),
                              blink::kWebIDBPutModeAddOnly,
-                             std::vector<content::IndexedDBIndexKeys>(),
+                             std::vector<IndexedDBIndexKeys>(),
                              put_callbacks->CreateInterfacePtrAndBind());
     connection.database->Commit(kTransactionId);
     loop.Run();
@@ -1061,11 +1064,10 @@
                                             content::IndexedDBKeyPath(), false);
     connection1.database->Put(
         kTransactionId1, kObjectStoreId,
-        ::indexed_db::mojom::Value::New(
-            "value", std::vector<::indexed_db::mojom::BlobInfoPtr>()),
-        content::IndexedDBKey(base::UTF8ToUTF16("key")),
-        blink::kWebIDBPutModeAddOnly,
-        std::vector<content::IndexedDBIndexKeys>(),
+        ::blink::mojom::IDBValue::New(
+            "value", std::vector<::blink::mojom::IDBBlobInfoPtr>()),
+        IndexedDBKey(base::UTF8ToUTF16("key")), blink::kWebIDBPutModeAddOnly,
+        std::vector<IndexedDBIndexKeys>(),
         put_callbacks->CreateInterfacePtrAndBind());
     connection1.database->Commit(kTransactionId1);
     loop.Run();

diff --git a/content/browser/indexed_db/indexed_db_factory_unittest.cc b/content/browser/indexed_db/indexed_db_factory_unittest.cc
index 0031ef8..a349862 100644
--- a/content/browser/indexed_db/indexed_db_factory_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_factory_unittest.cc

@@ -27,8 +27,8 @@
 #include "content/public/test/test_utils.h"
 #include "storage/browser/test/mock_quota_manager_proxy.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 

diff --git a/content/browser/indexed_db/indexed_db_fake_backing_store.cc b/content/browser/indexed_db/indexed_db_fake_backing_store.cc
index 9890819..f041c67 100644
--- a/content/browser/indexed_db/indexed_db_fake_backing_store.cc
+++ b/content/browser/indexed_db/indexed_db_fake_backing_store.cc

@@ -8,6 +8,8 @@
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "net/url_request/url_request_context_getter.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 
 IndexedDBFakeBackingStore::IndexedDBFakeBackingStore()

diff --git a/content/browser/indexed_db/indexed_db_fake_backing_store.h b/content/browser/indexed_db/indexed_db_fake_backing_store.h
index 091108d..c266b91 100644
--- a/content/browser/indexed_db/indexed_db_fake_backing_store.h
+++ b/content/browser/indexed_db/indexed_db_fake_backing_store.h

@@ -12,6 +12,7 @@
 
 #include "base/macros.h"
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -28,13 +29,12 @@
                             base::SequencedTaskRunner* task_runner);
   leveldb::Status DeleteDatabase(const base::string16& name) override;
 
-  leveldb::Status PutRecord(
-      IndexedDBBackingStore::Transaction* transaction,
-      int64_t database_id,
-      int64_t object_store_id,
-      const IndexedDBKey& key,
-      IndexedDBValue* value,
-      RecordIdentifier* record) override;
+  leveldb::Status PutRecord(IndexedDBBackingStore::Transaction* transaction,
+                            int64_t database_id,
+                            int64_t object_store_id,
+                            const blink::IndexedDBKey& key,
+                            IndexedDBValue* value,
+                            RecordIdentifier* record) override;
 
   leveldb::Status ClearObjectStore(Transaction*,
                                    int64_t database_id,
@@ -58,7 +58,7 @@
       Transaction*,
       int64_t database_id,
       int64_t object_store_id,
-      const IndexedDBKey&,
+      const blink::IndexedDBKey&,
       RecordIdentifier* found_record_identifier,
       bool* found) override;
 
@@ -70,7 +70,7 @@
                                         int64_t database_id,
                                         int64_t object_store_id,
                                         int64_t index_id,
-                                        const IndexedDBKey&,
+                                        const blink::IndexedDBKey&,
                                         const RecordIdentifier&) override;
   void ReportBlobUnused(int64_t database_id, int64_t blob_key) override;
   std::unique_ptr<Cursor> OpenObjectStoreKeyCursor(

diff --git a/content/browser/indexed_db/indexed_db_index_writer.cc b/content/browser/indexed_db/indexed_db_index_writer.cc
index f18444c..92e0ec9 100644
--- a/content/browser/indexed_db/indexed_db_index_writer.cc
+++ b/content/browser/indexed_db/indexed_db_index_writer.cc

@@ -12,11 +12,12 @@
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_tracing.h"
 #include "content/browser/indexed_db/indexed_db_transaction.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/common/indexed_db/indexed_db_key_range.h"
 
 using base::ASCIIToUTF16;
+using blink::IndexedDBIndexKeys;
+using blink::IndexedDBKey;
 
 namespace content {
 

diff --git a/content/browser/indexed_db/indexed_db_index_writer.h b/content/browser/indexed_db/indexed_db_index_writer.h
index bf9c4e8..e01253a 100644
--- a/content/browser/indexed_db/indexed_db_index_writer.h
+++ b/content/browser/indexed_db/indexed_db_index_writer.h

@@ -16,6 +16,7 @@
 #include "content/browser/indexed_db/indexed_db_database.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/common/indexed_db/indexed_db_metadata.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace content {
 
@@ -27,7 +28,7 @@
   explicit IndexWriter(const IndexedDBIndexMetadata& index_metadata);
 
   IndexWriter(const IndexedDBIndexMetadata& index_metadata,
-              const IndexedDBIndexKeys& index_keys);
+              const blink::IndexedDBIndexKeys& index_keys);
 
   bool VerifyIndexKeys(IndexedDBBackingStore* store,
                        IndexedDBBackingStore::Transaction* transaction,
@@ -35,7 +36,7 @@
                        int64_t object_store_id,
                        int64_t index_id,
                        bool* can_add_keys,
-                       const IndexedDBKey& primary_key,
+                       const blink::IndexedDBKey& primary_key,
                        base::string16* error_message) const WARN_UNUSED_RESULT;
 
   void WriteIndexKeys(const IndexedDBBackingStore::RecordIdentifier& record,
@@ -52,12 +53,12 @@
                         int64_t database_id,
                         int64_t object_store_id,
                         int64_t index_id,
-                        const IndexedDBKey& index_key,
-                        const IndexedDBKey& primary_key,
+                        const blink::IndexedDBKey& index_key,
+                        const blink::IndexedDBKey& primary_key,
                         bool* allowed) const WARN_UNUSED_RESULT;
 
   const IndexedDBIndexMetadata index_metadata_;
-  IndexedDBIndexKeys index_keys_;
+  blink::IndexedDBIndexKeys index_keys_;
 
   DISALLOW_COPY_AND_ASSIGN(IndexWriter);
 };
@@ -66,9 +67,9 @@
                       IndexedDBBackingStore* store,
                       int64_t database_id,
                       const IndexedDBObjectStoreMetadata& metadata,
-                      const IndexedDBKey& primary_key,
+                      const blink::IndexedDBKey& primary_key,
                       bool key_was_generated,
-                      const std::vector<IndexedDBIndexKeys>& index_keys,
+                      const std::vector<blink::IndexedDBIndexKeys>& index_keys,
                       std::vector<std::unique_ptr<IndexWriter>>* index_writers,
                       base::string16* error_message,
                       bool* completed) WARN_UNUSED_RESULT;

diff --git a/content/browser/indexed_db/indexed_db_leveldb_coding.cc b/content/browser/indexed_db/indexed_db_leveldb_coding.cc
index d407f601..4153031 100644
--- a/content/browser/indexed_db/indexed_db_leveldb_coding.cc
+++ b/content/browser/indexed_db/indexed_db_leveldb_coding.cc

@@ -11,13 +11,13 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/sys_byteorder.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 
 // See leveldb_coding_scheme.md for detailed documentation of the coding
 // scheme implemented here.
 
 using base::StringPiece;
+using blink::IndexedDBKey;
 using blink::WebIDBKeyType;
 using blink::kWebIDBKeyTypeArray;
 using blink::kWebIDBKeyTypeBinary;

diff --git a/content/browser/indexed_db/indexed_db_leveldb_coding.h b/content/browser/indexed_db/indexed_db_leveldb_coding.h
index 739982f..30b4738 100644
--- a/content/browser/indexed_db/indexed_db_leveldb_coding.h
+++ b/content/browser/indexed_db/indexed_db_leveldb_coding.h

@@ -18,8 +18,8 @@
 #include "base/memory/ref_counted.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace content {
 
@@ -50,7 +50,8 @@
                                            std::string* into);
 CONTENT_EXPORT void EncodeBinary(const std::string& value, std::string* into);
 CONTENT_EXPORT void EncodeDouble(double value, std::string* into);
-CONTENT_EXPORT void EncodeIDBKey(const IndexedDBKey& value, std::string* into);
+CONTENT_EXPORT void EncodeIDBKey(const blink::IndexedDBKey& value,
+                                 std::string* into);
 CONTENT_EXPORT void EncodeIDBKeyPath(const IndexedDBKeyPath& value,
                                      std::string* into);
 CONTENT_EXPORT void EncodeBlobJournal(const BlobJournalType& journal,
@@ -75,7 +76,7 @@
                                                     double* value);
 CONTENT_EXPORT WARN_UNUSED_RESULT bool DecodeIDBKey(
     base::StringPiece* slice,
-    std::unique_ptr<IndexedDBKey>* value);
+    std::unique_ptr<blink::IndexedDBKey>* value);
 CONTENT_EXPORT WARN_UNUSED_RESULT bool DecodeIDBKeyPath(
     base::StringPiece* slice,
     IndexedDBKeyPath* value);
@@ -415,8 +416,8 @@
                                            const std::string encoded_user_key);
   static std::string Encode(int64_t database_id,
                             int64_t object_store_id,
-                            const IndexedDBKey& user_key);
-  std::unique_ptr<IndexedDBKey> user_key() const;
+                            const blink::IndexedDBKey& user_key);
+  std::unique_ptr<blink::IndexedDBKey> user_key() const;
 
  private:
   std::string encoded_user_key_;
@@ -433,8 +434,8 @@
                                            const std::string& encoded_key);
   static std::string Encode(int64_t database_id,
                             int64_t object_store_id,
-                            const IndexedDBKey& user_key);
-  std::unique_ptr<IndexedDBKey> user_key() const;
+                            const blink::IndexedDBKey& user_key);
+  std::unique_ptr<blink::IndexedDBKey> user_key() const;
 
  private:
   static const int64_t kSpecialIndexNumber;
@@ -456,7 +457,7 @@
                                                  int64_t object_store_id);
   static std::string Encode(int64_t database_id,
                             int64_t object_store_id,
-                            const IndexedDBKey& user_key);
+                            const blink::IndexedDBKey& user_key);
   std::string Encode() const;
   int64_t database_id() const { return database_id_; }
   int64_t object_store_id() const { return object_store_id_; }
@@ -490,13 +491,13 @@
   static std::string Encode(int64_t database_id,
                             int64_t object_store_id,
                             int64_t index_id,
-                            const IndexedDBKey& user_key);
+                            const blink::IndexedDBKey& user_key);
   CONTENT_EXPORT static std::string Encode(
       int64_t database_id,
       int64_t object_store_id,
       int64_t index_id,
-      const IndexedDBKey& user_key,
-      const IndexedDBKey& user_primary_key);
+      const blink::IndexedDBKey& user_key,
+      const blink::IndexedDBKey& user_primary_key);
   CONTENT_EXPORT static std::string EncodeMinKey(int64_t database_id,
                                                  int64_t object_store_id,
                                                  int64_t index_id);
@@ -506,8 +507,8 @@
   int64_t DatabaseId() const;
   int64_t ObjectStoreId() const;
   int64_t IndexId() const;
-  std::unique_ptr<IndexedDBKey> user_key() const;
-  std::unique_ptr<IndexedDBKey> primary_key() const;
+  std::unique_ptr<blink::IndexedDBKey> user_key() const;
+  std::unique_ptr<blink::IndexedDBKey> primary_key() const;
 
   CONTENT_EXPORT std::string Encode() const;
 

diff --git a/content/browser/indexed_db/indexed_db_leveldb_coding_unittest.cc b/content/browser/indexed_db/indexed_db_leveldb_coding_unittest.cc
index d2e4e8e7..540f54f 100644
--- a/content/browser/indexed_db/indexed_db_leveldb_coding_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_leveldb_coding_unittest.cc

@@ -14,12 +14,12 @@
 #include "base/strings/string16.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/utf_string_conversions.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::ASCIIToUTF16;
 using base::StringPiece;
+using blink::IndexedDBKey;
 using blink::kWebIDBKeyTypeDate;
 using blink::kWebIDBKeyTypeNumber;
 

diff --git a/content/browser/indexed_db/indexed_db_observer.h b/content/browser/indexed_db/indexed_db_observer.h
index c648455a..5b5ae2d3 100644
--- a/content/browser/indexed_db/indexed_db_observer.h
+++ b/content/browser/indexed_db/indexed_db_observer.h

@@ -14,7 +14,7 @@
 #include "base/macros.h"
 #include "base/stl_util.h"
 #include "content/common/content_export.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 

diff --git a/content/browser/indexed_db/indexed_db_return_value.h b/content/browser/indexed_db/indexed_db_return_value.h
index 6a50a26..270dcfd 100644
--- a/content/browser/indexed_db/indexed_db_return_value.h
+++ b/content/browser/indexed_db/indexed_db_return_value.h

@@ -7,8 +7,8 @@
 
 #include "content/browser/indexed_db/indexed_db_value.h"
 #include "content/common/content_export.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace content {
 
@@ -18,7 +18,8 @@
 // database, so they are kept separately, and sent back with the original data
 // so that the render process can amend the returned object.
 struct CONTENT_EXPORT IndexedDBReturnValue : public IndexedDBValue {
-  IndexedDBKey primary_key;  // primary key (only when using key generator)
+  blink::IndexedDBKey
+      primary_key;  // primary key (only when using key generator)
   IndexedDBKeyPath key_path;
 };
 

diff --git a/content/browser/indexed_db/indexed_db_tombstone_sweeper.cc b/content/browser/indexed_db/indexed_db_tombstone_sweeper.cc
index e3d3556..5f7302b8 100644
--- a/content/browser/indexed_db/indexed_db_tombstone_sweeper.cc
+++ b/content/browser/indexed_db/indexed_db_tombstone_sweeper.cc

@@ -11,10 +11,13 @@
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/time/tick_clock.h"
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/leveldatabase/env_chromium.h"
 #include "third_party/leveldatabase/src/include/leveldb/db.h"
 #include "third_party/leveldatabase/src/include/leveldb/iterator.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 namespace {
 

diff --git a/content/browser/indexed_db/indexed_db_tombstone_sweeper_unittest.cc b/content/browser/indexed_db/indexed_db_tombstone_sweeper_unittest.cc
index 2793b74..0ffcb03 100644
--- a/content/browser/indexed_db/indexed_db_tombstone_sweeper_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_tombstone_sweeper_unittest.cc

@@ -18,11 +18,14 @@
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/leveldatabase/env_chromium.h"
 #include "third_party/leveldatabase/src/include/leveldb/db.h"
 #include "third_party/leveldatabase/src/include/leveldb/filter_policy.h"
 #include "third_party/leveldatabase/src/include/leveldb/slice.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 class BrowserContext;
 

diff --git a/content/browser/indexed_db/indexed_db_transaction.h b/content/browser/indexed_db/indexed_db_transaction.h
index fd690bc..fdd287e 100644
--- a/content/browser/indexed_db/indexed_db_transaction.h
+++ b/content/browser/indexed_db/indexed_db_transaction.h

@@ -24,7 +24,8 @@
 #include "content/browser/indexed_db/indexed_db_database_error.h"
 #include "content/browser/indexed_db/indexed_db_observer.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace content {
 

diff --git a/content/browser/indexed_db/indexed_db_transaction_coordinator.cc b/content/browser/indexed_db/indexed_db_transaction_coordinator.cc
index eb714dde..91dd9571 100644
--- a/content/browser/indexed_db/indexed_db_transaction_coordinator.cc
+++ b/content/browser/indexed_db/indexed_db_transaction_coordinator.cc

@@ -7,7 +7,7 @@
 #include "base/logging.h"
 #include "content/browser/indexed_db/indexed_db_tracing.h"
 #include "content/browser/indexed_db/indexed_db_transaction.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 namespace {

diff --git a/content/browser/indexed_db/mock_browsertest_indexed_db_class_factory.h b/content/browser/indexed_db/mock_browsertest_indexed_db_class_factory.h
index 0c52086..64e9ce48 100644
--- a/content/browser/indexed_db/mock_browsertest_indexed_db_class_factory.h
+++ b/content/browser/indexed_db/mock_browsertest_indexed_db_class_factory.h

@@ -14,7 +14,7 @@
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_class_factory.h"
 #include "content/browser/indexed_db/indexed_db_database.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 

diff --git a/content/browser/indexed_db/mock_indexed_db_callbacks.cc b/content/browser/indexed_db/mock_indexed_db_callbacks.cc
index fe8a6a1..88152cb 100644
--- a/content/browser/indexed_db/mock_indexed_db_callbacks.cc
+++ b/content/browser/indexed_db/mock_indexed_db_callbacks.cc

@@ -8,6 +8,8 @@
 
 #include "testing/gtest/include/gtest/gtest.h"
 
+using blink::IndexedDBKey;
+
 namespace content {
 
 MockIndexedDBCallbacks::MockIndexedDBCallbacks()

diff --git a/content/browser/indexed_db/mock_indexed_db_callbacks.h b/content/browser/indexed_db/mock_indexed_db_callbacks.h
index 10fa56e..b1d8e62 100644
--- a/content/browser/indexed_db/mock_indexed_db_callbacks.h
+++ b/content/browser/indexed_db/mock_indexed_db_callbacks.h

@@ -12,6 +12,7 @@
 #include "base/macros.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace content {
 
@@ -25,7 +26,7 @@
   void OnSuccess() override;
   void OnSuccess(int64_t result) override;
   void OnSuccess(const std::vector<base::string16>& result) override;
-  void OnSuccess(const IndexedDBKey& key) override;
+  void OnSuccess(const blink::IndexedDBKey& key) override;
   void OnSuccess(std::unique_ptr<IndexedDBConnection> connection,
                  const IndexedDBDatabaseMetadata& metadata) override;
   IndexedDBConnection* connection() { return connection_.get(); }

diff --git a/content/browser/indexed_db/mock_mojo_indexed_db_callbacks.h b/content/browser/indexed_db/mock_mojo_indexed_db_callbacks.h
index ca8fb74..e297612 100644
--- a/content/browser/indexed_db/mock_mojo_indexed_db_callbacks.h
+++ b/content/browser/indexed_db/mock_mojo_indexed_db_callbacks.h

@@ -12,6 +12,8 @@
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace content {
 
@@ -60,13 +62,13 @@
 
   MOCK_METHOD4(MockedSuccessCursor,
                void(::indexed_db::mojom::CursorAssociatedPtrInfo* cursor,
-                    const IndexedDBKey& key,
-                    const IndexedDBKey& primary_key,
-                    ::indexed_db::mojom::ValuePtr* value));
+                    const blink::IndexedDBKey& key,
+                    const blink::IndexedDBKey& primary_key,
+                    blink::mojom::IDBValuePtr* value));
   void SuccessCursor(::indexed_db::mojom::CursorAssociatedPtrInfo cursor,
-                     const IndexedDBKey& key,
-                     const IndexedDBKey& primary_key,
-                     ::indexed_db::mojom::ValuePtr value) override {
+                     const blink::IndexedDBKey& key,
+                     const blink::IndexedDBKey& primary_key,
+                     blink::mojom::IDBValuePtr value) override {
     MockedSuccessCursor(&cursor, key, primary_key, &value);
   }
 
@@ -77,25 +79,25 @@
   }
 
   MOCK_METHOD3(MockedSuccessCursorContinue,
-               void(const IndexedDBKey& key,
-                    const IndexedDBKey& primary_key,
-                    ::indexed_db::mojom::ValuePtr* value));
+               void(const blink::IndexedDBKey& key,
+                    const blink::IndexedDBKey& primary_key,
+                    blink::mojom::IDBValuePtr* value));
 
-  void SuccessCursorContinue(const IndexedDBKey& key,
-                             const IndexedDBKey& primary_key,
-                             ::indexed_db::mojom::ValuePtr value) override {
+  void SuccessCursorContinue(const blink::IndexedDBKey& key,
+                             const blink::IndexedDBKey& primary_key,
+                             blink::mojom::IDBValuePtr value) override {
     MockedSuccessCursorContinue(key, primary_key, &value);
   }
 
   MOCK_METHOD3(MockedSuccessCursorPrefetch,
-               void(const std::vector<IndexedDBKey>& keys,
-                    const std::vector<IndexedDBKey>& primary_keys,
-                    std::vector<::indexed_db::mojom::ValuePtr>* values));
+               void(const std::vector<blink::IndexedDBKey>& keys,
+                    const std::vector<blink::IndexedDBKey>& primary_keys,
+                    std::vector<blink::mojom::IDBValuePtr>* values));
 
   void SuccessCursorPrefetch(
-      const std::vector<IndexedDBKey>& keys,
-      const std::vector<IndexedDBKey>& primary_keys,
-      std::vector<::indexed_db::mojom::ValuePtr> values) override {
+      const std::vector<blink::IndexedDBKey>& keys,
+      const std::vector<blink::IndexedDBKey>& primary_keys,
+      std::vector<blink::mojom::IDBValuePtr> values) override {
     MockedSuccessCursorPrefetch(keys, primary_keys, &values);
   }
 
@@ -106,7 +108,7 @@
     MockedSuccessArray(&values);
   }
 
-  MOCK_METHOD1(SuccessKey, void(const IndexedDBKey& key));
+  MOCK_METHOD1(SuccessKey, void(const blink::IndexedDBKey& key));
   MOCK_METHOD1(SuccessInteger, void(int64_t value));
   MOCK_METHOD0(Success, void());
 

diff --git a/content/browser/indexed_db/mock_mojo_indexed_db_database_callbacks.h b/content/browser/indexed_db/mock_mojo_indexed_db_database_callbacks.h
index cff9888..7adb6ab 100644
--- a/content/browser/indexed_db/mock_mojo_indexed_db_database_callbacks.h
+++ b/content/browser/indexed_db/mock_mojo_indexed_db_database_callbacks.h

@@ -11,6 +11,7 @@
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace content {
 

diff --git a/content/browser/renderer_host/compositor_impl_android.cc b/content/browser/renderer_host/compositor_impl_android.cc
index 4ca6c42..b6ba885 100644
--- a/content/browser/renderer_host/compositor_impl_android.cc
+++ b/content/browser/renderer_host/compositor_impl_android.cc

@@ -1231,6 +1231,19 @@
   return !has_submitted_frame_since_became_visible_;
 }
 
+void CompositorImpl::SetVSyncPaused(bool paused) {
+  // No action needed in non-Viz mode, as VSync is handled in WindowAndroid.
+  if (!enable_viz_)
+    return;
+
+  if (vsync_paused_ == paused)
+    return;
+
+  vsync_paused_ = paused;
+  if (display_private_)
+    display_private_->SetVSyncPaused(paused);
+}
+
 void CompositorImpl::OnCompositorLockStateChanged(bool locked) {
   if (host_)
     host_->SetDeferCommits(locked);
@@ -1325,6 +1338,7 @@
   host_->SetLayerTreeFrameSink(std::move(layer_tree_frame_sink));
   display_private_->SetDisplayVisible(true);
   display_private_->Resize(size_);
+  display_private_->SetVSyncPaused(vsync_paused_);
 }
 
 viz::LocalSurfaceId CompositorImpl::GenerateLocalSurfaceId() const {

diff --git a/content/browser/renderer_host/compositor_impl_android.h b/content/browser/renderer_host/compositor_impl_android.h
index ad8f0ea..6ade9d2 100644
--- a/content/browser/renderer_host/compositor_impl_android.h
+++ b/content/browser/renderer_host/compositor_impl_android.h

@@ -148,6 +148,7 @@
       ui::CompositorLockClient* client,
       base::TimeDelta timeout) override;
   bool IsDrawingFirstVisibleFrame() const override;
+  void SetVSyncPaused(bool paused) override;
 
   // viz::HostFrameSinkClient implementation.
   void OnFirstSurfaceActivation(const viz::SurfaceInfo& surface_info) override {
@@ -253,6 +254,7 @@
   // Viz-specific members for communicating with the display.
   viz::mojom::DisplayPrivateAssociatedPtr display_private_;
   std::unique_ptr<viz::HostDisplayClient> display_client_;
+  bool vsync_paused_ = false;
 
   // Test-only. Called when we are notified of a swap.
   base::RepeatingCallback<void(const gfx::Size&)>

diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 1e570624..573ce19 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h

@@ -58,6 +58,7 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/mojom/associated_interfaces/associated_interfaces.mojom.h"
 #include "third_party/blink/public/mojom/dom_storage/storage_partition_service.mojom.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gl/gpu_switching_observer.h"
 

diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 65c1108a..0156a5f3 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc

@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
+#include "base/feature_list.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
@@ -453,6 +454,10 @@
 
 // Renderer processes should not be able to spoof Origin HTTP headers.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) {
+  // https://crbug.com/862176
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService))
+    return;
+
   // Create a set of IPC messages with various Origin headers.
   network::ResourceRequest chrome_origin_msg(
       CreateXHRRequestWithOrigin("chrome://settings"));

diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 4a52b5a..f806c32 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc

@@ -865,7 +865,6 @@
                         OnUnregisterProtocolHandler)
     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdatePageImportanceSignals,
                         OnUpdatePageImportanceSignals)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_Find_Reply, OnFindReply)
     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateFaviconURL, OnUpdateFaviconURL)
 #if BUILDFLAG(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER(FrameHostMsg_PepperInstanceCreated,
@@ -4587,22 +4586,6 @@
   page_importance_signals_ = signals;
 }
 
-void WebContentsImpl::OnFindReply(RenderFrameHostImpl* source,
-                                  int request_id,
-                                  int number_of_matches,
-                                  const gfx::Rect& selection_rect,
-                                  int active_match_ordinal,
-                                  bool final_update) {
-  if (active_match_ordinal > 0)
-    SetFocusedFrame(source->frame_tree_node(), source->GetSiteInstance());
-
-  // Forward the find reply to the FindRequestManager, along with the
-  // RenderFrameHost associated with the frame that the reply came from.
-  GetOrCreateFindRequestManager()->OnFindReply(
-      source, request_id, number_of_matches, selection_rect,
-      active_match_ordinal, final_update);
-}
-
 #if defined(OS_ANDROID)
 void WebContentsImpl::OnOpenDateTimeDialog(
     RenderViewHostImpl* source,

diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index de0e8b1..9b5d1c59 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h

@@ -1183,12 +1183,6 @@
                                    const std::string& protocol,
                                    const GURL& url,
                                    bool user_gesture);
-  void OnFindReply(RenderFrameHostImpl* source,
-                   int request_id,
-                   int number_of_matches,
-                   const gfx::Rect& selection_rect,
-                   int active_match_ordinal,
-                   bool final_update);
 #if defined(OS_ANDROID)
   void OnOpenDateTimeDialog(
       RenderViewHostImpl* source,

diff --git a/content/browser/web_package/signed_exchange_handler.cc b/content/browser/web_package/signed_exchange_handler.cc
index a148b07..b068987c 100644
--- a/content/browser/web_package/signed_exchange_handler.cc
+++ b/content/browser/web_package/signed_exchange_handler.cc

@@ -322,7 +322,7 @@
   int result = cert_verifier->Verify(
       net::CertVerifier::RequestParams(
           unverified_cert_chain_->cert(), envelope_->request_url().host(),
-          0 /* cert_verify_flags */, unverified_cert_chain_->ocsp(),
+          config.GetCertVerifyFlags(), unverified_cert_chain_->ocsp(),
           net::CertificateList()),
       net::SSLConfigService::GetCRLSet().get(), &cert_verify_result_,
       base::BindRepeating(&SignedExchangeHandler::OnCertVerifyComplete,

diff --git a/content/browser/web_package/signed_exchange_handler_unittest.cc b/content/browser/web_package/signed_exchange_handler_unittest.cc
index fb6b81b..d41021f 100644
--- a/content/browser/web_package/signed_exchange_handler_unittest.cc
+++ b/content/browser/web_package/signed_exchange_handler_unittest.cc

@@ -124,7 +124,6 @@
                    net::CertVerifyResult* verify_result,
                    std::unique_ptr<net::CertVerifier::Request>* out_req,
                    const net::NetLogWithSource& net_log));
-  MOCK_METHOD1(SetConfig, void(const net::CertVerifier::Config& config));
 };
 
 class MockCTVerifier : public net::CTVerifier {

diff --git a/content/browser/webauth/authenticator_impl.cc b/content/browser/webauth/authenticator_impl.cc
index b355d0b..beb94e9 100644
--- a/content/browser/webauth/authenticator_impl.cc
+++ b/content/browser/webauth/authenticator_impl.cc

@@ -646,7 +646,8 @@
 // Callback to handle the async registration response from a U2fDevice.
 void AuthenticatorImpl::OnRegisterResponse(
     device::FidoReturnCode status_code,
-    base::Optional<device::AuthenticatorMakeCredentialResponse> response_data) {
+    base::Optional<device::AuthenticatorMakeCredentialResponse> response_data,
+    device::FidoTransportProtocol transport_used) {
   if (!request_) {
     // Either the callback was called immediately and |request_| has not yet
     // been assigned (this is a bug), or a navigation caused the request to be
@@ -676,6 +677,7 @@
       return;
     case device::FidoReturnCode::kSuccess:
       DCHECK(response_data.has_value());
+      request_delegate_->UpdateLastTransportUsed(transport_used);
 
       if (attestation_preference_ !=
           blink::mojom::AttestationConveyancePreference::NONE) {
@@ -752,7 +754,8 @@
 
 void AuthenticatorImpl::OnSignResponse(
     device::FidoReturnCode status_code,
-    base::Optional<device::AuthenticatorGetAssertionResponse> response_data) {
+    base::Optional<device::AuthenticatorGetAssertionResponse> response_data,
+    device::FidoTransportProtocol transport_used) {
   if (!request_) {
     // Either the callback was called immediately and |request_| has not yet
     // been assigned (this is a bug), or a navigation caused the request to be
@@ -779,6 +782,8 @@
       return;
     case device::FidoReturnCode::kSuccess:
       DCHECK(response_data.has_value());
+      request_delegate_->UpdateLastTransportUsed(transport_used);
+
       base::Optional<bool> echo_appid_extension;
       if (alternative_application_parameter_) {
         echo_appid_extension = (response_data->GetRpIdHash() ==

diff --git a/content/browser/webauth/authenticator_impl.h b/content/browser/webauth/authenticator_impl.h
index 1b8dc671..9637a3b 100644
--- a/content/browser/webauth/authenticator_impl.h
+++ b/content/browser/webauth/authenticator_impl.h

@@ -125,8 +125,8 @@
   // Callback to handle the async response from a U2fDevice.
   void OnRegisterResponse(
       device::FidoReturnCode status_code,
-      base::Optional<device::AuthenticatorMakeCredentialResponse>
-          response_data);
+      base::Optional<device::AuthenticatorMakeCredentialResponse> response_data,
+      device::FidoTransportProtocol transport_used);
 
   // Callback to complete the registration process once a decision about
   // whether or not to return attestation data has been made.
@@ -137,7 +137,8 @@
   // Callback to handle the async response from a U2fDevice.
   void OnSignResponse(
       device::FidoReturnCode status_code,
-      base::Optional<device::AuthenticatorGetAssertionResponse> response_data);
+      base::Optional<device::AuthenticatorGetAssertionResponse> response_data,
+      device::FidoTransportProtocol transport_used);
 
   // Runs when timer expires and cancels all issued requests to a U2fDevice.
   void OnTimeout();

diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index 078402e..538a342 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn

@@ -134,8 +134,6 @@
     "in_process_child_thread_params.cc",
     "in_process_child_thread_params.h",
     "indexed_db/indexed_db_constants.h",
-    "indexed_db/indexed_db_key.cc",
-    "indexed_db/indexed_db_key.h",
     "indexed_db/indexed_db_key_path.cc",
     "indexed_db/indexed_db_key_path.h",
     "indexed_db/indexed_db_key_range.cc",

diff --git a/content/common/DEPS b/content/common/DEPS
index fb60614f..96e605eeb 100644
--- a/content/common/DEPS
+++ b/content/common/DEPS

@@ -55,7 +55,6 @@
   "+third_party/blink/public/platform/modules/device_orientation/WebDeviceMotionData.h",
   "+third_party/blink/public/platform/modules/device_orientation/WebDeviceOrientationData.h",
   "+third_party/blink/public/platform/modules/fetch/fetch_api_request.mojom.h",
-  "+third_party/blink/public/platform/modules/indexeddb/web_idb_types.h",
   "+third_party/blink/public/platform/modules/mediasession/media_session.mojom.h",
   "+third_party/blink/public/platform/modules/mediastream/media_devices.mojom.h",
   "+third_party/blink/public/platform/modules/permissions/permission.mojom.h",

diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 0add295..9793e89 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h

@@ -1078,16 +1078,6 @@
 IPC_MESSAGE_ROUTED1(FrameMsg_AdvanceFocusInForm,
                     blink::WebFocusType /* direction for advancing focus */)
 
-// Sent when the user wants to search for a word on the page (find-in-page).
-IPC_MESSAGE_ROUTED3(FrameMsg_Find,
-                    int /* request_id */,
-                    base::string16 /* search_text */,
-                    blink::WebFindOptions)
-
-// This message notifies the frame that the user has closed the find-in-page
-// window (and what action to take regarding the selection).
-IPC_MESSAGE_ROUTED1(FrameMsg_StopFinding, content::StopFindAction /* action */)
-
 // Copies the image at location x, y to the clipboard (if there indeed is an
 // image at that location).
 IPC_MESSAGE_ROUTED2(FrameMsg_CopyImageAt,
@@ -1701,19 +1691,6 @@
                     blink::WebFocusType /* type */,
                     int32_t /* source_routing_id */)
 
-// Result of string search in the document.
-// Response to FrameMsg_Find with the results of the requested find-in-page
-// search, the number of matches found and the selection rect (in screen
-// coordinates) for the string found. If |final_update| is false, it signals
-// that this is not the last Find_Reply message - more will be sent as the
-// scoping effort continues.
-IPC_MESSAGE_ROUTED5(FrameHostMsg_Find_Reply,
-                    int /* request_id */,
-                    int /* number of matches */,
-                    gfx::Rect /* selection_rect */,
-                    int /* active_match_ordinal */,
-                    bool /* final_update */)
-
 // Sends hittesting data needed to perform hittesting on the browser process.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_HittestData, FrameHostMsg_HittestData_Params)
 

diff --git a/content/common/indexed_db/indexed_db.mojom b/content/common/indexed_db/indexed_db.mojom
index 15edf0e..667bd658 100644
--- a/content/common/indexed_db/indexed_db.mojom
+++ b/content/common/indexed_db/indexed_db.mojom

@@ -13,43 +13,9 @@
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "third_party/blink/public/mojom/blob/blob.mojom";
+import "third_party/blink/public/mojom/indexeddb/indexeddb.mojom";
 import "url/mojom/origin.mojom";
 
-enum CursorDirection {
-  Next,
-  NextNoDuplicate,
-  Prev,
-  PrevNoDuplicate,
-};
-
-enum DataLoss {
-  None,
-  Total,
-};
-
-// Represents key types that hold no data and so cannot be options in the
-// KeyData union.
-// TODO(jsbell): These types should be cleaned up end-to-end, leaving only the
-// dataful options.
-enum DatalessKeyType {
-  Invalid,
-  Null,
-};
-
-union KeyData {
-  array<Key> key_array;
-  array<uint8> binary;
-  mojo_base.mojom.String16 string;
-  double date;
-  double number;
-  DatalessKeyType other;
-};
-
-// Defined as a structure so that it can by typemapped with StructTraits.
-struct Key {
-  KeyData data;
-};
-
 // Represents WebIDBKeyPathTypeString and WebIDBKeyPathTypeArray in a key path.
 union KeyPathData {
   mojo_base.mojom.String16 string;
@@ -62,19 +28,12 @@
 };
 
 struct KeyRange {
-  Key lower;
-  Key upper;
+  blink.mojom.IDBKey lower;
+  blink.mojom.IDBKey upper;
   bool lower_open;
   bool upper_open;
 };
 
-enum OperationType {
-  Add,
-  Put,
-  Delete,
-  Clear,
-};
-
 enum PutMode {
   AddOrUpdate,
   AddOnly,
@@ -128,49 +87,25 @@
 
 struct IndexKeys {
   int64 index_id;
-  array<Key> index_keys;
-};
-
-struct FileInfo {
-  mojo_base.mojom.FilePath path;
-  mojo_base.mojom.String16 name;
-  mojo_base.mojom.Time last_modified;
-};
-
-struct BlobInfo {
-  blink.mojom.Blob blob;
-  string uuid;
-  mojo_base.mojom.String16 mime_type;
-  int64 size;
-  FileInfo? file;
-};
-
-struct Value {
-  string bits;
-  array<BlobInfo> blob_or_file_info;
+  array<blink.mojom.IDBKey> index_keys;
 };
 
 struct ReturnValue {
-  Value value;
-  Key primary_key;
+  blink.mojom.IDBValue value;
+  blink.mojom.IDBKey primary_key;
   KeyPath key_path;
 };
 
 struct Observation {
   int64 object_store_id;
-  OperationType type;
+  blink.mojom.IDBOperationType type;
   KeyRange key_range;
-  Value? value;
-};
-
-struct ObserverTransaction {
-  int64 id;
-  array<int64> scope;
+  blink.mojom.IDBValue? value;
 };
 
 struct ObserverChanges {
   map<int32, array<int32>> observation_index_map;
-  map<int32, ObserverTransaction> transaction_map;
+  map<int32, blink.mojom.IDBObserverTransaction> transaction_map;
   array<Observation> observations;
 };
 
@@ -191,32 +126,34 @@
 
   // Factory::Open
   UpgradeNeeded(associated Database database, int64 old_version,
-                DataLoss data_loss, string data_loss_message,
+                blink.mojom.IDBDataLoss data_loss, string data_loss_message,
                 DatabaseMetadata db_metadata);
   SuccessDatabase(associated Database? database, DatabaseMetadata metadata);
 
   // Database::OpenCursor
   SuccessCursor(associated Cursor cursor,
-                Key key,
-                Key primary_key,
-                Value? value);
+                blink.mojom.IDBKey key,
+                blink.mojom.IDBKey primary_key,
+                blink.mojom.IDBValue? value);
 
   // Database::Get / Cursor::Advance
   SuccessValue(ReturnValue? value);
 
   // Cursor::Continue / Advance
-  SuccessCursorContinue(Key key, Key primary_key, Value? value);
+  SuccessCursorContinue(blink.mojom.IDBKey key,
+                        blink.mojom.IDBKey primary_key,
+                        blink.mojom.IDBValue? value);
 
   // Cursor::Prefetch
-  SuccessCursorPrefetch(array<Key> keys,
-                        array<Key> primary_keys,
-                        array<Value> values);
+  SuccessCursorPrefetch(array<blink.mojom.IDBKey> keys,
+                        array<blink.mojom.IDBKey> primary_keys,
+                        array<blink.mojom.IDBValue> values);
 
   // Database::GetAll
   SuccessArray(array<ReturnValue> values);
 
   // Database::Put / Cursor::Update
-  SuccessKey(Key key);
+  SuccessKey(blink.mojom.IDBKey key);
 
   // Database::Count / DeleteRange
   // Factory::DeleteDatabase
@@ -240,7 +177,9 @@
 
 interface Cursor {
   Advance(uint32 count, associated Callbacks callbacks);
-  Continue(Key key, Key primary_key, associated Callbacks callbacks);
+  Continue(blink.mojom.IDBKey key,
+           blink.mojom.IDBKey primary_key,
+           associated Callbacks callbacks);
   Prefetch(int32 count, associated Callbacks callbacks);
   PrefetchReset(int32 used_prefetches, int32 unused_prefetches);
 };
@@ -283,14 +222,14 @@
          associated Callbacks callbacks);
   Put(int64 transaction_id,
       int64 object_store_id,
-      Value value,
-      Key key,
+      blink.mojom.IDBValue value,
+      blink.mojom.IDBKey key,
       PutMode mode,
       array<IndexKeys> index_keys,
       associated Callbacks callbacks);
   SetIndexKeys(int64 transaction_id,
                int64 object_store_id,
-               Key primary_key,
+               blink.mojom.IDBKey primary_key,
                array<IndexKeys> index_keys);
   SetIndexesReady(int64 transaction_id,
                   int64 object_store_id,
@@ -299,7 +238,7 @@
              int64 object_store_id,
              int64 index_id,
              KeyRange key_range,
-             CursorDirection direction,
+             blink.mojom.IDBCursorDirection direction,
              bool key_only,
              TaskType task_type,
              associated Callbacks callbacks);

diff --git a/content/common/indexed_db/indexed_db.typemap b/content/common/indexed_db/indexed_db.typemap
index aad054c..ea189f5 100644
--- a/content/common/indexed_db/indexed_db.typemap
+++ b/content/common/indexed_db/indexed_db.typemap

@@ -4,24 +4,20 @@
 
 mojom = "//content/common/indexed_db/indexed_db.mojom"
 public_headers = [
-  "//content/common/indexed_db/indexed_db_key.h",
   "//content/common/indexed_db/indexed_db_key_path.h",
   "//content/common/indexed_db/indexed_db_key_range.h",
   "//content/common/indexed_db/indexed_db_metadata.h",
-  "//third_party/blink/public/platform/modules/indexeddb/web_idb_types.h",
+  "//third_party/blink/public/common/indexeddb/indexeddb_key.h",
+  "//third_party/blink/public/common/indexeddb/web_idb_types.h",
 ]
 traits_headers = [ "//content/common/indexed_db/indexed_db_struct_traits.h" ]
 type_mappings = [
-  "indexed_db.mojom.CursorDirection=blink::WebIDBCursorDirection",
   "indexed_db.mojom.DatabaseMetadata=content::IndexedDBDatabaseMetadata",
-  "indexed_db.mojom.DataLoss=blink::WebIDBDataLoss",
-  "indexed_db.mojom.IndexKeys=content::IndexedDBIndexKeys",
+  "indexed_db.mojom.IndexKeys=blink::IndexedDBIndexKeys",
   "indexed_db.mojom.IndexMetadata=content::IndexedDBIndexMetadata",
-  "indexed_db.mojom.Key=content::IndexedDBKey",
   "indexed_db.mojom.KeyPath=content::IndexedDBKeyPath",
   "indexed_db.mojom.KeyRange=content::IndexedDBKeyRange",
   "indexed_db.mojom.ObjectStoreMetadata=content::IndexedDBObjectStoreMetadata",
-  "indexed_db.mojom.OperationType=blink::WebIDBOperationType",
   "indexed_db.mojom.PutMode=blink::WebIDBPutMode",
   "indexed_db.mojom.TaskType=blink::WebIDBTaskType",
   "indexed_db.mojom.TransactionMode=blink::WebIDBTransactionMode",

diff --git a/content/common/indexed_db/indexed_db_key_path.h b/content/common/indexed_db/indexed_db_key_path.h
index 70c67f94..9a1edfe 100644
--- a/content/common/indexed_db/indexed_db_key_path.h
+++ b/content/common/indexed_db/indexed_db_key_path.h

@@ -11,7 +11,7 @@
 #include "base/logging.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 

diff --git a/content/common/indexed_db/indexed_db_key_range.cc b/content/common/indexed_db/indexed_db_key_range.cc
index e073e64..1db892b7 100644
--- a/content/common/indexed_db/indexed_db_key_range.cc
+++ b/content/common/indexed_db/indexed_db_key_range.cc

@@ -5,14 +5,14 @@
 #include "content/common/indexed_db/indexed_db_key_range.h"
 
 #include "base/logging.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
 namespace content {
 
 IndexedDBKeyRange::IndexedDBKeyRange() = default;
 
-IndexedDBKeyRange::IndexedDBKeyRange(const IndexedDBKey& lower,
-                                     const IndexedDBKey& upper,
+IndexedDBKeyRange::IndexedDBKeyRange(const blink::IndexedDBKey& lower,
+                                     const blink::IndexedDBKey& upper,
                                      bool lower_open,
                                      bool upper_open)
     : lower_(lower),
@@ -20,9 +20,8 @@
       lower_open_(lower_open),
       upper_open_(upper_open) {}
 
-IndexedDBKeyRange::IndexedDBKeyRange(const IndexedDBKey& key)
-    : lower_(key), upper_(key) {
-}
+IndexedDBKeyRange::IndexedDBKeyRange(const blink::IndexedDBKey& key)
+    : lower_(key), upper_(key) {}
 
 IndexedDBKeyRange::IndexedDBKeyRange(const IndexedDBKeyRange& other) = default;
 IndexedDBKeyRange::~IndexedDBKeyRange() = default;

diff --git a/content/common/indexed_db/indexed_db_key_range.h b/content/common/indexed_db/indexed_db_key_range.h
index ac334de..50a3b8fc 100644
--- a/content/common/indexed_db/indexed_db_key_range.h
+++ b/content/common/indexed_db/indexed_db_key_range.h

@@ -6,24 +6,24 @@
 #define CONTENT_COMMON_INDEXED_DB_INDEXED_DB_KEY_RANGE_H_
 
 #include "content/common/content_export.h"
-#include "content/common/indexed_db/indexed_db_key.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 namespace content {
 
 class CONTENT_EXPORT IndexedDBKeyRange {
  public:
   IndexedDBKeyRange();
-  explicit IndexedDBKeyRange(const IndexedDBKey& key);
-  IndexedDBKeyRange(const IndexedDBKey& lower,
-                    const IndexedDBKey& upper,
+  explicit IndexedDBKeyRange(const blink::IndexedDBKey& key);
+  IndexedDBKeyRange(const blink::IndexedDBKey& lower,
+                    const blink::IndexedDBKey& upper,
                     bool lower_open,
                     bool upper_open);
   IndexedDBKeyRange(const IndexedDBKeyRange& other);
   ~IndexedDBKeyRange();
   IndexedDBKeyRange& operator=(const IndexedDBKeyRange& other);
 
-  const IndexedDBKey& lower() const { return lower_; }
-  const IndexedDBKey& upper() const { return upper_; }
+  const blink::IndexedDBKey& lower() const { return lower_; }
+  const blink::IndexedDBKey& upper() const { return upper_; }
   bool lower_open() const { return lower_open_; }
   bool upper_open() const { return upper_open_; }
 
@@ -31,8 +31,8 @@
   bool IsEmpty() const;
 
  private:
-  IndexedDBKey lower_ = IndexedDBKey(blink::kWebIDBKeyTypeNull);
-  IndexedDBKey upper_ = IndexedDBKey(blink::kWebIDBKeyTypeNull);
+  blink::IndexedDBKey lower_ = blink::IndexedDBKey(blink::kWebIDBKeyTypeNull);
+  blink::IndexedDBKey upper_ = blink::IndexedDBKey(blink::kWebIDBKeyTypeNull);
   bool lower_open_ = false;
   bool upper_open_ = false;
 };

diff --git a/content/common/indexed_db/indexed_db_struct_traits.cc b/content/common/indexed_db/indexed_db_struct_traits.cc
index 7c714cd7..619bcd8 100644
--- a/content/common/indexed_db/indexed_db_struct_traits.cc
+++ b/content/common/indexed_db/indexed_db_struct_traits.cc

@@ -6,13 +6,12 @@
 
 #include "base/stl_util.h"
 #include "mojo/public/cpp/base/string16_mojom_traits.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h"
 
-using content::IndexedDBKey;
+using blink::IndexedDBKey;
+using blink::IndexedDBIndexKeys;
 using content::IndexedDBKeyPath;
 using content::IndexedDBKeyRange;
-using indexed_db::mojom::CursorDirection;
-using indexed_db::mojom::DataLoss;
-using indexed_db::mojom::OperationType;
 using indexed_db::mojom::PutMode;
 using indexed_db::mojom::TaskType;
 using indexed_db::mojom::TransactionMode;
@@ -20,91 +19,6 @@
 namespace mojo {
 
 // static
-indexed_db::mojom::KeyDataPtr
-StructTraits<indexed_db::mojom::KeyDataView, IndexedDBKey>::data(
-    const IndexedDBKey& key) {
-  auto data = indexed_db::mojom::KeyData::New();
-  switch (key.type()) {
-    case blink::kWebIDBKeyTypeInvalid:
-      data->set_other(indexed_db::mojom::DatalessKeyType::Invalid);
-      return data;
-    case blink::kWebIDBKeyTypeArray:
-      data->set_key_array(key.array());
-      return data;
-    case blink::kWebIDBKeyTypeBinary:
-      data->set_binary(std::vector<uint8_t>(
-          key.binary().data(), key.binary().data() + key.binary().size()));
-      return data;
-    case blink::kWebIDBKeyTypeString:
-      data->set_string(key.string());
-      return data;
-    case blink::kWebIDBKeyTypeDate:
-      data->set_date(key.date());
-      return data;
-    case blink::kWebIDBKeyTypeNumber:
-      data->set_number(key.number());
-      return data;
-    case blink::kWebIDBKeyTypeNull:
-      data->set_other(indexed_db::mojom::DatalessKeyType::Null);
-      return data;
-    case blink::kWebIDBKeyTypeMin:
-      break;
-  }
-  NOTREACHED();
-  return data;
-}
-
-// static
-bool StructTraits<indexed_db::mojom::KeyDataView, IndexedDBKey>::Read(
-    indexed_db::mojom::KeyDataView data,
-    IndexedDBKey* out) {
-  indexed_db::mojom::KeyDataDataView data_view;
-  data.GetDataDataView(&data_view);
-
-  switch (data_view.tag()) {
-    case indexed_db::mojom::KeyDataDataView::Tag::KEY_ARRAY: {
-      std::vector<IndexedDBKey> array;
-      if (!data_view.ReadKeyArray(&array))
-        return false;
-      *out = IndexedDBKey(array);
-      return true;
-    }
-    case indexed_db::mojom::KeyDataDataView::Tag::BINARY: {
-      std::vector<uint8_t> binary;
-      if (!data_view.ReadBinary(&binary))
-        return false;
-      *out = IndexedDBKey(
-          std::string(binary.data(), binary.data() + binary.size()));
-      return true;
-    }
-    case indexed_db::mojom::KeyDataDataView::Tag::STRING: {
-      base::string16 string;
-      if (!data_view.ReadString(&string))
-        return false;
-      *out = IndexedDBKey(string);
-      return true;
-    }
-    case indexed_db::mojom::KeyDataDataView::Tag::DATE:
-      *out = IndexedDBKey(data_view.date(), blink::kWebIDBKeyTypeDate);
-      return true;
-    case indexed_db::mojom::KeyDataDataView::Tag::NUMBER:
-      *out = IndexedDBKey(data_view.number(), blink::kWebIDBKeyTypeNumber);
-      return true;
-    case indexed_db::mojom::KeyDataDataView::Tag::OTHER:
-      switch (data_view.other()) {
-        case indexed_db::mojom::DatalessKeyType::Invalid:
-          *out = IndexedDBKey(blink::kWebIDBKeyTypeInvalid);
-          return true;
-        case indexed_db::mojom::DatalessKeyType::Null:
-          *out = IndexedDBKey(blink::kWebIDBKeyTypeNull);
-          return true;
-      }
-  }
-
-  return false;
-}
-
-// static
 indexed_db::mojom::KeyPathDataPtr
 StructTraits<indexed_db::mojom::KeyPathDataView, IndexedDBKeyPath>::data(
     const IndexedDBKeyPath& key_path) {
@@ -171,10 +85,8 @@
 }
 
 // static
-bool StructTraits<indexed_db::mojom::IndexKeysDataView,
-                  content::IndexedDBIndexKeys>::
-    Read(indexed_db::mojom::IndexKeysDataView data,
-         content::IndexedDBIndexKeys* out) {
+bool StructTraits<indexed_db::mojom::IndexKeysDataView, IndexedDBIndexKeys>::
+    Read(indexed_db::mojom::IndexKeysDataView data, IndexedDBIndexKeys* out) {
   out->first = data.index_id();
   return data.ReadIndexKeys(&out->second);
 }
@@ -246,114 +158,6 @@
 }
 
 // static
-CursorDirection
-EnumTraits<CursorDirection, blink::WebIDBCursorDirection>::ToMojom(
-    blink::WebIDBCursorDirection input) {
-  switch (input) {
-    case blink::kWebIDBCursorDirectionNext:
-      return CursorDirection::Next;
-    case blink::kWebIDBCursorDirectionNextNoDuplicate:
-      return CursorDirection::NextNoDuplicate;
-    case blink::kWebIDBCursorDirectionPrev:
-      return CursorDirection::Prev;
-    case blink::kWebIDBCursorDirectionPrevNoDuplicate:
-      return CursorDirection::PrevNoDuplicate;
-  }
-  NOTREACHED();
-  return CursorDirection::Next;
-}
-
-// static
-bool EnumTraits<CursorDirection, blink::WebIDBCursorDirection>::FromMojom(
-    CursorDirection input,
-    blink::WebIDBCursorDirection* output) {
-  switch (input) {
-    case CursorDirection::Next:
-      *output = blink::kWebIDBCursorDirectionNext;
-      return true;
-    case CursorDirection::NextNoDuplicate:
-      *output = blink::kWebIDBCursorDirectionNextNoDuplicate;
-      return true;
-    case CursorDirection::Prev:
-      *output = blink::kWebIDBCursorDirectionPrev;
-      return true;
-    case CursorDirection::PrevNoDuplicate:
-      *output = blink::kWebIDBCursorDirectionPrevNoDuplicate;
-      return true;
-  }
-  return false;
-}
-
-// static
-DataLoss EnumTraits<DataLoss, blink::WebIDBDataLoss>::ToMojom(
-    blink::WebIDBDataLoss input) {
-  switch (input) {
-    case blink::kWebIDBDataLossNone:
-      return DataLoss::None;
-    case blink::kWebIDBDataLossTotal:
-      return DataLoss::Total;
-  }
-  NOTREACHED();
-  return DataLoss::None;
-}
-
-// static
-bool EnumTraits<DataLoss, blink::WebIDBDataLoss>::FromMojom(
-    DataLoss input,
-    blink::WebIDBDataLoss* output) {
-  switch (input) {
-    case DataLoss::None:
-      *output = blink::kWebIDBDataLossNone;
-      return true;
-    case DataLoss::Total:
-      *output = blink::kWebIDBDataLossTotal;
-      return true;
-  }
-  return false;
-}
-
-// static
-OperationType EnumTraits<OperationType, blink::WebIDBOperationType>::ToMojom(
-    blink::WebIDBOperationType input) {
-  switch (input) {
-    case blink::kWebIDBAdd:
-      return OperationType::Add;
-    case blink::kWebIDBPut:
-      return OperationType::Put;
-    case blink::kWebIDBDelete:
-      return OperationType::Delete;
-    case blink::kWebIDBClear:
-      return OperationType::Clear;
-    case blink::kWebIDBOperationTypeCount:
-      // WebIDBOperationTypeCount is not a valid option.
-      break;
-  }
-  NOTREACHED();
-  return OperationType::Add;
-}
-
-// static
-bool EnumTraits<OperationType, blink::WebIDBOperationType>::FromMojom(
-    OperationType input,
-    blink::WebIDBOperationType* output) {
-  switch (input) {
-    case OperationType::Add:
-      *output = blink::kWebIDBAdd;
-      return true;
-    case OperationType::Put:
-      *output = blink::kWebIDBPut;
-      return true;
-    case OperationType::Delete:
-      *output = blink::kWebIDBDelete;
-      return true;
-    case OperationType::Clear:
-      *output = blink::kWebIDBClear;
-      return true;
-  }
-  return false;
-}
-
-// static
 PutMode EnumTraits<PutMode, blink::WebIDBPutMode>::ToMojom(
     blink::WebIDBPutMode input) {
   switch (input) {

diff --git a/content/common/indexed_db/indexed_db_struct_traits.h b/content/common/indexed_db/indexed_db_struct_traits.h
index 913b562..152884b 100644
--- a/content/common/indexed_db/indexed_db_struct_traits.h
+++ b/content/common/indexed_db/indexed_db_struct_traits.h

@@ -6,17 +6,12 @@
 #define CONTENT_COMMON_INDEXED_DB_INDEXED_DB_STRUCT_TRAITS_H_
 
 #include "content/common/indexed_db/indexed_db.mojom.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace mojo {
 
 template <>
-struct StructTraits<indexed_db::mojom::KeyDataView, content::IndexedDBKey> {
-  static indexed_db::mojom::KeyDataPtr data(const content::IndexedDBKey& key);
-  static bool Read(indexed_db::mojom::KeyDataView data,
-                   content::IndexedDBKey* out);
-};
-
-template <>
 struct StructTraits<indexed_db::mojom::KeyPathDataView,
                     content::IndexedDBKeyPath> {
   static indexed_db::mojom::KeyPathDataPtr data(
@@ -28,11 +23,11 @@
 template <>
 struct StructTraits<indexed_db::mojom::KeyRangeDataView,
                     content::IndexedDBKeyRange> {
-  static const content::IndexedDBKey& lower(
+  static const blink::IndexedDBKey& lower(
       const content::IndexedDBKeyRange& key_range) {
     return key_range.lower();
   }
-  static const content::IndexedDBKey& upper(
+  static const blink::IndexedDBKey& upper(
       const content::IndexedDBKeyRange& key_range) {
     return key_range.upper();
   }
@@ -48,16 +43,16 @@
 
 template <>
 struct StructTraits<indexed_db::mojom::IndexKeysDataView,
-                    content::IndexedDBIndexKeys> {
-  static int64_t index_id(const content::IndexedDBIndexKeys& index_keys) {
+                    blink::IndexedDBIndexKeys> {
+  static int64_t index_id(const blink::IndexedDBIndexKeys& index_keys) {
     return index_keys.first;
   }
-  static const std::vector<content::IndexedDBKey>& index_keys(
-      const content::IndexedDBIndexKeys& index_keys) {
+  static const std::vector<blink::IndexedDBKey>& index_keys(
+      const blink::IndexedDBIndexKeys& index_keys) {
     return index_keys.second;
   }
   static bool Read(indexed_db::mojom::IndexKeysDataView data,
-                   content::IndexedDBIndexKeys* out);
+                   blink::IndexedDBIndexKeys* out);
 };
 
 template <>
@@ -139,31 +134,6 @@
 };
 
 template <>
-struct EnumTraits<indexed_db::mojom::CursorDirection,
-                  blink::WebIDBCursorDirection> {
-  static indexed_db::mojom::CursorDirection ToMojom(
-      blink::WebIDBCursorDirection input);
-  static bool FromMojom(indexed_db::mojom::CursorDirection input,
-                        blink::WebIDBCursorDirection* output);
-};
-
-template <>
-struct EnumTraits<indexed_db::mojom::DataLoss, blink::WebIDBDataLoss> {
-  static indexed_db::mojom::DataLoss ToMojom(blink::WebIDBDataLoss input);
-  static bool FromMojom(indexed_db::mojom::DataLoss input,
-                        blink::WebIDBDataLoss* output);
-};
-
-template <>
-struct EnumTraits<indexed_db::mojom::OperationType,
-                  blink::WebIDBOperationType> {
-  static indexed_db::mojom::OperationType ToMojom(
-      blink::WebIDBOperationType input);
-  static bool FromMojom(indexed_db::mojom::OperationType input,
-                        blink::WebIDBOperationType* output);
-};
-
-template <>
 struct EnumTraits<indexed_db::mojom::PutMode, blink::WebIDBPutMode> {
   static indexed_db::mojom::PutMode ToMojom(blink::WebIDBPutMode input);
   static bool FromMojom(indexed_db::mojom::PutMode input,

diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 11ee631..89da7bd 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc

@@ -390,8 +390,14 @@
     "ServiceWorkerScriptFullCodeCache", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // http://tc39.github.io/ecmascript_sharedmem/shmem.html
-const base::Feature kSharedArrayBuffer{"SharedArrayBuffer",
-                                       base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kSharedArrayBuffer {
+  "SharedArrayBuffer",
+#if defined(OS_ANDROID)
+      base::FEATURE_DISABLED_BY_DEFAULT
+#else
+      base::FEATURE_ENABLED_BY_DEFAULT
+#endif
+};
 
 // Origin-Signed HTTP Exchanges (for WebPackage Loading)
 // https://www.chromestatus.com/features/5745285984681984

diff --git a/content/public/test/fake_service_worker_context.cc b/content/public/test/fake_service_worker_context.cc
index b4ad259..e22e795 100644
--- a/content/public/test/fake_service_worker_context.cc
+++ b/content/public/test/fake_service_worker_context.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "content/public/test/fake_service_worker_context.h"
+#include "content/public/browser/service_worker_context_observer.h"
 
 #include "base/callback.h"
 #include "base/logging.h"
@@ -14,11 +15,11 @@
 
 void FakeServiceWorkerContext::AddObserver(
     ServiceWorkerContextObserver* observer) {
-  NOTREACHED();
+  observers_.AddObserver(observer);
 }
 void FakeServiceWorkerContext::RemoveObserver(
     ServiceWorkerContextObserver* observer) {
-  NOTREACHED();
+  observers_.RemoveObserver(observer);
 }
 void FakeServiceWorkerContext::RegisterServiceWorker(
     const GURL& script_url,
@@ -93,4 +94,25 @@
   NOTREACHED();
 }
 
+void FakeServiceWorkerContext::NotifyObserversOnVersionActivated(
+    int64_t version_id,
+    const GURL& scope) {
+  for (auto& observer : observers_)
+    observer.OnVersionActivated(version_id, scope);
+}
+
+void FakeServiceWorkerContext::NotifyObserversOnVersionRedundant(
+    int64_t version_id,
+    const GURL& scope) {
+  for (auto& observer : observers_)
+    observer.OnVersionRedundant(version_id, scope);
+}
+
+void FakeServiceWorkerContext::NotifyObserversOnNoControllees(
+    int64_t version_id,
+    const GURL& scope) {
+  for (auto& observer : observers_)
+    observer.OnNoControllees(version_id, scope);
+}
+
 }  // namespace content

diff --git a/content/public/test/fake_service_worker_context.h b/content/public/test/fake_service_worker_context.h
index 465b667..40380c3 100644
--- a/content/public/test/fake_service_worker_context.h
+++ b/content/public/test/fake_service_worker_context.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/callback_forward.h"
+#include "base/observer_list.h"
 #include "content/public/browser/service_worker_context.h"
 
 class GURL;
@@ -56,6 +57,11 @@
   void StopAllServiceWorkersForOrigin(const GURL& origin) override;
   void StopAllServiceWorkers(base::OnceClosure callback) override;
 
+  // Explicitly notify ServiceWorkerContextObservers added to this context.
+  void NotifyObserversOnVersionActivated(int64_t version_id, const GURL& scope);
+  void NotifyObserversOnVersionRedundant(int64_t version_id, const GURL& scope);
+  void NotifyObserversOnNoControllees(int64_t version_id, const GURL& scope);
+
   bool start_service_worker_for_navigation_hint_called() {
     return start_service_worker_for_navigation_hint_called_;
   }
@@ -68,6 +74,8 @@
  private:
   bool start_service_worker_for_navigation_hint_called_ = false;
 
+  base::ObserverList<ServiceWorkerContextObserver, true> observers_;
+
   DISALLOW_COPY_AND_ASSIGN(FakeServiceWorkerContext);
 };
 

diff --git a/content/renderer/indexed_db/indexed_db_callbacks_impl.cc b/content/renderer/indexed_db/indexed_db_callbacks_impl.cc
index 5f0e57a..9c7c068 100644
--- a/content/renderer/indexed_db/indexed_db_callbacks_impl.cc
+++ b/content/renderer/indexed_db/indexed_db_callbacks_impl.cc

@@ -79,7 +79,7 @@
 
 // static
 WebIDBValue IndexedDBCallbacksImpl::ConvertValue(
-    const indexed_db::mojom::ValuePtr& value) {
+    const blink::mojom::IDBValuePtr& value) {
   if (!value || value->bits.empty())
     return WebIDBValue(WebData(), WebVector<WebBlobInfo>());
 
@@ -169,7 +169,7 @@
     indexed_db::mojom::CursorAssociatedPtrInfo cursor_info,
     const IndexedDBKey& key,
     const IndexedDBKey& primary_key,
-    indexed_db::mojom::ValuePtr value) {
+    blink::mojom::IDBValuePtr value) {
   WebIDBCursorImpl* cursor =
       new WebIDBCursorImpl(std::move(cursor_info), transaction_id_);
   callbacks_->OnSuccess(cursor, WebIDBKeyBuilder::Build(key),
@@ -187,7 +187,7 @@
 void IndexedDBCallbacksImpl::SuccessCursorContinue(
     const IndexedDBKey& key,
     const IndexedDBKey& primary_key,
-    indexed_db::mojom::ValuePtr value) {
+    blink::mojom::IDBValuePtr value) {
   callbacks_->OnSuccess(WebIDBKeyBuilder::Build(key),
                         WebIDBKeyBuilder::Build(primary_key),
                         ConvertValue(value));
@@ -197,10 +197,10 @@
 void IndexedDBCallbacksImpl::SuccessCursorPrefetch(
     const std::vector<IndexedDBKey>& keys,
     const std::vector<IndexedDBKey>& primary_keys,
-    std::vector<indexed_db::mojom::ValuePtr> values) {
+    std::vector<blink::mojom::IDBValuePtr> values) {
   std::vector<WebIDBValue> web_values;
   web_values.reserve(values.size());
-  for (const indexed_db::mojom::ValuePtr& value : values)
+  for (const blink::mojom::IDBValuePtr& value : values)
     web_values.emplace_back(ConvertValue(value));
 
   if (cursor_) {

diff --git a/content/renderer/indexed_db/indexed_db_callbacks_impl.h b/content/renderer/indexed_db/indexed_db_callbacks_impl.h
index 6024a4a8..1251e7f 100644
--- a/content/renderer/indexed_db/indexed_db_callbacks_impl.h
+++ b/content/renderer/indexed_db/indexed_db_callbacks_impl.h

@@ -7,6 +7,10 @@
 
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
+
+using blink::IndexedDBKey;
 
 namespace blink {
 class WebIDBCallbacks;
@@ -25,7 +29,7 @@
   enum : int64_t { kNoTransaction = -1 };
 
   static blink::WebIDBValue ConvertValue(
-      const indexed_db::mojom::ValuePtr& value);
+      const blink::mojom::IDBValuePtr& value);
 
   IndexedDBCallbacksImpl(std::unique_ptr<blink::WebIDBCallbacks> callbacks,
                          int64_t transaction_id,
@@ -48,15 +52,15 @@
   void SuccessCursor(indexed_db::mojom::CursorAssociatedPtrInfo cursor,
                      const IndexedDBKey& key,
                      const IndexedDBKey& primary_key,
-                     indexed_db::mojom::ValuePtr value) override;
+                     blink::mojom::IDBValuePtr value) override;
   void SuccessValue(indexed_db::mojom::ReturnValuePtr value) override;
   void SuccessCursorContinue(const IndexedDBKey& key,
                              const IndexedDBKey& primary_key,
-                             indexed_db::mojom::ValuePtr value) override;
+                             blink::mojom::IDBValuePtr value) override;
   void SuccessCursorPrefetch(
       const std::vector<IndexedDBKey>& keys,
       const std::vector<IndexedDBKey>& primary_keys,
-      std::vector<indexed_db::mojom::ValuePtr> values) override;
+      std::vector<blink::mojom::IDBValuePtr> values) override;
   void SuccessArray(
       std::vector<indexed_db::mojom::ReturnValuePtr> values) override;
   void SuccessKey(const IndexedDBKey& key) override;

diff --git a/content/renderer/indexed_db/indexed_db_database_callbacks_impl.h b/content/renderer/indexed_db/indexed_db_database_callbacks_impl.h
index 2b36930..6bb278f 100644
--- a/content/renderer/indexed_db/indexed_db_database_callbacks_impl.h
+++ b/content/renderer/indexed_db/indexed_db_database_callbacks_impl.h

@@ -7,6 +7,7 @@
 
 #include "base/single_thread_task_runner.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace blink {
 class WebIDBDatabaseCallbacks;

diff --git a/content/renderer/indexed_db/indexed_db_dispatcher.h b/content/renderer/indexed_db/indexed_db_dispatcher.h
index b568519..f6e09a3 100644
--- a/content/renderer/indexed_db/indexed_db_dispatcher.h
+++ b/content/renderer/indexed_db/indexed_db_dispatcher.h

@@ -17,8 +17,8 @@
 #include "content/renderer/indexed_db/indexed_db_callbacks_impl.h"
 #include "content/renderer/indexed_db/indexed_db_database_callbacks_impl.h"
 #include "ipc/ipc_sync_message_filter.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_callbacks.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "url/origin.h"
 
 namespace content {

diff --git a/content/renderer/indexed_db/indexed_db_key_builders.cc b/content/renderer/indexed_db/indexed_db_key_builders.cc
index 657655f..c83b9e6 100644
--- a/content/renderer/indexed_db/indexed_db_key_builders.cc
+++ b/content/renderer/indexed_db/indexed_db_key_builders.cc

@@ -11,13 +11,14 @@
 #include <vector>
 
 #include "base/logging.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key_range.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_vector.h"
 
+using blink::IndexedDBKey;
 using blink::WebIDBKey;
 using blink::WebIDBKeyRange;
 using blink::WebIDBKeyView;
@@ -34,8 +35,8 @@
 
 namespace {
 
-content::IndexedDBKey::KeyArray CopyKeyArray(blink::WebIDBKeyArrayView array) {
-  content::IndexedDBKey::KeyArray result;
+IndexedDBKey::KeyArray CopyKeyArray(blink::WebIDBKeyArrayView array) {
+  IndexedDBKey::KeyArray result;
   const size_t array_size = array.size();
   result.reserve(array_size);
   for (size_t i = 0; i < array_size; ++i)

diff --git a/content/renderer/indexed_db/indexed_db_key_builders.h b/content/renderer/indexed_db/indexed_db_key_builders.h
index 7462d8dc..2f411b7 100644
--- a/content/renderer/indexed_db/indexed_db_key_builders.h
+++ b/content/renderer/indexed_db/indexed_db_key_builders.h

@@ -7,9 +7,9 @@
 
 #include "base/macros.h"
 #include "content/common/content_export.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/common/indexed_db/indexed_db_key_path.h"
 #include "content/common/indexed_db/indexed_db_key_range.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key.h"
 
 namespace blink {
@@ -23,7 +23,7 @@
 
 class CONTENT_EXPORT IndexedDBKeyBuilder {
  public:
-  static IndexedDBKey Build(blink::WebIDBKeyView key);
+  static blink::IndexedDBKey Build(blink::WebIDBKeyView key);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(IndexedDBKeyBuilder);
@@ -31,7 +31,7 @@
 
 class CONTENT_EXPORT WebIDBKeyBuilder {
  public:
-  static blink::WebIDBKey Build(const content::IndexedDBKey& key);
+  static blink::WebIDBKey Build(const blink::IndexedDBKey& key);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(WebIDBKeyBuilder);

diff --git a/content/renderer/indexed_db/webidbcursor_impl.h b/content/renderer/indexed_db/webidbcursor_impl.h
index f363d5dc..08b4454 100644
--- a/content/renderer/indexed_db/webidbcursor_impl.h
+++ b/content/renderer/indexed_db/webidbcursor_impl.h

@@ -15,7 +15,8 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
-#include "content/common/indexed_db/indexed_db_key.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_callbacks.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key.h"
@@ -37,8 +38,8 @@
                 blink::WebIDBCallbacks* callback) override;
   void PostSuccessHandlerCallback() override;
 
-  void SetPrefetchData(const std::vector<IndexedDBKey>& keys,
-                       const std::vector<IndexedDBKey>& primary_keys,
+  void SetPrefetchData(const std::vector<blink::IndexedDBKey>& keys,
+                       const std::vector<blink::IndexedDBKey>& primary_keys,
                        std::vector<blink::WebIDBValue> values);
 
   void CachedAdvance(unsigned long count, blink::WebIDBCallbacks* callbacks);
@@ -69,8 +70,8 @@
   indexed_db::mojom::CursorAssociatedPtr cursor_;
 
   // Prefetch cache.
-  base::circular_deque<IndexedDBKey> prefetch_keys_;
-  base::circular_deque<IndexedDBKey> prefetch_primary_keys_;
+  base::circular_deque<blink::IndexedDBKey> prefetch_keys_;
+  base::circular_deque<blink::IndexedDBKey> prefetch_primary_keys_;
   base::circular_deque<blink::WebIDBValue> prefetch_values_;
 
   // Number of continue calls that would qualify for a pre-fetch.

diff --git a/content/renderer/indexed_db/webidbcursor_impl_unittest.cc b/content/renderer/indexed_db/webidbcursor_impl_unittest.cc
index 18495907..990da376 100644
--- a/content/renderer/indexed_db/webidbcursor_impl_unittest.cc
+++ b/content/renderer/indexed_db/webidbcursor_impl_unittest.cc

@@ -16,7 +16,6 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/values.h"
 #include "content/child/thread_safe_sender.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/renderer/indexed_db/indexed_db_key_builders.h"
 #include "content/renderer/indexed_db/mock_webidbcallbacks.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
@@ -24,6 +23,7 @@
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/web_data.h"
 
+using blink::IndexedDBKey;
 using blink::WebBlobInfo;
 using blink::WebData;
 using blink::WebIDBCallbacks;

diff --git a/content/renderer/indexed_db/webidbdatabase_impl.cc b/content/renderer/indexed_db/webidbdatabase_impl.cc
index 366aa15..17e9077 100644
--- a/content/renderer/indexed_db/webidbdatabase_impl.cc
+++ b/content/renderer/indexed_db/webidbdatabase_impl.cc

@@ -17,6 +17,7 @@
 #include "content/renderer/indexed_db/indexed_db_dispatcher.h"
 #include "content/renderer/indexed_db/indexed_db_key_builders.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_error.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
@@ -26,6 +27,8 @@
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_vector.h"
 
+using blink::IndexedDBKey;
+using blink::IndexedDBIndexKeys;
 using blink::WebBlobInfo;
 using blink::WebIDBCallbacks;
 using blink::WebIDBDatabase;
@@ -44,15 +47,15 @@
 
 namespace {
 
-std::vector<content::IndexedDBIndexKeys> ConvertWebIndexKeys(
+std::vector<IndexedDBIndexKeys> ConvertWebIndexKeys(
     const WebVector<long long>& index_ids,
     const WebVector<WebIDBDatabase::WebIndexKeys>& index_keys) {
   DCHECK_EQ(index_ids.size(), index_keys.size());
-  std::vector<content::IndexedDBIndexKeys> result;
+  std::vector<IndexedDBIndexKeys> result;
   result.reserve(index_ids.size());
   for (size_t i = 0, len = index_ids.size(); i < len; ++i) {
-    result.emplace_back(index_ids[i], std::vector<content::IndexedDBKey>());
-    std::vector<content::IndexedDBKey>& result_keys = result.back().second;
+    result.emplace_back(index_ids[i], std::vector<IndexedDBKey>());
+    std::vector<IndexedDBKey>& result_keys = result.back().second;
     result_keys.reserve(index_keys[i].size());
     for (const WebIDBKey& index_key : index_keys[i])
       result_keys.emplace_back(IndexedDBKeyBuilder::Build(index_key.View()));
@@ -185,7 +188,7 @@
   IndexedDBDispatcher::ThreadSpecificInstance()->ResetCursorPrefetchCaches(
       transaction_id, nullptr);
 
-  auto mojo_value = indexed_db::mojom::Value::New();
+  auto mojo_value = blink::mojom::IDBValue::New();
   DCHECK(mojo_value->bits.empty());
   mojo_value->bits.reserve(value.size());
   value.ForEachSegment([&mojo_value](const char* segment, size_t segment_size,
@@ -195,9 +198,9 @@
   });
   mojo_value->blob_or_file_info.reserve(web_blob_info.size());
   for (const WebBlobInfo& info : web_blob_info) {
-    auto blob_info = indexed_db::mojom::BlobInfo::New();
+    auto blob_info = blink::mojom::IDBBlobInfo::New();
     if (info.IsFile()) {
-      blob_info->file = indexed_db::mojom::FileInfo::New();
+      blob_info->file = blink::mojom::IDBFileInfo::New();
       blob_info->file->path = blink::WebStringToFilePath(info.FilePath());
       blob_info->file->name = info.FileName().Utf16();
       blob_info->file->last_modified =

diff --git a/content/renderer/indexed_db/webidbdatabase_impl.h b/content/renderer/indexed_db/webidbdatabase_impl.h
index b6e235c..3d938a5 100644
--- a/content/renderer/indexed_db/webidbdatabase_impl.h
+++ b/content/renderer/indexed_db/webidbdatabase_impl.h

@@ -14,9 +14,10 @@
 #include "content/common/content_export.h"
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "content/common/indexed_db/indexed_db_constants.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 
 namespace blink {
 class WebBlobInfo;

diff --git a/content/renderer/indexed_db/webidbdatabase_impl_unittest.cc b/content/renderer/indexed_db/webidbdatabase_impl_unittest.cc
index 879fd50..be6629f1 100644
--- a/content/renderer/indexed_db/webidbdatabase_impl_unittest.cc
+++ b/content/renderer/indexed_db/webidbdatabase_impl_unittest.cc

@@ -10,16 +10,17 @@
 #include "base/macros.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/child/thread_safe_sender.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/renderer/indexed_db/mock_webidbcallbacks.h"
 #include "content/renderer/indexed_db/webidbdatabase_impl.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/web_blob_info.h"
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/web/web_heap.h"
 
+using blink::IndexedDBKey;
 using blink::WebBlobInfo;
 using blink::WebData;
 using blink::WebIDBCursor;

diff --git a/content/renderer/indexed_db/webidbfactory_impl.h b/content/renderer/indexed_db/webidbfactory_impl.h
index f19655df..e70c4ce9 100644
--- a/content/renderer/indexed_db/webidbfactory_impl.h
+++ b/content/renderer/indexed_db/webidbfactory_impl.h

@@ -10,6 +10,7 @@
 #include "content/common/indexed_db/indexed_db.mojom.h"
 #include "content/renderer/indexed_db/indexed_db_callbacks_impl.h"
 #include "content/renderer/indexed_db/indexed_db_database_callbacks_impl.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_callbacks.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_callbacks.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_factory.h"

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 1526238..e406f99 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -199,7 +199,6 @@
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_element_collection.h"
 #include "third_party/blink/public/web/web_file_chooser_completion.h"
-#include "third_party/blink/public/web/web_find_options.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
 #include "third_party/blink/public/web/web_frame_serializer.h"
 #include "third_party/blink/public/web/web_frame_serializer_cache_control_policy.h"
@@ -265,7 +264,6 @@
 using blink::WebElementCollection;
 using blink::WebExternalPopupMenu;
 using blink::WebExternalPopupMenuClient;
-using blink::WebFindOptions;
 using blink::WebFrame;
 using blink::WebFrameLoadType;
 using blink::WebFrameSerializer;
@@ -1925,7 +1923,6 @@
     IPC_MESSAGE_HANDLER(FrameMsg_GetSerializedHtmlWithLocalLinks,
                         OnGetSerializedHtmlWithLocalLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_SerializeAsMHTML, OnSerializeAsMHTML)
-    IPC_MESSAGE_HANDLER(FrameMsg_Find, OnFind)
     IPC_MESSAGE_HANDLER(FrameMsg_EnableViewSourceMode, OnEnableViewSourceMode)
     IPC_MESSAGE_HANDLER(FrameMsg_SuppressFurtherDialogs,
                         OnSuppressFurtherDialogs)
@@ -6292,29 +6289,6 @@
       main_thread_use_time));
 }
 
-void RenderFrameImpl::OnFind(int request_id,
-                             const base::string16& search_text,
-                             const WebFindOptions& options) {
-  DCHECK(!search_text.empty());
-
-  blink::WebPlugin* plugin = GetWebPluginForFind();
-  // Check if the plugin still exists in the document.
-  if (plugin) {
-    if (options.find_next) {
-      // Just navigate back/forward.
-      plugin->SelectFindResult(options.forward, request_id);
-      render_view_->webview()->SetFocusedFrame(frame_);
-    } else if (!plugin->StartFind(WebString::FromUTF16(search_text),
-                                  options.match_case, request_id)) {
-      // Send "no results".
-      frame_->ReportFindInPageMatchCount(request_id, 0, true);
-    }
-    return;
-  }
-
-  frame_->RequestFind(request_id, WebString::FromUTF16(search_text), options);
-}
-
 #define STATIC_ASSERT_ENUM(a, b)                            \
   static_assert(static_cast<int>(a) == static_cast<int>(b), \
                 "mismatching enums: " #a)
@@ -7167,25 +7141,6 @@
   return GetLoaderFactoryBundle();
 }
 
-blink::WebPlugin* RenderFrameImpl::GetWebPluginForFind() {
-  return frame_->GetWebPluginForFind();
-}
-
-void RenderFrameImpl::SendFindReply(int request_id,
-                                    int match_count,
-                                    int ordinal,
-                                    const WebRect& selection_rect,
-                                    bool final_status_update) {
-  DCHECK_GE(ordinal, -1);
-  WebRect converted_rect = selection_rect;
-
-  GetRenderWidget()->ConvertViewportToWindow(&converted_rect);
-
-  Send(new FrameHostMsg_Find_Reply(routing_id_, request_id, match_count,
-                                   converted_rect, ordinal,
-                                   final_status_update));
-}
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 void RenderFrameImpl::PepperInstanceCreated(
     PepperPluginInstanceImpl* instance) {

diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 15a587e..f618b0d 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h

@@ -125,7 +125,6 @@
 struct FramePolicy;
 struct WebContextMenuData;
 struct WebCursorInfo;
-struct WebFindOptions;
 struct WebMediaPlayerAction;
 struct WebImeTextSpan;
 struct WebScrollIntoViewParams;
@@ -1047,9 +1046,6 @@
       const std::map<GURL, base::FilePath>& url_to_local_path,
       const std::map<int, base::FilePath>& frame_routing_id_to_local_path);
   void OnSerializeAsMHTML(const FrameMsg_SerializeAsMHTML_Params& params);
-  void OnFind(int request_id,
-              const base::string16& search_text,
-              const blink::WebFindOptions& options);
   void OnEnableViewSourceMode();
   void OnSuppressFurtherDialogs();
   void OnFileChooserResponse(
@@ -1208,18 +1204,6 @@
 
   void OnHostZoomClientRequest(mojom::HostZoomAssociatedRequest request);
 
-  // Called to get the WebPlugin to handle find requests in the document.
-  // Returns nullptr if there is no such WebPlugin.
-  blink::WebPlugin* GetWebPluginForFind();
-
-  // Sends a reply to the current find operation handling if it was a
-  // synchronous find request.
-  void SendFindReply(int request_id,
-                     int match_count,
-                     int ordinal,
-                     const blink::WebRect& selection_rect,
-                     bool final_status_update) override;
-
   void InitializeBlameContext(RenderFrameImpl* parent_frame);
 
   // service_manager::mojom::InterfaceProvider:

diff --git a/content/renderer/render_frame_impl_browsertest.cc b/content/renderer/render_frame_impl_browsertest.cc
index 859a433a..7debc65 100644
--- a/content/renderer/render_frame_impl_browsertest.cc
+++ b/content/renderer/render_frame_impl_browsertest.cc

@@ -482,8 +482,7 @@
 TEST_F(RenderFrameImplTest, NoCrashWhenDeletingFrameDuringFind) {
   blink::WebFindOptions options;
   options.force = true;
-  FrameMsg_Find find_message(0, 1, base::ASCIIToUTF16("foo"), options);
-  frame()->OnMessageReceived(find_message);
+  frame()->GetWebFrame()->Find(1, "foo", options, false);
 
   FrameMsg_Delete delete_message(0);
   frame()->OnMessageReceived(delete_message);

diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
index 33626b1..f9e8afc 100644
--- a/content/renderer/renderer_blink_platform_impl.cc
+++ b/content/renderer/renderer_blink_platform_impl.cc

@@ -90,6 +90,7 @@
 #include "services/ui/public/cpp/gpu/context_provider_command_buffer.h"
 #include "storage/common/database/database_identifier.h"
 #include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 #include "third_party/blink/public/platform/blame_context.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
 #include "third_party/blink/public/platform/modules/webmidi/web_midi_accessor.h"

diff --git a/content/shell/test_runner/test_runner_for_specific_view.cc b/content/shell/test_runner/test_runner_for_specific_view.cc
index dce1c04b..ebd32efe 100644
--- a/content/shell/test_runner/test_runner_for_specific_view.cc
+++ b/content/shell/test_runner/test_runner_for_specific_view.cc

@@ -626,10 +626,6 @@
       find_options.forward = false;
     else if (option == "StartInSelection")
       find_options.find_next = false;
-    else if (option == "AtWordStarts")
-      find_options.word_start = true;
-    else if (option == "TreatMedialCapitalAsWordStart")
-      find_options.medial_capital_as_word_start = true;
     else if (option == "WrapAround")
       wrap_around = true;
   }

diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index f726754..b3d954b 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn

@@ -1618,7 +1618,6 @@
     "../common/content_switches_internal_unittest.cc",
     "../common/cursors/webcursor_unittest.cc",
     "../common/dom_storage/dom_storage_map_unittest.cc",
-    "../common/indexed_db/indexed_db_key_unittest.cc",
     "../common/input/event_with_latency_info_unittest.cc",
     "../common/input/gesture_event_stream_validator_unittest.cc",
     "../common/input/synthetic_web_input_event_builders_unittest.cc",

diff --git a/content/test/gpu/gpu_tests/gpu_process_integration_test.py b/content/test/gpu/gpu_tests/gpu_process_integration_test.py
index 9c5a6f6..54f2544 100644
--- a/content/test/gpu/gpu_tests/gpu_process_integration_test.py
+++ b/content/test/gpu/gpu_tests/gpu_process_integration_test.py

@@ -167,6 +167,17 @@
             (sys.platform.startswith('linux') and
              not self._RunningOnAndroid()))
 
+  def _AlwaysRunsGpuProcess(self):
+    # With VizDisplayCompositor enabled we always run a GPU process for the
+    # display compositor, except on Windows where the display compositor will
+    # run in the browser process if GPU and SwiftShader are disabled.
+    system_info = self.browser.GetSystemInfo()
+    if not system_info:
+      self.fail("Browser doesn't support GetSystemInfo")
+
+    viz_status = system_info.gpu.feature_status.get('viz_display_compositor')
+    return viz_status == 'enabled_on' and sys.platform != 'win32'
+
   @staticmethod
   def _Filterer(workaround):
     # Filter all entries starting with "disabled_extension_" and
@@ -376,6 +387,11 @@
       # Chrome on Android doesn't support software fallback, skip it.
       # TODO(zmo): If this test runs on ChromeOS, we also need to skip it.
       return
+
+    if self._AlwaysRunsGpuProcess():
+      # The current configuration will always launch a GPU process, skip test.
+      return
+
     self.RestartBrowserIfNecessaryWithArgs([
       '--disable-gpu',
       '--disable-software-rasterizer'])

diff --git a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
index 300075a..17310e3 100644
--- a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
+++ b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py

@@ -43,6 +43,11 @@
     # Conformance expectations
     # ========================
 
+    # Failing new test
+    self.Fail(
+        'conformance2/glsl3/const-struct-from-array-as-function-parameter.html',
+        bug=874620)
+
     # Failing new test added in https://github.com/KhronosGroup/WebGL/pull/2665
     self.Fail('conformance2/textures/misc/tex-subimage3d-canvas-bug.html',
               ['linux'], bug=859400)

diff --git a/content/test/gpu/gpu_tests/webgl_conformance_revision.txt b/content/test/gpu/gpu_tests/webgl_conformance_revision.txt
index cee8f07..496f48d 100644
--- a/content/test/gpu/gpu_tests/webgl_conformance_revision.txt
+++ b/content/test/gpu/gpu_tests/webgl_conformance_revision.txt

@@ -1,3 +1,3 @@
 # AUTOGENERATED FILE - DO NOT EDIT
 # SEE roll_webgl_conformance.py
-Current webgl revision 21dbf06b5aa6c7dc8cf56314d4a3f96f57956c53
+Current webgl revision 7ca87fb1d3da3b3d2060886e8c58e726d74c8219

diff --git a/dbus/bus.cc b/dbus/bus.cc
index 2f3db88..9d37656a 100644
--- a/dbus/bus.cc
+++ b/dbus/bus.cc

@@ -997,6 +997,10 @@
   return dbus_bus_get_unique_name(connection_);
 }
 
+bool Bus::IsConnected() {
+  return connection_ != nullptr;
+}
+
 dbus_bool_t Bus::OnAddWatch(DBusWatch* raw_watch) {
   AssertOnDBusThread();
 

diff --git a/dbus/bus.h b/dbus/bus.h
index 704a4c3a..b082110e 100644
--- a/dbus/bus.h
+++ b/dbus/bus.h

@@ -601,7 +601,7 @@
   std::string GetConnectionName();
 
   // Returns true if the bus is connected to D-Bus.
-  bool is_connected() { return connection_ != nullptr; }
+  virtual bool IsConnected();
 
  protected:
   // This is protected, so we can define sub classes.

diff --git a/dbus/bus_unittest.cc b/dbus/bus_unittest.cc
index f00d1e9..5e7173a 100644
--- a/dbus/bus_unittest.cc
+++ b/dbus/bus_unittest.cc

@@ -402,14 +402,14 @@
   scoped_refptr<Bus> bus = new Bus(options);
 
   // Connection name is empty since bus is not connected.
-  EXPECT_FALSE(bus->is_connected());
+  EXPECT_FALSE(bus->IsConnected());
   EXPECT_TRUE(bus->GetConnectionName().empty());
 
   // Connect bus to D-Bus.
   bus->Connect();
 
   // Connection name is not empty after connection is established.
-  EXPECT_TRUE(bus->is_connected());
+  EXPECT_TRUE(bus->IsConnected());
   EXPECT_FALSE(bus->GetConnectionName().empty());
 
   // Shut down synchronously.

diff --git a/dbus/exported_object.cc b/dbus/exported_object.cc
index d6c91b6d..5fa1b91 100644
--- a/dbus/exported_object.cc
+++ b/dbus/exported_object.cc

@@ -280,7 +280,7 @@
 
   // Check if the bus is still connected. If the method takes long to
   // complete, the bus may be shut down meanwhile.
-  if (!bus_->is_connected())
+  if (!bus_->IsConnected())
     return;
 
   if (!response) {

diff --git a/dbus/mock_bus.h b/dbus/mock_bus.h
index 6b3495d..2280762 100644
--- a/dbus/mock_bus.h
+++ b/dbus/mock_bus.h

@@ -73,6 +73,7 @@
   MOCK_METHOD0(HasDBusThread, bool());
   MOCK_METHOD0(AssertOnOriginThread, void());
   MOCK_METHOD0(AssertOnDBusThread, void());
+  MOCK_METHOD0(IsConnected, bool());
 
  protected:
   ~MockBus() override;

diff --git a/dbus/object_proxy.cc b/dbus/object_proxy.cc
index aa5102a..3046dbb 100644
--- a/dbus/object_proxy.cc
+++ b/dbus/object_proxy.cc

@@ -288,7 +288,7 @@
 void ObjectProxy::Detach() {
   bus_->AssertOnDBusThread();
 
-  if (bus_->is_connected())
+  if (bus_->IsConnected())
     bus_->RemoveFilterFunction(&ObjectProxy::HandleMessageThunk, this);
 
   for (const auto& match_rule : match_rules_) {

diff --git a/device/fido/fido_request_handler.h b/device/fido/fido_request_handler.h
index 1c360e38..b97092c 100644
--- a/device/fido/fido_request_handler.h
+++ b/device/fido/fido_request_handler.h

@@ -27,7 +27,8 @@
  public:
   using CompletionCallback =
       base::OnceCallback<void(FidoReturnCode status_code,
-                              base::Optional<Response> response_data)>;
+                              base::Optional<Response> response_data,
+                              FidoTransportProtocol transport_used)>;
 
   FidoRequestHandler(service_manager::Connector* connector,
                      const base::flat_set<FidoTransportProtocol>& transports,
@@ -78,7 +79,9 @@
     // Once response has been passed to the relying party, cancel all other on
     // going requests.
     CancelOngoingTasks(authenticator->GetId());
-    std::move(completion_callback_).Run(*return_code, std::move(response_data));
+    std::move(completion_callback_)
+        .Run(*return_code, std::move(response_data),
+             authenticator->AuthenticatorTransport());
   }
 
  private:

diff --git a/device/fido/fido_request_handler_unittest.cc b/device/fido/fido_request_handler_unittest.cc
index f6cd3e2f..1660af61 100644
--- a/device/fido/fido_request_handler_unittest.cc
+++ b/device/fido/fido_request_handler_unittest.cc

@@ -30,12 +30,14 @@
 using FakeTaskCallback =
     base::OnceCallback<void(CtapDeviceResponseCode status_code,
                             base::Optional<std::vector<uint8_t>>)>;
-using FakeHandlerCallback = base::OnceCallback<void(
-    FidoReturnCode status_code,
-    base::Optional<std::vector<uint8_t>> response_data)>;
+using FakeHandlerCallback =
+    base::OnceCallback<void(FidoReturnCode status_code,
+                            base::Optional<std::vector<uint8_t>> response_data,
+                            FidoTransportProtocol)>;
 using FakeHandlerCallbackReceiver =
-    test::StatusAndValueCallbackReceiver<FidoReturnCode,
-                                         base::Optional<std::vector<uint8_t>>>;
+    test::StatusAndValuesCallbackReceiver<FidoReturnCode,
+                                          base::Optional<std::vector<uint8_t>>,
+                                          FidoTransportProtocol>;
 
 enum class FakeTaskResponse : uint8_t {
   kSuccess = 0x00,

diff --git a/device/fido/fido_transport_protocol.cc b/device/fido/fido_transport_protocol.cc
index eb626939..5035da66 100644
--- a/device/fido/fido_transport_protocol.cc
+++ b/device/fido/fido_transport_protocol.cc

@@ -6,7 +6,7 @@
 
 namespace device {
 
-const char kUsbHumanInterfaceDevice[] = "hid";
+const char kUsbHumanInterfaceDevice[] = "usb";
 const char kNearFieldCommunication[] = "nfc";
 const char kBluetoothLowEnergy[] = "ble";
 const char kCloudAssistedBluetoothLowEnergy[] = "cable";

diff --git a/device/fido/get_assertion_handler_unittest.cc b/device/fido/get_assertion_handler_unittest.cc
index bfebbb3..14430c2 100644
--- a/device/fido/get_assertion_handler_unittest.cc
+++ b/device/fido/get_assertion_handler_unittest.cc

@@ -25,9 +25,10 @@
 
 namespace {
 
-using TestGetAssertionRequestCallback = test::StatusAndValueCallbackReceiver<
+using TestGetAssertionRequestCallback = test::StatusAndValuesCallbackReceiver<
     FidoReturnCode,
-    base::Optional<AuthenticatorGetAssertionResponse>>;
+    base::Optional<AuthenticatorGetAssertionResponse>,
+    FidoTransportProtocol>;
 
 }  // namespace
 
@@ -96,7 +97,7 @@
   get_assertion_callback().WaitForCallback();
 
   EXPECT_EQ(FidoReturnCode::kSuccess, get_assertion_callback().status());
-  EXPECT_TRUE(get_assertion_callback().value());
+  EXPECT_TRUE(get_assertion_callback().value<0>());
   EXPECT_TRUE(request_handler->is_complete());
 }
 
@@ -116,7 +117,7 @@
   discovery()->AddDevice(std::move(device));
   scoped_task_environment_.FastForwardUntilNoTasksRemain();
   EXPECT_EQ(FidoReturnCode::kSuccess, get_assertion_callback().status());
-  EXPECT_TRUE(get_assertion_callback().value());
+  EXPECT_TRUE(get_assertion_callback().value<0>());
   EXPECT_TRUE(request_handler->is_complete());
 }
 
@@ -139,7 +140,7 @@
   discovery()->AddDevice(std::move(device));
   scoped_task_environment_.FastForwardUntilNoTasksRemain();
   EXPECT_EQ(FidoReturnCode::kSuccess, get_assertion_callback().status());
-  EXPECT_TRUE(get_assertion_callback().value());
+  EXPECT_TRUE(get_assertion_callback().value<0>());
   EXPECT_TRUE(request_handler->is_complete());
 }
 

diff --git a/device/fido/get_assertion_request_handler.h b/device/fido/get_assertion_request_handler.h
index 28172e6d..735b3800 100644
--- a/device/fido/get_assertion_request_handler.h
+++ b/device/fido/get_assertion_request_handler.h

@@ -27,7 +27,8 @@
 
 using SignResponseCallback =
     base::OnceCallback<void(FidoReturnCode,
-                            base::Optional<AuthenticatorGetAssertionResponse>)>;
+                            base::Optional<AuthenticatorGetAssertionResponse>,
+                            FidoTransportProtocol)>;
 
 class COMPONENT_EXPORT(DEVICE_FIDO) GetAssertionRequestHandler
     : public FidoRequestHandler<AuthenticatorGetAssertionResponse> {

diff --git a/device/fido/make_credential_handler_unittest.cc b/device/fido/make_credential_handler_unittest.cc
index 5f97ff82..243975d 100644
--- a/device/fido/make_credential_handler_unittest.cc
+++ b/device/fido/make_credential_handler_unittest.cc

@@ -30,9 +30,10 @@
 
 namespace {
 
-using TestMakeCredentialRequestCallback = test::StatusAndValueCallbackReceiver<
+using TestMakeCredentialRequestCallback = test::StatusAndValuesCallbackReceiver<
     FidoReturnCode,
-    base::Optional<AuthenticatorMakeCredentialResponse>>;
+    base::Optional<AuthenticatorMakeCredentialResponse>,
+    FidoTransportProtocol>;
 
 }  // namespace
 

diff --git a/device/fido/make_credential_request_handler.h b/device/fido/make_credential_request_handler.h
index 66cd2eae..5ddba77 100644
--- a/device/fido/make_credential_request_handler.h
+++ b/device/fido/make_credential_request_handler.h

@@ -27,8 +27,10 @@
 class FidoAuthenticator;
 class AuthenticatorMakeCredentialResponse;
 
-using RegisterResponseCallback = base::OnceCallback<
-    void(FidoReturnCode, base::Optional<AuthenticatorMakeCredentialResponse>)>;
+using RegisterResponseCallback =
+    base::OnceCallback<void(FidoReturnCode,
+                            base::Optional<AuthenticatorMakeCredentialResponse>,
+                            FidoTransportProtocol)>;
 
 class COMPONENT_EXPORT(DEVICE_FIDO) MakeCredentialRequestHandler
     : public FidoRequestHandler<AuthenticatorMakeCredentialResponse> {

diff --git a/device/fido/test_callback_receiver.h b/device/fido/test_callback_receiver.h
index 9036378..6678357 100644
--- a/device/fido/test_callback_receiver.h
+++ b/device/fido/test_callback_receiver.h

@@ -114,6 +114,20 @@
   }
 };
 
+template <class Status, class... Values>
+class StatusAndValuesCallbackReceiver
+    : public TestCallbackReceiver<Status, Values...> {
+ public:
+  const Status& status() const {
+    return std::get<0>(*TestCallbackReceiver<Status, Values...>::result());
+  }
+
+  template <size_t I>
+  const std::tuple_element_t<I, std::tuple<Values...>>& value() const {
+    return std::get<I + 1>(*TestCallbackReceiver<Status, Values...>::result());
+  }
+};
+
 }  // namespace test
 }  // namespace device
 

diff --git a/extensions/renderer/ipc_message_sender.cc b/extensions/renderer/ipc_message_sender.cc
index 2a62f48..07c98d7f 100644
--- a/extensions/renderer/ipc_message_sender.cc
+++ b/extensions/renderer/ipc_message_sender.cc

@@ -265,7 +265,7 @@
     DCHECK_NE(kMainThreadId, content::WorkerThread::GetCurrentId());
     ServiceWorkerIdentifier sw_identifier;
     sw_identifier.scope = context->service_worker_scope();
-    sw_identifier.thread_id = content::WorkerThread::GetCurrentId(),
+    sw_identifier.thread_id = content::WorkerThread::GetCurrentId();
     dispatcher_->Send(new ExtensionHostMsg_AddFilteredListener(
         context->GetExtensionID(), event_name, sw_identifier, filter, is_lazy));
   }
@@ -278,7 +278,7 @@
     DCHECK_NE(kMainThreadId, content::WorkerThread::GetCurrentId());
     ServiceWorkerIdentifier sw_identifier;
     sw_identifier.scope = context->service_worker_scope();
-    sw_identifier.thread_id = content::WorkerThread::GetCurrentId(),
+    sw_identifier.thread_id = content::WorkerThread::GetCurrentId();
     dispatcher_->Send(new ExtensionHostMsg_RemoveFilteredListener(
         context->GetExtensionID(), event_name, sw_identifier, filter,
         remove_lazy_listener));

diff --git a/google_apis/gcm/tools/mcs_probe.cc b/google_apis/gcm/tools/mcs_probe.cc
index 1f9a4a7..26800cf 100644
--- a/google_apis/gcm/tools/mcs_probe.cc
+++ b/google_apis/gcm/tools/mcs_probe.cc

@@ -152,7 +152,6 @@
              const net::NetLogWithSource& net_log) override {
     return net::OK;
   }
-  void SetConfig(const Config& config) override {}
 };
 
 class MCSProbeAuthPreferences : public net::HttpAuthPreferences {

diff --git a/gpu/command_buffer/client/client_discardable_manager.cc b/gpu/command_buffer/client/client_discardable_manager.cc
index 02e0bb47..1374cda 100644
--- a/gpu/command_buffer/client/client_discardable_manager.cc
+++ b/gpu/command_buffer/client/client_discardable_manager.cc

@@ -4,6 +4,7 @@
 
 #include "gpu/command_buffer/client/client_discardable_manager.h"
 
+#include "base/atomic_sequence_num.h"
 #include "base/containers/flat_set.h"
 #include "base/sys_info.h"
 
@@ -120,6 +121,15 @@
   return allocation_size;
 }
 
+ClientDiscardableHandle::Id GetNextHandleId() {
+  static base::AtomicSequenceNumber g_next_handle_id;
+
+  // AtomicSequenceNumber is 0-based, add 1 to have a 1-based ID where 0 is
+  // invalid.
+  return ClientDiscardableHandle::Id::FromUnsafeValue(
+      g_next_handle_id.GetNext() + 1);
+}
+
 }  // namespace
 
 struct ClientDiscardableManager::Allocation {
@@ -147,7 +157,7 @@
   DCHECK_LT(offset * element_size_, std::numeric_limits<uint32_t>::max());
   uint32_t byte_offset = static_cast<uint32_t>(offset * element_size_);
   ClientDiscardableHandle handle(std::move(buffer), byte_offset, shm_id);
-  ClientDiscardableHandle::Id handle_id = handle.GetId();
+  ClientDiscardableHandle::Id handle_id = GetNextHandleId();
   handles_.emplace(handle_id, handle);
 
   return handle_id;

diff --git a/gpu/command_buffer/client/client_discardable_manager_unittest.cc b/gpu/command_buffer/client/client_discardable_manager_unittest.cc
index 6f7a83ef..0c967daf 100644
--- a/gpu/command_buffer/client/client_discardable_manager_unittest.cc
+++ b/gpu/command_buffer/client/client_discardable_manager_unittest.cc

@@ -168,11 +168,19 @@
   FakeCommandBuffer command_buffer;
   ClientDiscardableManager manager;
   manager.SetElementCountForTesting(4);
+
+  // Track seen IDs, we should never see an ID again, even when re-using a
+  // handle.
+  std::set<ClientDiscardableHandle::Id> seen_ids;
+
   // Fill our allocation with unlocked handles.
   std::vector<ClientDiscardableHandle::Id> handle_ids;
   for (int i = 0; i < 4; ++i) {
     ClientDiscardableHandle::Id handle_id =
         manager.CreateHandle(&command_buffer);
+    EXPECT_EQ(0u, seen_ids.count(handle_id));
+    seen_ids.insert(handle_id);
+
     ClientDiscardableHandle handle = manager.GetHandle(handle_id);
     EXPECT_TRUE(handle.IsLockedForTesting());
     EXPECT_EQ(handle.shm_id(), 1);
@@ -183,6 +191,9 @@
   {
     ClientDiscardableHandle::Id handle_id =
         manager.CreateHandle(&command_buffer);
+    EXPECT_EQ(0u, seen_ids.count(handle_id));
+    seen_ids.insert(handle_id);
+
     ClientDiscardableHandle handle = manager.GetHandle(handle_id);
     EXPECT_TRUE(handle.IsLockedForTesting());
     EXPECT_EQ(handle.shm_id(), 2);
@@ -195,6 +206,9 @@
   {
     ClientDiscardableHandle::Id handle_id =
         manager.CreateHandle(&command_buffer);
+    EXPECT_EQ(0u, seen_ids.count(handle_id));
+    seen_ids.insert(handle_id);
+
     ClientDiscardableHandle handle = manager.GetHandle(handle_id);
     EXPECT_TRUE(handle.IsLockedForTesting());
     EXPECT_EQ(handle.shm_id(), 1);

diff --git a/gpu/command_buffer/common/discardable_handle.cc b/gpu/command_buffer/common/discardable_handle.cc
index 6f3fd727..c32bd8c2 100644
--- a/gpu/command_buffer/common/discardable_handle.cc
+++ b/gpu/command_buffer/common/discardable_handle.cc

@@ -108,16 +108,6 @@
   return kHandleDeleted == base::subtle::Acquire_Load(AsAtomic());
 }
 
-// Creates an Id which is guaranteed to be unique among all live handles in a
-// ShareGroup. Created from the shared memory offset/id backing this handle.
-ClientDiscardableHandle::Id ClientDiscardableHandle::GetId() const {
-  DCHECK_GE(shm_id(), 0);
-
-  // This will never generate invalid (max uint64_t), as shm_id is signed.
-  return Id::FromUnsafeValue(static_cast<uint64_t>(shm_id()) << 32 |
-                             static_cast<uint64_t>(byte_offset()));
-}
-
 ServiceDiscardableHandle::ServiceDiscardableHandle()
     : DiscardableHandleBase(nullptr, 0, 0) {}
 

diff --git a/gpu/command_buffer/common/discardable_handle.h b/gpu/command_buffer/common/discardable_handle.h
index 938dc8fd..33f2d85 100644
--- a/gpu/command_buffer/common/discardable_handle.h
+++ b/gpu/command_buffer/common/discardable_handle.h

@@ -83,9 +83,7 @@
 // handle (via the constructor), and can Lock an existing handle.
 class GPU_EXPORT ClientDiscardableHandle : public DiscardableHandleBase {
  public:
-  using Id = IdType<ClientDiscardableHandle,
-                    uint64_t,
-                    std::numeric_limits<uint64_t>::max()>;
+  using Id = IdType32<ClientDiscardableHandle>;
 
   ClientDiscardableHandle();  // Constructs an invalid handle.
   ClientDiscardableHandle(scoped_refptr<Buffer> buffer,
@@ -104,11 +102,8 @@
   // re-used on the client.
   bool CanBeReUsed() const;
 
-  // Gets an Id which uniquely identifies this ClientDiscardableHandle within
-  // the ClientDiscardableManager which created it.
-  Id GetId() const;
-
-  bool IsValid() const { return !GetId().is_null(); }
+  // Returns true if this handle is backed by valid shared memory.
+  bool IsValid() const { return shm_id() > 0; }
 };
 
 // ServiceDiscardableHandle can wrap an existing handle (via the constructor),

diff --git a/infra/config/global/cr-buildbucket-dev.cfg b/infra/config/global/cr-buildbucket-dev.cfg
index bea01791..d237306 100644
--- a/infra/config/global/cr-buildbucket-dev.cfg
+++ b/infra/config/global/cr-buildbucket-dev.cfg

@@ -51,6 +51,7 @@
       execution_timeout_secs: 10800  # 3h
       service_account: "chromium-ci-builder-dev@chops-service-accounts.iam.gserviceaccount.com"
       build_numbers: YES
+      auto_builder_dimension: YES
       recipe {
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"

diff --git a/ios/chrome/browser/tabs/BUILD.gn b/ios/chrome/browser/tabs/BUILD.gn
index 918aee9..5953fed 100644
--- a/ios/chrome/browser/tabs/BUILD.gn
+++ b/ios/chrome/browser/tabs/BUILD.gn

@@ -156,6 +156,7 @@
     ":tabs",
     ":tabs_internal",
     "//base",
+    "//base/test:test_support",
     "//components/bookmarks/test",
     "//components/favicon/ios",
     "//components/history/core/browser",
@@ -182,6 +183,7 @@
     "//ios/web",
     "//ios/web/public/test",
     "//ios/web/public/test/fakes",
+    "//ios/web/test/fakes:fakes",
     "//net",
     "//testing/gmock",
     "//testing/gtest",

diff --git a/ios/chrome/browser/tabs/DEPS b/ios/chrome/browser/tabs/DEPS
index acfed58b..6787c46 100644
--- a/ios/chrome/browser/tabs/DEPS
+++ b/ios/chrome/browser/tabs/DEPS

@@ -9,6 +9,7 @@
     "+ios/web/web_state/ui/crw_web_controller.h",
     "+ios/web/navigation/navigation_manager_impl.h",
     "+ios/web/web_state/web_state_impl.h",
+    "+ios/web/test/fakes/crw_fake_back_forward_list.h",
   ],
 
   # TODO(crbug.com/620480): tab_model_unittest.mm exceptions.

diff --git a/ios/chrome/browser/tabs/tab_unittest.mm b/ios/chrome/browser/tabs/tab_unittest.mm
index 28f2a5f..1b698d7 100644
--- a/ios/chrome/browser/tabs/tab_unittest.mm
+++ b/ios/chrome/browser/tabs/tab_unittest.mm

@@ -13,6 +13,7 @@
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/sys_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "components/bookmarks/test/bookmark_test_helpers.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/keyed_service/core/service_access_type.h"
@@ -40,11 +41,13 @@
 #include "ios/public/provider/chrome/browser/test_chrome_browser_provider.h"
 #import "ios/testing/ocmock_complex_type_helper.h"
 #import "ios/web/navigation/navigation_manager_impl.h"
+#include "ios/web/public/features.h"
 #include "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
 #include "ios/web/public/referrer.h"
 #import "ios/web/public/test/fakes/fake_navigation_context.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
+#import "ios/web/test/fakes/crw_fake_back_forward_list.h"
 #import "ios/web/web_state/ui/crw_web_controller.h"
 #import "ios/web/web_state/web_state_impl.h"
 #import "net/base/mac/url_conversions.h"
@@ -139,10 +142,18 @@
 
 HistoryQueryResultsObserver::~HistoryQueryResultsObserver() {}
 
+// TabTest is parameterized on this enum to test both LegacyNavigationManager
+// and WKBasedNavigationManager.
+enum class NavigationManagerChoice {
+  LEGACY,
+  WK_BASED,
+};
+
 // TODO(crbug.com/620465): can a TestWebState be used instead of a WebStateImpl
 // for those tests? This will require changing Tab to use a WebState instead of
 // a WebStateImpl first though.
-class TabTest : public BlockCleanupTest {
+class TabTest : public BlockCleanupTest,
+                public ::testing::WithParamInterface<NavigationManagerChoice> {
  public:
   TabTest()
       : scoped_browser_state_manager_(
@@ -152,6 +163,14 @@
   void SetUp() override {
     BlockCleanupTest::SetUp();
 
+    if (GetParam() == NavigationManagerChoice::LEGACY) {
+      scoped_feature_list_.InitAndDisableFeature(
+          web::features::kSlimNavigationManager);
+    } else {
+      scoped_feature_list_.InitAndEnableFeature(
+          web::features::kSlimNavigationManager);
+    }
+
     [[ChromeAppConstants sharedInstance]
         setCallbackSchemeForTesting:@"chromium"];
 
@@ -173,6 +192,15 @@
 
     mock_web_controller_ =
         [OCMockObject niceMockForClass:[CRWWebController class]];
+
+    if (GetParam() == NavigationManagerChoice::WK_BASED) {
+      mock_web_view_ = [OCMockObject mockForClass:[WKWebView class]];
+      fake_wk_list_ = [[CRWFakeBackForwardList alloc] init];
+      OCMStub([mock_web_view_ backForwardList]).andReturn(fake_wk_list_);
+      OCMStub([mock_web_controller_ webViewNavigationProxy])
+          .andReturn(mock_web_view_);
+    }
+
     web::WebState::CreateParams create_params(browser_state);
     web_state_impl_ = std::make_unique<web::WebStateImpl>(create_params);
     web_state_impl_->SetWebController(mock_web_controller_);
@@ -221,7 +249,13 @@
     web::FakeNavigationContext context2;
     context2.SetUrl(redirect_url);
     web_state_impl_->OnNavigationStarted(&context2);
+
+    if (GetParam() == NavigationManagerChoice::WK_BASED) {
+      [fake_wk_list_
+          setCurrentURL:base::SysUTF8ToNSString(redirect_url.spec())];
+    }
     [tab_ navigationManagerImpl]->CommitPendingItem();
+
     context2.SetHasCommitted(true);
     web_state_impl_->UpdateHttpResponseHeaders(redirect_url);
     web_state_impl_->OnNavigationFinished(&context2);
@@ -302,12 +336,15 @@
   std::unique_ptr<TestChromeBrowserState> chrome_browser_state_;
   std::unique_ptr<web::WebStateImpl> web_state_impl_;
   __weak CRWWebController* mock_web_controller_;
+  WKWebView* mock_web_view_;
+  CRWFakeBackForwardList* fake_wk_list_;
   UIView* web_controller_view_;
   ArrayTabModel* tabModel_;
   __weak Tab* tab_;
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
-TEST_F(TabTest, AddToHistoryWithRedirect) {
+TEST_P(TabTest, AddToHistoryWithRedirect) {
   BrowseTo(GURL(kGoogleUserUrl), GURL(kGoogleRedirectUrl), kGoogleTitle);
   history::QueryResults results;
   QueryAllHistory(&results);
@@ -320,7 +357,7 @@
 // CRWWebController, so this test cannot function with a mock CRWWebController.
 // Rewrite and re-enable this test when it becomes a CRWWebController or
 // NavigationManager test.
-TEST_F(TabTest, DISABLED_BackAndForward) {
+TEST_P(TabTest, DISABLED_BackAndForward) {
   BrowseTo(GURL(kGoogleUserUrl), GURL(kGoogleRedirectUrl), kGoogleTitle);
   BrowseTo(GURL(kOtherUserUrl), GURL(kOtherRedirectUrl), kOtherTitle);
 
@@ -336,7 +373,7 @@
 // possible with a mock
 // CRWWebController. Rewrite and re-enable this test when it becomes a
 // CRWWebController test.
-TEST_F(TabTest, DISABLED_NewTabInMiddleOfNavigation) {
+TEST_P(TabTest, DISABLED_NewTabInMiddleOfNavigation) {
   BrowseTo(GURL(kGoogleUserUrl), GURL(kGoogleRedirectUrl), kGoogleTitle);
   BrowseToNewTab();
   BrowseTo(GURL(kOtherUserUrl), GURL(kOtherRedirectUrl), kOtherTitle);
@@ -349,7 +386,7 @@
   CheckHistoryResult(results[1], GURL(kGoogleRedirectUrl), kGoogleTitle);
 }
 
-TEST_F(TabTest, GetSuggestedFilenameFromContentDisposition) {
+TEST_P(TabTest, GetSuggestedFilenameFromContentDisposition) {
   // If possible, the filename should be generated from the content-disposition
   // header.
   GURL url(kValidFilenameUrl);
@@ -364,7 +401,7 @@
               [[tab_ openInController] suggestedFilename]);
 }
 
-TEST_F(TabTest, GetSuggestedFilenameFromURL) {
+TEST_P(TabTest, GetSuggestedFilenameFromURL) {
   // If the content-disposition header does not specify a filename, this should
   // be extracted from the last component of the url.
   GURL url(kValidFilenameUrl);
@@ -378,7 +415,7 @@
   EXPECT_NSEQ(@"filename.pdf", [[tab_ openInController] suggestedFilename]);
 }
 
-TEST_F(TabTest, GetSuggestedFilenameFromDefaultName) {
+TEST_P(TabTest, GetSuggestedFilenameFromDefaultName) {
   // If the filename cannot be extracted from the content disposition or from
   // the url, the default filename "Document.pdf" should be used.
   GURL url(kInvalidFilenameUrl);
@@ -390,7 +427,7 @@
   EXPECT_NSEQ(@"Document.pdf", [[tab_ openInController] suggestedFilename]);
 }
 
-TEST_F(TabTest, ClosingWebStateDoesNotRemoveSnapshot) {
+TEST_P(TabTest, ClosingWebStateDoesNotRemoveSnapshot) {
   id partialMock = OCMPartialMock(
       SnapshotCacheFactory::GetForBrowserState(tab_.browserState));
   SnapshotTabHelper::CreateForWebState(tab_.webState, tab_.tabId);
@@ -407,7 +444,7 @@
   }
 }
 
-TEST_F(TabTest, CallingRemoveSnapshotRemovesSnapshot) {
+TEST_P(TabTest, CallingRemoveSnapshotRemovesSnapshot) {
   id partialMock = OCMPartialMock(
       SnapshotCacheFactory::GetForBrowserState(tab_.browserState));
   SnapshotTabHelper::CreateForWebState(tab_.webState, tab_.tabId);
@@ -417,4 +454,9 @@
   EXPECT_OCMOCK_VERIFY(partialMock);
 }
 
+INSTANTIATE_TEST_CASE_P(ProgrammaticTabTest,
+                        TabTest,
+                        ::testing::Values(NavigationManagerChoice::LEGACY,
+                                          NavigationManagerChoice::WK_BASED));
+
 }  // namespace

diff --git a/ios/web/web_state/ui/crw_web_view_content_view.mm b/ios/web/web_state/ui/crw_web_view_content_view.mm
index 43d9452..463e3ad 100644
--- a/ios/web/web_state/ui/crw_web_view_content_view.mm
+++ b/ios/web/web_state/ui/crw_web_view_content_view.mm

@@ -129,25 +129,11 @@
                   std::fabs(oldInsets.right - contentInset.right);
   if (delta <= std::numeric_limits<CGFloat>::epsilon())
     return;
+  _contentInset = contentInset;
   if (self.shouldUseViewContentInset) {
     [_scrollView setContentInset:contentInset];
   } else {
-    // Update the content offset of the scroll view to match the padding
-    // that will be included in the frame.
-    CGFloat topPaddingChange = contentInset.top - _contentInset.top;
-    CGPoint contentOffset = [_scrollView contentOffset];
-    contentOffset.y += topPaddingChange;
-    [_scrollView setContentOffset:contentOffset];
-    _contentInset = contentInset;
-    // Update web view frame immediately to make |contentInset| animatable.
-    [self updateWebViewFrame];
-    // Setting WKWebView frame can mistakenly reset contentOffset. Change it
-    // back to the initial value if necessary.
-    // TODO(crbug.com/645857): Remove this workaround once WebKit bug is
-    // fixed.
-    if ([_scrollView contentOffset].y != contentOffset.y) {
-      [_scrollView setContentOffset:contentOffset];
-    }
+    [self resizeViewportForContentInsetChangeFromInsets:oldInsets];
   }
 }
 
@@ -162,6 +148,26 @@
 
 #pragma mark Private methods
 
+// Updates the viewport by updating the web view frame after self.contentInset
+// is changed to a new value from |oldInsets|.
+- (void)resizeViewportForContentInsetChangeFromInsets:(UIEdgeInsets)oldInsets {
+  // Update the content offset of the scroll view to match the padding
+  // that will be included in the frame.
+  CGFloat topPaddingChange = self.contentInset.top - oldInsets.top;
+  CGPoint contentOffset = [_scrollView contentOffset];
+  contentOffset.y += topPaddingChange;
+  [_scrollView setContentOffset:contentOffset];
+  // Update web view frame immediately to make |contentInset| animatable.
+  [self updateWebViewFrame];
+  // Setting WKWebView frame can mistakenly reset contentOffset. Change it
+  // back to the initial value if necessary.
+  // TODO(crbug.com/645857): Remove this workaround once WebKit bug is
+  // fixed.
+  if ([_scrollView contentOffset].y != contentOffset.y) {
+    [_scrollView setContentOffset:contentOffset];
+  }
+}
+
 - (void)updateWebViewFrame {
   CGRect frame = self.bounds;
   frame = UIEdgeInsetsInsetRect(frame, _contentInset);

diff --git a/ios/web_view/shell/shell_autofill_delegate.m b/ios/web_view/shell/shell_autofill_delegate.m
index 75dc5f82..2573ce69 100644
--- a/ios/web_view/shell/shell_autofill_delegate.m
+++ b/ios/web_view/shell/shell_autofill_delegate.m

@@ -162,6 +162,8 @@
                                 handler:^(UIAlertAction* _Nonnull action) {
                                   [_autofillController fillSuggestion:suggestion
                                                     completionHandler:nil];
+                                  [UIApplication.sharedApplication.keyWindow
+                                      endEditing:YES];
                                 }];
 }
 

diff --git a/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.cc b/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.cc
index 22fe7351..6cb64f5 100644
--- a/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.cc

@@ -133,9 +133,8 @@
     const BitstreamBuffer& bitstream_buffer,
     scoped_refptr<VideoFrame> video_frame)
     : bitstream_buffer_id(bitstream_buffer.id()),
-      shm(bitstream_buffer.handle(),
-          bitstream_buffer.size(),
-          bitstream_buffer.offset()),
+      shm(bitstream_buffer.handle(), bitstream_buffer.size(), true),
+      offset(bitstream_buffer.offset()),
       out_frame(video_frame) {}
 
 V4L2JpegDecodeAccelerator::JobRecord::~JobRecord() {}
@@ -290,7 +289,7 @@
 void V4L2JpegDecodeAccelerator::DecodeTask(
     std::unique_ptr<JobRecord> job_record) {
   DCHECK(decoder_task_runner_->BelongsToCurrentThread());
-  if (!job_record->shm.IsValid()) {
+  if (!job_record->shm.MapAt(job_record->offset, job_record->shm.size())) {
     VPLOGF(1) << "could not map bitstream_buffer";
     PostNotifyError(job_record->bitstream_buffer_id, UNREADABLE_INPUT);
     return;

diff --git a/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.h b/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.h
index c40c422..f68c213 100644
--- a/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.h
+++ b/media/gpu/v4l2/v4l2_jpeg_decode_accelerator.h

@@ -67,7 +67,9 @@
     // Input image buffer ID.
     int32_t bitstream_buffer_id;
     // Memory mapped from |bitstream_buffer|.
-    WritableUnalignedMapping shm;
+    UnalignedSharedMemory shm;
+    // Offset used for shm.
+    off_t offset;
     // Output frame buffer.
     scoped_refptr<VideoFrame> out_frame;
   };

diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
index 98b4181..feb0f9c4 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc

@@ -201,7 +201,8 @@
   ~BitstreamBufferRef();
   const base::WeakPtr<VideoDecodeAccelerator::Client> client;
   const scoped_refptr<base::SingleThreadTaskRunner> client_task_runner;
-  const std::unique_ptr<WritableUnalignedMapping> shm;
+  const std::unique_ptr<UnalignedSharedMemory> shm;
+  off_t offset;
   off_t bytes_used;
   const int32_t input_id;
 };
@@ -213,10 +214,11 @@
     int32_t input_id)
     : client(client),
       client_task_runner(client_task_runner),
-      shm(buffer ? std::make_unique<WritableUnalignedMapping>(buffer->handle(),
-                                                              buffer->size(),
-                                                              buffer->offset())
+      shm(buffer ? std::make_unique<UnalignedSharedMemory>(buffer->handle(),
+                                                           buffer->size(),
+                                                           true)
                  : nullptr),
+      offset(buffer ? buffer->offset() : 0),
       bytes_used(0),
       input_id(input_id) {}
 
@@ -1347,12 +1349,12 @@
       new BitstreamBufferRef(decode_client_, decode_task_runner_,
                              &bitstream_buffer, bitstream_buffer.id()));
 
-  // Skip empty buffer. This must be done after creating bitstream_record as the
-  // handle in the bitstream_buffer needs to be consumed.
+  // Skip empty buffer.
   if (bitstream_buffer.size() == 0)
     return;
 
-  if (!bitstream_record->shm->IsValid()) {
+  if (!bitstream_record->shm->MapAt(bitstream_record->offset,
+                                    bitstream_record->shm->size())) {
     VLOGF(1) << "Could not map bitstream_buffer";
     NOTIFY_ERROR(UNREADABLE_INPUT);
     return;

diff --git a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
index e6260515..a89015a0 100644
--- a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc

@@ -78,7 +78,8 @@
   ~BitstreamBufferRef();
   const base::WeakPtr<Client> client;
   const scoped_refptr<base::SingleThreadTaskRunner> client_task_runner;
-  const std::unique_ptr<WritableUnalignedMapping> shm;
+  const std::unique_ptr<UnalignedSharedMemory> shm;
+  off_t offset;
   size_t bytes_used;
   const int32_t input_id;
 };
@@ -97,10 +98,11 @@
     int32_t input_id)
     : client(client),
       client_task_runner(client_task_runner),
-      shm(buffer ? std::make_unique<WritableUnalignedMapping>(buffer->handle(),
-                                                              buffer->size(),
-                                                              buffer->offset())
+      shm(buffer ? std::make_unique<UnalignedSharedMemory>(buffer->handle(),
+                                                           buffer->size(),
+                                                           true)
                  : nullptr),
+      offset(buffer ? buffer->offset() : 0),
       bytes_used(0),
       input_id(input_id) {}
 
@@ -777,12 +779,12 @@
       new BitstreamBufferRef(decode_client_, decode_task_runner_,
                              &bitstream_buffer, bitstream_buffer.id()));
 
-  // Skip empty buffer. This must be done after creating bitstream_record as the
-  // handle in the bitstream_buffer needs to be consumed.
+  // Skip empty buffer.
   if (bitstream_buffer.size() == 0)
     return;
 
-  if (!bitstream_record->shm->IsValid()) {
+  if (!bitstream_record->shm->MapAt(bitstream_record->offset,
+                                    bitstream_record->shm->size())) {
     VLOGF(1) << "could not map bitstream_buffer";
     NOTIFY_ERROR(UNREADABLE_INPUT);
     return;

diff --git a/media/gpu/v4l2/v4l2_video_encode_accelerator.cc b/media/gpu/v4l2/v4l2_video_encode_accelerator.cc
index 702ea012..3f966114 100644
--- a/media/gpu/v4l2/v4l2_video_encode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_video_encode_accelerator.cc

@@ -89,10 +89,10 @@
 namespace media {
 
 struct V4L2VideoEncodeAccelerator::BitstreamBufferRef {
-  BitstreamBufferRef(int32_t id, std::unique_ptr<WritableUnalignedMapping> shm)
+  BitstreamBufferRef(int32_t id, std::unique_ptr<UnalignedSharedMemory> shm)
       : id(id), shm(std::move(shm)) {}
   const int32_t id;
-  const std::unique_ptr<WritableUnalignedMapping> shm;
+  const std::unique_ptr<UnalignedSharedMemory> shm;
 };
 
 V4L2VideoEncodeAccelerator::InputRecord::InputRecord() : at_device(false) {}
@@ -309,9 +309,9 @@
     return;
   }
 
-  auto shm = std::make_unique<WritableUnalignedMapping>(
-      buffer.handle(), buffer.size(), buffer.offset());
-  if (!shm->IsValid()) {
+  auto shm = std::make_unique<UnalignedSharedMemory>(buffer.handle(),
+                                                     buffer.size(), false);
+  if (!shm->MapAt(buffer.offset(), buffer.size())) {
     NOTIFY_ERROR(kPlatformFailureError);
     return;
   }

diff --git a/media/gpu/vaapi/vaapi_h264_accelerator.cc b/media/gpu/vaapi/vaapi_h264_accelerator.cc
index 3bcf0f34..1b653a5 100644
--- a/media/gpu/vaapi/vaapi_h264_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_h264_accelerator.cc

@@ -296,9 +296,9 @@
     const scoped_refptr<H264Picture>& pic) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  return vaapi_dec_->DecodeVASurface(pic->AsVaapiH264Picture()->va_surface())
-             ? Status::kOk
-             : Status::kFail;
+  const bool success = vaapi_wrapper_->ExecuteAndDestroyPendingBuffers(
+      pic->AsVaapiH264Picture()->va_surface()->id());
+  return success ? Status::kOk : Status::kFail;
 }
 
 bool VaapiH264Accelerator::OutputPicture(

diff --git a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
index b347326..59ee7af 100644
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc

@@ -872,15 +872,6 @@
   return false;
 }
 
-bool VaapiVideoDecodeAccelerator::DecodeVASurface(
-    const scoped_refptr<VASurface>& va_surface) {
-  const bool result =
-      vaapi_wrapper_->ExecuteAndDestroyPendingBuffers(va_surface->id());
-  if (!result)
-    VLOGF(1) << "Failed decoding picture";
-  return result;
-}
-
 void VaapiVideoDecodeAccelerator::VASurfaceReady(
     const scoped_refptr<VASurface>& va_surface,
     int32_t bitstream_id,

diff --git a/media/gpu/vaapi/vaapi_video_decode_accelerator.h b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
index 271bcc00..afe28f2 100644
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h

@@ -83,10 +83,6 @@
   //
   // Below methods are used by accelerator implementations.
   //
-  // Decode of |va_surface| is ready to be submitted and all codec-specific
-  // settings are set in hardware.
-  bool DecodeVASurface(const scoped_refptr<VASurface>& va_surface);
-
   // The |visible_rect| area of |va_surface| associated with |bitstream_id| is
   // ready to be outputted once decode is finished. This can be called before
   // decode is actually done in hardware, and this method is responsible for
@@ -98,8 +94,7 @@
   void VASurfaceReady(const scoped_refptr<VASurface>& va_surface,
                       int32_t bitstream_id,
                       const gfx::Rect& visible_rect);
-
-  // Return a new VASurface for decoding into, or nullptr if not available.
+  // Returns a new VASurface for decoding into, or nullptr if not available.
   scoped_refptr<VASurface> CreateVASurface();
 
  private:

diff --git a/media/gpu/vaapi/vaapi_vp8_accelerator.cc b/media/gpu/vaapi/vaapi_vp8_accelerator.cc
index 638537b..1bec4cc7 100644
--- a/media/gpu/vaapi/vaapi_vp8_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_vp8_accelerator.cc

@@ -220,7 +220,8 @@
                                     frame_hdr->frame_size, frame_hdr->data))
     return false;
 
-  return vaapi_dec_->DecodeVASurface(pic->AsVaapiVP8Picture()->va_surface());
+  return vaapi_wrapper_->ExecuteAndDestroyPendingBuffers(
+      pic->AsVaapiVP8Picture()->va_surface()->id());
 }
 
 bool VaapiVP8Accelerator::OutputPicture(const scoped_refptr<VP8Picture>& pic) {

diff --git a/media/gpu/vaapi/vaapi_vp9_accelerator.cc b/media/gpu/vaapi/vaapi_vp9_accelerator.cc
index 53ebb7b..ea85874 100644
--- a/media/gpu/vaapi/vaapi_vp9_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_vp9_accelerator.cc

@@ -158,7 +158,8 @@
                                     frame_hdr->frame_size, frame_hdr->data))
     return false;
 
-  return vaapi_dec_->DecodeVASurface(pic->AsVaapiVP9Picture()->va_surface());
+  return vaapi_wrapper_->ExecuteAndDestroyPendingBuffers(
+      pic->AsVaapiVP9Picture()->va_surface()->id());
 }
 
 bool VaapiVP9Accelerator::OutputPicture(const scoped_refptr<VP9Picture>& pic) {

diff --git a/net/BUILD.gn b/net/BUILD.gn
index 326b22e..59a8968 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn

@@ -399,7 +399,6 @@
 
   if (!is_nacl) {
     sources += [
-      "android/android_http_util.cc",
       "android/cellular_signal_strength.cc",
       "android/cellular_signal_strength.h",
       "android/cert_verify_result_android.cc",
@@ -407,6 +406,7 @@
       "android/gurl_utils.cc",
       "android/http_auth_negotiate_android.cc",
       "android/http_auth_negotiate_android.h",
+      "android/android_http_util.cc",
       "android/keystore.cc",
       "android/keystore.h",
       "android/legacy_openssl.h",
@@ -2508,7 +2508,6 @@
     "data/ssl/certificates/websocket_cacert.pem",
     "data/ssl/certificates/websocket_client_cert.p12",
     "data/ssl/certificates/wildcard.pem",
-    "data/ssl/certificates/www.ahrn.com.pem",
     "data/ssl/certificates/x509_verify_results.chain.pem",
   ]
   outputs = [

diff --git a/net/base/load_flags_list.h b/net/base/load_flags_list.h
index 798863f..fd80563 100644
--- a/net/base/load_flags_list.h
+++ b/net/base/load_flags_list.h

@@ -37,9 +37,9 @@
 // impact the HTTP request headers or use of the host cache.
 LOAD_FLAG(DISABLE_CACHE, 1 << 4)
 
-// If present, causes dependent network fetches (AIA, CRLs, OCSP) to be
-// skipped on secure connections.
-LOAD_FLAG(DISABLE_CERT_NETWORK_FETCHES, 1 << 5)
+// If present, causes certificate revocation checks to be skipped on secure
+// connections.
+LOAD_FLAG(DISABLE_CERT_REVOCATION_CHECKING, 1 << 5)
 
 // This load will not make any changes to cookies, including storing new
 // cookies or updating existing ones.

diff --git a/net/cert/caching_cert_verifier.cc b/net/cert/caching_cert_verifier.cc
index e1c3625..d3c5787 100644
--- a/net/cert/caching_cert_verifier.cc
+++ b/net/cert/caching_cert_verifier.cc

@@ -23,7 +23,6 @@
 
 CachingCertVerifier::CachingCertVerifier(std::unique_ptr<CertVerifier> verifier)
     : verifier_(std::move(verifier)),
-      config_id_(0u),
       cache_(kMaxCacheEntries),
       requests_(0u),
       cache_hits_(0u) {
@@ -54,24 +53,18 @@
 
   base::Time start_time = base::Time::Now();
   CompletionOnceCallback caching_callback = base::BindOnce(
-      &CachingCertVerifier::OnRequestFinished, base::Unretained(this),
-      config_id_, params, start_time, std::move(callback), verify_result);
+      &CachingCertVerifier::OnRequestFinished, base::Unretained(this), params,
+      start_time, std::move(callback), verify_result);
   int result = verifier_->Verify(params, crl_set, verify_result,
                                  std::move(caching_callback), out_req, net_log);
   if (result != ERR_IO_PENDING) {
     // Synchronous completion; add directly to cache.
-    AddResultToCache(config_id_, params, start_time, *verify_result, result);
+    AddResultToCache(params, start_time, *verify_result, result);
   }
 
   return result;
 }
 
-void CachingCertVerifier::SetConfig(const CertVerifier::Config& config) {
-  verifier_->SetConfig(config);
-  config_id_++;
-  ClearCache();
-}
-
 CachingCertVerifier::CachedResult::CachedResult() : error(ERR_FAILED) {}
 
 CachingCertVerifier::CachedResult::~CachedResult() = default;
@@ -119,29 +112,22 @@
          now.verification_time < expiration.expiration_time;
 };
 
-void CachingCertVerifier::OnRequestFinished(uint32_t config_id,
-                                            const RequestParams& params,
+void CachingCertVerifier::OnRequestFinished(const RequestParams& params,
                                             base::Time start_time,
                                             CompletionOnceCallback callback,
                                             CertVerifyResult* verify_result,
                                             int error) {
-  AddResultToCache(config_id, params, start_time, *verify_result, error);
+  AddResultToCache(params, start_time, *verify_result, error);
 
   // Now chain to the user's callback, which may delete |this|.
   std::move(callback).Run(error);
 }
 
 void CachingCertVerifier::AddResultToCache(
-    uint32_t config_id,
     const RequestParams& params,
     base::Time start_time,
     const CertVerifyResult& verify_result,
     int error) {
-  // If the configuration has changed since this verification was started,
-  // don't add it to the cache.
-  if (config_id != config_id_)
-    return;
-
   // When caching, this uses the time that validation started as the
   // beginning of the validity, rather than the time that it ended (aka
   // base::Time::Now()), to account for the fact that during validation,
@@ -175,7 +161,6 @@
 }
 
 void CachingCertVerifier::OnCertDBChanged() {
-  config_id_++;
   ClearCache();
 }
 

diff --git a/net/cert/caching_cert_verifier.h b/net/cert/caching_cert_verifier.h
index 145c6eb..387229f 100644
--- a/net/cert/caching_cert_verifier.h
+++ b/net/cert/caching_cert_verifier.h

@@ -49,7 +49,6 @@
              CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const NetLogWithSource& net_log) override;
-  void SetConfig(const Config& config) override;
 
  private:
   FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, CacheHit);
@@ -94,21 +93,18 @@
                                               CacheExpirationFunctor>;
 
   // Handles completion of the request matching |params|, which started at
-  // |start_time| and with config |config_id|, completing. |verify_result| and
-  // |result| are added to the cache, and then |callback| (the original caller's
-  // callback) is invoked.
-  void OnRequestFinished(uint32_t config_id,
-                         const RequestParams& params,
+  // |start_time|, completing. |verify_result| and |result| are added to the
+  // cache, and then |callback| (the original caller's callback) is invoked.
+  void OnRequestFinished(const RequestParams& params,
                          base::Time start_time,
                          CompletionOnceCallback callback,
                          CertVerifyResult* verify_result,
                          int error);
 
   // Adds |verify_result| and |error| to the cache for |params|, whose
-  // verification attempt began at |start_time| with config |config_id|. See the
-  // implementation for more details about the necessity of |start_time|.
-  void AddResultToCache(uint32_t config_id,
-                        const RequestParams& params,
+  // verification attempt began at |start_time|. See the implementation
+  // for more details about the necessity of |start_time|.
+  void AddResultToCache(const RequestParams& params,
                         base::Time start_time,
                         const CertVerifyResult& verify_result,
                         int error);
@@ -124,7 +120,6 @@
 
   std::unique_ptr<CertVerifier> verifier_;
 
-  uint32_t config_id_;
   CertVerificationCache cache_;
 
   uint64_t requests_;

diff --git a/net/cert/cert_verifier.cc b/net/cert/cert_verifier.cc
index 18ab114..89ba98a9 100644
--- a/net/cert/cert_verifier.cc
+++ b/net/cert/cert_verifier.cc

@@ -81,18 +81,4 @@
 #endif
 }
 
-bool operator==(const CertVerifier::Config& lhs,
-                const CertVerifier::Config& rhs) {
-  return std::tie(
-             lhs.enable_rev_checking, lhs.require_rev_checking_local_anchors,
-             lhs.enable_sha1_local_anchors, lhs.disable_symantec_enforcement) ==
-         std::tie(
-             rhs.enable_rev_checking, rhs.require_rev_checking_local_anchors,
-             rhs.enable_sha1_local_anchors, rhs.disable_symantec_enforcement);
-}
-bool operator!=(const CertVerifier::Config& lhs,
-                const CertVerifier::Config& rhs) {
-  return !(lhs == rhs);
-}
-
 }  // namespace net

diff --git a/net/cert/cert_verifier.h b/net/cert/cert_verifier.h
index 6fb008e8..7abc4071 100644
--- a/net/cert/cert_verifier.h
+++ b/net/cert/cert_verifier.h

@@ -27,26 +27,6 @@
 // CertVerifiers can handle multiple requests at a time.
 class NET_EXPORT CertVerifier {
  public:
-  struct Config {
-    // Enable online revocation checking via CRLs and OCSP for the certificate
-    // chain. Note that revocation checking is soft-fail.
-    bool enable_rev_checking = false;
-
-    // Enable online revocation checking via CRLs and OCSP for the certificate
-    // chain if the constructed chain terminates in a locally-installed,
-    // non-public trust anchor. A revocation error, such as a failure to
-    // obtain fresh revocation information, is treated as a hard failure.
-    bool require_rev_checking_local_anchors = false;
-
-    // Enable support for SHA-1 signatures if the constructed chain terminates
-    // in a locally-installed, non-public trust anchor.
-    bool enable_sha1_local_anchors = false;
-
-    // Disable enforcement of the policies described at
-    // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
-    bool disable_symantec_enforcement = false;
-  };
-
   class Request {
    public:
     Request() {}
@@ -59,16 +39,35 @@
   };
 
   enum VerifyFlags {
-    // If set, actively overrides the current CertVerifier::Config to disable
-    // dependent network fetches. This can be used to avoid triggering
-    // re-entrancy in the network stack. For example, fetching a PAC script
-    // over HTTPS may cause AIA, OCSP, or CRL fetches to block on retrieving
-    // the PAC script, while the PAC script fetch is waiting for those
-    // dependent fetches, creating a deadlock. When set, this flag prevents
-    // those fetches from being started (best effort).
-    // Note that cached information may still be used, if it can be accessed
-    // without accessing the network.
-    VERIFY_DISABLE_NETWORK_FETCHES = 1 << 0,
+    // If set, enables online revocation checking via CRLs and OCSP for the
+    // certificate chain.
+    VERIFY_REV_CHECKING_ENABLED = 1 << 0,
+
+    // 1 << 1 is reserved (used to be VERIFY_EV_CERT).
+    // 1 << 2 is reserved (used to be VERIY_CERT_IO_ENABLED).
+    // 1 << 3 is reserved (used to be VERIFY_REV_CHECKING_ENABLED_EV_ONLY).
+
+    // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it
+    // enables online revocation checking via CRLs or OCSP, but only
+    // for certificates issued by non-public trust anchors. Failure to check
+    // revocation is treated as a hard failure.
+    // Note: If VERIFY_CERT_IO_ENABLE is not also supplied, certificates
+    // that chain to local trust anchors will likely fail - for example, due to
+    // lacking fresh cached revocation issue (Windows) or because OCSP stapling
+    // can only provide information for the leaf, and not for any
+    // intermediates.
+    VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 4,
+
+    // If set, certificates with SHA-1 signatures will be allowed, but only if
+    // they are issued by non-public trust anchors.
+    VERIFY_ENABLE_SHA1_LOCAL_ANCHORS = 1 << 5,
+
+    // 1 << 6 is reserved (used to be
+    // VERIFY_ENABLE_COMMON_NAME_FALLBACK_LOCAL_ANCHORS).
+
+    // If set, disables the policy enforcement described at
+    // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
+    VERIFY_DISABLE_SYMANTEC_ENFORCEMENT = 1 << 7,
   };
 
   // Parameters to verify |certificate| against the supplied
@@ -159,29 +158,11 @@
                      std::unique_ptr<Request>* out_req,
                      const NetLogWithSource& net_log) = 0;
 
-  // Sets the configuration for new certificate verifications to be |config|.
-  // Any in-progress verifications (i.e. those with outstanding Request
-  // handles) will continue using the old configuration. This may be called
-  // throughout the CertVerifier's lifetime in response to configuration
-  // changes from embedders.
-  // Note: As configuration changes will replace any existing configuration,
-  // this should only be called by the logical 'owner' of this CertVerifier.
-  // Callers should NOT attempt to change configuration for single calls, and
-  // should NOT attempt to change configuration for CertVerifiers they do not
-  // explicitly manage.
-  virtual void SetConfig(const Config& config) = 0;
-
   // Creates a CertVerifier implementation that verifies certificates using
-  // the preferred underlying cryptographic libraries, using the specified
-  // configuration.
+  // the preferred underlying cryptographic libraries.
   static std::unique_ptr<CertVerifier> CreateDefault();
 };
 
-NET_EXPORT bool operator==(const CertVerifier::Config& lhs,
-                           const CertVerifier::Config& rhs);
-NET_EXPORT bool operator!=(const CertVerifier::Config& lhs,
-                           const CertVerifier::Config& rhs);
-
 }  // namespace net
 
 #endif  // NET_CERT_CERT_VERIFIER_H_

diff --git a/net/cert/cert_verifier_unittest.cc b/net/cert/cert_verifier_unittest.cc
index cccb12d..c61e996d 100644
--- a/net/cert/cert_verifier_unittest.cc
+++ b/net/cert/cert_verifier_unittest.cc

@@ -86,10 +86,9 @@
       {
           // The same certificate, chain, and host, but with different flags
           // are different validation keys.
-          CertVerifier::RequestParams(
-              ok_cert, "www.example.test",
-              CertVerifier::VERIFY_DISABLE_NETWORK_FETCHES, std::string(),
-              empty_list),
+          CertVerifier::RequestParams(ok_cert, "www.example.test",
+                                      CertVerifier::VERIFY_REV_CHECKING_ENABLED,
+                                      std::string(), empty_list),
           CertVerifier::RequestParams(ok_cert, "www.example.test", 0,
                                       std::string(), empty_list),
           false,

diff --git a/net/cert/cert_verify_proc.cc b/net/cert/cert_verify_proc.cc
index 6177891b..57cfa782 100644
--- a/net/cert/cert_verify_proc.cc
+++ b/net/cert/cert_verify_proc.cc

@@ -600,7 +600,7 @@
   //   allowed for that platform. See https://crbug.com/588789
   bool current_sha1_issue =
       (verify_result->is_issued_by_known_root ||
-       !(flags & VERIFY_ENABLE_SHA1_LOCAL_ANCHORS)) &&
+       !(flags & CertVerifier::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS)) &&
       (verify_result->has_sha1_leaf ||
        (verify_result->has_sha1 && !AreSHA1IntermediatesAllowed()));
 
@@ -617,7 +617,7 @@
 
   // Distrust Symantec-issued certificates, as described at
   // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
-  if (!(flags & VERIFY_DISABLE_SYMANTEC_ENFORCEMENT) &&
+  if (!(flags & CertVerifier::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT) &&
       IsLegacySymantecCert(verify_result->public_key_hashes)) {
     if (base::FeatureList::IsEnabled(kLegacySymantecPKIEnforcement) ||
         IsUntrustedSymantecCert(*verify_result->verified_cert)) {

diff --git a/net/cert/cert_verify_proc.h b/net/cert/cert_verify_proc.h
index c89c1379..64b2bdd 100644
--- a/net/cert/cert_verify_proc.h
+++ b/net/cert/cert_verify_proc.h

@@ -28,31 +28,6 @@
 class NET_EXPORT CertVerifyProc
     : public base::RefCountedThreadSafe<CertVerifyProc> {
  public:
-  enum VerifyFlags {
-    // If set, enables online revocation checking via CRLs and OCSP for the
-    // certificate chain.
-    VERIFY_REV_CHECKING_ENABLED = 1 << 0,
-
-    // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it
-    // enables online revocation checking via CRLs or OCSP, but only
-    // for certificates issued by non-public trust anchors. Failure to check
-    // revocation is treated as a hard failure.
-    // Note: If VERIFY_CERT_IO_ENABLE is not also supplied, certificates
-    // that chain to local trust anchors will likely fail - for example, due to
-    // lacking fresh cached revocation issue (Windows) or because OCSP stapling
-    // can only provide information for the leaf, and not for any
-    // intermediates.
-    VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 1,
-
-    // If set, certificates with SHA-1 signatures will be allowed, but only if
-    // they are issued by non-public trust anchors.
-    VERIFY_ENABLE_SHA1_LOCAL_ANCHORS = 1 << 2,
-
-    // If set, disables the policy enforcement described at
-    // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
-    VERIFY_DISABLE_SYMANTEC_ENFORCEMENT = 1 << 3,
-  };
-
   // Creates and returns the default CertVerifyProc.
   static scoped_refptr<CertVerifyProc> CreateDefault();
 
@@ -74,6 +49,9 @@
   // based revocation checking is always enabled, regardless of this flag, if
   // |crl_set| is given.
   //
+  // If VERIFY_EV_CERT is set in |flags| too, EV certificate verification is
+  // performed.
+  //
   // |crl_set| points to an optional CRLSet structure which can be used to
   // avoid revocation checks over the network.
   //

diff --git a/net/cert/cert_verify_proc_builtin.cc b/net/cert/cert_verify_proc_builtin.cc
index 9345b47..62e84937 100644
--- a/net/cert/cert_verify_proc_builtin.cc
+++ b/net/cert/cert_verify_proc_builtin.cc

@@ -183,7 +183,7 @@
 
     // Use hard-fail revocation checking for local trust anchors, if requested
     // by the load flag and the chain uses a non-public root.
-    if ((flags_ & CertVerifyProc::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) &&
+    if ((flags_ & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) &&
         !certs.empty() && !ssl_trust_store_->IsKnownRoot(certs.back().get())) {
       RevocationPolicy policy;
       policy.check_revocation = true;
@@ -214,7 +214,7 @@
     }
 
     // Use soft-fail revocation checking for VERIFY_REV_CHECKING_ENABLED.
-    if (flags_ & CertVerifyProc::VERIFY_REV_CHECKING_ENABLED) {
+    if (flags_ & CertVerifier::VERIFY_REV_CHECKING_ENABLED) {
       RevocationPolicy policy;
       policy.check_revocation = true;
       policy.networking_allowed = true;

diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc
index ae80b29..1257ac5 100644
--- a/net/cert/cert_verify_proc_mac.cc
+++ b/net/cert/cert_verify_proc_mac.cc

@@ -182,7 +182,7 @@
   // revocation checking policies and instead respect the application-level
   // revocation preference.
   status = x509_util::CreateRevocationPolicies(
-      (flags & CertVerifyProc::VERIFY_REV_CHECKING_ENABLED), local_policies);
+      (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED), local_policies);
   if (status)
     return status;
 
@@ -546,7 +546,7 @@
 
   // Note: For EV certificates, the Apple TP will handle setting these flags
   // as part of EV evaluation.
-  if (flags & CertVerifyProc::VERIFY_REV_CHECKING_ENABLED) {
+  if (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED) {
     // Require a positive result from an OCSP responder or a CRL (or both)
     // for every certificate in the chain. The Apple TP automatically
     // excludes the self-signed root from this requirement. If a certificate
@@ -830,7 +830,7 @@
       break;
   }
 
-  if (flags & CertVerifyProc::VERIFY_REV_CHECKING_ENABLED)
+  if (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED)
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
   if (*completed_chain_crl_result == kCRLSetRevoked)
@@ -908,7 +908,7 @@
             weak_key_or_signature_algorithm = true;
             policy_fail_already_mapped = true;
           } else if (policy_failed &&
-                     (flags & CertVerifyProc::VERIFY_REV_CHECKING_ENABLED) &&
+                     (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED) &&
                      chain_info[index].StatusCodes[status_code_index] ==
                          CSSMERR_TP_VERIFY_ACTION_FAILED &&
                      base::mac::IsOS10_12()) {
@@ -1013,17 +1013,17 @@
     // EV policies check out and the verification succeeded. See if revocation
     // checking still needs to be done before it can be marked as EV.
     if (completed_chain_crl_result == kCRLSetUnknown &&
-        !(flags & VERIFY_REV_CHECKING_ENABLED)) {
+        !(flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED)) {
       // If this is an EV cert and it wasn't covered by CRLSets and revocation
       // checking wasn't already on, try again with revocation forced on.
       //
       // Restore the input state of |*verify_result|, so that the
       // re-verification starts with a clean slate.
       *verify_result = input_verify_result;
-      int tmp_rv =
-          VerifyWithGivenFlags(verify_result->verified_cert.get(), hostname,
-                               flags | VERIFY_REV_CHECKING_ENABLED, crl_set,
-                               verify_result, &completed_chain_crl_result);
+      int tmp_rv = VerifyWithGivenFlags(
+          verify_result->verified_cert.get(), hostname,
+          flags | CertVerifier::VERIFY_REV_CHECKING_ENABLED, crl_set,
+          verify_result, &completed_chain_crl_result);
       // If re-verification failed, return those results without setting EV
       // status.
       if (tmp_rv != OK)

diff --git a/net/cert/cert_verify_proc_nss.cc b/net/cert/cert_verify_proc_nss.cc
index 9c11b054..d98b304 100644
--- a/net/cert/cert_verify_proc_nss.cc
+++ b/net/cert/cert_verify_proc_nss.cc

@@ -892,7 +892,8 @@
   SECOidTag ev_policy_oid = SEC_OID_UNKNOWN;
   bool is_ev_candidate =
       IsEVCandidate(metadata, cert_handle, &ev_policy_oid);
-  bool check_revocation = (flags & VERIFY_REV_CHECKING_ENABLED);
+  bool check_revocation =
+      (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED);
   if (check_revocation)
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
 
@@ -916,7 +917,8 @@
   }
 
   if (status == SECSuccess &&
-      (flags & VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) && !known_root) {
+      (flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS) &&
+      !known_root) {
     // TODO(rsleevi): Optimize this by supplying the constructed chain to
     // libpkix via cvin. Omitting for now, due to lack of coverage in upstream
     // NSS tests for that feature.

diff --git a/net/cert/cert_verify_proc_unittest.cc b/net/cert/cert_verify_proc_unittest.cc
index 65785fa..5e3ad57 100644
--- a/net/cert/cert_verify_proc_unittest.cc
+++ b/net/cert/cert_verify_proc_unittest.cc

@@ -1208,7 +1208,7 @@
   ASSERT_TRUE(cert_chain);
 
   CertVerifyResult verify_result;
-  int flags = CertVerifyProc::VERIFY_REV_CHECKING_ENABLED;
+  int flags = CertVerifier::VERIFY_REV_CHECKING_ENABLED;
   int error = Verify(cert_chain.get(), "mail.google.com", flags, NULL,
                      CertificateList(), &verify_result);
   EXPECT_NE(OK, error);
@@ -2002,7 +2002,7 @@
     CertVerifyResult test_result_3;
     error =
         verify_proc->Verify(cert.get(), "127.0.0.1", std::string(),
-                            CertVerifyProc::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT,
+                            CertVerifier::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT,
                             nullptr, CertificateList(), &test_result_3);
     EXPECT_THAT(error, IsOk());
     EXPECT_FALSE(test_result_3.cert_status & CERT_STATUS_SYMANTEC_LEGACY);
@@ -2062,7 +2062,7 @@
     CertVerifyResult test_result_3;
     error =
         verify_proc->Verify(cert.get(), "127.0.0.1", std::string(),
-                            CertVerifyProc::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT,
+                            CertVerifier::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT,
                             nullptr, CertificateList(), &test_result_3);
     EXPECT_THAT(error, IsOk());
     EXPECT_FALSE(test_result_3.cert_status & CERT_STATUS_SYMANTEC_LEGACY);
@@ -3221,7 +3221,7 @@
   EXPECT_TRUE(verify_result.cert_status & CERT_STATUS_SHA1_SIGNATURE_PRESENT);
 
   // ... unless VERIFY_ENABLE_SHA1_LOCAL_ANCHORS was supplied.
-  flags = CertVerifyProc::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS;
+  flags = CertVerifier::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS;
   verify_result.Reset();
   error = verify_proc->Verify(cert.get(), "127.0.0.1", std::string(), flags,
                               nullptr /* crl_set */, CertificateList(),

diff --git a/net/cert/cert_verify_proc_win.cc b/net/cert/cert_verify_proc_win.cc
index 272288d..65f41ca1 100644
--- a/net/cert/cert_verify_proc_win.cc
+++ b/net/cert/cert_verify_proc_win.cc

@@ -911,7 +911,8 @@
   // Note: The root cert is also checked for revocation status, so that CRLSets
   // will cover revoked SPKIs.
   DWORD chain_flags = CERT_CHAIN_REVOCATION_CHECK_CHAIN;
-  bool rev_checking_enabled = (flags & VERIFY_REV_CHECKING_ENABLED);
+  bool rev_checking_enabled =
+      (flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED);
   if (rev_checking_enabled) {
     verify_result->cert_status |= CERT_STATUS_REV_CHECKING_ENABLED;
   } else {
@@ -1066,7 +1067,7 @@
   CertVerifyResult temp_verify_result = *verify_result;
   GetCertChainInfo(chain_context, verify_result);
   if (!verify_result->is_issued_by_known_root &&
-      (flags & VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS)) {
+      (flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS)) {
     *verify_result = temp_verify_result;
 
     rev_checking_enabled = true;

diff --git a/net/cert/mock_cert_verifier.h b/net/cert/mock_cert_verifier.h
index db7bea5f..77b403a 100644
--- a/net/cert/mock_cert_verifier.h
+++ b/net/cert/mock_cert_verifier.h

@@ -33,7 +33,6 @@
              CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const NetLogWithSource& net_log) override;
-  void SetConfig(const Config& config) override {}
 
   // Sets the default return value for Verify() for certificates/hosts that do
   // not have explicit results added via the AddResult*() methods.

diff --git a/net/cert/multi_threaded_cert_verifier.cc b/net/cert/multi_threaded_cert_verifier.cc
index 217d9046..7ebdf94 100644
--- a/net/cert/multi_threaded_cert_verifier.cc
+++ b/net/cert/multi_threaded_cert_verifier.cc

@@ -5,7 +5,6 @@
 #include "net/cert/multi_threaded_cert_verifier.h"
 
 #include <algorithm>
-#include <iterator>
 #include <utility>
 
 #include "base/bind.h"
@@ -120,21 +119,6 @@
   CertVerifyResult result;
 };
 
-int GetFlagsForConfig(const CertVerifier::Config& config) {
-  int flags = 0;
-
-  if (config.enable_rev_checking)
-    flags |= CertVerifyProc::VERIFY_REV_CHECKING_ENABLED;
-  if (config.require_rev_checking_local_anchors)
-    flags |= CertVerifyProc::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS;
-  if (config.enable_sha1_local_anchors)
-    flags |= CertVerifyProc::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS;
-  if (config.disable_symantec_enforcement)
-    flags |= CertVerifyProc::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT;
-
-  return flags;
-}
-
 }  // namespace
 
 // Represents the output and result callback of a request. The
@@ -241,22 +225,15 @@
   // Posts a task to TaskScheduler to do the verification. Once the verification
   // has completed, it will call OnJobCompleted() on the origin thread.
   void Start(const scoped_refptr<CertVerifyProc>& verify_proc,
-             const CertVerifier::Config& config,
-             uint32_t config_id,
              const scoped_refptr<CRLSet>& crl_set) {
-    int flags = GetFlagsForConfig(config);
-    if (key_.flags() & CertVerifier::VERIFY_DISABLE_NETWORK_FETCHES) {
-      flags &= ~CertVerifyProc::VERIFY_REV_CHECKING_ENABLED;
-      flags &= ~CertVerifyProc::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS;
-    }
     base::PostTaskWithTraitsAndReplyWithResult(
         FROM_HERE,
         {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
         base::BindOnce(&DoVerifyOnWorkerThread, verify_proc, key_.certificate(),
-                       key_.hostname(), key_.ocsp_response(), flags, crl_set,
-                       key_.additional_trust_anchors()),
+                       key_.hostname(), key_.ocsp_response(), key_.flags(),
+                       crl_set, key_.additional_trust_anchors()),
         base::BindOnce(&CertVerifierJob::OnJobCompleted,
-                       weak_ptr_factory_.GetWeakPtr(), config_id, crl_set));
+                       weak_ptr_factory_.GetWeakPtr(), crl_set));
   }
 
   ~CertVerifierJob() {
@@ -313,16 +290,14 @@
     }
   }
 
-  void OnJobCompleted(uint32_t config_id,
-                      scoped_refptr<CRLSet> crl_set,
+  void OnJobCompleted(scoped_refptr<CRLSet> crl_set,
                       std::unique_ptr<ResultHelper> verify_result) {
     TRACE_EVENT0(kNetTracingCategory, "CertVerifierJob::OnJobCompleted");
     std::unique_ptr<CertVerifierJob> keep_alive =
         cert_verifier_->RemoveJob(this);
 
     LogMetrics(*verify_result);
-    if (cert_verifier_->verify_complete_callback_ &&
-        config_id == cert_verifier_->config_id_) {
+    if (cert_verifier_->verify_complete_callback_) {
       cert_verifier_->verify_complete_callback_.Run(
           key_, std::move(crl_set), net_log_, verify_result->error,
           verify_result->result, base::TimeTicks::Now() - start_time_,
@@ -399,10 +374,10 @@
     std::unique_ptr<CertVerifierJob> new_job =
         std::make_unique<CertVerifierJob>(params, net_log.net_log(), this);
 
-    new_job->Start(verify_proc_, config_, config_id_, crl_set);
+    new_job->Start(verify_proc_, crl_set);
 
     job = new_job.get();
-    joinable_[job] = std::move(new_job);
+    inflight_[job] = std::move(new_job);
 
     if (requests_ == 1)
       job->set_is_first_job(true);
@@ -414,17 +389,6 @@
   return ERR_IO_PENDING;
 }
 
-void MultiThreadedCertVerifier::SetConfig(const CertVerifier::Config& config) {
-  ++config_id_;
-  config_ = config;
-
-  // In C++17, this would be a .merge() call to combine |joinable_| into
-  // |inflight_|.
-  inflight_.insert(std::make_move_iterator(joinable_.begin()),
-                   std::make_move_iterator(joinable_.end()));
-  joinable_.clear();
-}
-
 bool MultiThreadedCertVerifier::JobComparator::operator()(
     const CertVerifierJob* job1,
     const CertVerifierJob* job2) const {
@@ -435,8 +399,7 @@
     scoped_refptr<CertVerifyProc> verify_proc,
     VerifyCompleteCallback verify_complete_callback,
     bool should_record_histograms)
-    : config_id_(0),
-      requests_(0),
+    : requests_(0),
       inflight_joins_(0),
       verify_proc_(verify_proc),
       verify_complete_callback_(std::move(verify_complete_callback)),
@@ -445,16 +408,6 @@
 std::unique_ptr<CertVerifierJob> MultiThreadedCertVerifier::RemoveJob(
     CertVerifierJob* job) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-
-  // See if it's a job from the current generation.
-  auto joinable_it = joinable_.find(job);
-  if (joinable_it != joinable_.end()) {
-    std::unique_ptr<CertVerifierJob> job_ptr = std::move(joinable_it->second);
-    joinable_.erase(joinable_it);
-    return job_ptr;
-  }
-
-  // Otherwise, find it and remove it from previous generations.
   auto it = inflight_.find(job);
   DCHECK(it != inflight_.end());
   std::unique_ptr<CertVerifierJob> job_ptr = std::move(it->second);
@@ -475,9 +428,9 @@
 
   // The JobSet is kept in sorted order so items can be found using binary
   // search.
-  auto it = std::lower_bound(joinable_.begin(), joinable_.end(), key,
+  auto it = std::lower_bound(inflight_.begin(), inflight_.end(), key,
                              JobToRequestParamsComparator());
-  if (it != joinable_.end() && !(key < it->first->key()))
+  if (it != inflight_.end() && !(key < it->first->key()))
     return it->first;
   return nullptr;
 }

diff --git a/net/cert/multi_threaded_cert_verifier.h b/net/cert/multi_threaded_cert_verifier.h
index 4ce98ca..13c02e7 100644
--- a/net/cert/multi_threaded_cert_verifier.h
+++ b/net/cert/multi_threaded_cert_verifier.h

@@ -67,7 +67,6 @@
              CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const NetLogWithSource& net_log) override;
-  void SetConfig(const CertVerifier::Config& config) override;
 
  private:
   struct JobToRequestParamsComparator;
@@ -89,8 +88,8 @@
                             VerifyCompleteCallback verify_complete_callback,
                             bool should_record_histograms);
 
-  // Returns an inflight job for |key|, if it can be joined. If there is no
-  // such job then returns null.
+  // Returns an inflight job for |key|. If there is no such job then returns
+  // null.
   CertVerifierJob* FindJob(const RequestParams& key);
 
   // Removes |job| from the inflight set, and passes ownership back to the
@@ -101,23 +100,13 @@
   uint64_t requests() const { return requests_; }
   uint64_t inflight_joins() const { return inflight_joins_; }
 
-  // |joinable_| holds the jobs for which an active verification is taking
-  // place and can be joined by new requests (e.g. the config is the same),
-  // mapping the job's raw pointer to an owned pointer.
-  // TODO(rsleevi): Once C++17 is supported, switch this to be a std::set<>,
-  // which supports extracting owned objects from the set.
-  std::map<CertVerifierJob*, std::unique_ptr<CertVerifierJob>, JobComparator>
-      joinable_;
-
-  // |inflight_| contains all jobs that are still undergoing active
-  // verification, but which can no longer be joined - such as due to the
-  // underlying configuration changing.
+  // inflight_ holds the jobs for which an active verification is taking place,
+  // mapping the job's raw pointer to an owned pointer. Would be a
+  // set<unique_ptr> but extraction of owned objects from a set of owned types
+  // doesn't come until C++17.
   std::map<CertVerifierJob*, std::unique_ptr<CertVerifierJob>, JobComparator>
       inflight_;
 
-  uint32_t config_id_;
-  Config config_;
-
   uint64_t requests_;
   uint64_t inflight_joins_;
 

diff --git a/net/cert/multi_threaded_cert_verifier_unittest.cc b/net/cert/multi_threaded_cert_verifier_unittest.cc
index 36dc29c..74508e6 100644
--- a/net/cert/multi_threaded_cert_verifier_unittest.cc
+++ b/net/cert/multi_threaded_cert_verifier_unittest.cc

@@ -25,9 +25,6 @@
 
 using net::test::IsError;
 using net::test::IsOk;
-using testing::_;
-using testing::DoAll;
-using testing::Return;
 
 namespace net {
 
@@ -39,53 +36,36 @@
 
 class MockCertVerifyProc : public CertVerifyProc {
  public:
-  MOCK_METHOD7(VerifyInternal,
-               int(X509Certificate*,
-                   const std::string&,
-                   const std::string&,
-                   int,
-                   CRLSet*,
-                   const CertificateList&,
-                   CertVerifyResult*));
-  MOCK_CONST_METHOD0(SupportsAdditionalTrustAnchors, bool());
+  MockCertVerifyProc() = default;
 
  private:
   ~MockCertVerifyProc() override = default;
+
+  // CertVerifyProc implementation
+  bool SupportsAdditionalTrustAnchors() const override { return false; }
+
+  int VerifyInternal(X509Certificate* cert,
+                     const std::string& hostname,
+                     const std::string& ocsp_response,
+                     int flags,
+                     CRLSet* crl_set,
+                     const CertificateList& additional_trust_anchors,
+                     CertVerifyResult* verify_result) override {
+    verify_result->Reset();
+    verify_result->verified_cert = cert;
+    verify_result->cert_status = CERT_STATUS_COMMON_NAME_INVALID;
+    return ERR_CERT_COMMON_NAME_INVALID;
+  }
 };
 
-ACTION(SetCertVerifyResult) {
-  X509Certificate* cert = arg0;
-  CertVerifyResult* result = arg6;
-  result->Reset();
-  result->verified_cert = cert;
-  result->cert_status = CERT_STATUS_COMMON_NAME_INVALID;
-}
-
-ACTION(SetCertVerifyRevokedResult) {
-  X509Certificate* cert = arg0;
-  CertVerifyResult* result = arg6;
-  result->Reset();
-  result->verified_cert = cert;
-  result->cert_status = CERT_STATUS_REVOKED;
-}
-
 }  // namespace
 
 class MultiThreadedCertVerifierTest : public TestWithScopedTaskEnvironment {
  public:
-  MultiThreadedCertVerifierTest()
-      : mock_verify_proc_(base::MakeRefCounted<MockCertVerifyProc>()),
-        verifier_(mock_verify_proc_) {
-    EXPECT_CALL(*mock_verify_proc_, SupportsAdditionalTrustAnchors())
-        .WillRepeatedly(Return(true));
-    EXPECT_CALL(*mock_verify_proc_, VerifyInternal(_, _, _, _, _, _, _))
-        .WillRepeatedly(
-            DoAll(SetCertVerifyResult(), Return(ERR_CERT_COMMON_NAME_INVALID)));
-  }
+  MultiThreadedCertVerifierTest() : verifier_(new MockCertVerifyProc()) {}
   ~MultiThreadedCertVerifierTest() override = default;
 
  protected:
-  scoped_refptr<MockCertVerifyProc> mock_verify_proc_;
   MultiThreadedCertVerifier verifier_;
 };
 
@@ -276,53 +256,4 @@
   ASSERT_EQ(2u, verifier_.inflight_joins());
 }
 
-// Tests propagation of configuration options into CertVerifyProc flags
-TEST_F(MultiThreadedCertVerifierTest, ConvertsConfigToFlags) {
-  base::FilePath certs_dir = GetTestCertsDirectory();
-  scoped_refptr<X509Certificate> test_cert(
-      ImportCertFromFile(certs_dir, "ok_cert.pem"));
-  ASSERT_TRUE(test_cert);
-
-  const struct TestConfig {
-    bool CertVerifier::Config::*config_ptr;
-    int expected_flag;
-  } kTestConfig[] = {
-      {&CertVerifier::Config::enable_rev_checking,
-       CertVerifyProc::VERIFY_REV_CHECKING_ENABLED},
-      {&CertVerifier::Config::require_rev_checking_local_anchors,
-       CertVerifyProc::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS},
-      {&CertVerifier::Config::enable_sha1_local_anchors,
-       CertVerifyProc::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS},
-      {&CertVerifier::Config::disable_symantec_enforcement,
-       CertVerifyProc::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT},
-  };
-  for (const auto& test_config : kTestConfig) {
-    CertVerifier::Config config;
-    config.*test_config.config_ptr = true;
-
-    verifier_.SetConfig(config);
-
-    EXPECT_CALL(*mock_verify_proc_,
-                VerifyInternal(_, _, _, test_config.expected_flag, _, _, _))
-        .WillRepeatedly(
-            DoAll(SetCertVerifyRevokedResult(), Return(ERR_CERT_REVOKED)));
-
-    CertVerifyResult verify_result;
-    TestCompletionCallback callback;
-    std::unique_ptr<CertVerifier::Request> request;
-    int error = verifier_.Verify(
-        CertVerifier::RequestParams(test_cert, "www.example.com", 0,
-                                    std::string(), CertificateList()),
-        nullptr, &verify_result, callback.callback(), &request,
-        NetLogWithSource());
-    ASSERT_THAT(error, IsError(ERR_IO_PENDING));
-    EXPECT_TRUE(request);
-    error = callback.WaitForResult();
-    EXPECT_TRUE(IsCertificateError(error));
-    EXPECT_THAT(error, IsError(ERR_CERT_REVOKED));
-
-    testing::Mock::VerifyAndClearExpectations(mock_verify_proc_.get());
-  }
-}
-
 }  // namespace net

diff --git a/net/data/ssl/certificates/README b/net/data/ssl/certificates/README
index 3594a94..ed5dbf4 100644
--- a/net/data/ssl/certificates/README
+++ b/net/data/ssl/certificates/README

@@ -66,9 +66,6 @@
   Trust the certificate in verisign_class3_g5_crosssigned.pem (Generated by
   scripts/generate-verisign_class3_g5_crosssigned-trusted-keychain.sh)
 
-- www.ahrn.com.pem: A certificate issued by the Legacy Symantec PKI in 2014,
-  expires on 2019-10-27.
-
 ===== Manually generated certificates
 - client.p12 : A PKCS #12 file containing a client certificate and a private
      key created for testing.  The password is "12345".

diff --git a/net/data/ssl/certificates/www.ahrn.com.pem b/net/data/ssl/certificates/www.ahrn.com.pem
deleted file mode 100644
index b050b18..0000000
--- a/net/data/ssl/certificates/www.ahrn.com.pem
+++ /dev/null

@@ -1,299 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            4b:55:a8:9e:db:00:a8:b5:62:d7:5c:a3:2c:b3:70:0f
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4
-        Validity
-            Not Before: Oct 28 00:00:00 2014 GMT
-            Not After : Oct 27 23:59:59 2019 GMT
-        Subject: C = US, ST = Wisconsin, L = Waterford, O = Runzheimer International LTD, OU = IT, CN = www.ahrn.com
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:d1:30:e0:95:77:78:37:76:72:63:76:d8:7d:f7:
-                    e0:ca:c8:3f:3d:43:70:bb:ed:50:8f:8e:50:16:0d:
-                    28:64:8f:e6:0c:5c:eb:cd:a9:24:93:1a:51:fa:9f:
-                    7f:52:da:32:7a:1d:86:7c:b7:3f:be:be:76:a3:4f:
-                    4e:b9:ab:38:79:69:9a:ab:1f:77:7a:94:80:77:5f:
-                    6c:c8:25:2b:b0:9d:60:0a:78:88:27:33:c5:ac:1a:
-                    35:2f:a9:65:f9:c0:0e:8f:8f:e5:66:06:df:bb:60:
-                    bf:67:85:2f:c1:26:57:78:ac:ce:dd:39:a9:fd:04:
-                    17:f3:0b:53:bb:b4:76:fc:fb:e3:2e:21:87:fd:40:
-                    4f:12:9a:43:8f:b3:15:4a:6f:bc:0c:0b:4e:94:33:
-                    06:a5:2c:66:50:ff:7a:2f:6f:f7:83:83:9d:a8:52:
-                    9a:36:97:ea:97:88:96:96:0b:e9:d9:c6:37:7c:e1:
-                    b4:63:b7:4a:a8:2c:e6:75:fe:0f:33:dd:28:7a:5a:
-                    4a:7a:c8:26:b1:cb:7d:1a:f4:b1:63:5b:c7:01:3c:
-                    53:86:33:4e:b6:5a:2c:81:42:41:12:85:60:a7:38:
-                    a7:7b:05:ea:b0:7b:ef:ec:f4:ba:5d:8b:63:dc:ba:
-                    3d:aa:78:d8:66:9c:d1:35:b3:0d:97:a3:62:95:1f:
-                    64:af
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Alternative Name: 
-                DNS:www.ahrn.com
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Key Usage: critical
-                Digital Signature, Key Encipherment
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://ss.symcb.com/ss.crl
-
-            X509v3 Certificate Policies: 
-                Policy: 2.16.840.1.113733.1.7.54
-                  CPS: https://d.symcb.com/cps
-                  User Notice:
-                    Explicit Text: https://d.symcb.com/rpa
-
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication, TLS Web Client Authentication
-            X509v3 Authority Key Identifier: 
-                keyid:5F:60:CF:61:90:55:DF:84:43:14:8A:60:2A:B2:F5:7A:F4:43:18:EF
-
-            Authority Information Access: 
-                OCSP - URI:http://ss.symcd.com
-                CA Issuers - URI:http://ss.symcb.com/ss.crt
-
-    Signature Algorithm: sha256WithRSAEncryption
-         b0:e7:ed:25:04:03:bc:86:9a:1c:4d:93:99:c1:a0:18:6d:61:
-         4d:ab:e1:a8:74:c0:34:71:99:1b:90:9a:62:88:b4:92:ca:c5:
-         3a:ba:b3:a6:4f:6a:00:3f:75:9b:fe:69:d7:68:8c:26:63:a8:
-         22:ee:8e:ed:3e:20:2e:54:5d:c7:d3:82:ac:18:42:28:ef:7b:
-         69:f3:86:f6:55:d1:67:1b:cf:28:0c:0f:82:2b:d6:f4:07:4b:
-         de:57:3d:02:3e:88:01:59:3d:7c:cd:80:68:61:e3:ac:0b:7f:
-         16:4e:1e:54:9b:7d:80:26:31:eb:0c:da:f4:53:5e:bc:62:2a:
-         8a:ff:6a:df:f5:b4:07:89:82:b4:67:68:68:54:b9:d5:1b:a0:
-         f1:35:de:e7:18:b0:64:08:4f:93:13:88:02:8a:9f:42:c5:c3:
-         67:a0:d7:aa:dd:54:84:8d:c7:5a:a5:3c:5e:d1:9a:1c:3d:36:
-         45:6a:66:a3:10:ad:3e:bf:95:a2:27:8d:a6:7a:7a:6b:59:d3:
-         66:79:10:05:fb:3f:0c:f6:b3:b5:85:83:e1:a4:49:02:56:db:
-         5b:9d:36:ea:59:e7:b5:f4:9a:aa:59:21:ab:54:a7:fc:b7:15:
-         0c:41:29:39:15:ff:83:1f:5e:d3:73:85:96:6e:a4:dc:01:bd:
-         7d:21:34:3f
------BEGIN CERTIFICATE-----
-MIIE8DCCA9igAwIBAgIQS1WontsAqLVi11yjLLNwDzANBgkqhkiG9w0BAQsFADB+
-MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
-BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVj
-IENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE0MTAyODAwMDAwMFoX
-DTE5MTAyNzIzNTk1OVowgYAxCzAJBgNVBAYTAlVTMRIwEAYDVQQIDAlXaXNjb25z
-aW4xEjAQBgNVBAcMCVdhdGVyZm9yZDElMCMGA1UECgwcUnVuemhlaW1lciBJbnRl
-cm5hdGlvbmFsIExURDELMAkGA1UECwwCSVQxFTATBgNVBAMMDHd3dy5haHJuLmNv
-bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANEw4JV3eDd2cmN22H33
-4MrIPz1DcLvtUI+OUBYNKGSP5gxc682pJJMaUfqff1LaMnodhny3P76+dqNPTrmr
-OHlpmqsfd3qUgHdfbMglK7CdYAp4iCczxawaNS+pZfnADo+P5WYG37tgv2eFL8Em
-V3iszt05qf0EF/MLU7u0dvz74y4hh/1ATxKaQ4+zFUpvvAwLTpQzBqUsZlD/ei9v
-94ODnahSmjaX6peIlpYL6dnGN3zhtGO3Sqgs5nX+DzPdKHpaSnrIJrHLfRr0sWNb
-xwE8U4YzTrZaLIFCQRKFYKc4p3sF6rB77+z0ul2LY9y6Pap42Gac0TWzDZejYpUf
-ZK8CAwEAAaOCAWUwggFhMBcGA1UdEQQQMA6CDHd3dy5haHJuLmNvbTAJBgNVHRME
-AjAAMA4GA1UdDwEB/wQEAwIFoDArBgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc3Mu
-c3ltY2IuY29tL3NzLmNybDBlBgNVHSAEXjBcMFoGCmCGSAGG+EUBBzYwTDAjBggr
-BgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGQwX
-aHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
-AQUFBwMCMB8GA1UdIwQYMBaAFF9gz2GQVd+EQxSKYCqy9Xr0QxjvMFcGCCsGAQUF
-BwEBBEswSTAfBggrBgEFBQcwAYYTaHR0cDovL3NzLnN5bWNkLmNvbTAmBggrBgEF
-BQcwAoYaaHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcnQwDQYJKoZIhvcNAQELBQAD
-ggEBALDn7SUEA7yGmhxNk5nBoBhtYU2r4ah0wDRxmRuQmmKItJLKxTq6s6ZPagA/
-dZv+addojCZjqCLuju0+IC5UXcfTgqwYQijve2nzhvZV0WcbzygMD4Ir1vQHS95X
-PQI+iAFZPXzNgGhh46wLfxZOHlSbfYAmMesM2vRTXrxiKor/at/1tAeJgrRnaGhU
-udUboPE13ucYsGQIT5MTiAKKn0LFw2eg16rdVISNx1qlPF7Rmhw9NkVqZqMQrT6/
-laInjaZ6emtZ02Z5EAX7Pwz2s7WFg+GkSQJW21udNupZ57X0mqpZIatUp/y3FQxB
-KTkV/4MfXtNzhZZupNwBvX0hND8=
------END CERTIFICATE-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            13:b3:e3:02:18:03:97:66:8d:50:34:e0:e6:74:e2:8d
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
-        Validity
-            Not Before: Oct 31 00:00:00 2013 GMT
-            Not After : Oct 30 23:59:59 2023 GMT
-        Subject: C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:b2:d8:05:ca:1c:74:2d:b5:17:56:39:c5:4a:52:
-                    09:96:e8:4b:d8:0c:f1:68:9f:9a:42:28:62:c3:a5:
-                    30:53:7e:55:11:82:5b:03:7a:0d:2f:e1:79:04:c9:
-                    b4:96:77:19:81:01:94:59:f9:bc:f7:7a:99:27:82:
-                    2d:b7:83:dd:5a:27:7f:b2:03:7a:9c:53:25:e9:48:
-                    1f:46:4f:c8:9d:29:f8:be:79:56:f6:f7:fd:d9:3a:
-                    68:da:8b:4b:82:33:41:12:c3:c8:3c:cc:d6:96:7a:
-                    84:21:1a:22:04:03:27:17:8b:1c:68:61:93:0f:0e:
-                    51:80:33:1d:b4:b5:ce:eb:7e:d0:62:ac:ee:b3:7b:
-                    01:74:ef:69:35:eb:ca:d5:3d:a9:ee:97:98:ca:8d:
-                    aa:44:0e:25:99:4a:15:96:a4:ce:6d:02:54:1f:2a:
-                    6a:26:e2:06:3a:63:48:ac:b4:4c:d1:75:93:50:ff:
-                    13:2f:d6:da:e1:c6:18:f5:9f:c9:25:5d:f3:00:3a:
-                    de:26:4d:b4:29:09:cd:0f:3d:23:6f:16:4a:81:16:
-                    fb:f2:83:10:c3:b8:d6:d8:55:32:3d:f1:bd:0f:bd:
-                    8c:52:95:4a:16:97:7a:52:21:63:75:2f:16:f9:c4:
-                    66:be:f5:b5:09:d8:ff:27:00:cd:44:7c:6f:4b:3f:
-                    b0:f7
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE, pathlen:0
-            X509v3 CRL Distribution Points: 
-
-                Full Name:
-                  URI:http://s1.symcb.com/pca3-g5.crl
-
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            X509v3 Subject Alternative Name: 
-                DirName:/CN=SymantecPKI-1-534
-            X509v3 Subject Key Identifier: 
-                5F:60:CF:61:90:55:DF:84:43:14:8A:60:2A:B2:F5:7A:F4:43:18:EF
-            X509v3 Certificate Policies: 
-                Policy: 2.23.140.1.2.2
-                  CPS: http://www.symauth.com/cps
-                  User Notice:
-                    Explicit Text: http://www.symauth.com/rpa
-
-            Authority Information Access: 
-                OCSP - URI:http://s2.symcb.com
-
-            X509v3 Authority Key Identifier: 
-                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
-
-    Signature Algorithm: sha256WithRSAEncryption
-         16:19:9a:85:c5:85:ea:47:56:4f:40:37:ad:34:e5:a3:2d:74:
-         82:be:3a:cd:25:fe:62:70:25:bb:98:09:35:be:77:80:5b:ae:
-         28:66:e7:37:34:c0:da:0f:b5:b4:2e:97:78:3e:c8:53:3f:a6:
-         b1:ae:d5:a4:fd:bc:43:af:7a:20:7b:c8:15:a6:ed:5a:e5:1c:
-         8c:a6:81:ef:61:a4:a8:50:76:bd:d0:e0:a2:95:99:78:5f:50:
-         88:89:e6:e0:8a:db:ae:f2:e5:be:7a:7d:a0:a9:cf:48:ef:7b:
-         c6:09:d0:1a:46:11:c5:f8:99:90:5e:6f:c5:91:0d:f6:9e:3f:
-         78:95:fe:84:af:73:64:ec:8d:6a:d2:6e:70:08:00:cc:88:a9:
-         4e:85:95:f3:31:8a:9e:10:e2:62:23:3d:0b:5c:97:96:7e:db:
-         36:64:fb:c9:d6:55:44:21:77:0f:0a:64:26:e2:15:2f:96:31:
-         50:eb:f5:bd:ee:1d:e3:dd:d1:50:7e:c4:86:9a:31:fe:a8:7f:
-         cd:2b:bc:93:c1:2f:67:60:f0:30:59:0d:d6:f5:05:2b:55:31:
-         8f:60:b0:b9:f3:1a:de:bc:8d:50:aa:12:39:87:54:38:2a:b7:
-         9b:1c:1f:51:ef:9e:a0:fc:8e:fd:c4:4a:de:8a:62:82:9c:a1:
-         9d:97:5c:92
------BEGIN CERTIFICATE-----
-MIIFNDCCBBygAwIBAgIQE7PjAhgDl2aNUDTg5nTijTANBgkqhkiG9w0BAQsFADCB
-yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
-U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
-ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5IC0gRzUwHhcNMTMxMDMxMDAwMDAwWhcNMjMxMDMwMjM1OTU5WjB+MQsw
-CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNV
-BAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVjIENs
-YXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEAstgFyhx0LbUXVjnFSlIJluhL2AzxaJ+aQihiw6UwU35VEYJb
-A3oNL+F5BMm0lncZgQGUWfm893qZJ4Itt4PdWid/sgN6nFMl6UgfRk/InSn4vnlW
-9vf92Tpo2otLgjNBEsPIPMzWlnqEIRoiBAMnF4scaGGTDw5RgDMdtLXO637QYqzu
-s3sBdO9pNevK1T2p7peYyo2qRA4lmUoVlqTObQJUHypqJuIGOmNIrLRM0XWTUP8T
-L9ba4cYY9Z/JJV3zADreJk20KQnNDz0jbxZKgRb78oMQw7jW2FUyPfG9D72MUpVK
-Fpd6UiFjdS8W+cRmvvW1Cdj/JwDNRHxvSz+w9wIDAQABo4IBXzCCAVswEgYDVR0T
-AQH/BAgwBgEB/wIBADAwBgNVHR8EKTAnMCWgI6Ahhh9odHRwOi8vczEuc3ltY2Iu
-Y29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB/wQEAwIBBjApBgNVHREEIjAgpB4wHDEa
-MBgGA1UEAxMRU3ltYW50ZWNQS0ktMS01MzQwHQYDVR0OBBYEFF9gz2GQVd+EQxSK
-YCqy9Xr0QxjvMGcGA1UdIARgMF4wXAYGZ4EMAQICMFIwJgYIKwYBBQUHAgEWGmh0
-dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93
-d3cuc3ltYXV0aC5jb20vcnBhMC8GCCsGAQUFBwEBBCMwITAfBggrBgEFBQcwAYYT
-aHR0cDovL3MyLnN5bWNiLmNvbTAfBgNVHSMEGDAWgBR/02Wnwt3su/AwCfNDOfoC
-rzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAFhmahcWF6kdWT0A3rTTloy10gr46zSX+
-YnAlu5gJNb53gFuuKGbnNzTA2g+1tC6XeD7IUz+msa7VpP28Q696IHvIFabtWuUc
-jKaB72GkqFB2vdDgopWZeF9QiInm4IrbrvLlvnp9oKnPSO97xgnQGkYRxfiZkF5v
-xZEN9p4/eJX+hK9zZOyNatJucAgAzIipToWV8zGKnhDiYiM9C1yXln7bNmT7ydZV
-RCF3DwpkJuIVL5YxUOv1ve4d493RUH7Ehpox/qh/zSu8k8EvZ2DwMFkN1vUFK1Ux
-j2CwufMa3ryNUKoSOYdUOCq3mxwfUe+eoPyO/cRK3opigpyhnZdckg==
------END CERTIFICATE-----
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
-    Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
-        Validity
-            Not Before: Nov  8 00:00:00 2006 GMT
-            Not After : Jul 16 23:59:59 2036 GMT
-        Subject: C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:af:24:08:08:29:7a:35:9e:60:0c:aa:e7:4b:3b:
-                    4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:
-                    08:a3:64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:
-                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:
-                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:
-                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:
-                    54:85:26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:
-                    d8:43:63:6a:52:4b:d2:8f:e8:70:51:4d:d1:89:69:
-                    7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b:56:d3:96:
-                    bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:
-                    f4:06:04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:
-                    ba:f4:3c:ee:e0:8b:eb:37:8b:ec:f4:d7:ac:f2:f6:
-                    f0:3d:af:dd:75:91:33:19:1d:1c:40:cb:74:24:19:
-                    21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:
-                    63:47:88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:
-                    ae:0e:9d:d4:d1:43:c0:67:73:e3:14:08:7e:e5:3f:
-                    9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a:ee:53:e8:
-                    25:15
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Key Usage: critical
-                Certificate Sign, CRL Sign
-            1.3.6.1.5.5.7.1.12: 
-                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
-            X509v3 Subject Key Identifier: 
-                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
-    Signature Algorithm: sha1WithRSAEncryption
-         93:24:4a:30:5f:62:cf:d8:1a:98:2f:3d:ea:dc:99:2d:bd:77:
-         f6:a5:79:22:38:ec:c4:a7:a0:78:12:ad:62:0e:45:70:64:c5:
-         e7:97:66:2d:98:09:7e:5f:af:d6:cc:28:65:f2:01:aa:08:1a:
-         47:de:f9:f9:7c:92:5a:08:69:20:0d:d9:3e:6d:6e:3c:0d:6e:
-         d8:e6:06:91:40:18:b9:f8:c1:ed:df:db:41:aa:e0:96:20:c9:
-         cd:64:15:38:81:c9:94:ee:a2:84:29:0b:13:6f:8e:db:0c:dd:
-         25:02:db:a4:8b:19:44:d2:41:7a:05:69:4a:58:4f:60:ca:7e:
-         82:6a:0b:02:aa:25:17:39:b5:db:7f:e7:84:65:2a:95:8a:bd:
-         86:de:5e:81:16:83:2d:10:cc:de:fd:a8:82:2a:6d:28:1f:0d:
-         0b:c4:e5:e7:1a:26:19:e1:f4:11:6f:10:b5:95:fc:e7:42:05:
-         32:db:ce:9d:51:5e:28:b6:9e:85:d3:5b:ef:a5:7d:45:40:72:
-         8e:b7:0e:6b:0e:06:fb:33:35:48:71:b8:9d:27:8b:c4:65:5f:
-         0d:86:76:9c:44:7a:f6:95:5c:f6:5d:32:08:33:a4:54:b6:18:
-         3f:68:5c:f2:42:4a:85:38:54:83:5f:d1:e8:2c:f2:ac:11:d6:
-         a8:ed:63:6a
------BEGIN CERTIFICATE-----
-MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB
-yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
-ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
-U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
-ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL
-MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW
-ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln
-biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp
-U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y
-aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1
-nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex
-t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz
-SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG
-BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+
-rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/
-NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
-BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH
-BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy
-aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv
-MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE
-p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y
-5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK
-WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ
-4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N
-hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq
------END CERTIFICATE-----

diff --git a/net/dns/dns_transaction.cc b/net/dns/dns_transaction.cc
index a41b389..6db64b7 100644
--- a/net/dns/dns_transaction.cc
+++ b/net/dns/dns_transaction.cc

@@ -389,9 +389,8 @@
 
     request_->SetExtraRequestHeaders(extra_request_headers);
     request_->SetLoadFlags(request_->load_flags() | LOAD_DISABLE_CACHE |
-                           LOAD_BYPASS_PROXY | LOAD_DO_NOT_SEND_COOKIES |
-                           LOAD_DO_NOT_SAVE_COOKIES |
-                           LOAD_DO_NOT_SEND_AUTH_DATA);
+                           LOAD_BYPASS_PROXY);
+    request_->set_allow_credentials(false);
   }
 
   // DnsAttempt overrides.

diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
index cd6b96b..526e9e7d 100644
--- a/net/http/http_network_transaction.cc
+++ b/net/http/http_network_transaction.cc

@@ -147,9 +147,9 @@
   // Now that we have an HttpRequestInfo object, update server_ssl_config_.
   session_->GetSSLConfig(*request_, &server_ssl_config_, &proxy_ssl_config_);
 
-  if (request_->load_flags & LOAD_DISABLE_CERT_NETWORK_FETCHES) {
-    server_ssl_config_.disable_cert_verification_network_fetches = true;
-    proxy_ssl_config_.disable_cert_verification_network_fetches = true;
+  if (request_->load_flags & LOAD_DISABLE_CERT_REVOCATION_CHECKING) {
+    server_ssl_config_.rev_checking_enabled = false;
+    proxy_ssl_config_.rev_checking_enabled = false;
   }
 
   if (HttpUtil::IsMethodSafe(request_info->method)) {

diff --git a/net/http/http_stream_factory_job.cc b/net/http/http_stream_factory_job.cc
index 75e62eb1..a04327d2 100644
--- a/net/http/http_stream_factory_job.cc
+++ b/net/http/http_stream_factory_job.cc

@@ -863,9 +863,9 @@
 
   if (proxy_info_.is_https() || proxy_info_.is_quic()) {
     InitSSLConfig(&proxy_ssl_config_, /*is_proxy=*/true);
-    // Disable network fetches for HTTPS proxies, since the network requests
-    // are probably going to need to go through the proxy too.
-    proxy_ssl_config_.disable_cert_verification_network_fetches = true;
+    // Disable revocation checking for HTTPS proxies since the revocation
+    // requests are probably going to need to go through the proxy too.
+    proxy_ssl_config_.rev_checking_enabled = false;
   }
   if (using_ssl_) {
     InitSSLConfig(&server_ssl_config_, /*is_proxy=*/false);

diff --git a/net/proxy_resolution/pac_file_fetcher_impl.cc b/net/proxy_resolution/pac_file_fetcher_impl.cc
index a688c00..0201c27 100644
--- a/net/proxy_resolution/pac_file_fetcher_impl.cc
+++ b/net/proxy_resolution/pac_file_fetcher_impl.cc

@@ -171,7 +171,7 @@
   // the proxy might be the only way to the outside world.  IGNORE_LIMITS is
   // used to avoid blocking proxy resolution on other network requests.
   cur_request_->SetLoadFlags(LOAD_BYPASS_PROXY | LOAD_DISABLE_CACHE |
-                             LOAD_DISABLE_CERT_NETWORK_FETCHES |
+                             LOAD_DISABLE_CERT_REVOCATION_CHECKING |
                              LOAD_IGNORE_LIMITS);
 
   // Save the caller's info for notification on completion.

diff --git a/net/proxy_resolution/pac_file_fetcher_impl_unittest.cc b/net/proxy_resolution/pac_file_fetcher_impl_unittest.cc
index b658df8..029c025 100644
--- a/net/proxy_resolution/pac_file_fetcher_impl_unittest.cc
+++ b/net/proxy_resolution/pac_file_fetcher_impl_unittest.cc

@@ -154,7 +154,7 @@
   int OnBeforeURLRequest(URLRequest* request,
                          CompletionOnceCallback callback,
                          GURL* new_url) override {
-    EXPECT_TRUE(request->load_flags() & LOAD_DISABLE_CERT_NETWORK_FETCHES);
+    EXPECT_TRUE(request->load_flags() & LOAD_DISABLE_CERT_REVOCATION_CHECKING);
     return OK;
   }
 

diff --git a/net/quic/crypto/proof_verifier_chromium_test.cc b/net/quic/crypto/proof_verifier_chromium_test.cc
index af39290..c35ae43 100644
--- a/net/quic/crypto/proof_verifier_chromium_test.cc
+++ b/net/quic/crypto/proof_verifier_chromium_test.cc

@@ -52,7 +52,6 @@
     ADD_FAILURE() << "CertVerifier::Verify() should not be called";
     return ERR_FAILED;
   }
-  void SetConfig(const Config& config) override {}
 };
 
 // A mock CTPolicyEnforcer that returns a custom verification result.

diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
index 50d861e..39a1ae2 100644
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc

@@ -1366,10 +1366,6 @@
         CreateOutgoingReliableStreamImpl(request->traffic_annotation())
             ->CreateHandle());
   }
-
-  if (GetNumOpenOutgoingStreams() == 0 && stream_factory_) {
-    stream_factory_->OnIdleSession(this);
-  }
 }
 
 void QuicChromiumClientSession::OnConfigNegotiated() {

diff --git a/net/quic/quic_stream_factory.cc b/net/quic/quic_stream_factory.cc
index a13d210..d23cb2a 100644
--- a/net/quic/quic_stream_factory.cc
+++ b/net/quic/quic_stream_factory.cc

@@ -1181,8 +1181,6 @@
   active_cert_verifier_jobs_.erase(job->server_id());
 }
 
-void QuicStreamFactory::OnIdleSession(QuicChromiumClientSession* session) {}
-
 void QuicStreamFactory::OnSessionGoingAway(QuicChromiumClientSession* session) {
   const AliasSet& aliases = session_aliases_[session];
   for (AliasSet::const_iterator it = aliases.begin(); it != aliases.end();

diff --git a/net/quic/quic_stream_factory.h b/net/quic/quic_stream_factory.h
index 3b4a2cc..76291f3 100644
--- a/net/quic/quic_stream_factory.h
+++ b/net/quic/quic_stream_factory.h

@@ -278,17 +278,6 @@
              const NetLogWithSource& net_log,
              QuicStreamRequest* request);
 
-  // Called when the handshake for |session| is confirmed. If QUIC is disabled
-  // currently disabled, then it closes the connection and returns true.
-  bool OnHandshakeConfirmed(QuicChromiumClientSession* session);
-
-  // Called when a TCP job completes for an origin that QUIC potentially
-  // could be used for.
-  void OnTcpJobCompleted(bool succeeded);
-
-  // Called by a session when it becomes idle.
-  void OnIdleSession(QuicChromiumClientSession* session);
-
   // Called by a session when it is going away and no more streams should be
   // created on it.
   void OnSessionGoingAway(QuicChromiumClientSession* session);

diff --git a/net/quic/quic_stream_factory_test.cc b/net/quic/quic_stream_factory_test.cc
index fe535e8..1ba3ef9 100644
--- a/net/quic/quic_stream_factory_test.cc
+++ b/net/quic/quic_stream_factory_test.cc

@@ -815,6 +815,7 @@
   void TestMigrationOnWriteErrorWithMultipleNotifications(
       IoMode write_error_mode,
       bool disconnect_before_connect);
+  void TestNoAlternateNetworkBeforeHandshake(quic::QuicErrorCode error);
   void TestNewConnectionOnAlternateNetworkBeforeHandshake(
       quic::QuicErrorCode error);
 
@@ -4716,6 +4717,83 @@
   EXPECT_TRUE(socket_data.AllWriteDataConsumed());
 }
 
+// This test verifies that if a connection is closed with
+// QUIC_NETWORK_IDLE_TIMEOUT before handshake is completed and there is no
+// alternate network, no new connection will be created.
+TEST_P(QuicStreamFactoryTest, NoAlternateNetworkBeforeHandshakeOnIdleTimeout) {
+  TestNoAlternateNetworkBeforeHandshake(quic::QUIC_NETWORK_IDLE_TIMEOUT);
+}
+
+// This test verifies that if a connection is closed with QUIC_HANDSHAKE_TIMEOUT
+// and there is no alternate network, no new connection will be created.
+TEST_P(QuicStreamFactoryTest, NoAlternateNetworkOnHandshakeTimeout) {
+  TestNoAlternateNetworkBeforeHandshake(quic::QUIC_HANDSHAKE_TIMEOUT);
+}
+
+void QuicStreamFactoryTestBase::TestNoAlternateNetworkBeforeHandshake(
+    quic::QuicErrorCode quic_error) {
+  DCHECK(quic_error == quic::QUIC_NETWORK_IDLE_TIMEOUT ||
+         quic_error == quic::QUIC_HANDSHAKE_TIMEOUT);
+  InitializeConnectionMigrationV2Test({kDefaultNetworkForTests});
+
+  // Using a testing task runner.
+  auto task_runner = base::MakeRefCounted<base::TestMockTimeTaskRunner>();
+  QuicStreamFactoryPeer::SetTaskRunner(factory_.get(), task_runner.get());
+
+  // Use cold start mode to send crypto message for handshake.
+  crypto_client_stream_factory_.set_handshake_mode(
+      MockCryptoClientStream::COLD_START_WITH_CHLO_SENT);
+
+  MockQuicData socket_data;
+  socket_data.AddRead(SYNCHRONOUS, ERR_IO_PENDING);
+  socket_data.AddWrite(ASYNC, client_maker_.MakeDummyCHLOPacket(1));
+  socket_data.AddSocketDataToFactory(socket_factory_.get());
+
+  // Create request.
+  QuicStreamRequest request(factory_.get());
+  EXPECT_EQ(ERR_IO_PENDING,
+            request.Request(host_port_pair_, version_, privacy_mode_,
+                            DEFAULT_PRIORITY, SocketTag(),
+                            /*cert_verify_flags=*/0, url_, net_log_,
+                            &net_error_details_, callback_.callback()));
+
+  base::RunLoop().RunUntilIdle();
+
+  // Ensure that session is alive but not active.
+  EXPECT_FALSE(HasActiveSession(host_port_pair_));
+  EXPECT_TRUE(HasActiveJob(host_port_pair_, privacy_mode_));
+  QuicChromiumClientSession* session = GetPendingSession(host_port_pair_);
+  EXPECT_TRUE(QuicStreamFactoryPeer::IsLiveSession(factory_.get(), session));
+  EXPECT_EQ(0u, task_runner->GetPendingTaskCount());
+
+  // Cause the connection to report path degrading to the session.
+  // Session will ignore the signal as handshake is not completed.
+  session->connection()->OnPathDegradingTimeout();
+  EXPECT_EQ(0u, task_runner->GetPendingTaskCount());
+  EXPECT_FALSE(HasActiveSession(host_port_pair_));
+  EXPECT_TRUE(HasActiveJob(host_port_pair_, privacy_mode_));
+
+  // Cause the connection to close due to |quic_error| before handshake.
+  quic::QuicString error_details;
+  if (quic_error == quic::QUIC_NETWORK_IDLE_TIMEOUT) {
+    error_details = "No recent network activity.";
+  } else {
+    error_details = "Handshake timeout expired.";
+  }
+  session->connection()->CloseConnection(
+      quic_error, error_details, quic::ConnectionCloseBehavior::SILENT_CLOSE);
+
+  // A task will be posted to clean up the session in the factory.
+  EXPECT_EQ(1u, task_runner->GetPendingTaskCount());
+  task_runner->FastForwardUntilNoTasksRemain();
+
+  // No new session should be created as there is no alternate network.
+  EXPECT_FALSE(HasActiveSession(host_port_pair_));
+  EXPECT_FALSE(HasActiveJob(host_port_pair_, privacy_mode_));
+  EXPECT_TRUE(socket_data.AllReadDataConsumed());
+  EXPECT_TRUE(socket_data.AllWriteDataConsumed());
+}
+
 TEST_P(QuicStreamFactoryTest, NewConnectionBeforeHandshakeAfterIdleTimeout) {
   TestNewConnectionOnAlternateNetworkBeforeHandshake(
       quic::QUIC_NETWORK_IDLE_TIMEOUT);

diff --git a/net/ssl/ssl_config.cc b/net/ssl/ssl_config.cc
index dd7273a..515c410 100644
--- a/net/ssl/ssl_config.cc
+++ b/net/ssl/ssl_config.cc

@@ -22,7 +22,11 @@
 SSLConfig::CertAndStatus::~CertAndStatus() = default;
 
 SSLConfig::SSLConfig()
-    : version_min(kDefaultSSLVersionMin),
+    : rev_checking_enabled(false),
+      rev_checking_required_local_anchors(false),
+      sha1_local_anchors_enabled(false),
+      symantec_enforcement_disabled(false),
+      version_min(kDefaultSSLVersionMin),
       version_max(kDefaultSSLVersionMax),
       tls13_variant(kDefaultTLS13Variant),
       early_data_enabled(false),
@@ -30,7 +34,6 @@
       channel_id_enabled(false),
       false_start_enabled(true),
       require_ecdhe(false),
-      disable_cert_verification_network_fetches(false),
       send_client_cert(false),
       renego_allowed_default(false) {}
 
@@ -52,8 +55,14 @@
 
 int SSLConfig::GetCertVerifyFlags() const {
   int flags = 0;
-  if (disable_cert_verification_network_fetches)
-    flags |= CertVerifier::VERIFY_DISABLE_NETWORK_FETCHES;
+  if (rev_checking_enabled)
+    flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED;
+  if (rev_checking_required_local_anchors)
+    flags |= CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS;
+  if (sha1_local_anchors_enabled)
+    flags |= CertVerifier::VERIFY_ENABLE_SHA1_LOCAL_ANCHORS;
+  if (symantec_enforcement_disabled)
+    flags |= CertVerifier::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT;
 
   return flags;
 }

diff --git a/net/ssl/ssl_config.h b/net/ssl/ssl_config.h
index 2d7782e0..6604979 100644
--- a/net/ssl/ssl_config.h
+++ b/net/ssl/ssl_config.h

@@ -66,6 +66,31 @@
   // configuration.
   int GetCertVerifyFlags() const;
 
+  // rev_checking_enabled is true if online certificate revocation checking is
+  // enabled (i.e. OCSP and CRL fetching).
+  //
+  // Regardless of this flag, CRLSet checking is always enabled and locally
+  // cached revocation information will be considered.
+  bool rev_checking_enabled;
+
+  // rev_checking_required_local_anchors is true if revocation checking is
+  // required to succeed when certificates chain to local trust anchors (that
+  // is, non-public CAs). If revocation information cannot be obtained, such
+  // certificates will be treated as revoked ("hard-fail").
+  // Note: This is distinct from rev_checking_enabled. If true, it is
+  // equivalent to also setting rev_checking_enabled, but only when the
+  // certificate chain chains to a local (non-public) trust anchor.
+  bool rev_checking_required_local_anchors;
+
+  // sha1_local_anchors_enabled is true if SHA-1 signed certificates issued by a
+  // local (non-public) trust anchor should be allowed.
+  bool sha1_local_anchors_enabled;
+
+  // symantec_enforcement_disabled is true if the policies outlined in
+  // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
+  // should not be enforced.
+  bool symantec_enforcement_disabled;
+
   // The minimum and maximum protocol versions that are enabled.
   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
@@ -137,14 +162,6 @@
   // response to the user explicitly accepting the bad certificate.
   std::vector<CertAndStatus> allowed_bad_certs;
 
-  // True if, for a single connection, any dependent network fetches should
-  // be disabled. This can be used to avoid triggering re-entrancy in the
-  // network layer. For example, fetching a PAC script over HTTPS may cause
-  // AIA, OCSP, or CRL fetches to block on retrieving the PAC script, while
-  // the PAC script fetch is waiting for those dependent fetches, creating a
-  // deadlock.
-  bool disable_cert_verification_network_fetches;
-
   // True if we should send client_cert to the server.
   bool send_client_cert;
 

diff --git a/net/ssl/ssl_config_service.cc b/net/ssl/ssl_config_service.cc
index cb6799e..c53a449d 100644
--- a/net/ssl/ssl_config_service.cc
+++ b/net/ssl/ssl_config_service.cc

@@ -17,14 +17,20 @@
 // Checks if the config-service managed fields in two SSLConfigs are the same.
 bool SSLConfigsAreEqual(const net::SSLConfig& config1,
                         const net::SSLConfig& config2) {
-  return std::tie(config1.version_min, config1.version_max,
-                  config1.tls13_variant, config1.disabled_cipher_suites,
-                  config1.channel_id_enabled, config1.false_start_enabled,
-                  config1.require_ecdhe) ==
-         std::tie(config2.version_min, config2.version_max,
-                  config2.tls13_variant, config2.disabled_cipher_suites,
-                  config2.channel_id_enabled, config2.false_start_enabled,
-                  config2.require_ecdhe);
+  return std::tie(config1.rev_checking_enabled,
+                  config1.rev_checking_required_local_anchors,
+                  config1.sha1_local_anchors_enabled,
+                  config1.symantec_enforcement_disabled, config1.version_min,
+                  config1.version_max, config1.tls13_variant,
+                  config1.disabled_cipher_suites, config1.channel_id_enabled,
+                  config1.false_start_enabled, config1.require_ecdhe) ==
+         std::tie(config2.rev_checking_enabled,
+                  config2.rev_checking_required_local_anchors,
+                  config2.sha1_local_anchors_enabled,
+                  config2.symantec_enforcement_disabled, config2.version_min,
+                  config2.version_max, config2.tls13_variant,
+                  config2.disabled_cipher_suites, config2.channel_id_enabled,
+                  config2.false_start_enabled, config2.require_ecdhe);
 }
 
 }  // namespace

diff --git a/net/ssl/ssl_config_service.h b/net/ssl/ssl_config_service.h
index b1157bb..21e686c 100644
--- a/net/ssl/ssl_config_service.h
+++ b/net/ssl/ssl_config_service.h

@@ -27,13 +27,13 @@
     // Notify observers if SSL settings have changed.  We don't check all of the
     // data in SSLConfig, just those that qualify as a user config change.
     // The following settings are considered user changes:
+    //     rev_checking_enabled
     //     version_min
     //     version_max
-    //     tls13_variant
     //     disabled_cipher_suites
     //     channel_id_enabled
     //     false_start_enabled
-    //     require_ecdhe
+    //     require_forward_secrecy
     virtual void OnSSLConfigChanged() = 0;
 
    protected:

diff --git a/net/ssl/ssl_config_service_unittest.cc b/net/ssl/ssl_config_service_unittest.cc
index 4763a7b6..391d663 100644
--- a/net/ssl/ssl_config_service_unittest.cc
+++ b/net/ssl/ssl_config_service_unittest.cc

@@ -52,6 +52,7 @@
 
 TEST(SSLConfigServiceTest, NoChangesWontNotifyObservers) {
   SSLConfig initial_config;
+  initial_config.rev_checking_enabled = true;
   initial_config.false_start_enabled = false;
   initial_config.version_min = SSL_PROTOCOL_VERSION_TLS1;
   initial_config.version_max = SSL_PROTOCOL_VERSION_TLS1_2;
@@ -68,6 +69,7 @@
 
 TEST(SSLConfigServiceTest, ForceNotificationNotifiesObservers) {
   SSLConfig initial_config;
+  initial_config.rev_checking_enabled = true;
   initial_config.false_start_enabled = false;
   initial_config.version_min = SSL_PROTOCOL_VERSION_TLS1;
   initial_config.version_max = SSL_PROTOCOL_VERSION_TLS1_2;
@@ -84,6 +86,9 @@
 
 TEST(SSLConfigServiceTest, ConfigUpdatesNotifyObservers) {
   SSLConfig initial_config;
+  initial_config.rev_checking_enabled = true;
+  initial_config.rev_checking_required_local_anchors = false;
+  initial_config.sha1_local_anchors_enabled = true;
   initial_config.false_start_enabled = false;
   initial_config.require_ecdhe = false;
   initial_config.version_min = SSL_PROTOCOL_VERSION_TLS1;
@@ -94,6 +99,18 @@
   mock_service.AddObserver(&observer);
 
   // Test that the basic boolean preferences trigger updates.
+  initial_config.rev_checking_enabled = false;
+  EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
+  mock_service.SetSSLConfig(initial_config);
+
+  initial_config.rev_checking_required_local_anchors = true;
+  EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
+  mock_service.SetSSLConfig(initial_config);
+
+  initial_config.sha1_local_anchors_enabled = false;
+  EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
+  mock_service.SetSSLConfig(initial_config);
+
   initial_config.false_start_enabled = true;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service.SetSSLConfig(initial_config);

diff --git a/net/ssl/ssl_config_unittest.cc b/net/ssl/ssl_config_unittest.cc
index 9dde2242..11001b4 100644
--- a/net/ssl/ssl_config_unittest.cc
+++ b/net/ssl/ssl_config_unittest.cc

@@ -12,13 +12,22 @@
 namespace {
 
 void CheckCertVerifyFlags(SSLConfig* ssl_config,
-                          bool disable_cert_verification_network_fetches) {
-  ssl_config->disable_cert_verification_network_fetches =
-      disable_cert_verification_network_fetches;
+                          bool rev_checking_enabled,
+                          bool rev_checking_required_local_anchors,
+                          bool symantec_enforcement_disabled) {
+  ssl_config->rev_checking_enabled = rev_checking_enabled;
+  ssl_config->rev_checking_required_local_anchors =
+      rev_checking_required_local_anchors;
+  ssl_config->symantec_enforcement_disabled = symantec_enforcement_disabled;
 
   int flags = ssl_config->GetCertVerifyFlags();
-  EXPECT_EQ(disable_cert_verification_network_fetches,
-            !!(flags & CertVerifier::VERIFY_DISABLE_NETWORK_FETCHES));
+  EXPECT_EQ(rev_checking_enabled,
+            !!(flags & CertVerifier::VERIFY_REV_CHECKING_ENABLED));
+  EXPECT_EQ(
+      rev_checking_required_local_anchors,
+      !!(flags & CertVerifier::VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS));
+  EXPECT_EQ(symantec_enforcement_disabled,
+            !!(flags & CertVerifier::VERIFY_DISABLE_SYMANTEC_ENFORCEMENT));
 }
 
 }  // namespace
@@ -26,9 +35,29 @@
 TEST(SSLConfigTest, GetCertVerifyFlags) {
   SSLConfig ssl_config;
   CheckCertVerifyFlags(&ssl_config,
-                       /*disable_cert_verification_network_fetches*/ false);
+                       /*rev_checking_enabled=*/true,
+                       /*rev_checking_required_local_anchors=*/true,
+                       /*symantec_enforcement_disabled=*/true);
+
   CheckCertVerifyFlags(&ssl_config,
-                       /*disable_cert_verification_network_fetches*/ true);
+                       /*rev_checking_enabled=*/true,
+                       /*rev_checking_required_local_anchors=*/false,
+                       /*symantec_enforcement_disabled=*/false);
+
+  CheckCertVerifyFlags(&ssl_config,
+                       /*rev_checking_enabled=*/false,
+                       /*rev_checking_required_local_anchors=*/true,
+                       /*symantec_enforcement_disabled=*/false);
+
+  CheckCertVerifyFlags(&ssl_config,
+                       /*rev_checking_enabled=*/false,
+                       /*rev_checking_required_local_anchors=*/false,
+                       /*symantec_enforcement_disabled=*/true);
+
+  CheckCertVerifyFlags(&ssl_config,
+                       /*rev_checking_enabled=*/false,
+                       /*rev_checking_required_local_anchors=*/false,
+                       /*symantec_enforcement_disabled=*/false);
 }
 
 }  // namespace net

diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index 9812f3b..03702a71 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc

@@ -4128,8 +4128,13 @@
 
 class TestSSLConfigService : public SSLConfigService {
  public:
-  explicit TestSSLConfigService(bool token_binding_enabled)
-      : token_binding_enabled_(token_binding_enabled),
+  TestSSLConfigService(bool online_rev_checking,
+                       bool rev_checking_required_local_anchors,
+                       bool token_binding_enabled)
+      : online_rev_checking_(online_rev_checking),
+        rev_checking_required_local_anchors_(
+            rev_checking_required_local_anchors),
+        token_binding_enabled_(token_binding_enabled),
         min_version_(kDefaultSSLVersionMin),
         max_version_(kDefaultSSLVersionMax) {}
   ~TestSSLConfigService() override = default;
@@ -4140,6 +4145,9 @@
   // SSLConfigService:
   void GetSSLConfig(SSLConfig* config) override {
     *config = SSLConfig();
+    config->rev_checking_enabled = online_rev_checking_;
+    config->rev_checking_required_local_anchors =
+        rev_checking_required_local_anchors_;
     config->version_min = min_version_;
     config->version_max = max_version_;
     if (token_binding_enabled_) {
@@ -4153,6 +4161,8 @@
   }
 
  private:
+  const bool online_rev_checking_;
+  const bool rev_checking_required_local_anchors_;
   const bool token_binding_enabled_;
   uint16_t min_version_;
   uint16_t max_version_;
@@ -4167,8 +4177,8 @@
   TokenBindingURLRequestTest() = default;
 
   void SetUp() override {
-    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
-        true /* token_binding_enabled */);
+    ssl_config_service_ =
+        std::make_unique<TestSSLConfigService>(false, false, true);
     default_context().set_ssl_config_service(ssl_config_service_.get());
     channel_id_service_ =
         std::make_unique<ChannelIDService>(new DefaultChannelIDStore(NULL));
@@ -10808,6 +10818,8 @@
  public:
   HTTPSFallbackTest() : context_(true) {
     ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        false /* online revocation checking */,
+        false /* require rev. checking for local anchors */,
         false /* token binding enabled */);
     context_.set_ssl_config_service(ssl_config_service_.get());
   }
@@ -11014,10 +11026,9 @@
 
   void SetUp() override {
     context_.SetCTPolicyEnforcer(std::make_unique<DefaultCTPolicyEnforcer>());
+    SetupContext();
     context_.Init();
 
-    context_.cert_verifier()->SetConfig(GetCertVerifierConfig());
-
     scoped_refptr<X509Certificate> root_cert =
         ImportCertFromFile(GetTestCertsDirectory(), "ocsp-test-root.pem");
     CHECK_NE(static_cast<X509Certificate*>(NULL), root_cert.get());
@@ -11081,13 +11092,15 @@
   }
 
  protected:
-  // GetCertVerifierConfig() configures the URLRequestContext that will be used
-  // for making connections to the testserver. This can be overridden in test
-  // subclasses for different behaviour.
-  virtual CertVerifier::Config GetCertVerifierConfig() {
-    CertVerifier::Config config;
-    config.enable_rev_checking = true;
-    return config;
+  // SetupContext configures the URLRequestContext that will be used for making
+  // connetions to testserver. This can be overridden in test subclasses for
+  // different behaviour.
+  virtual void SetupContext() {
+    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        true /* online revocation checking */,
+        false /* require rev. checking for local anchors */,
+        false /* token binding enabled */);
+    context_.set_ssl_config_service(ssl_config_service_.get());
   }
 
   std::unique_ptr<ScopedTestRoot> test_root_;
@@ -11686,9 +11699,12 @@
 
 class HTTPSAIATest : public HTTPSOCSPTest {
  public:
-  CertVerifier::Config GetCertVerifierConfig() override {
-    CertVerifier::Config config;
-    return config;
+  void SetupContext() override {
+    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        false /* online revocation checking */,
+        false /* require rev. checking for local anchors */,
+        false /* token binding enabled */);
+    context_.set_ssl_config_service(ssl_config_service_.get());
   }
 };
 
@@ -11728,10 +11744,12 @@
 
 class HTTPSHardFailTest : public HTTPSOCSPTest {
  protected:
-  CertVerifier::Config GetCertVerifierConfig() override {
-    CertVerifier::Config config;
-    config.require_rev_checking_local_anchors = true;
-    return config;
+  void SetupContext() override {
+    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        false /* online revocation checking */,
+        true /* require rev. checking for local anchors */,
+        false /* token binding enabled */);
+    context_.set_ssl_config_service(ssl_config_service_.get());
   }
 };
 
@@ -11771,9 +11789,12 @@
 
 class HTTPSEVCRLSetTest : public HTTPSOCSPTest {
  protected:
-  CertVerifier::Config GetCertVerifierConfig() override {
-    CertVerifier::Config config;
-    return config;
+  void SetupContext() override {
+    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        false /* online revocation checking */,
+        false /* require rev. checking for local anchors */,
+        false /* token binding enabled */);
+    context_.set_ssl_config_service(ssl_config_service_.get());
   }
 };
 
@@ -11943,9 +11964,12 @@
 
 class HTTPSCRLSetTest : public HTTPSOCSPTest {
  protected:
-  CertVerifier::Config GetCertVerifierConfig() override {
-    CertVerifier::Config config;
-    return config;
+  void SetupContext() override {
+    ssl_config_service_ = std::make_unique<TestSSLConfigService>(
+        false /* online revocation checking */,
+        false /* require rev. checking for local anchors */,
+        false /* token binding enabled */);
+    context_.set_ssl_config_service(ssl_config_service_.get());
   }
 
   void SetUp() override {

diff --git a/remoting/protocol/ssl_hmac_channel_authenticator.cc b/remoting/protocol/ssl_hmac_channel_authenticator.cc
index bf905eb8..e78926e5 100644
--- a/remoting/protocol/ssl_hmac_channel_authenticator.cc
+++ b/remoting/protocol/ssl_hmac_channel_authenticator.cc

@@ -93,7 +93,6 @@
     verify_result->cert_status = net::CERT_STATUS_INVALID;
     return net::ERR_CERT_INVALID;
   }
-  void SetConfig(const Config& config) override {}
 };
 
 // Implements net::StreamSocket interface on top of P2PStreamSocket to be passed
@@ -288,6 +287,11 @@
     ct_policy_enforcer_.reset(new net::DefaultCTPolicyEnforcer);
 
     net::SSLConfig ssl_config;
+    // Certificate verification and revocation checking are not needed
+    // because we use self-signed certs. Disable it so that the SSL
+    // layer doesn't try to initialize OCSP (OCSP works only on the IO
+    // thread).
+    ssl_config.rev_checking_enabled = false;
     ssl_config.require_ecdhe = true;
 
     scoped_refptr<net::X509Certificate> cert =

diff --git a/rlz/lib/financial_ping.cc b/rlz/lib/financial_ping.cc
index 3a0e2cb5..f170fcc 100644
--- a/rlz/lib/financial_ping.cc
+++ b/rlz/lib/financial_ping.cc

@@ -306,9 +306,8 @@
         })");
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GURL(url);
-  resource_request->load_flags =
-      net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SEND_AUTH_DATA |
-      net::LOAD_DO_NOT_SEND_COOKIES | net::LOAD_DO_NOT_SAVE_COOKIES;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->allow_credentials = false;
 
   auto url_loader = network::SimpleURLLoader::Create(
       std::move(resource_request), traffic_annotation);

diff --git a/services/network/BUILD.gn b/services/network/BUILD.gn
index bc00fb74..bbf55585 100644
--- a/services/network/BUILD.gn
+++ b/services/network/BUILD.gn

@@ -10,8 +10,6 @@
 
 component("network_service") {
   sources = [
-    "cert_verifier_config_type_converter.cc",
-    "cert_verifier_config_type_converter.h",
     "chunked_data_pipe_upload_data_stream.cc",
     "chunked_data_pipe_upload_data_stream.h",
     "conditional_cache_deletion_helper.cc",

diff --git a/services/network/cert_verifier_config_type_converter.cc b/services/network/cert_verifier_config_type_converter.cc
deleted file mode 100644
index bcbb045..0000000
--- a/services/network/cert_verifier_config_type_converter.cc
+++ /dev/null

@@ -1,26 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "services/network/cert_verifier_config_type_converter.h"
-
-namespace mojo {
-
-net::CertVerifier::Config
-TypeConverter<net::CertVerifier::Config, network::mojom::SSLConfigPtr>::Convert(
-    const network::mojom::SSLConfigPtr& mojo_config) {
-  DCHECK(mojo_config);
-
-  net::CertVerifier::Config net_config;
-  net_config.enable_rev_checking = mojo_config->rev_checking_enabled;
-  net_config.require_rev_checking_local_anchors =
-      mojo_config->rev_checking_required_local_anchors;
-  net_config.enable_sha1_local_anchors =
-      mojo_config->sha1_local_anchors_enabled;
-  net_config.disable_symantec_enforcement =
-      mojo_config->symantec_enforcement_disabled;
-
-  return net_config;
-}
-
-}  // namespace mojo

diff --git a/services/network/cert_verifier_config_type_converter.h b/services/network/cert_verifier_config_type_converter.h
deleted file mode 100644
index 5a05579..0000000
--- a/services/network/cert_verifier_config_type_converter.h
+++ /dev/null

@@ -1,24 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef SERVICES_NETWORK_CERT_VERIFIER_CONFIG_TYPE_CONVERTER_H_
-#define SERVICES_NETWORK_CERT_VERIFIER_CONFIG_TYPE_CONVERTER_H_
-
-#include "mojo/public/cpp/bindings/type_converter.h"
-#include "net/cert/cert_verifier.h"
-#include "services/network/public/mojom/ssl_config.mojom.h"
-
-namespace mojo {
-
-// Converts a network::mojom::SSLConfigPtr to a net::CertVerifier::Config.
-// Tested in SSLConfigServiceMojo's unittests.
-template <>
-struct TypeConverter<net::CertVerifier::Config, network::mojom::SSLConfigPtr> {
-  static net::CertVerifier::Config Convert(
-      const network::mojom::SSLConfigPtr& mojo_config);
-};
-
-}  // namespace mojo
-
-#endif  // SERVICES_NETWORK_CERT_VERIFIER_CONFIG_TYPE_CONVERTER_H_

diff --git a/services/network/expect_ct_reporter.cc b/services/network/expect_ct_reporter.cc
index 980582a..666f8e99 100644
--- a/services/network/expect_ct_reporter.cc
+++ b/services/network/expect_ct_reporter.cc

@@ -254,10 +254,8 @@
   std::unique_ptr<net::URLRequest> url_request =
       request_context_->CreateRequest(report_uri, net::DEFAULT_PRIORITY, this,
                                       kExpectCTReporterTrafficAnnotation);
-  url_request->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE |
-                            net::LOAD_DO_NOT_SEND_AUTH_DATA |
-                            net::LOAD_DO_NOT_SEND_COOKIES |
-                            net::LOAD_DO_NOT_SAVE_COOKIES);
+  url_request->SetLoadFlags(net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE);
+  url_request->set_allow_credentials(false);
   url_request->set_method("OPTIONS");
 
   net::HttpRequestHeaders extra_headers;

diff --git a/services/network/host_resolver.cc b/services/network/host_resolver.cc
index 8bbd2f7..23bb4a0 100644
--- a/services/network/host_resolver.cc
+++ b/services/network/host_resolver.cc

@@ -21,6 +21,20 @@
     resolve_host_callback;
 }
 
+namespace {
+base::Optional<net::HostResolver::ResolveHostParameters>
+ConvertOptionalParameters(
+    const mojom::ResolveHostParametersPtr& mojo_parameters) {
+  if (!mojo_parameters)
+    return base::nullopt;
+
+  net::HostResolver::ResolveHostParameters parameters;
+  parameters.dns_query_type = mojo_parameters->dns_query_type;
+  parameters.initial_priority = mojo_parameters->initial_priority;
+  return parameters;
+}
+}  // namespace
+
 HostResolver::HostResolver(
     mojom::HostResolverRequest resolver_request,
     ConnectionShutdownCallback connection_shutdown_callback,
@@ -45,18 +59,25 @@
     binding_.Close();
 }
 
-void HostResolver::ResolveHost(const net::HostPortPair& host,
-                               mojom::ResolveHostHandleRequest control_handle,
-                               mojom::ResolveHostClientPtr response_client) {
+void HostResolver::ResolveHost(
+    const net::HostPortPair& host,
+    mojom::ResolveHostParametersPtr optional_parameters,
+    mojom::ResolveHostClientPtr response_client) {
   if (resolve_host_callback.Get())
     resolve_host_callback.Get().Run(host.host());
-  auto request =
-      std::make_unique<ResolveHostRequest>(internal_resolver_, host, net_log_);
 
-  int rv =
-      request->Start(std::move(control_handle), std::move(response_client),
-                     base::BindOnce(&HostResolver::OnResolveHostComplete,
-                                    base::Unretained(this), request.get()));
+  auto request = std::make_unique<ResolveHostRequest>(
+      internal_resolver_, host, ConvertOptionalParameters(optional_parameters),
+      net_log_);
+
+  mojom::ResolveHostHandleRequest control_handle_request;
+  if (optional_parameters)
+    control_handle_request = std::move(optional_parameters->control_handle);
+
+  int rv = request->Start(
+      std::move(control_handle_request), std::move(response_client),
+      base::BindOnce(&HostResolver::OnResolveHostComplete,
+                     base::Unretained(this), request.get()));
   if (rv != net::ERR_IO_PENDING)
     return;
 

diff --git a/services/network/host_resolver.h b/services/network/host_resolver.h
index 7d4901a..fb4c00e7 100644
--- a/services/network/host_resolver.h
+++ b/services/network/host_resolver.h

@@ -45,7 +45,7 @@
   ~HostResolver() override;
 
   void ResolveHost(const net::HostPortPair& host,
-                   mojom::ResolveHostHandleRequest control_handle,
+                   mojom::ResolveHostParametersPtr optional_parameters,
                    mojom::ResolveHostClientPtr response_client) override;
 
   size_t GetNumOutstandingRequestsForTesting() const;

diff --git a/services/network/host_resolver_unittest.cc b/services/network/host_resolver_unittest.cc
index 48766d9..ea4a651 100644
--- a/services/network/host_resolver_unittest.cc
+++ b/services/network/host_resolver_unittest.cc

@@ -96,12 +96,15 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 160),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
   run_loop.Run();
 
@@ -109,6 +112,7 @@
   EXPECT_THAT(response_client.result_addresses().value().endpoints(),
               testing::ElementsAre(CreateExpectedEndPoint("127.0.0.1", 160)));
   EXPECT_EQ(0u, resolver.GetNumOutstandingRequestsForTesting());
+  EXPECT_EQ(net::DEFAULT_PRIORITY, inner_resolver->last_request_priority());
 }
 
 TEST_F(HostResolverTest, Async) {
@@ -119,12 +123,15 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 160),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
 
   bool control_handle_closed = false;
@@ -138,6 +145,57 @@
               testing::ElementsAre(CreateExpectedEndPoint("127.0.0.1", 160)));
   EXPECT_TRUE(control_handle_closed);
   EXPECT_EQ(0u, resolver.GetNumOutstandingRequestsForTesting());
+  EXPECT_EQ(net::DEFAULT_PRIORITY, inner_resolver->last_request_priority());
+}
+
+TEST_F(HostResolverTest, DnsQueryType) {
+  net::NetLog net_log;
+  std::unique_ptr<net::HostResolver> inner_resolver =
+      net::HostResolver::CreateDefaultResolver(&net_log);
+
+  HostResolver resolver(inner_resolver.get(), &net_log);
+
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->dns_query_type = net::HostResolver::DnsQueryType::AAAA;
+
+  base::RunLoop run_loop;
+  mojom::ResolveHostClientPtr response_client_ptr;
+  TestResolveHostClient response_client(&response_client_ptr, &run_loop);
+
+  resolver.ResolveHost(net::HostPortPair("localhost", 160),
+                       std::move(optional_parameters),
+                       std::move(response_client_ptr));
+  run_loop.Run();
+
+  EXPECT_EQ(net::OK, response_client.result_error());
+  EXPECT_THAT(response_client.result_addresses().value().endpoints(),
+              testing::ElementsAre(CreateExpectedEndPoint("::1", 160)));
+}
+
+TEST_F(HostResolverTest, InitialPriority) {
+  auto inner_resolver = std::make_unique<net::MockHostResolver>();
+  net::NetLog net_log;
+
+  HostResolver resolver(inner_resolver.get(), &net_log);
+
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->initial_priority = net::HIGHEST;
+
+  base::RunLoop run_loop;
+  mojom::ResolveHostClientPtr response_client_ptr;
+  TestResolveHostClient response_client(&response_client_ptr, &run_loop);
+
+  resolver.ResolveHost(net::HostPortPair("localhost", 80),
+                       std::move(optional_parameters),
+                       std::move(response_client_ptr));
+  run_loop.Run();
+
+  EXPECT_EQ(net::OK, response_client.result_error());
+  EXPECT_THAT(response_client.result_addresses().value().endpoints(),
+              testing::ElementsAre(CreateExpectedEndPoint("127.0.0.1", 80)));
+  EXPECT_EQ(net::HIGHEST, inner_resolver->last_request_priority());
 }
 
 TEST_F(HostResolverTest, Failure_Sync) {
@@ -149,12 +207,15 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("example.com", 160),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
   run_loop.Run();
 
@@ -172,12 +233,15 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("example.com", 160),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
 
   bool control_handle_closed = false;
@@ -192,7 +256,7 @@
   EXPECT_EQ(0u, resolver.GetNumOutstandingRequestsForTesting());
 }
 
-TEST_F(HostResolverTest, NoControlHandle) {
+TEST_F(HostResolverTest, NoOptionalParameters) {
   net::NetLog net_log;
   std::unique_ptr<net::HostResolver> inner_resolver =
       net::HostResolver::CreateDefaultResolver(&net_log);
@@ -217,6 +281,34 @@
   EXPECT_EQ(0u, resolver.GetNumOutstandingRequestsForTesting());
 }
 
+TEST_F(HostResolverTest, NoControlHandle) {
+  net::NetLog net_log;
+  std::unique_ptr<net::HostResolver> inner_resolver =
+      net::HostResolver::CreateDefaultResolver(&net_log);
+
+  HostResolver resolver(inner_resolver.get(), &net_log);
+
+  base::RunLoop run_loop;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  mojom::ResolveHostClientPtr response_client_ptr;
+  TestResolveHostClient response_client(&response_client_ptr, &run_loop);
+
+  // Resolve "localhost" because it should always resolve fast and locally, even
+  // when using a real HostResolver.
+  resolver.ResolveHost(net::HostPortPair("localhost", 80),
+                       std::move(optional_parameters),
+                       std::move(response_client_ptr));
+  run_loop.Run();
+
+  EXPECT_EQ(net::OK, response_client.result_error());
+  EXPECT_THAT(
+      response_client.result_addresses().value().endpoints(),
+      testing::UnorderedElementsAre(CreateExpectedEndPoint("127.0.0.1", 80),
+                                    CreateExpectedEndPoint("::1", 80)));
+  EXPECT_EQ(0u, resolver.GetNumOutstandingRequestsForTesting());
+}
+
 TEST_F(HostResolverTest, CloseControlHandle) {
   net::NetLog net_log;
   std::unique_ptr<net::HostResolver> inner_resolver =
@@ -225,14 +317,17 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
   // Resolve "localhost" because it should always resolve fast and locally, even
   // when using a real HostResolver.
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 160),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
   control_handle = nullptr;
   run_loop.Run();
@@ -256,12 +351,15 @@
   ASSERT_EQ(0, inner_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 80),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -288,12 +386,15 @@
   HostResolver resolver(inner_resolver.get(), &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, nullptr);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 80),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
 
   control_handle->Cancel(net::ERR_ABORTED);
@@ -333,12 +434,15 @@
   ASSERT_EQ(0, inner_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver->ResolveHost(net::HostPortPair("localhost", 80),
-                        mojo::MakeRequest(&control_handle),
+                        std::move(optional_parameters),
                         std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -367,12 +471,15 @@
   ASSERT_EQ(0, inner_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 80),
-                       mojo::MakeRequest(&control_handle),
+                       std::move(optional_parameters),
                        std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -401,7 +508,6 @@
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, nullptr);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver.ResolveHost(net::HostPortPair("localhost", 80), nullptr,
                        std::move(response_client_ptr));
 
@@ -446,13 +552,17 @@
                         &net_log);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
+
   // Resolve "localhost" because it should always resolve fast and locally, even
   // when using a real HostResolver.
-  mojom::ResolveHostHandlePtr control_handle;
   resolver_ptr->ResolveHost(net::HostPortPair("localhost", 160),
-                            mojo::MakeRequest(&control_handle),
+                            std::move(optional_parameters),
                             std::move(response_client_ptr));
   run_loop.Run();
 
@@ -484,11 +594,14 @@
   ASSERT_EQ(0, inner_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
-  mojom::ResolveHostHandlePtr control_handle;
   resolver_ptr->ResolveHost(net::HostPortPair("localhost", 160),
-                            mojo::MakeRequest(&control_handle),
+                            std::move(optional_parameters),
                             std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =

diff --git a/services/network/ignore_errors_cert_verifier.cc b/services/network/ignore_errors_cert_verifier.cc
index 0df80e72..b6a67488 100644
--- a/services/network/ignore_errors_cert_verifier.cc
+++ b/services/network/ignore_errors_cert_verifier.cc

@@ -133,10 +133,6 @@
                            out_req, net_log);
 }
 
-void IgnoreErrorsCertVerifier::SetConfig(const Config& config) {
-  verifier_->SetConfig(config);
-}
-
 void IgnoreErrorsCertVerifier::set_whitelist(const SPKIHashSet& whitelist) {
   whitelist_ = whitelist;
 }

diff --git a/services/network/ignore_errors_cert_verifier.h b/services/network/ignore_errors_cert_verifier.h
index ad895ec..ce0984c 100644
--- a/services/network/ignore_errors_cert_verifier.h
+++ b/services/network/ignore_errors_cert_verifier.h

@@ -64,7 +64,6 @@
              net::CompletionOnceCallback callback,
              std::unique_ptr<Request>* out_req,
              const net::NetLogWithSource& net_log) override;
-  void SetConfig(const Config& config) override;
 
  private:
   friend class IgnoreErrorsCertVerifierTest;

diff --git a/services/network/network_context.cc b/services/network/network_context.cc
index 5ef646cf..9350af9f 100644
--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc

@@ -139,11 +139,6 @@
     return g_cert_verifier_for_testing->Verify(
         params, crl_set, verify_result, std::move(callback), out_req, net_log);
   }
-  void SetConfig(const Config& config) override {
-    if (!g_cert_verifier_for_testing)
-      return;
-    g_cert_verifier_for_testing->SetConfig(config);
-  }
 };
 
 // Predicate function to determine if the given |domain| matches the
@@ -813,15 +808,16 @@
                                         std::move(request));
 }
 
-void NetworkContext::ResolveHost(const net::HostPortPair& host,
-                                 mojom::ResolveHostHandleRequest control_handle,
-                                 mojom::ResolveHostClientPtr response_client) {
+void NetworkContext::ResolveHost(
+    const net::HostPortPair& host,
+    mojom::ResolveHostParametersPtr optional_parameters,
+    mojom::ResolveHostClientPtr response_client) {
   if (!internal_host_resolver_) {
     internal_host_resolver_ = std::make_unique<HostResolver>(
         url_request_context_->host_resolver(), network_service_->net_log());
   }
 
-  internal_host_resolver_->ResolveHost(host, std::move(control_handle),
+  internal_host_resolver_->ResolveHost(host, std::move(optional_parameters),
                                        std::move(response_client));
 }
 
@@ -1021,12 +1017,9 @@
     builder->EnableHttpCache(cache_params);
   }
 
-  std::unique_ptr<SSLConfigServiceMojo> ssl_config_service =
-      std::make_unique<SSLConfigServiceMojo>(
-          std::move(params_->initial_ssl_config),
-          std::move(params_->ssl_config_client_request));
-  SSLConfigServiceMojo* ssl_config_service_raw = ssl_config_service.get();
-  builder->set_ssl_config_service(std::move(ssl_config_service));
+  builder->set_ssl_config_service(std::make_unique<SSLConfigServiceMojo>(
+      std::move(params_->initial_ssl_config),
+      std::move(params_->ssl_config_client_request)));
 
   if (!params_->initial_proxy_config &&
       !params_->proxy_config_client_request.is_pending()) {
@@ -1160,12 +1153,6 @@
   auto result =
       URLRequestContextOwner(std::move(pref_service), builder->Build());
 
-  // Subscribe the CertVerifier to configuration changes that are exposed via
-  // the mojom::SSLConfig, but which are not part of the
-  // net::SSLConfig[Service] interfaces.
-  ssl_config_service_raw->SetCertVerifierForConfiguring(
-      result.url_request_context->cert_verifier());
-
   // Attach some things to the URLRequestContextBuilder's
   // TransportSecurityState.  Since no requests have been made yet, safe to do
   // this even after the call to Build().

diff --git a/services/network/network_context.h b/services/network/network_context.h
index d79690e..6525515 100644
--- a/services/network/network_context.h
+++ b/services/network/network_context.h

@@ -208,7 +208,7 @@
       mojom::ProxyLookupClientPtr proxy_lookup_client) override;
   void CreateNetLogExporter(mojom::NetLogExporterRequest request) override;
   void ResolveHost(const net::HostPortPair& host,
-                   mojom::ResolveHostHandleRequest control_handle,
+                   mojom::ResolveHostParametersPtr optional_parameters,
                    mojom::ResolveHostClientPtr response_client) override;
   void CreateHostResolver(mojom::HostResolverRequest request) override;
   void AddHSTSForTesting(const std::string& host,

diff --git a/services/network/network_context_unittest.cc b/services/network/network_context_unittest.cc
index ae04f85..1b821c1 100644
--- a/services/network/network_context_unittest.cc
+++ b/services/network/network_context_unittest.cc

@@ -2620,12 +2620,15 @@
   resolver->set_synchronous_mode(true);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 160),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   run_loop.Run();
 
@@ -2646,12 +2649,15 @@
   resolver->set_synchronous_mode(false);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 160),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
 
   bool control_handle_closed = false;
@@ -2679,12 +2685,15 @@
   resolver->set_synchronous_mode(true);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("example.com", 160),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   run_loop.Run();
 
@@ -2704,12 +2713,15 @@
   resolver->set_synchronous_mode(false);
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("example.com", 160),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
 
   bool control_handle_closed = false;
@@ -2753,14 +2765,17 @@
       CreateContextWithParams(CreateContextParams());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
   // Resolve "localhost" because it should always resolve fast and locally, even
   // when using a real HostResolver.
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 160),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   control_handle = nullptr;
   run_loop.Run();
@@ -2786,12 +2801,15 @@
   ASSERT_EQ(0, resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 80),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -2823,12 +2841,15 @@
   ASSERT_EQ(0, resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 80),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -2858,12 +2879,15 @@
   ASSERT_EQ(0, resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   network_context->ResolveHost(net::HostPortPair("localhost", 80),
-                               mojo::MakeRequest(&control_handle),
+                               std::move(optional_parameters),
                                std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -2922,12 +2946,15 @@
   ASSERT_EQ(0, internal_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver->ResolveHost(net::HostPortPair("localhost", 80),
-                        mojo::MakeRequest(&control_handle),
+                        std::move(optional_parameters),
                         std::move(response_client_ptr));
   bool control_handle_closed = false;
   auto connection_error_callback =
@@ -2961,12 +2988,15 @@
   ASSERT_EQ(0, internal_resolver->num_cancellations());
 
   base::RunLoop run_loop;
+  mojom::ResolveHostHandlePtr control_handle;
+  mojom::ResolveHostParametersPtr optional_parameters =
+      mojom::ResolveHostParameters::New();
+  optional_parameters->control_handle = mojo::MakeRequest(&control_handle);
   mojom::ResolveHostClientPtr response_client_ptr;
   TestResolveHostClient response_client(&response_client_ptr, &run_loop);
 
-  mojom::ResolveHostHandlePtr control_handle;
   resolver->ResolveHost(net::HostPortPair("localhost", 80),
-                        mojo::MakeRequest(&control_handle),
+                        std::move(optional_parameters),
                         std::move(response_client_ptr));
   // Run a bit to ensure the resolve request makes it to the resolver. Otherwise
   // the resolver will be destroyed and close its pipe before it even knows

diff --git a/services/network/public/cpp/host_resolver.typemap b/services/network/public/cpp/host_resolver.typemap
new file mode 100644
index 0000000..14f2edb0
--- /dev/null
+++ b/services/network/public/cpp/host_resolver.typemap

@@ -0,0 +1,15 @@
+# Copyright 2018 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.

+
+mojom = "//services/network/public/mojom/host_resolver.mojom"
+public_headers = [ "//net/dns/host_resolver.h" ]
+traits_headers =
+    [ "//services/network/public/cpp/host_resolver_mojom_traits.h" ]
+sources = [
+  "//services/network/public/cpp/host_resolver_mojom_traits.cc",
+]
+public_deps = [
+  "//net",
+]
+type_mappings = [ "network.mojom.ResolveHostParameters.DnsQueryType=net::HostResolver::DnsQueryType" ]

diff --git a/services/network/public/cpp/host_resolver_mojom_traits.cc b/services/network/public/cpp/host_resolver_mojom_traits.cc
new file mode 100644
index 0000000..d8085bc
--- /dev/null
+++ b/services/network/public/cpp/host_resolver_mojom_traits.cc

@@ -0,0 +1,44 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/network/public/cpp/host_resolver_mojom_traits.h"
+
+namespace mojo {
+
+using network::mojom::ResolveHostParameters;
+
+// static
+ResolveHostParameters::DnsQueryType EnumTraits<
+    ResolveHostParameters::DnsQueryType,
+    net::HostResolver::DnsQueryType>::ToMojom(net::HostResolver::DnsQueryType
+                                                  input) {
+  switch (input) {
+    case net::HostResolver::DnsQueryType::UNSPECIFIED:
+      return ResolveHostParameters::DnsQueryType::UNSPECIFIED;
+    case net::HostResolver::DnsQueryType::A:
+      return ResolveHostParameters::DnsQueryType::A;
+    case net::HostResolver::DnsQueryType::AAAA:
+      return ResolveHostParameters::DnsQueryType::AAAA;
+  }
+}
+
+// static
+bool EnumTraits<ResolveHostParameters::DnsQueryType,
+                net::HostResolver::DnsQueryType>::
+    FromMojom(ResolveHostParameters::DnsQueryType input,
+              net::HostResolver::DnsQueryType* output) {
+  switch (input) {
+    case ResolveHostParameters::DnsQueryType::UNSPECIFIED:
+      *output = net::HostResolver::DnsQueryType::UNSPECIFIED;
+      return true;
+    case ResolveHostParameters::DnsQueryType::A:
+      *output = net::HostResolver::DnsQueryType::A;
+      return true;
+    case ResolveHostParameters::DnsQueryType::AAAA:
+      *output = net::HostResolver::DnsQueryType::AAAA;
+      return true;
+  }
+}
+
+}  // namespace mojo

diff --git a/services/network/public/cpp/host_resolver_mojom_traits.h b/services/network/public/cpp/host_resolver_mojom_traits.h
new file mode 100644
index 0000000..c0daabd
--- /dev/null
+++ b/services/network/public/cpp/host_resolver_mojom_traits.h

@@ -0,0 +1,26 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_HOST_RESOLVER_MOJOM_TRAITS_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_HOST_RESOLVER_MOJOM_TRAITS_H_
+
+#include "mojo/public/cpp/bindings/enum_traits.h"
+#include "net/dns/host_resolver.h"
+#include "services/network/public/mojom/host_resolver.mojom.h"
+
+namespace mojo {
+
+template <>
+struct EnumTraits<network::mojom::ResolveHostParameters::DnsQueryType,
+                  net::HostResolver::DnsQueryType> {
+  static network::mojom::ResolveHostParameters::DnsQueryType ToMojom(
+      net::HostResolver::DnsQueryType input);
+  static bool FromMojom(
+      network::mojom::ResolveHostParameters::DnsQueryType input,
+      net::HostResolver::DnsQueryType* output);
+};
+
+}  // namespace mojo
+
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_HOST_RESOLVER_MOJOM_TRAITS_H_

diff --git a/services/network/public/cpp/network_ipc_param_traits.h b/services/network/public/cpp/network_ipc_param_traits.h
index 76ecabe..7ff5eaf3b 100644
--- a/services/network/public/cpp/network_ipc_param_traits.h
+++ b/services/network/public/cpp/network_ipc_param_traits.h

@@ -136,6 +136,7 @@
   IPC_STRUCT_TRAITS_MEMBER(is_prerendering)
   IPC_STRUCT_TRAITS_MEMBER(headers)
   IPC_STRUCT_TRAITS_MEMBER(load_flags)
+  IPC_STRUCT_TRAITS_MEMBER(allow_credentials)
   IPC_STRUCT_TRAITS_MEMBER(plugin_child_id)
   IPC_STRUCT_TRAITS_MEMBER(resource_type)
   IPC_STRUCT_TRAITS_MEMBER(priority)

diff --git a/services/network/public/cpp/resource_request.h b/services/network/public/cpp/resource_request.h
index e29eee8..506d4b4 100644
--- a/services/network/public/cpp/resource_request.h
+++ b/services/network/public/cpp/resource_request.h

@@ -73,6 +73,10 @@
   // net::URLRequest load flags (0 by default).
   int load_flags = 0;
 
+  // If false, calls set_allow_credentials(false) on the
+  // net::URLRequest.
+  bool allow_credentials = true;
+
   // If this request originated from a pepper plugin running in a child
   // process, this identifies which process it came from. Otherwise, it
   // is zero.

diff --git a/services/network/public/cpp/typemaps.gni b/services/network/public/cpp/typemaps.gni
index a7dcbf85..be61d94 100644
--- a/services/network/public/cpp/typemaps.gni
+++ b/services/network/public/cpp/typemaps.gni

@@ -7,6 +7,7 @@
   "//services/network/public/cpp/cors_error_status.typemap",
   "//services/network/public/cpp/digitally_signed.typemap",
   "//services/network/public/cpp/http_request_headers.typemap",
+  "//services/network/public/cpp/host_resolver.typemap",
   "//services/network/public/cpp/mutable_network_traffic_annotation_tag.typemap",
   "//services/network/public/cpp/mutable_partial_network_traffic_annotation_tag.typemap",
   "//services/network/public/cpp/network_param.typemap",

diff --git a/services/network/public/mojom/host_resolver.mojom b/services/network/public/mojom/host_resolver.mojom
index e059a41..8fd8674 100644
--- a/services/network/public/mojom/host_resolver.mojom
+++ b/services/network/public/mojom/host_resolver.mojom

@@ -6,6 +6,7 @@
 

 import "net/interfaces/address_list.mojom";

 import "services/network/public/mojom/network_param.mojom";

+import "services/network/public/mojom/url_loader.mojom";

 

 // Control handle used to control outstanding NetworkContext::ResolveHost
 // requests. Handle is optional for all requests, and may be closed at any time
@@ -31,6 +32,31 @@
   OnComplete(int32 result, net.interfaces.AddressList? resolved_addresses);
 };
 
+// Parameter-grouping struct for additional optional parameters for
+// HostResolver::CreateRequest() calls. All fields are optional and have a
+// reasonable default.
+struct ResolveHostParameters {
+  // DNS query type for a ResolveHostRequest.
+  // See:
+  // https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4
+  enum DnsQueryType {

+    UNSPECIFIED,

+    A,

+    AAAA,

+  };

+

+  // Requested DNS query type. If UNSPECIFIED, resolver will pick A or AAAA (or

+  // both) based on IPv4/IPv6 settings.

+  DnsQueryType dns_query_type = DnsQueryType.UNSPECIFIED;

+
+  // The initial net priority for the host resolution request.
+  RequestPriority initial_priority = RequestPriority.kLowest;
+
+  // If set, the outstanding request can be controlled, eg cancelled, via the
+  // handle.
+  ResolveHostHandle&? control_handle;
+};
+
 // Interface that can be passed to code/processes without direct access to
 // NetworkContext to make ResolveHost requests. If destroyed, all outstanding
 // ResolveHost requests from the destroyed interface will be cancelled.
@@ -39,12 +65,14 @@
   // error code, and on success (network error code OK), an AddressList. All
   // results are sent via the passed |response_client|.
   //
+  // Additional optional parameters may be set using |optional_parameters|. If
+  // unset, reasonable defaults will be used, equivalent to using a
+  // ResolveHostParameters struct without changing any fields from their default
+  // values.
+  //
   // Results in ERR_NAME_NOT_RESOLVED if hostname is invalid, or if it is an
   // incompatible IP literal (e.g. IPv6 is disabled and it is an IPv6 literal).
   //
-  // If passed an optional |control_handle|, the outstanding request can be
-  // controlled, eg cancelled, via the handle.
-  //
   // All outstanding requests are cancelled if the HostResolver or parent
   // NetworkContext are destroyed. Such requests will receive ERR_FAILED via
   // |response_client|.
@@ -52,6 +80,6 @@
   // TODO(crbug.com/821021): Implement more complex functionality to meet full
   // capabilities of Resolve() and DnsClient/MDnsClient functionality.
   ResolveHost(HostPortPair host,

-              ResolveHostHandle&? control_handle,

+              ResolveHostParameters? optional_parameters,

               ResolveHostClient response_client);
 };

diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
index 5694efe..08885dfb 100644
--- a/services/network/public/mojom/network_context.mojom
+++ b/services/network/public/mojom/network_context.mojom

@@ -555,7 +555,7 @@
   // through CreateHostResolver, but most likely most usage except proxy
   // resolver will directly use this method.
   ResolveHost(HostPortPair host,

-              ResolveHostHandle&? control_handle,

+              ResolveHostParameters? optional_parameters,

               ResolveHostClient response_client);

 

   // Creates a HostResolver interface that can be passed to code/processes


diff --git a/services/network/resolve_host_request.cc b/services/network/resolve_host_request.cc
index eb4e055..6baf554 100644
--- a/services/network/resolve_host_request.cc
+++ b/services/network/resolve_host_request.cc

@@ -15,15 +15,18 @@
 
 namespace network {
 
-ResolveHostRequest::ResolveHostRequest(net::HostResolver* resolver,
-                                       const net::HostPortPair& host,
-                                       net::NetLog* net_log) {
+ResolveHostRequest::ResolveHostRequest(
+    net::HostResolver* resolver,
+    const net::HostPortPair& host,
+    const base::Optional<net::HostResolver::ResolveHostParameters>&
+        optional_parameters,
+    net::NetLog* net_log) {
   DCHECK(resolver);
   DCHECK(net_log);
 
   internal_request_ = resolver->CreateRequest(
       host, net::NetLogWithSource::Make(net_log, net::NetLogSourceType::NONE),
-      base::nullopt);
+      optional_parameters);
 }
 
 ResolveHostRequest::~ResolveHostRequest() {

diff --git a/services/network/resolve_host_request.h b/services/network/resolve_host_request.h
index 24bbef5e..8ee3d2d3 100644
--- a/services/network/resolve_host_request.h
+++ b/services/network/resolve_host_request.h

@@ -26,9 +26,12 @@
 // lifetime and cancellation.
 class ResolveHostRequest : public mojom::ResolveHostHandle {
  public:
-  ResolveHostRequest(net::HostResolver* resolver,
-                     const net::HostPortPair& host,
-                     net::NetLog* net_log);
+  ResolveHostRequest(
+      net::HostResolver* resolver,
+      const net::HostPortPair& host,
+      const base::Optional<net::HostResolver::ResolveHostParameters>&
+          optional_parameters,
+      net::NetLog* net_log);
   ~ResolveHostRequest() override;
 
   int Start(mojom::ResolveHostHandleRequest control_handle_request,

diff --git a/services/network/ssl_config_service_mojo.cc b/services/network/ssl_config_service_mojo.cc
index 4fa16e5..36c6512 100644
--- a/services/network/ssl_config_service_mojo.cc
+++ b/services/network/ssl_config_service_mojo.cc

@@ -6,7 +6,6 @@
 
 #include "base/strings/string_piece.h"
 #include "mojo/public/cpp/bindings/type_converter.h"
-#include "services/network/cert_verifier_config_type_converter.h"
 #include "services/network/ssl_config_type_converter.h"
 
 namespace network {
@@ -35,44 +34,25 @@
     mojom::SSLConfigPtr initial_config,
     mojom::SSLConfigClientRequest ssl_config_client_request)
     : binding_(this),
-
       client_cert_pooling_policy_(
           initial_config ? initial_config->client_cert_pooling_policy
                          : std::vector<std::string>()) {
-  if (initial_config) {
-    cert_verifier_config_ =
-        mojo::ConvertTo<net::CertVerifier::Config>(initial_config->Clone());
+  if (initial_config)
     ssl_config_ = mojo::ConvertTo<net::SSLConfig>(std::move(initial_config));
-  }
   if (ssl_config_client_request)
     binding_.Bind(std::move(ssl_config_client_request));
 }
 
 SSLConfigServiceMojo::~SSLConfigServiceMojo() = default;
 
-void SSLConfigServiceMojo::SetCertVerifierForConfiguring(
-    net::CertVerifier* cert_verifier) {
-  cert_verifier_ = cert_verifier;
-  if (cert_verifier_) {
-    cert_verifier_->SetConfig(cert_verifier_config_);
-  }
-}
-
 void SSLConfigServiceMojo::OnSSLConfigUpdated(mojom::SSLConfigPtr ssl_config) {
   bool force_notification =
       client_cert_pooling_policy_ != ssl_config->client_cert_pooling_policy;
   client_cert_pooling_policy_ = ssl_config->client_cert_pooling_policy;
 
   net::SSLConfig old_config = ssl_config_;
-  ssl_config_ = mojo::ConvertTo<net::SSLConfig>(ssl_config->Clone());
+  ssl_config_ = mojo::ConvertTo<net::SSLConfig>(std::move(ssl_config));
   ProcessConfigUpdate(old_config, ssl_config_, force_notification);
-
-  net::CertVerifier::Config old_cert_verifier_config = cert_verifier_config_;
-  cert_verifier_config_ =
-      mojo::ConvertTo<net::CertVerifier::Config>(std::move(ssl_config));
-  if (cert_verifier_ && (old_cert_verifier_config != cert_verifier_config_)) {
-    cert_verifier_->SetConfig(cert_verifier_config_);
-  }
 }
 
 void SSLConfigServiceMojo::GetSSLConfig(net::SSLConfig* ssl_config) {

diff --git a/services/network/ssl_config_service_mojo.h b/services/network/ssl_config_service_mojo.h
index 8fee4bd..28bd7dc 100644
--- a/services/network/ssl_config_service_mojo.h
+++ b/services/network/ssl_config_service_mojo.h

@@ -7,7 +7,6 @@
 
 #include "base/component_export.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "net/cert/cert_verifier.h"
 #include "net/ssl/ssl_config.h"
 #include "net/ssl/ssl_config_service.h"
 #include "services/network/public/mojom/ssl_config.mojom.h"
@@ -26,12 +25,6 @@
                        mojom::SSLConfigClientRequest ssl_config_client_request);
   ~SSLConfigServiceMojo() override;
 
-  // Sets |cert_verifier| to be configured by certificate-related settings
-  // provided by the mojom::SSLConfigClient via OnSSLConfigUpdated. Once set,
-  // |cert_verifier| must outlive the SSLConfigServiceMojo or be cleared by
-  // passing nullptr as |cert_verifier| prior to destruction.
-  void SetCertVerifierForConfiguring(net::CertVerifier* cert_verifier);
-
   // mojom::SSLConfigClient implementation:
   void OnSSLConfigUpdated(const mojom::SSLConfigPtr ssl_config) override;
 
@@ -44,9 +37,6 @@
   mojo::Binding<mojom::SSLConfigClient> binding_;
 
   net::SSLConfig ssl_config_;
-  net::CertVerifier::Config cert_verifier_config_;
-
-  net::CertVerifier* cert_verifier_;
 
   // The list of domains and subdomains from enterprise policy where connection
   // coalescing is allowed when client certs are in use if the hosts being

diff --git a/services/network/ssl_config_service_mojo_unittest.cc b/services/network/ssl_config_service_mojo_unittest.cc
index 5e8a2e8..1bd8f08 100644
--- a/services/network/ssl_config_service_mojo_unittest.cc
+++ b/services/network/ssl_config_service_mojo_unittest.cc

@@ -8,7 +8,6 @@
 #include "base/stl_util.h"
 #include "base/test/scoped_task_environment.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
-#include "net/cert/cert_verifier.h"
 #include "net/ssl/ssl_config.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/url_request/url_request_context.h"
@@ -16,7 +15,6 @@
 #include "services/network/network_service.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/ssl_config.mojom.h"
-#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace network {
@@ -74,69 +72,12 @@
   std::unique_ptr<base::RunLoop> run_loop_;
 };
 
-class TestCertVerifierConfigObserver : public net::CertVerifier {
- public:
-  TestCertVerifierConfigObserver() = default;
-  ~TestCertVerifierConfigObserver() override {
-    EXPECT_EQ(observed_changes_, changes_to_wait_for_);
-  }
-
-  // CertVerifier implementation:
-  int Verify(const net::CertVerifier::RequestParams& params,
-             net::CRLSet* crl_set,
-             net::CertVerifyResult* verify_result,
-             net::CompletionOnceCallback callback,
-             std::unique_ptr<net::CertVerifier::Request>* out_req,
-             const net::NetLogWithSource& net_log) override {
-    ADD_FAILURE() << "Verify should not be called by tests";
-    return net::ERR_FAILED;
-  }
-  void SetConfig(const Config& config) override {
-    ++observed_changes_;
-    verifier_config_during_change_ = config;
-    if (run_loop_)
-      run_loop_->Quit();
-  }
-
-  // Waits for a SSLConfig change. The first time it's called, waits for the
-  // first change, if one hasn't been observed already, the second time, waits
-  // for the second, etc. Must be called once for each change that happens, and
-  // fails it more than once change happens between calls, or during a call.
-  void WaitForChange() {
-    EXPECT_FALSE(run_loop_);
-    ++changes_to_wait_for_;
-    if (changes_to_wait_for_ == observed_changes_)
-      return;
-    EXPECT_LT(observed_changes_, changes_to_wait_for_);
-
-    run_loop_ = std::make_unique<base::RunLoop>();
-    run_loop_->Run();
-    run_loop_.reset();
-    EXPECT_EQ(observed_changes_, changes_to_wait_for_);
-  }
-
-  const net::CertVerifier::Config& verifier_config_during_change() const {
-    return verifier_config_during_change_;
-  }
-
-  int observed_changes() const { return observed_changes_; }
-
- private:
-  int observed_changes_ = 0;
-  int changes_to_wait_for_ = 0;
-  net::CertVerifier::Config verifier_config_during_change_;
-  std::unique_ptr<base::RunLoop> run_loop_;
-};
-
 class NetworkServiceSSLConfigServiceTest : public testing::Test {
  public:
   NetworkServiceSSLConfigServiceTest()
       : scoped_task_environment_(
             base::test::ScopedTaskEnvironment::MainThreadType::IO),
         network_service_(NetworkService::CreateForTesting()) {}
-  ~NetworkServiceSSLConfigServiceTest() override {
-    NetworkContext::SetCertVerifierForTesting(nullptr);
-  }
 
   // Creates a NetworkContext using the specified NetworkContextParams, and
   // stores it in |network_context_|.
@@ -202,49 +143,6 @@
         observer.ssl_config_during_change(), expected_net_config));
   }
 
-  // Runs two conversion tests for |mojo_config|.  Uses it as an initial
-  // net::CertVerifier::Config for a NetworkContext, making sure it matches
-  // |expected_net_config|. Then switches to the default configuration and then
-  // back to |mojo_config|, to make sure it works as a new configuration. The
-  // expected configuration must not be the default configuration.
-  void RunCertConversionTests(
-      const mojom::SSLConfig& mojo_config,
-      const net::CertVerifier::Config& expected_net_config) {
-    TestCertVerifierConfigObserver observer;
-    NetworkContext::SetCertVerifierForTesting(&observer);
-
-    EXPECT_NE(net::CertVerifier::Config(), expected_net_config);
-
-    // Set up |mojo_config| as the initial configuration of a NetworkContext.
-    mojom::NetworkContextParamsPtr network_context_params =
-        mojom::NetworkContextParams::New();
-    network_context_params->initial_ssl_config = mojo_config.Clone();
-    SetUpNetworkContext(std::move(network_context_params));
-
-    // Make sure the initial configuration is set.
-    observer.WaitForChange();
-    EXPECT_EQ(observer.verifier_config_during_change(), expected_net_config);
-    // Sanity check.
-    EXPECT_NE(observer.verifier_config_during_change(),
-              net::CertVerifier::Config());
-
-    // Reset the configuration to the default ones, and check the results.
-    ssl_config_client_->OnSSLConfigUpdated(mojom::SSLConfig::New());
-    observer.WaitForChange();
-    EXPECT_EQ(observer.verifier_config_during_change(),
-              net::CertVerifier::Config());
-    // Sanity check.
-    EXPECT_NE(observer.verifier_config_during_change(), expected_net_config);
-
-    // Set the configuration to |mojo_config| again, and check the results.
-    ssl_config_client_->OnSSLConfigUpdated(mojo_config.Clone());
-    observer.WaitForChange();
-    EXPECT_EQ(observer.verifier_config_during_change(), expected_net_config);
-
-    // Reset the CertVerifier for subsequent invocations.
-    NetworkContext::SetCertVerifierForTesting(nullptr);
-  }
-
  protected:
   base::test::ScopedTaskEnvironment scoped_task_environment_;
   std::unique_ptr<NetworkService> network_service_;
@@ -282,75 +180,56 @@
   EXPECT_EQ(net::kDefaultTLS13Variant, GetSSLConfig().tls13_variant);
 }
 
-// Check that passing in the default mojom::SSLConfig matches the default
-// net::CertVerifier::Config.
-TEST_F(NetworkServiceSSLConfigServiceTest, DefaultCertConfig) {
-  TestCertVerifierConfigObserver observer;
-  NetworkContext::SetCertVerifierForTesting(&observer);
-
-  mojom::NetworkContextParamsPtr network_context_params =
-      mojom::NetworkContextParams::New();
-  network_context_params->initial_ssl_config = mojom::SSLConfig::New();
-  SetUpNetworkContext(std::move(network_context_params));
-
-  observer.WaitForChange();
-
-  net::CertVerifier::Config default_config;
-  EXPECT_EQ(observer.verifier_config_during_change(), default_config);
-
-  NetworkContext::SetCertVerifierForTesting(nullptr);
-}
-
 TEST_F(NetworkServiceSSLConfigServiceTest, RevCheckingEnabled) {
-  net::CertVerifier::Config expected_net_config;
+  net::SSLConfig expected_net_config;
   // Use the opposite of the default value.
-  expected_net_config.enable_rev_checking =
-      !expected_net_config.enable_rev_checking;
+  expected_net_config.rev_checking_enabled =
+      !expected_net_config.rev_checking_enabled;
 
   mojom::SSLConfigPtr mojo_config = mojom::SSLConfig::New();
-  mojo_config->rev_checking_enabled = expected_net_config.enable_rev_checking;
+  mojo_config->rev_checking_enabled = expected_net_config.rev_checking_enabled;
 
-  RunCertConversionTests(*mojo_config, expected_net_config);
+  RunConversionTests(*mojo_config, expected_net_config);
 }
 
 TEST_F(NetworkServiceSSLConfigServiceTest,
        RevCheckingRequiredLocalTrustAnchors) {
-  net::CertVerifier::Config expected_net_config;
+  net::SSLConfig expected_net_config;
   // Use the opposite of the default value.
-  expected_net_config.require_rev_checking_local_anchors =
-      !expected_net_config.require_rev_checking_local_anchors;
+  expected_net_config.rev_checking_required_local_anchors =
+      !expected_net_config.rev_checking_required_local_anchors;
 
   mojom::SSLConfigPtr mojo_config = mojom::SSLConfig::New();
   mojo_config->rev_checking_required_local_anchors =
-      expected_net_config.require_rev_checking_local_anchors;
+      expected_net_config.rev_checking_required_local_anchors;
 
-  RunCertConversionTests(*mojo_config, expected_net_config);
+  RunConversionTests(*mojo_config, expected_net_config);
 }
 
 TEST_F(NetworkServiceSSLConfigServiceTest, Sha1LocalAnchorsEnabled) {
-  net::CertVerifier::Config expected_net_config;
+  net::SSLConfig expected_net_config;
   // Use the opposite of the default value.
-  expected_net_config.enable_sha1_local_anchors =
-      !expected_net_config.enable_sha1_local_anchors;
+  expected_net_config.sha1_local_anchors_enabled =
+      !expected_net_config.sha1_local_anchors_enabled;
 
   mojom::SSLConfigPtr mojo_config = mojom::SSLConfig::New();
   mojo_config->sha1_local_anchors_enabled =
-      expected_net_config.enable_sha1_local_anchors;
+      expected_net_config.sha1_local_anchors_enabled;
 
-  RunCertConversionTests(*mojo_config, expected_net_config);
+  RunConversionTests(*mojo_config, expected_net_config);
 }
 
 TEST_F(NetworkServiceSSLConfigServiceTest, SymantecEnforcementDisabled) {
-  net::CertVerifier::Config expected_net_config;
+  net::SSLConfig expected_net_config;
   // Use the opposite of the default value.
-  expected_net_config.disable_symantec_enforcement =
-      !expected_net_config.disable_symantec_enforcement;
+  expected_net_config.symantec_enforcement_disabled =
+      !expected_net_config.symantec_enforcement_disabled;
 
   mojom::SSLConfigPtr mojo_config = mojom::SSLConfig::New();
   mojo_config->symantec_enforcement_disabled =
-      expected_net_config.disable_symantec_enforcement;
+      expected_net_config.symantec_enforcement_disabled;
 
-  RunCertConversionTests(*mojo_config, expected_net_config);
+  RunConversionTests(*mojo_config, expected_net_config);
 }
 
 TEST_F(NetworkServiceSSLConfigServiceTest, SSLVersion) {

diff --git a/services/network/ssl_config_type_converter.cc b/services/network/ssl_config_type_converter.cc
index 3ef67f43..556f22a 100644
--- a/services/network/ssl_config_type_converter.cc
+++ b/services/network/ssl_config_type_converter.cc

@@ -44,6 +44,15 @@
 
   net::SSLConfig net_config;
 
+  net_config.rev_checking_enabled = mojo_config->rev_checking_enabled;
+  net_config.rev_checking_required_local_anchors =
+      mojo_config->rev_checking_required_local_anchors;
+
+  net_config.sha1_local_anchors_enabled =
+      mojo_config->sha1_local_anchors_enabled;
+  net_config.symantec_enforcement_disabled =
+      mojo_config->symantec_enforcement_disabled;
+
   net_config.version_min =
       MojoSSLVersionToNetSSLVersion(mojo_config->version_min);
   net_config.version_max =

diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
index 9610378..d746d89 100644
--- a/services/network/test/test_network_context.h
+++ b/services/network/test/test_network_context.h

@@ -106,7 +106,7 @@
       ::network::mojom::ProxyLookupClientPtr proxy_lookup_client) override {}
   void CreateNetLogExporter(mojom::NetLogExporterRequest exporter) override {}
   void ResolveHost(const net::HostPortPair& host,
-                   mojom::ResolveHostHandleRequest control_handle,
+                   mojom::ResolveHostParametersPtr optional_parameters,
                    mojom::ResolveHostClientPtr response_client) override {}
   void CreateHostResolver(mojom::HostResolverRequest request) override {}
   void AddHSTSForTesting(const std::string& host,

diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
index d44de16..393f1bae 100644
--- a/services/network/url_loader.cc
+++ b/services/network/url_loader.cc

@@ -365,6 +365,16 @@
   }
 
   url_request_->SetLoadFlags(request.load_flags);
+
+  // Use allow credentials unless credential load flags have been explicitly
+  // set.
+  if (!request.allow_credentials) {
+    DCHECK((request.load_flags &
+            (net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES |
+             net::LOAD_DO_NOT_SEND_AUTH_DATA)) == 0);
+    url_request_->set_allow_credentials(false);
+  }
+
   if (report_raw_headers_) {
     url_request_->SetRequestHeadersCallback(
         base::Bind(&net::HttpRawRequestHeaders::Assign,

diff --git a/services/ui/ws2/window_tree_unittest.cc b/services/ui/ws2/window_tree_unittest.cc
index 830996d5..f149aaf 100644
--- a/services/ui/ws2/window_tree_unittest.cc
+++ b/services/ui/ws2/window_tree_unittest.cc

@@ -353,6 +353,45 @@
           data->properties[ui::mojom::WindowManager::kAlwaysOnTop_Property]));
 }
 
+TEST(WindowTreeTest, EventLocation) {
+  WindowServiceTestSetup setup;
+  TestWindowTreeClient* window_tree_client = setup.window_tree_client();
+  aura::Window* top_level =
+      setup.window_tree_test_helper()->NewTopLevelWindow();
+  ASSERT_TRUE(top_level);
+
+  top_level->Show();
+  top_level->SetBounds(gfx::Rect(10, 20, 100, 100));
+
+  // Add a child Window that covers the bottom half of the top-level window.
+  aura::Window* window = setup.window_tree_test_helper()->NewWindow();
+  ASSERT_TRUE(window);
+  window->Show();
+  window->SetBounds(gfx::Rect(0, 50, 100, 50));
+  top_level->AddChild(window);
+
+  test::EventGenerator event_generator(setup.root());
+  event_generator.MoveMouseTo(33, 44);
+  ASSERT_EQ(1u, window_tree_client->input_events().size());
+  TestWindowTreeClient::InputEvent event1 = window_tree_client->PopInputEvent();
+  ASSERT_TRUE(event1.event->IsLocatedEvent());
+  ui::LocatedEvent* located_event1 = event1.event->AsLocatedEvent();
+  // The location is in the top-level's (client-root) coordinate system.
+  EXPECT_EQ(gfx::Point(23, 24), located_event1->location());
+  // The root location is in the display's (display-root) coordinate system.
+  EXPECT_EQ(gfx::Point(33, 44), located_event1->root_location());
+
+  event_generator.MoveMouseTo(55, 66);
+  ASSERT_EQ(1u, window_tree_client->input_events().size());
+  TestWindowTreeClient::InputEvent event2 = window_tree_client->PopInputEvent();
+  ASSERT_TRUE(event2.event->IsLocatedEvent());
+  ui::LocatedEvent* located_event2 = event2.event->AsLocatedEvent();
+  // The location is in the top-level's (client-root) coordinate system.
+  EXPECT_EQ(gfx::Point(45, 46), located_event2->location());
+  // The root location is in the display's (display-root) coordinate system.
+  EXPECT_EQ(gfx::Point(55, 66), located_event2->root_location());
+}
+
 TEST(WindowTreeTest, MovePressDragRelease) {
   WindowServiceTestSetup setup;
   TestWindowTreeClient* window_tree_client = setup.window_tree_client();

diff --git a/services/viz/privileged/interfaces/compositing/display_private.mojom b/services/viz/privileged/interfaces/compositing/display_private.mojom
index 12498eaa..f1144ab 100644
--- a/services/viz/privileged/interfaces/compositing/display_private.mojom
+++ b/services/viz/privileged/interfaces/compositing/display_private.mojom

@@ -43,6 +43,10 @@
   SetDisplayVSyncParameters(
     mojo_base.mojom.TimeTicks timebase,
     mojo_base.mojom.TimeDelta interval);
+
+  // Notifies the display to pause VSync signals. Used for VR.
+  [EnableIf=is_android]
+  SetVSyncPaused(bool paused);
 };
 
 interface DisplayClient {

diff --git a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
index b4b6af9..1dc1018 100644
--- a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter

@@ -181,10 +181,6 @@
 # about an origin.
 -ReportingBrowserTest.TestReportingHeadersProcessed
 
-# https://crbug.com/862176
-# Requires checking Origin headers on requests made after extension unload.
--ExtensionUnloadBrowserTest.UnloadWithContentScripts
-
 # https://crbug.com/721403
 -ContextMenuBrowserTest.DataSaverOpenOrigImageInNewTab
 

diff --git a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
index ad55344..8edb13b 100644
--- a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter

@@ -37,9 +37,6 @@
 # https://crbug.com/827318
 -RenderThreadImplBrowserTest.NonResourceDispatchIPCTasksDontGoThroughScheduler
 
-# https://crbug.com/862176
--SecurityExploitBrowserTest.InvalidOriginHeaders
-
 # NOTE: if adding an exclusion for an existing failure (e.g. additional test for
 # feature X that is already not working), please add it beside the existing
 # failures. Otherwise please reach out to network-service-dev@.

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 4a8a315..05440aa 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -4711,6 +4711,22 @@
             ]
         }
     ],
+    "VizDisplayCompositor": [
+        {
+            "platforms": [
+                "windows",
+                "linux"
+            ],
+            "experiments": [
+                {
+                    "name": "VizDisplayCompositor",
+                    "enable_features": [
+                        "VizDisplayCompositor"
+                    ]
+                }
+            ]
+        }
+    ],
     "VizHitTestDrawQuad": [
         {
             "platforms": [

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees
index 1a61bb3..967c5da0 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees

@@ -154,6 +154,7 @@
 
 # These scrollbar tests should pass.
 Bug(none) virtual/prefer_compositing_to_lcd_text/scrollbars/ [ Pass ]
+crbug.com/836890 compositing/rtl/rtl-fixed-overflow-scrolled.html [ Failure ]
 crbug.com/836890 compositing/rtl/rtl-absolute-overflow.html [ Failure ]
 crbug.com/836890 compositing/rtl/rtl-and-writing-mode-scrolling.html [ Failure ]
 crbug.com/836890 compositing/rtl/rtl-fixed-overflow.html [ Failure ]
@@ -342,6 +343,11 @@
 Bug(none) fast/clip/overflow-border-radius-composited-parent.html [ Failure ]
 Bug(none) fast/clip/overflow-border-radius-composited.html [ Failure ]
 
+crbug.com/874675 compositing/overflow/mixed-composited-nested-sticky-overflow-scroller.html [ Failure ]
+crbug.com/874675 fast/css/sticky/sticky-clip-rel-child.html [ Failure ]
+
+crbug.com/874672 images/cross-fade-invalidation.html [ Failure ]
+
 # Something wrong with vertical-rl scrollbars
 crbug.com/853945 fast/block/positioning/vertical-rl/002.html [ Failure ]
 

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index f3888ae..43ef9fd 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -3851,25 +3851,25 @@
 
 crbug.com/716320 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/broadcastchannel-success-and-failure.html [ Failure Timeout ]
 crbug.com/716320 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/broadcastchannel-success.html [ Failure Timeout ]
-crbug.com/716320 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-messagechannel-success.html [ Failure Timeout ]
+crbug.com/716320 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-messagechannel-success.html [ Failure Timeout ]
 crbug.com/716320 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-sharedworker-failure.html [ Failure Timeout ]
 
-# Disabling SharedArrayBuffer
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/identity-not-preserved.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/no-transferring.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-history.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-idb.any.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-idb.any.worker.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-notifications-api.any.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-notifications-api.any.worker.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-domain-success.sub.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-serviceworker-failure.https.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-similar-but-cross-origin-success.sub.html [ Failure ]
-crbug.com/798864 external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-simple-success.html [ Failure ]
-crbug.com/798864 external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-dedicatedworker.html [ Failure ]
-crbug.com/798864 external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-serviceworker.https.html [ Failure ]
-crbug.com/798864 external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-sharedworker.html [ Failure ]
-crbug.com/798864 external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-window.html [ Failure ]
+# SharedArrayBuffer is disabled on Android
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/identity-not-preserved.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/no-transferring.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-history.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-idb.any.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-idb.any.worker.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-notifications-api.any.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/serialization-via-notifications-api.any.worker.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-domain-success.sub.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-serviceworker-failure.https.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-similar-but-cross-origin-success.sub.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/window-simple-success.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-dedicatedworker.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-serviceworker.https.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-sharedworker.html [ Failure ]
+crbug.com/798864 [ Android ] external/wpt/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-agent-formalism/canblock-window.html [ Failure ]
 
 crbug.com/716320 virtual/sharedarraybuffer/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/broadcastchannel-success-and-failure.html [ Timeout ]
 crbug.com/716320 virtual/sharedarraybuffer/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/broadcastchannel-success.html [ Timeout ]
@@ -4934,3 +4934,11 @@
 crbug.com/873873 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html [ Timeout Pass ]
 crbug.com/873873 virtual/outofblink-cors-ns/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html [ Timeout Pass ]
 crbug.com/873873 virtual/service-worker-servicification/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html [ Timeout Pass ]
+
+# Tests that work only when LazyImageLoading feature is enabled.
+crbug.com/846170 http/tests/lazyload/lazy.html [ Skip ]
+
+# Sheriff 2018-08-15
+crbug.com/874733 [ Android ] accessibility/aria-labelledby-on-input.html [ Crash ]
+crbug.com/874733 [ Android ] accessibility/aria-link-supports-press.html [ Crash ]
+crbug.com/874733 [ Android ] accessibility/insert-adjacent-html-causes-crash.xhtml [ Crash ]

diff --git a/third_party/WebKit/LayoutTests/VirtualTestSuites b/third_party/WebKit/LayoutTests/VirtualTestSuites
index e355068..8d8d27d 100644
--- a/third_party/WebKit/LayoutTests/VirtualTestSuites
+++ b/third_party/WebKit/LayoutTests/VirtualTestSuites

@@ -719,6 +719,11 @@
     "args": ["--enable-features=MojoBlobURLs"]
   },
   {
+    "prefix": "lazyload-image",
+    "base": "http/tests/lazyload",
+    "args": ["--enable-features=LazyImageLoading"]
+  },
+  {
     "prefix": "origin-policy",
     "base": "external/wpt/origin-policy",
     "args": ["--enable-features=OriginPolicy"]

diff --git a/third_party/WebKit/LayoutTests/crypto/random-values-expected.txt b/third_party/WebKit/LayoutTests/crypto/random-values-expected.txt
index b0012025..1334f1f 100644
--- a/third_party/WebKit/LayoutTests/crypto/random-values-expected.txt
+++ b/third_party/WebKit/LayoutTests/crypto/random-values-expected.txt

@@ -7,6 +7,7 @@
 PASS 'getRandomValues' in self.crypto is true
 PASS self.crypto.__proto__.hasOwnProperty('getRandomValues') is true
 PASS matchingBytes < 100 is true
+PASS crypto.getRandomValues(new Uint8Array(new SharedArrayBuffer(100))) threw exception TypeError: Failed to execute 'getRandomValues' on 'Crypto': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/crypto/subtle/importKey-badParameters-expected.txt b/third_party/WebKit/LayoutTests/crypto/subtle/importKey-badParameters-expected.txt
index 73949bf..f3e09a7 100644
--- a/third_party/WebKit/LayoutTests/crypto/subtle/importKey-badParameters-expected.txt
+++ b/third_party/WebKit/LayoutTests/crypto/subtle/importKey-badParameters-expected.txt

@@ -11,7 +11,7 @@
 error is: TypeError: Invalid keyFormat argument
 error is: TypeError: HmacImportParams: hash: Missing or not an AlgorithmIdentifier
 error is: NotSupportedError: SHA-1: Unsupported operation: importKey
-error is: SharedArrayBuffers not enabled.
+error is: TypeError: Failed to execute 'importKey' on 'SubtleCrypto': The provided ArrayBufferView value must not be shared.
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/crypto/worker-random-values-expected.txt b/third_party/WebKit/LayoutTests/crypto/worker-random-values-expected.txt
index 382e3ee3..47f33e1 100644
--- a/third_party/WebKit/LayoutTests/crypto/worker-random-values-expected.txt
+++ b/third_party/WebKit/LayoutTests/crypto/worker-random-values-expected.txt

@@ -8,6 +8,7 @@
 PASS [Worker] 'getRandomValues' in self.crypto is true
 PASS [Worker] self.crypto.__proto__.hasOwnProperty('getRandomValues') is true
 PASS [Worker] matchingBytes < 100 is true
+PASS [Worker] crypto.getRandomValues(new Uint8Array(new SharedArrayBuffer(100))) threw exception TypeError: Failed to execute 'getRandomValues' on 'Crypto': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/editing/text-iterator/findString-expected.txt b/third_party/WebKit/LayoutTests/editing/text-iterator/findString-expected.txt
index a0a9bc1..9e03e1e 100644
--- a/third_party/WebKit/LayoutTests/editing/text-iterator/findString-expected.txt
+++ b/third_party/WebKit/LayoutTests/editing/text-iterator/findString-expected.txt

@@ -35,86 +35,32 @@
 PASS: Got a match at 15,20 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘mount’ in ‘insurmountable mountain’ with options [AtWordStarts]:
-PASS: Got a match at 15,20 as expected.
-PASS: Got no match as expected.
-
 Searching for ‘co’ in ‘cocoa’ with options []:
 PASS: Got a match at 0,2 as expected.
 PASS: Got a match at 2,4 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘co’ in ‘cocoa’ with options [AtWordStarts]:
-PASS: Got a match at 0,2 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘org’ in ‘webkit.org’ with options [AtWordStarts]:
+Searching for ‘org’ in ‘webkit.org’ with options []:
 PASS: Got a match at 7,10 as expected.
 
-Searching for ‘.org’ in ‘webkit.org’ with options [AtWordStarts]:
+Searching for ‘.org’ in ‘webkit.org’ with options []:
 PASS: Got a match at 6,10 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘rg’ in ‘webkit.org’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘org’ in ‘webkit.org’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got a match at 7,10 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘.org’ in ‘webkit.org’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got a match at 6,10 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘t.org’ in ‘webkit.org’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘it’ in ‘WebKit’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘Kit’ in ‘WebKit’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got a match at 3,6 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘bKit’ in ‘WebKit’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘equest’ in ‘XMLHTTPRequest’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘Request’ in ‘XMLHTTPRequest’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got a match at 7,14 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘PRequest’ in ‘XMLHTTPRequest’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘64’ in ‘LP64’ with options [AtWordStarts]:
-PASS: Got no match as expected.
-
-Searching for ‘4’ in ‘LP64’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘64’ in ‘LP64’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got a match at 2,4 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘P64’ in ‘LP64’ with options [AtWordStarts, TreatMedialCapitalAsWordStart]:
-PASS: Got no match as expected.
-
-Searching for ‘動戦士’ in ‘起動戦士’ with options [AtWordStarts]:
+Searching for ‘動戦士’ in ‘起動戦士’ with options []:
 PASS: Got a match at 1,4 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘戦士’ in ‘起動戦士’ with options [AtWordStarts]:
+Searching for ‘戦士’ in ‘起動戦士’ with options []:
 PASS: Got a match at 2,4 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘士’ in ‘起動戦士’ with options [AtWordStarts]:
+Searching for ‘士’ in ‘起動戦士’ with options []:
 PASS: Got a match at 3,4 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘a’ in long string with options [AtWordStarts]:
+Searching for ‘a’ in long string with options []:
+PASS: Got a match at 6144,6145 as expected.
 PASS: Got a match at 6146,6147 as expected.
 PASS: Got no match as expected.
 
@@ -124,11 +70,6 @@
 PASS: Got a match at 12,14 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘กร’ in ‘กรปูเลกชกชกรกรกชบงกช’ with options [AtWordStarts]:
-PASS: Got a match at 0,2 as expected.
-PASS: Got a match at 12,14 as expected.
-PASS: Got no match as expected.
-
 Searching for ‘กช’ in ‘กรปูเลกชกชกรกรกชบงกช’ with options []:
 PASS: Got a match at 6,8 as expected.
 PASS: Got a match at 8,10 as expected.
@@ -136,40 +77,23 @@
 PASS: Got a match at 18,20 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘กช’ in ‘กรปูเลกชกชกรกรกชบงกช’ with options [AtWordStarts]:
-PASS: Got a match at 6,8 as expected.
-PASS: Got a match at 8,10 as expected.
-PASS: Got no match as expected.
-
 Searching for ‘กร’ in long string with options []:
 PASS: Got a match at 6144,6146 as expected.
 PASS: Got a match at 6154,6156 as expected.
 PASS: Got a match at 6156,6158 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘กร’ in long string with options [AtWordStarts]:
-PASS: Got a match at 6156,6158 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘กร’ in long string with options [AtWordStarts]:
-PASS: Got a match at 6144,6146 as expected.
-PASS: Got a match at 6156,6158 as expected.
-PASS: Got no match as expected.
-
-Searching for ‘กช’ in long string with options [AtWordStarts]:
-PASS: Got no match as expected.
-
-Searching for ‘ ’ in ‘Spaces, the final frontier’ with options [AtWordStarts]:
+Searching for ‘ ’ in ‘Spaces, the final frontier’ with options []:
 PASS: Got a match at 7,8 as expected.
 PASS: Got a match at 11,12 as expected.
 PASS: Got a match at 17,18 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘@’ in ‘Use an @import rule’ with options [AtWordStarts]:
+Searching for ‘@’ in ‘Use an @import rule’ with options []:
 PASS: Got a match at 7,8 as expected.
 PASS: Got no match as expected.
 
-Searching for ‘(x’ in ‘If ((x + 5) * 2) = 14, then x = 2’ with options [AtWordStarts]:
+Searching for ‘(x’ in ‘If ((x + 5) * 2) = 14, then x = 2’ with options []:
 PASS: Got a match at 4,6 as expected.
 PASS: Got no match as expected.
 

diff --git a/third_party/WebKit/LayoutTests/editing/text-iterator/findString.html b/third_party/WebKit/LayoutTests/editing/text-iterator/findString.html
index 6f91419..77fc6563 100644
--- a/third_party/WebKit/LayoutTests/editing/text-iterator/findString.html
+++ b/third_party/WebKit/LayoutTests/editing/text-iterator/findString.html

@@ -45,35 +45,15 @@
     testFindString("Lorem ipsum dolor sit amet", "O", ["CaseInsensitive"], [[1, 2], [13, 14], [15, 16]]);
 
     testFindString("insurmountable mountain", "mount", [], [[5, 10], [15, 20], []]);
-    testFindString("insurmountable mountain", "mount", ["AtWordStarts"], [[15, 20], []]);
 
     testFindString("cocoa", "co", [], [[0, 2], [2, 4], []]);
-    testFindString("cocoa", "co", ["AtWordStarts"], [[0, 2], []]);
 
-    testFindString("webkit.org", "org", ["AtWordStarts"], [[7, 10]]);
-    testFindString("webkit.org", ".org", ["AtWordStarts"], [[6, 10], []]);
+    testFindString("webkit.org", "org", [], [[7, 10]]);
+    testFindString("webkit.org", ".org", [], [[6, 10], []]);
 
-    testFindString("webkit.org", "rg", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-    testFindString("webkit.org", "org", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[7, 10], []]);
-    testFindString("webkit.org", ".org", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[6, 10], []]);
-    testFindString("webkit.org", "t.org", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-
-    testFindString("WebKit", "it", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-    testFindString("WebKit", "Kit", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[3, 6], []]);
-    testFindString("WebKit", "bKit", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-
-    testFindString("XMLHTTPRequest", "equest", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-    testFindString("XMLHTTPRequest", "Request", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[7, 14], []]);
-    testFindString("XMLHTTPRequest", "PRequest", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-
-    testFindString("LP64", "64", ["AtWordStarts"], [[]]);
-    testFindString("LP64", "4", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-    testFindString("LP64", "64", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[2, 4], []]);
-    testFindString("LP64", "P64", ["AtWordStarts", "TreatMedialCapitalAsWordStart"], [[]]);
-
-    testFindString("\u8d77\u52d5\u6226\u58eb", "\u52d5\u6226\u58eb", ["AtWordStarts"], [[1, 4], []]);
-    testFindString("\u8d77\u52d5\u6226\u58eb", "\u6226\u58eb", ["AtWordStarts"], [[2, 4], []]);
-    testFindString("\u8d77\u52d5\u6226\u58eb", "\u58eb", ["AtWordStarts"], [[3, 4], []]);
+    testFindString("\u8d77\u52d5\u6226\u58eb", "\u52d5\u6226\u58eb", [], [[1, 4], []]);
+    testFindString("\u8d77\u52d5\u6226\u58eb", "\u6226\u58eb", [], [[2, 4], []]);
+    testFindString("\u8d77\u52d5\u6226\u58eb", "\u58eb", [], [[3, 4], []]);
 
     const searchBufferSize = 8192;
     const searchBufferOverlapSize = searchBufferSize / 4;
@@ -83,7 +63,8 @@
         bufferSizedString += bufferSizedString;
     bufferSizedString = bufferSizedString.substring(0, searchBufferSize);
 
-    testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize - 2) + " ba a" + bufferSizedString, "a", ["AtWordStarts"], [[searchBufferUnoverlappedSize + 2, searchBufferUnoverlappedSize + 3], []]);
+    testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize - 2) + " ba a" + bufferSizedString, "a", [],
+                   [[searchBufferUnoverlappedSize, searchBufferUnoverlappedSize+1], [searchBufferUnoverlappedSize + 2, searchBufferUnoverlappedSize + 3], []]);
 
     var thaiWords = [
         "\u0e01\u0e23",
@@ -95,19 +76,14 @@
     ];
 
     testFindString(thaiWords.join(""), thaiWords[0], [], [[0, 2], [10, 12], [12, 14], []]);
-    testFindString(thaiWords.join(""), thaiWords[0], ["AtWordStarts"], [[0, 2], [12, 14], []]);
 
     testFindString(thaiWords.join(""), thaiWords[2], [], [[6, 8], [8, 10], [14, 16], [18, 20], []]);
-    testFindString(thaiWords.join(""), thaiWords[2], ["AtWordStarts"], [[6, 8], [8, 10], []]);
 
     testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize) + thaiWords.join("") + bufferSizedString, thaiWords[0], [], [[searchBufferUnoverlappedSize, searchBufferUnoverlappedSize + 2], [searchBufferUnoverlappedSize + 10, searchBufferUnoverlappedSize + 12], [searchBufferUnoverlappedSize + 12, searchBufferUnoverlappedSize + 14], []]);
-    testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize) + thaiWords.join("") + bufferSizedString, thaiWords[0], ["AtWordStarts"], [[searchBufferUnoverlappedSize + 12, searchBufferUnoverlappedSize + 14], []]);
-    testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize - 1) + " " + thaiWords.join("") + bufferSizedString, thaiWords[0], ["AtWordStarts"], [[searchBufferUnoverlappedSize, searchBufferUnoverlappedSize + 2], [searchBufferUnoverlappedSize + 12, searchBufferUnoverlappedSize + 14], []]);
-    testFindString(bufferSizedString.substring(0, searchBufferUnoverlappedSize - 3) + " " + thaiWords[4] + bufferSizedString, thaiWords[2], ["AtWordStarts"], [[]]);
-
-    testFindString("Spaces, the final frontier", " ", ["AtWordStarts"], [[7, 8], [11, 12], [17, 18], []]);
-    testFindString("Use an @import rule", "@", ["AtWordStarts"], [[7, 8], []]);
-    testFindString("If ((x + 5) * 2) = 14, then x = 2", "(x", ["AtWordStarts"], [[4, 6], []]);
+  
+    testFindString("Spaces, the final frontier", " ", [], [[7, 8], [11, 12], [17, 18], []]);
+    testFindString("Use an @import rule", "@", [], [[7, 8], []]);
+    testFindString("If ((x + 5) * 2) = 14, then x = 2", "(x", [], [[4, 6], []]);
 
     testFindString("hello<img src='../resources/abe.png'>world", "lowo", [], [[3, 2], []]);
 

diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index 0821e098..aa6cf94 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json

@@ -144350,6 +144350,11 @@
      {}
     ]
    ],
+   "feature-policy/idlharness.window-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "feature-policy/payment-allowed-by-feature-policy.https.sub.html.headers": [
     [
      {}
@@ -153500,11 +153505,6 @@
      {}
     ]
    ],
-   "html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-sharedworker-expected.txt": [
     [
      {}
@@ -160580,6 +160580,11 @@
      {}
     ]
    ],
+   "interfaces/reporting.idl": [
+    [
+     {}
+    ]
+   ],
    "interfaces/requestidlecallback.idl": [
     [
      {}
@@ -166140,6 +166145,16 @@
      {}
     ]
    ],
+   "reporting/META.yml": [
+    [
+     {}
+    ]
+   ],
+   "reporting/idlharness.window-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "requestidlecallback/META.yml": [
     [
      {}
@@ -213068,13 +213083,9 @@
      {}
     ]
    ],
-   "feature-policy/interfaces.any.js": [
+   "feature-policy/idlharness.window.js": [
     [
-     "/feature-policy/interfaces.any.html",
-     {}
-    ],
-    [
-     "/feature-policy/interfaces.any.worker.html",
+     "/feature-policy/idlharness.window.html",
      {}
     ]
    ],
@@ -249868,6 +249879,12 @@
      {}
     ]
    ],
+   "reporting/idlharness.window.js": [
+    [
+     "/reporting/idlharness.window.html",
+     {}
+    ]
+   ],
    "requestidlecallback/basic.html": [
     [
      "/requestidlecallback/basic.html",
@@ -358199,8 +358216,12 @@
    "f20475f628a5f4a3067b8682019054e3f31c703a",
    "support"
   ],
-  "feature-policy/interfaces.any.js": [
-   "57e4d58d5b12e63832c1c620b271b0124469d728",
+  "feature-policy/idlharness.window-expected.txt": [
+   "020250fe04df31bb30adb4310beedb8071a02ad7",
+   "support"
+  ],
+  "feature-policy/idlharness.window.js": [
+   "84c072b3172a9b6dcb952d51943806a35ecfcc7e",
    "testharness"
   ],
   "feature-policy/payment-allowed-by-feature-policy-attribute-redirect-on-load.https.sub.html": [
@@ -369375,10 +369396,6 @@
    "594d11e18e7ef8e9aaa0eca3dc2865033827ce7c",
    "testharness"
   ],
-  "html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt": [
-   "ec7b06e82bb0eb5806b5f73e56914624f99dcdfc",
-   "support"
-  ],
   "html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker.html": [
    "1fa9a3ae8d33bfd08d37a18853d511b9de66889b",
    "testharness"
@@ -381888,7 +381905,7 @@
    "support"
   ],
   "interfaces/feature-policy.idl": [
-   "ace338bf245dde3b21d3c65da64a5d0f6ad40fb2",
+   "319ba0b1a30557dcfb449e84b9ffd84dd074e93f",
    "support"
   ],
   "interfaces/fetch.idl": [
@@ -382079,6 +382096,10 @@
    "82489f9a820161a71a890c03d3c1b933099e035f",
    "support"
   ],
+  "interfaces/reporting.idl": [
+   "fb3937d1d5b0d828e24d69f6faf7d99772149a07",
+   "support"
+  ],
   "interfaces/requestidlecallback.idl": [
    "c7631a117e3a441797382a02eb41835ea0f04727",
    "support"
@@ -382184,11 +382205,11 @@
    "support"
   ],
   "interfaces/webgl1.idl": [
-   "e874ac0e00d7e9b78b55f9f2e1704ca263857f98",
+   "a19ba02f415c4deb3e441917d22ea54f049df413",
    "support"
   ],
   "interfaces/webgl2.idl": [
-   "5ec433d860f230c3eddddc38bc1f4d40e94d4b23",
+   "b2ec69f6c7d728e0e5ec7c4910d2a6651ed32b7a",
    "support"
   ],
   "interfaces/webmidi.idl": [
@@ -385468,7 +385489,7 @@
    "support"
   ],
   "notifications/idlharness.https.any.js": [
-   "c140ff43dc93d45d611941edfdb92b42be11ba87",
+   "d729aba5f6305006a354fa0cc266865e262eb3ab",
    "testharness"
   ],
   "notifications/idlharness.https.any.serviceworker-expected.txt": [
@@ -401871,6 +401892,18 @@
    "3d220a3cc0e6a05fbc40c0ab0e46a2e60162b2be",
    "testharness"
   ],
+  "reporting/META.yml": [
+   "95939f65d22483f55515c7a79f5c1aaca965b2db",
+   "support"
+  ],
+  "reporting/idlharness.window-expected.txt": [
+   "f08a89b82eeb6d0f487881bd79d488631b0afde1",
+   "support"
+  ],
+  "reporting/idlharness.window.js": [
+   "3764b6d566e1c6c63d46e0e59839a6e5f29b3b4e",
+   "testharness"
+  ],
   "requestidlecallback/META.yml": [
    "ffff9dc9862d13c919751243591b418ac8d1eee3",
    "support"

diff --git a/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window-expected.txt
new file mode 100644
index 0000000..f987f06
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window-expected.txt

@@ -0,0 +1,28 @@
+This is a testharness.js-based test.
+PASS idl_test setup
+PASS Partial interface Document: original interface defined
+PASS Partial interface HTMLIFrameElement: original interface defined
+PASS Stringification of document.policy
+PASS Policy interface: document.policy must inherit property "allowsFeature(DOMString, DOMString)" with the proper type
+PASS Policy interface: calling allowsFeature(DOMString, DOMString) on document.policy with too few arguments must throw TypeError
+PASS Policy interface: document.policy must inherit property "allowedFeatures()" with the proper type
+PASS Policy interface: document.policy must inherit property "getAllowlistForFeature(DOMString)" with the proper type
+PASS Policy interface: calling getAllowlistForFeature(DOMString) on document.policy with too few arguments must throw TypeError
+FAIL FeaturePolicyViolationReportBody interface: existence and properties of interface object assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface object length assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface object name assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: existence and properties of interface prototype object assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute featureId assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute message assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute sourceFile assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute lineNumber assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute columnNumber assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+FAIL FeaturePolicyViolationReportBody interface: attribute disposition assert_own_property: self does not have own property "FeaturePolicyViolationReportBody" expected property "FeaturePolicyViolationReportBody" missing
+PASS HTMLIFrameElement interface: attribute policy
+PASS WorkerGlobalScope interface: existence and properties of interface object
+PASS Document interface: attribute policy
+PASS Document interface: document must inherit property "policy" with the proper type
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window.js b/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window.js
new file mode 100644
index 0000000..fb17cab9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/feature-policy/idlharness.window.js

@@ -0,0 +1,18 @@
+// META: script=/resources/WebIDLParser.js
+// META: script=/resources/idlharness.js
+
+"use strict";
+
+// https://wicg.github.io/feature-policy/
+
+idl_test(
+  ['feature-policy'],
+  ['reporting', 'html', 'dom'],
+  idl_array => {
+    idl_array.add_objects({
+      Document: ['document'],
+      HTMLIframeElement: ['document.createElement("iframe")'],
+      Policy: ['document.policy'],
+    })
+  }
+);

diff --git a/third_party/WebKit/LayoutTests/external/wpt/feature-policy/interfaces.any.js b/third_party/WebKit/LayoutTests/external/wpt/feature-policy/interfaces.any.js
deleted file mode 100644
index baebc2f..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/feature-policy/interfaces.any.js
+++ /dev/null

@@ -1,23 +0,0 @@
-// META: script=/resources/WebIDLParser.js
-// META: script=/resources/idlharness.js
-
-"use strict";
-
-// https://wicg.github.io/feature-policy/
-
-var idlArray = new IdlArray();
-
-function doTest(idl) {
-  idlArray.add_untested_idls("interface HTMLIFrameElement {};");
-  idlArray.add_idls(idl);
-  idlArray.add_objects({
-    HTMLIframeElement: ['document.createElement("iframe")'],
-  })
-  idlArray.test();
-  done();
-}
-
-promise_test(function () {
-  return fetch("/interfaces/feature-policy.idl").then(response => response.text())
-    .then(doTest);
-}, "Test interfaces");

diff --git a/third_party/WebKit/LayoutTests/external/wpt/interfaces/feature-policy.idl b/third_party/WebKit/LayoutTests/external/wpt/interfaces/feature-policy.idl
index 34d9277..de2f046 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/interfaces/feature-policy.idl
+++ b/third_party/WebKit/LayoutTests/external/wpt/interfaces/feature-policy.idl

@@ -1,8 +1,27 @@
 // GENERATED CONTENT - DO NOT EDIT
-// Content of this file was automatically extracted from the
-// "Feature Policy" spec.
-// See: https://wicg.github.io/feature-policy/
+// Content was automatically extracted by Reffy into reffy-reports
+// (https://github.com/tidoust/reffy-reports)
+// Source: Feature Policy (https://wicg.github.io/feature-policy/)
+
+[NoInterfaceObject]
+interface Policy {
+  boolean allowsFeature(DOMString feature, optional DOMString origin);
+  sequence<DOMString> allowedFeatures();
+  sequence<DOMString> getAllowlistForFeature(DOMString feature);
+};
+
+partial interface Document {
+    [SameObject] readonly attribute Policy policy;
+};
 
 partial interface HTMLIFrameElement {
-    [CEReactions] attribute DOMString allow;
+    [SameObject] readonly attribute Policy policy;
+};
+interface FeaturePolicyViolationReportBody : ReportBody {
+  readonly attribute DOMString featureId;
+  readonly attribute DOMString message;
+  readonly attribute DOMString? sourceFile;
+  readonly attribute long? lineNumber;
+  readonly attribute long? columnNumber;
+  readonly attribute DOMString disposition;
 };

diff --git a/third_party/WebKit/LayoutTests/external/wpt/interfaces/reporting.idl b/third_party/WebKit/LayoutTests/external/wpt/interfaces/reporting.idl
new file mode 100644
index 0000000..e9800365
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/interfaces/reporting.idl

@@ -0,0 +1,56 @@
+// GENERATED CONTENT - DO NOT EDIT
+// Content was automatically extracted by Reffy into reffy-reports
+// (https://github.com/tidoust/reffy-reports)
+// Source: Reporting API 1 (https://w3c.github.io/reporting/)
+
+interface ReportBody {
+};
+
+interface Report {
+  readonly attribute DOMString type;
+  readonly attribute DOMString url;
+  readonly attribute ReportBody? body;
+};
+
+[Constructor(ReportingObserverCallback callback, optional ReportingObserverOptions options)]
+interface ReportingObserver {
+  void observe();
+  void disconnect();
+  ReportList takeRecords();
+};
+
+callback ReportingObserverCallback = void (sequence<Report> reports, ReportingObserver observer);
+
+dictionary ReportingObserverOptions {
+  sequence<DOMString> types;
+  boolean buffered = false;
+};
+
+typedef sequence<Report> ReportList;
+
+interface DeprecationReportBody : ReportBody {
+  readonly attribute DOMString id;
+  readonly attribute Date? anticipatedRemoval;
+  readonly attribute DOMString message;
+  readonly attribute DOMString? sourceFile;
+  readonly attribute unsigned long? lineNumber;
+  readonly attribute unsigned long? columnNumber;
+};
+
+interface InterventionReportBody : ReportBody {
+  readonly attribute DOMString id;
+  readonly attribute DOMString message;
+  readonly attribute DOMString? sourceFile;
+  readonly attribute unsigned long? lineNumber;
+  readonly attribute unsigned long? columnNumber;
+};
+
+interface CrashReportBody : ReportBody {
+  readonly attribute DOMString crashId;
+  readonly attribute DOMString? reason;
+};
+
+dictionary GenerateTestReportParameters {
+  required DOMString message;
+  DOMString group;
+};

diff --git a/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl1.idl b/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl1.idl
index fce2cdf..bab7d421 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl1.idl
+++ b/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl1.idl

@@ -1,7 +1,7 @@
 // GENERATED CONTENT - DO NOT EDIT
-// Content of this file was automatically extracted from the
-// "WebGL Specification" spec.
-// See: https://www.khronos.org/registry/webgl/specs/latest/1.0/
+// Content was automatically extracted by Reffy into reffy-reports
+// (https://github.com/tidoust/reffy-reports)
+// Source: WebGL Specification (https://www.khronos.org/registry/webgl/specs/latest/1.0/)
 
 typedef unsigned long  GLenum;
 typedef boolean        GLboolean;
@@ -34,36 +34,46 @@
     GLboolean failIfMajorPerformanceCaveat = false;
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLBuffer : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLFramebuffer : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLProgram : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLRenderbuffer : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLShader : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLTexture : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLUniformLocation {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLActiveInfo {
     readonly attribute GLint size;
     readonly attribute GLenum type;
     readonly attribute DOMString name;
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLShaderPrecisionFormat {
     readonly attribute GLint rangeMin;
     readonly attribute GLint rangeMax;
@@ -500,7 +510,7 @@
     const GLenum UNPACK_COLORSPACE_CONVERSION_WEBGL = 0x9243;
     const GLenum BROWSER_DEFAULT_WEBGL          = 0x9244;
 
-    readonly attribute HTMLCanvasElement canvas;
+    [Exposed=Window] readonly attribute HTMLCanvasElement canvas;
     readonly attribute GLsizei drawingBufferWidth;
     readonly attribute GLsizei drawingBufferHeight;
 
@@ -708,12 +718,15 @@
     void viewport(GLint x, GLint y, GLsizei width, GLsizei height);
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLRenderingContext
 {
 };
 WebGLRenderingContext includes WebGLRenderingContextBase;
 
-[Constructor(DOMString type, optional WebGLContextEventInit eventInit)]
+[Exposed=(Window,Worker),
+ Constructor(DOMString type,
+ optional WebGLContextEventInit eventInit)]
 interface WebGLContextEvent : Event {
     readonly attribute DOMString statusMessage;
 };

diff --git a/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl2.idl b/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl2.idl
index b8f5b23b..11d0d8c2a 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl2.idl
+++ b/third_party/WebKit/LayoutTests/external/wpt/interfaces/webgl2.idl

@@ -1,23 +1,28 @@
 // GENERATED CONTENT - DO NOT EDIT
-// Content of this file was automatically extracted from the
-// "WebGL 2.0 Specification" spec.
-// See: https://www.khronos.org/registry/webgl/specs/latest/2.0/
+// Content was automatically extracted by Reffy into reffy-reports
+// (https://github.com/tidoust/reffy-reports)
+// Source: WebGL 2.0 Specification (https://www.khronos.org/registry/webgl/specs/latest/2.0/)
 
 typedef long long GLint64;
 typedef unsigned long long GLuint64;
 
+[Exposed=(Window,Worker)]
 interface WebGLQuery : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLSampler : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLSync : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLTransformFeedback : WebGLObject {
 };
 
+[Exposed=(Window,Worker)]
 interface WebGLVertexArrayObject : WebGLObject {
 };
 
@@ -567,6 +572,7 @@
   void bindVertexArray(WebGLVertexArrayObject? array);
 };
 
+[Exposed=(Window,Worker)]
 interface WebGL2RenderingContext
 {
 };

diff --git a/third_party/WebKit/LayoutTests/external/wpt/notifications/idlharness.https.any.js b/third_party/WebKit/LayoutTests/external/wpt/notifications/idlharness.https.any.js
index e2907f3..0b9a71b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/notifications/idlharness.https.any.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/notifications/idlharness.https.any.js

@@ -10,18 +10,22 @@
   ['notifications'],
   ['service-workers', 'html', 'dom'],
   idl_array => {
-    idl_array.add_objects({
-      Notification: ['notification'],
-    });
     if (self.ServiceWorkerGlobalScope) {
       idl_array.add_objects({
-        NotificationEvent: ['notificationEvent'],
         ServiceWorkerGlobalScope: ['self'],
       });
-    }
-    self.notification = new Notification("Running idlharness.");
-    if (self.ServiceWorkerGlobalScope) {
-      self.notificationEvent = new NotificationEvent("type", { notification: notification });
+      // NotificationEvent could be tested here, but the constructor requires
+      // a Notification instance which cannot be created in a service worker,
+      // see below.
+    } else {
+      // While the Notification interface is exposed in service workers, the
+      // constructor (https://notifications.spec.whatwg.org/#dom-notification-notification)
+      // is defined to throw a TypeError. Therefore, we only add the object in
+      // the other scopes.
+      idl_array.add_objects({
+        Notification: ['notification'],
+      });
+      self.notification = new Notification('title');
     }
   }
 );

diff --git a/third_party/WebKit/LayoutTests/external/wpt/reporting/META.yml b/third_party/WebKit/LayoutTests/external/wpt/reporting/META.yml
new file mode 100644
index 0000000..980823f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/reporting/META.yml

@@ -0,0 +1,5 @@
+spec: https://w3c.github.io/reporting/
+suggested_reviewers:
+  - dcreager
+  - igrigorik
+  - paulmeyer90

diff --git a/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window-expected.txt
new file mode 100644
index 0000000..ced2a2ec
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window-expected.txt

@@ -0,0 +1,60 @@
+This is a testharness.js-based test.
+Found 56 tests; 10 PASS, 46 FAIL, 0 TIMEOUT, 0 NOTRUN.
+PASS idl_test setup
+FAIL ReportBody interface: existence and properties of interface object assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL ReportBody interface object length assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL ReportBody interface object name assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL ReportBody interface: existence and properties of interface prototype object assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL ReportBody interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL ReportBody interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "ReportBody" expected property "ReportBody" missing
+FAIL Report interface: existence and properties of interface object assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface object length assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface object name assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: existence and properties of interface prototype object assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: attribute type assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: attribute url assert_own_property: self does not have own property "Report" expected property "Report" missing
+FAIL Report interface: attribute body assert_own_property: self does not have own property "Report" expected property "Report" missing
+PASS ReportingObserver interface: existence and properties of interface object
+PASS ReportingObserver interface object length
+PASS ReportingObserver interface object name
+PASS ReportingObserver interface: existence and properties of interface prototype object
+PASS ReportingObserver interface: existence and properties of interface prototype object's "constructor" property
+PASS ReportingObserver interface: existence and properties of interface prototype object's @@unscopables property
+PASS ReportingObserver interface: operation observe()
+PASS ReportingObserver interface: operation disconnect()
+PASS ReportingObserver interface: operation takeRecords()
+FAIL DeprecationReportBody interface: existence and properties of interface object assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface object length assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface object name assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: existence and properties of interface prototype object assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute id assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute anticipatedRemoval assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute message assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute sourceFile assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute lineNumber assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL DeprecationReportBody interface: attribute columnNumber assert_own_property: self does not have own property "DeprecationReportBody" expected property "DeprecationReportBody" missing
+FAIL InterventionReportBody interface: existence and properties of interface object assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface object length assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface object name assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: existence and properties of interface prototype object assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: attribute id assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: attribute message assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: attribute sourceFile assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: attribute lineNumber assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL InterventionReportBody interface: attribute columnNumber assert_own_property: self does not have own property "InterventionReportBody" expected property "InterventionReportBody" missing
+FAIL CrashReportBody interface: existence and properties of interface object assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface object length assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface object name assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface: existence and properties of interface prototype object assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface: existence and properties of interface prototype object's @@unscopables property assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface: attribute crashId assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+FAIL CrashReportBody interface: attribute reason assert_own_property: self does not have own property "CrashReportBody" expected property "CrashReportBody" missing
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window.js b/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window.js
new file mode 100644
index 0000000..17cef81
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/reporting/idlharness.window.js

@@ -0,0 +1,14 @@
+// META: script=/resources/WebIDLParser.js
+// META: script=/resources/idlharness.js
+
+'use strict';
+
+idl_test(
+  ['reporting'],
+  [],
+  idl_array => {
+    idl_array.add_objects({
+      // TODO: objects
+    });
+  }
+);

diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
index 46af645..fac0d8d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/navigation-preload/resources/resource-timing-worker.js

@@ -1,19 +1,37 @@
+async function wait_for_performance_entries(url) {
+  let entries = performance.getEntriesByName(url);
+  if (entries.length > 0) {
+    return entries;
+  }
+  return new Promise((resolve) => {
+    new PerformanceObserver((list) => {
+      const entries = list.getEntriesByName(url);
+      if (entries.length > 0) {
+        resolve(entries);
+      }
+    }).observe({ entryTypes: ['resource'] });
+  });
+}
+
 self.addEventListener('activate', event => {
     event.waitUntil(self.registration.navigationPreload.enable());
   });
 
 self.addEventListener('fetch', event => {
+    let headers;
     event.respondWith(
       event.preloadResponse
           .then(response => {
-            var headers = response.headers;
-            return response.text().then(text =>
-              new Response(
-                JSON.stringify({
-                  decodedBodySize: headers.get('X-Decoded-Body-Size'),
-                  encodedBodySize: headers.get('X-Encoded-Body-Size'),
-                  timingEntries: performance.getEntriesByName(event.request.url)
-                }),
-                {headers: {'Content-Type': 'text/html'}}));
-          }));
+            headers = response.headers;
+            return response.text()
+          })
+          .then(_ => wait_for_performance_entries(event.request.url))
+          .then(entries =>
+            new Response(
+              JSON.stringify({
+                decodedBodySize: headers.get('X-Decoded-Body-Size'),
+                encodedBodySize: headers.get('X-Encoded-Body-Size'),
+                timingEntries: entries
+              }),
+              {headers: {'Content-Type': 'text/html'}})));
   });

diff --git a/third_party/WebKit/LayoutTests/fast/beacon/beacon-basic-expected.txt b/third_party/WebKit/LayoutTests/fast/beacon/beacon-basic-expected.txt
index 17c5cb1..33d164ec 100644
--- a/third_party/WebKit/LayoutTests/fast/beacon/beacon-basic-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/beacon/beacon-basic-expected.txt

@@ -8,6 +8,7 @@
 PASS navigator.sendBeacon() threw exception TypeError: Failed to execute 'sendBeacon' on 'Navigator': 1 argument required, but only 0 present..
 PASS navigator.sendBeacon('http:') threw exception TypeError: Failed to execute 'sendBeacon' on 'Navigator': The URL argument is ill-formed or unsupported..
 PASS navigator.sendBeacon('javascript:alert(1);') threw exception TypeError: Failed to execute 'sendBeacon' on 'Navigator': Beacons are only supported over HTTP(S)..
+PASS navigator.sendBeacon('https:', new Uint8Array(new SharedArrayBuffer(10))) threw exception TypeError: Failed to execute 'sendBeacon' on 'Navigator': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/fast/css/fontface-arraybuffer-expected.txt b/third_party/WebKit/LayoutTests/fast/css/fontface-arraybuffer-expected.txt
index 549324c..26e246e 100644
--- a/third_party/WebKit/LayoutTests/fast/css/fontface-arraybuffer-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/css/fontface-arraybuffer-expected.txt

@@ -5,6 +5,7 @@
 
 PASS face1.status is "loaded"
 PASS face2.status is "loaded"
+PASS rejectionValue.name is "TypeError"
 PASS face3.status is "error"
 PASS rejectionValue.name is "SyntaxError"
 PASS document.getElementById('FontFromArrayBuffer').offsetWidth is document.getElementById('ref').offsetWidth

diff --git a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-matrix-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-matrix-expected.txt
index bdf0090..de7b170 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-matrix-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/geometry-interfaces-dom-matrix-expected.txt

@@ -14,6 +14,7 @@
 PASS DOMMatrix fromFloat*Array - invalid array size of nearby 6
 PASS DOMMatrix fromFloat*Array - invalid array size of nearby 16
 PASS DOMMatrix fromFloat*Array - invalid array size
+PASS DOMMatrix fromFloat*Array - can't use SharedArrayBuffer view
 PASS DOMMatrix.fromMatrix() with no parameter
 PASS DOMMatrix.fromMatrix() with null
 PASS DOMMatrix.fromMatrix() with undefined

diff --git a/third_party/WebKit/LayoutTests/fast/encoding/api/sharedarraybuffer.html b/third_party/WebKit/LayoutTests/fast/encoding/api/sharedarraybuffer.html
index 161b546..02e9615 100644
--- a/third_party/WebKit/LayoutTests/fast/encoding/api/sharedarraybuffer.html
+++ b/third_party/WebKit/LayoutTests/fast/encoding/api/sharedarraybuffer.html

@@ -6,7 +6,7 @@
 if (window.SharedArrayBuffer) {
   test(() => {
     const decoder = new TextDecoder('utf-8');
-    assert_throws(null, () => {
+    assert_throws(new TypeError, () => {
       decoder.decode(new Uint8Array(new SharedArrayBuffer(4)));
     }, 'constructing TextDecoder with SharedArrayBuffer view should throw');
   }, 'decoding SharedArrayBuffer');

diff --git a/third_party/WebKit/LayoutTests/fast/events/constructors/midi-message-event-constructor-expected.txt b/third_party/WebKit/LayoutTests/fast/events/constructors/midi-message-event-constructor-expected.txt
index 5e399a2..14b8b2b 100644
--- a/third_party/WebKit/LayoutTests/fast/events/constructors/midi-message-event-constructor-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/events/constructors/midi-message-event-constructor-expected.txt

@@ -14,6 +14,7 @@
 PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).bubbles is true
 PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).cancelable is true
 PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).data == '0,0,0' is true
+PASS new MIDIMessageEvent('eventType', { data: data }) threw exception TypeError: Failed to construct 'MIDIMessageEvent': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/fast/files/blob-constructor-expected.txt b/third_party/WebKit/LayoutTests/fast/files/blob-constructor-expected.txt
index 0aae9c8..f3fe4d0 100644
--- a/third_party/WebKit/LayoutTests/fast/files/blob-constructor-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/files/blob-constructor-expected.txt

@@ -30,6 +30,7 @@
 PASS new Blob([(new Float64Array(100)).buffer]).size is 800
 PASS new Blob([(new Float64Array(100)).buffer, (new Int32Array(100)).buffer, (new Uint8Array(100)).buffer, (new DataView(new ArrayBuffer(100))).buffer]).size is 1400
 PASS new Blob([new Blob([(new Int32Array(100)).buffer]), (new Uint8Array(100)).buffer, (new Float32Array(100)).buffer, (new DataView(new ArrayBuffer(100))).buffer]).size is 1000
+PASS new Blob([new Uint8Array(new SharedArrayBuffer(4))]) threw exception TypeError: Failed to construct 'Blob': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt b/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt
index 1b02504..b86c1a0 100644
--- a/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt

@@ -39,6 +39,7 @@
 PASS data.byteLength is 10
 PASS array[0] is 1
 PASS array[9] is 10
+PASS dc.send(new Uint8Array(new SharedArrayBuffer(16))); threw exception TypeError: Failed to execute 'send' on 'RTCDataChannel': The provided ArrayBufferView value must not be shared..
 PASS dc_onclose was called
 PASS dc.readyState is 'closed'
 PASS successfullyParsed is true

diff --git a/third_party/WebKit/LayoutTests/fast/workers/worker-atomics-wait-expected.txt b/third_party/WebKit/LayoutTests/fast/workers/worker-atomics-wait-expected.txt
index f10bb142..43d4b94b 100644
--- a/third_party/WebKit/LayoutTests/fast/workers/worker-atomics-wait-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/workers/worker-atomics-wait-expected.txt

@@ -1,4 +1,6 @@
 Test that Atomics.wait is not allowed on the main thread.
 
-SharedArrayBuffers are not enabled -- skipping test.
+PASS: Calling Atomics.wait on the main thread throws.
+PASS: Atomics.wait is allowed in a worker.
+DONE
 

diff --git a/third_party/WebKit/LayoutTests/fast/workers/worker-sharedarraybuffer-transfer-expected.txt b/third_party/WebKit/LayoutTests/fast/workers/worker-sharedarraybuffer-transfer-expected.txt
index 64bf5d6..e25db6bf 100644
--- a/third_party/WebKit/LayoutTests/fast/workers/worker-sharedarraybuffer-transfer-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/workers/worker-sharedarraybuffer-transfer-expected.txt

@@ -1,4 +1,73 @@
 Test sharing SharedArrayBuffers between dedicated workers.
 
-SharedArrayBuffers are not enabled -- skipping test.
+Running SharedArrayBuffer test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred data is OK.
+Running Int8Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Uint8Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Uint8ClampedArray test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Int16Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Uint16Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Int32Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Uint32Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Float32Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running Float64Array test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: SharedArrayBuffer not neutered during transfer.
+PASS: Original data not changed during transfer.
+PASS: Transferred array type is OK.
+PASS: Transferred data is OK.
+Running SendSharedArrayBufferTwice test case
+PASS: Transferred data is OK.
+Running TransferArrayBufferAndSharedArrayBuffer test case
+PASS: ArrayBuffer was neutered during transfer.
+PASS: Transferred data is OK.
+PASS: Transferred data is OK.
+Running SharedArrayBufferInTransferListViaMessagePort test case
+PASS: Passing SharedArrayBuffer in the transfer list threw.
+PASS: ArrayBuffer 'ab1' was not neutered.
+PASS: ArrayBuffer 'ab2' was not neutered.
+DONE
 

diff --git a/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-send-sharedarraybuffer.html b/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-send-sharedarraybuffer.html
index 9f02118..cab77ef 100644
--- a/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-send-sharedarraybuffer.html
+++ b/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-send-sharedarraybuffer.html

@@ -8,7 +8,7 @@
     const xhr = new XMLHttpRequest();
     xhr.open('POST', '/foo.html');
 
-    assert_throws(null, () => {
+    assert_throws(new TypeError, () => {
       xhr.send(new Uint8Array(new SharedArrayBuffer(32)));
     }, 'send() of SharedArrayBuffer view should throw');
   }, 'sending SharedArrayBuffer');

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-gen-property-trees/paint/invalidation/scroll/composited-iframe-scroll-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-gen-property-trees/paint/invalidation/scroll/composited-iframe-scroll-repaint-expected.txt
new file mode 100644
index 0000000..4e0f7c45
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-gen-property-trees/paint/invalidation/scroll/composited-iframe-scroll-repaint-expected.txt

@@ -0,0 +1,90 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "drawsContent": false,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "Scrolling Layer",
+      "bounds": [800, 600],
+      "drawsContent": false
+    },
+    {
+      "name": "Scrolling Contents Layer",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutIFrame IFRAME",
+      "position": [8, 8],
+      "bounds": [304, 154]
+    },
+    {
+      "name": "LayoutView #document",
+      "position": [10, 10],
+      "bounds": [300, 150],
+      "drawsContent": false,
+      "backgroundColor": "#EEEEEE"
+    },
+    {
+      "name": "Scrolling Layer",
+      "position": [10, 10],
+      "bounds": [300, 150],
+      "drawsContent": false
+    },
+    {
+      "name": "Scrolling Contents Layer",
+      "position": [10, 10],
+      "bounds": [300, 516],
+      "backgroundColor": "#EEEEEE",
+      "transform": 1
+    },
+    {
+      "name": "LayoutBlockFlow BODY",
+      "bounds": [284, 500],
+      "transform": 2
+    },
+    {
+      "name": "Overflow Controls Host Layer",
+      "position": [10, 10],
+      "bounds": [300, 150],
+      "drawsContent": false
+    },
+    {
+      "name": "Horizontal Scrollbar Layer",
+      "position": [10, 160],
+      "bounds": [300, 0]
+    },
+    {
+      "name": "Vertical Scrollbar Layer",
+      "position": [310, 10],
+      "bounds": [0, 150]
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [0, -20, 0, 1]
+      ],
+      "flattenInheritedTransform": false
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [18, 18, 0, 1]
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/http/tests/lazyload/js-image.html b/third_party/WebKit/LayoutTests/http/tests/lazyload/js-image.html
new file mode 100644
index 0000000..212c7ba
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/lazyload/js-image.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="placeholder.js"></script>
+
+<body>
+  <div style="height:10000px;"></div>
+</body>
+
+<script>
+  async_test(function(t) {
+    const img = new Image();
+    img.onload = t.step_func_done(function() {
+      assert_true(is_image_fully_loaded(img));
+    });
+    img.src = '../loading/resources/base-image1.png';
+  }, "Test that load event is fired for JS Image() fetches");
+
+  async_test(function(t) {
+    const attached_img = document.createElement("IMG");
+    document.body.appendChild(attached_img);
+    attached_img.onload = t.step_func_done(function() {
+      assert_true(is_image_fully_loaded(attached_img));
+    });
+    attached_img.src = "../loading/resources/base-image2.png";
+  }, "Test that load event is fired for <img> created via JS and attached below viewport");
+</script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/lazyload/lazy.html b/third_party/WebKit/LayoutTests/http/tests/lazyload/lazy.html
new file mode 100644
index 0000000..1ffb625
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/lazyload/lazy.html

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="placeholder.js"></script>
+
+<body>
+  <img id="in_viewport" src='../loading/resources/base-image1.png'>
+  <div style="height:10000px;"></div>
+  <img id="below_viewport" src='../loading/resources/base-image2.png'>
+</body>
+
+<script>
+  var in_viewport_element = document.getElementById("in_viewport");
+  var below_viewport_element = document.getElementById("below_viewport");
+  async_test(function(t) {
+    window.addEventListener("load", t.step_func_done());
+  }, "Test that document load event is fired");
+
+  async_test(function(t) {
+    in_viewport_element.addEventListener("load",
+      t.step_func_done(function() {
+        assert_true(is_image_fully_loaded(in_viewport_element));
+      }));
+  }, "Test that <img> in viewport is loaded, and not a placeholder");
+
+  async_test(function(t) {
+    var complete = 0;
+    var onload_callback = function() {
+      if (++complete == 2) {
+        // Document and the above viewport image has loaded.
+        assert_false(is_image_fully_loaded(below_viewport_element));
+        t.done();
+      }
+    };
+    window.addEventListener("load", t.step_func(onload_callback));
+    in_viewport_element.addEventListener("load",
+      t.step_func(onload_callback));
+    below_viewport_element.addEventListener("load",
+      t.unreached_func("Load event should not be fired for below viewport image"));
+  }, "Test that <img> below viewport is a placeholder, with lazyimage enabled");
+</script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/lazyload/placeholder.js b/third_party/WebKit/LayoutTests/http/tests/lazyload/placeholder.js
new file mode 100644
index 0000000..e3a2236
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/lazyload/placeholder.js

@@ -0,0 +1,16 @@
+// Returns if the image is complete and fully loaded as a non-placeholder image.
+function is_image_fully_loaded(image) {
+  if (!image.complete) {
+    return false;
+  }
+
+  let canvas = document.createElement('canvas');
+  canvas.width = canvas.height = 1;
+  let canvasContext = canvas.getContext("2d");
+  canvasContext.drawImage(image, 0, 0);
+  let data = canvasContext.getImageData(0, 0, canvas.width, canvas.height).data;
+
+  // Fully loaded image should not be a placeholder which is drawn as a
+  // translucent gray rectangle in placeholder_image.cc
+  return data[0] != 0xd9 || data[1] != 0xd9 || data[2] != 0xd9;
+}

diff --git a/third_party/WebKit/LayoutTests/http/tests/lazyload/scroll.html b/third_party/WebKit/LayoutTests/http/tests/lazyload/scroll.html
new file mode 100644
index 0000000..499928f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/lazyload/scroll.html

@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="placeholder.js"></script>
+
+<body>
+  <img id="in_viewport" src='../loading/resources/base-image1.png'>
+  <div style="height:10000px;"></div>
+  <img id="below_viewport" src='../loading/resources/base-image2.png'>
+</body>
+
+<script>
+  var in_viewport_element = document.getElementById("in_viewport");
+  var below_viewport_element = document.getElementById("below_viewport");
+  async_test(function(t) {
+    window.addEventListener("load", t.step_func_done());
+  }, "Test that document load event is fired");
+
+  async_test(function(t) {
+    in_viewport_element.addEventListener("load",
+      t.step_func_done(function() {
+        assert_true(is_image_fully_loaded(in_viewport_element));
+      }));
+  }, "Test that <img> in viewport is loaded, and not a placeholder");
+
+  async_test(function(t) {
+    in_viewport_element.addEventListener("load", t.step_func(function() {
+      below_viewport_element.scrollIntoView();
+    }));
+    below_viewport_element.addEventListener("load",
+      t.step_func_done(function() {
+        assert_true(is_image_fully_loaded(below_viewport_element));
+      }));
+  }, "Test that <img> below viewport is loaded when scrolled near, and not a placeholder");
+</script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt b/third_party/WebKit/LayoutTests/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt
index d07266d..d908d84 100644
--- a/third_party/WebKit/LayoutTests/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt

@@ -1,37 +1,37 @@
 CONSOLE MESSAGE: line 13: List all interfaces in the animation worklet global scope.
-CONSOLE MESSAGE: line 151: interface AnimationWorkletGlobalScope : WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface ByteLengthQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface CountQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface EffectProxy
-CONSOLE MESSAGE: line 151:     getter localTime
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter localTime
-CONSOLE MESSAGE: line 151: interface ReadableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method cancel
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getReader
-CONSOLE MESSAGE: line 151:     method pipeThrough
-CONSOLE MESSAGE: line 151:     method pipeTo
-CONSOLE MESSAGE: line 151:     method tee
-CONSOLE MESSAGE: line 151: interface TransformStream
-CONSOLE MESSAGE: line 151:     getter readable
-CONSOLE MESSAGE: line 151:     getter writable
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WritableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method abort
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getWriter
-CONSOLE MESSAGE: line 151: global object
-CONSOLE MESSAGE: line 151:     attribute console
-CONSOLE MESSAGE: line 151:     method gc
-CONSOLE MESSAGE: line 151:     method registerAnimator
+CONSOLE MESSAGE: line 153: interface AnimationWorkletGlobalScope : WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface ByteLengthQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface CountQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface EffectProxy
+CONSOLE MESSAGE: line 153:     getter localTime
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter localTime
+CONSOLE MESSAGE: line 153: interface ReadableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method cancel
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getReader
+CONSOLE MESSAGE: line 153:     method pipeThrough
+CONSOLE MESSAGE: line 153:     method pipeTo
+CONSOLE MESSAGE: line 153:     method tee
+CONSOLE MESSAGE: line 153: interface TransformStream
+CONSOLE MESSAGE: line 153:     getter readable
+CONSOLE MESSAGE: line 153:     getter writable
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WritableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method abort
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getWriter
+CONSOLE MESSAGE: line 153: global object
+CONSOLE MESSAGE: line 153:     attribute console
+CONSOLE MESSAGE: line 153:     method gc
+CONSOLE MESSAGE: line 153:     method registerAnimator
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/push_messaging/resources/pushmessagedata-worker.js b/third_party/WebKit/LayoutTests/http/tests/push_messaging/resources/pushmessagedata-worker.js
index f330a6f..1350f61 100644
--- a/third_party/WebKit/LayoutTests/http/tests/push_messaging/resources/pushmessagedata-worker.js
+++ b/third_party/WebKit/LayoutTests/http/tests/push_messaging/resources/pushmessagedata-worker.js

@@ -111,7 +111,7 @@
 
 if (self.SharedArrayBuffer) {
     test(function() {
-        assert_throws(null, () => {
+        assert_throws(new TypeError, () => {
             createPushMessageData(new Uint8Array(new SharedArrayBuffer(16)));
         });
     }, 'PushMessageData throws when passed SharedArrayBuffer view.');

diff --git a/third_party/WebKit/LayoutTests/http/tests/websocket/send-arraybufferview-expected.txt b/third_party/WebKit/LayoutTests/http/tests/websocket/send-arraybufferview-expected.txt
index e939eae9..f4970fe 100644
--- a/third_party/WebKit/LayoutTests/http/tests/websocket/send-arraybufferview-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/websocket/send-arraybufferview-expected.txt

@@ -2,6 +2,7 @@
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
+PASS ws.send(createSharedArrayBufferView()) threw exception TypeError: Failed to execute 'send' on 'WebSocket': The provided ArrayBufferView value must not be shared..
 PASS PASS: Message #0.
 PASS PASS: Message #1.
 PASS PASS: Message #2.

diff --git a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
index 895a9ab1..cee77c52 100644
--- a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt

@@ -1,506 +1,506 @@
 CONSOLE MESSAGE: line 10: This test logs exposed APIs once from each PaintWorkletGlobalScope
-CONSOLE MESSAGE: line 151: interface ByteLengthQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface CSSImageValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSKeywordValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter value
-CONSOLE MESSAGE: line 151: interface CSSMathInvert : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathMax : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathMin : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathNegate : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathProduct : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathSum : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathValue : CSSNumericValue
-CONSOLE MESSAGE: line 151:     getter operator
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMatrixComponent : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter matrix
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter matrix
-CONSOLE MESSAGE: line 151: interface CSSNumericArray
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSNumericValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     method add
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method div
-CONSOLE MESSAGE: line 151:     method equals
-CONSOLE MESSAGE: line 151:     method max
-CONSOLE MESSAGE: line 151:     method min
-CONSOLE MESSAGE: line 151:     method mul
-CONSOLE MESSAGE: line 151:     method sub
-CONSOLE MESSAGE: line 151:     method to
-CONSOLE MESSAGE: line 151:     method toSum
-CONSOLE MESSAGE: line 151:     method type
-CONSOLE MESSAGE: line 151: interface CSSPerspective : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter length
-CONSOLE MESSAGE: line 151: interface CSSPositionValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151: interface CSSRotate : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter angle
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter angle
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSScale : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSSkew : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter ax
-CONSOLE MESSAGE: line 151:     getter ay
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter ax
-CONSOLE MESSAGE: line 151:     setter ay
-CONSOLE MESSAGE: line 151: interface CSSStyleValue
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method toString
-CONSOLE MESSAGE: line 151: interface CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter is2D
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method toMatrix
-CONSOLE MESSAGE: line 151:     method toString
-CONSOLE MESSAGE: line 151:     setter is2D
-CONSOLE MESSAGE: line 151: interface CSSTransformValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter is2D
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method toMatrix
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSTranslate : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSUnitValue : CSSNumericValue
-CONSOLE MESSAGE: line 151:     getter unit
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter value
-CONSOLE MESSAGE: line 151: interface CSSUnparsedValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSVariableReferenceValue
-CONSOLE MESSAGE: line 151:     getter fallback
-CONSOLE MESSAGE: line 151:     getter variable
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter variable
-CONSOLE MESSAGE: line 151: interface CountQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface PaintRenderingContext2D
-CONSOLE MESSAGE: line 151:     getter fillStyle
-CONSOLE MESSAGE: line 151:     getter filter
-CONSOLE MESSAGE: line 151:     getter globalAlpha
-CONSOLE MESSAGE: line 151:     getter globalCompositeOperation
-CONSOLE MESSAGE: line 151:     getter imageSmoothingEnabled
-CONSOLE MESSAGE: line 151:     getter imageSmoothingQuality
-CONSOLE MESSAGE: line 151:     getter lineCap
-CONSOLE MESSAGE: line 151:     getter lineDashOffset
-CONSOLE MESSAGE: line 151:     getter lineJoin
-CONSOLE MESSAGE: line 151:     getter lineWidth
-CONSOLE MESSAGE: line 151:     getter miterLimit
-CONSOLE MESSAGE: line 151:     getter shadowBlur
-CONSOLE MESSAGE: line 151:     getter shadowColor
-CONSOLE MESSAGE: line 151:     getter shadowOffsetX
-CONSOLE MESSAGE: line 151:     getter shadowOffsetY
-CONSOLE MESSAGE: line 151:     getter strokeStyle
-CONSOLE MESSAGE: line 151:     method arc
-CONSOLE MESSAGE: line 151:     method arcTo
-CONSOLE MESSAGE: line 151:     method beginPath
-CONSOLE MESSAGE: line 151:     method bezierCurveTo
-CONSOLE MESSAGE: line 151:     method clearRect
-CONSOLE MESSAGE: line 151:     method clip
-CONSOLE MESSAGE: line 151:     method closePath
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method createLinearGradient
-CONSOLE MESSAGE: line 151:     method createPattern
-CONSOLE MESSAGE: line 151:     method createRadialGradient
-CONSOLE MESSAGE: line 151:     method drawImage
-CONSOLE MESSAGE: line 151:     method ellipse
-CONSOLE MESSAGE: line 151:     method fill
-CONSOLE MESSAGE: line 151:     method fillRect
-CONSOLE MESSAGE: line 151:     method getLineDash
-CONSOLE MESSAGE: line 151:     method getTransform
-CONSOLE MESSAGE: line 151:     method isPointInPath
-CONSOLE MESSAGE: line 151:     method isPointInStroke
-CONSOLE MESSAGE: line 151:     method lineTo
-CONSOLE MESSAGE: line 151:     method moveTo
-CONSOLE MESSAGE: line 151:     method quadraticCurveTo
-CONSOLE MESSAGE: line 151:     method rect
-CONSOLE MESSAGE: line 151:     method resetTransform
-CONSOLE MESSAGE: line 151:     method restore
-CONSOLE MESSAGE: line 151:     method rotate
-CONSOLE MESSAGE: line 151:     method save
-CONSOLE MESSAGE: line 151:     method scale
-CONSOLE MESSAGE: line 151:     method setLineDash
-CONSOLE MESSAGE: line 151:     method setTransform
-CONSOLE MESSAGE: line 151:     method stroke
-CONSOLE MESSAGE: line 151:     method strokeRect
-CONSOLE MESSAGE: line 151:     method transform
-CONSOLE MESSAGE: line 151:     method translate
-CONSOLE MESSAGE: line 151:     setter fillStyle
-CONSOLE MESSAGE: line 151:     setter filter
-CONSOLE MESSAGE: line 151:     setter globalAlpha
-CONSOLE MESSAGE: line 151:     setter globalCompositeOperation
-CONSOLE MESSAGE: line 151:     setter imageSmoothingEnabled
-CONSOLE MESSAGE: line 151:     setter imageSmoothingQuality
-CONSOLE MESSAGE: line 151:     setter lineCap
-CONSOLE MESSAGE: line 151:     setter lineDashOffset
-CONSOLE MESSAGE: line 151:     setter lineJoin
-CONSOLE MESSAGE: line 151:     setter lineWidth
-CONSOLE MESSAGE: line 151:     setter miterLimit
-CONSOLE MESSAGE: line 151:     setter shadowBlur
-CONSOLE MESSAGE: line 151:     setter shadowColor
-CONSOLE MESSAGE: line 151:     setter shadowOffsetX
-CONSOLE MESSAGE: line 151:     setter shadowOffsetY
-CONSOLE MESSAGE: line 151:     setter strokeStyle
-CONSOLE MESSAGE: line 151: interface PaintSize
-CONSOLE MESSAGE: line 151:     getter height
-CONSOLE MESSAGE: line 151:     getter width
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface PaintWorkletGlobalScope : WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface Path2D
-CONSOLE MESSAGE: line 151:     method addPath
-CONSOLE MESSAGE: line 151:     method arc
-CONSOLE MESSAGE: line 151:     method arcTo
-CONSOLE MESSAGE: line 151:     method bezierCurveTo
-CONSOLE MESSAGE: line 151:     method closePath
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method ellipse
-CONSOLE MESSAGE: line 151:     method lineTo
-CONSOLE MESSAGE: line 151:     method moveTo
-CONSOLE MESSAGE: line 151:     method quadraticCurveTo
-CONSOLE MESSAGE: line 151:     method rect
-CONSOLE MESSAGE: line 151: interface ReadableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method cancel
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getReader
-CONSOLE MESSAGE: line 151:     method pipeThrough
-CONSOLE MESSAGE: line 151:     method pipeTo
-CONSOLE MESSAGE: line 151:     method tee
-CONSOLE MESSAGE: line 151: interface StylePropertyMapReadOnly
-CONSOLE MESSAGE: line 151:     getter size
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method get
-CONSOLE MESSAGE: line 151:     method getAll
-CONSOLE MESSAGE: line 151:     method has
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface TransformStream
-CONSOLE MESSAGE: line 151:     getter readable
-CONSOLE MESSAGE: line 151:     getter writable
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WritableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method abort
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getWriter
-CONSOLE MESSAGE: line 151: global object
-CONSOLE MESSAGE: line 151:     attribute console
-CONSOLE MESSAGE: line 151:     getter devicePixelRatio
-CONSOLE MESSAGE: line 151:     method gc
-CONSOLE MESSAGE: line 151:     method registerPaint
-CONSOLE MESSAGE: line 151: interface ByteLengthQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface CSSImageValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSKeywordValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter value
-CONSOLE MESSAGE: line 151: interface CSSMathInvert : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathMax : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathMin : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathNegate : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathProduct : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathSum : CSSMathValue
-CONSOLE MESSAGE: line 151:     getter values
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMathValue : CSSNumericValue
-CONSOLE MESSAGE: line 151:     getter operator
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface CSSMatrixComponent : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter matrix
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter matrix
-CONSOLE MESSAGE: line 151: interface CSSNumericArray
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSNumericValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     method add
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method div
-CONSOLE MESSAGE: line 151:     method equals
-CONSOLE MESSAGE: line 151:     method max
-CONSOLE MESSAGE: line 151:     method min
-CONSOLE MESSAGE: line 151:     method mul
-CONSOLE MESSAGE: line 151:     method sub
-CONSOLE MESSAGE: line 151:     method to
-CONSOLE MESSAGE: line 151:     method toSum
-CONSOLE MESSAGE: line 151:     method type
-CONSOLE MESSAGE: line 151: interface CSSPerspective : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter length
-CONSOLE MESSAGE: line 151: interface CSSPositionValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151: interface CSSRotate : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter angle
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter angle
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSScale : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSSkew : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter ax
-CONSOLE MESSAGE: line 151:     getter ay
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter ax
-CONSOLE MESSAGE: line 151:     setter ay
-CONSOLE MESSAGE: line 151: interface CSSStyleValue
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method toString
-CONSOLE MESSAGE: line 151: interface CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter is2D
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method toMatrix
-CONSOLE MESSAGE: line 151:     method toString
-CONSOLE MESSAGE: line 151:     setter is2D
-CONSOLE MESSAGE: line 151: interface CSSTransformValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter is2D
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method toMatrix
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSTranslate : CSSTransformComponent
-CONSOLE MESSAGE: line 151:     getter x
-CONSOLE MESSAGE: line 151:     getter y
-CONSOLE MESSAGE: line 151:     getter z
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter x
-CONSOLE MESSAGE: line 151:     setter y
-CONSOLE MESSAGE: line 151:     setter z
-CONSOLE MESSAGE: line 151: interface CSSUnitValue : CSSNumericValue
-CONSOLE MESSAGE: line 151:     getter unit
-CONSOLE MESSAGE: line 151:     getter value
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter value
-CONSOLE MESSAGE: line 151: interface CSSUnparsedValue : CSSStyleValue
-CONSOLE MESSAGE: line 151:     getter length
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface CSSVariableReferenceValue
-CONSOLE MESSAGE: line 151:     getter fallback
-CONSOLE MESSAGE: line 151:     getter variable
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     setter variable
-CONSOLE MESSAGE: line 151: interface CountQueuingStrategy
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method size
-CONSOLE MESSAGE: line 151: interface PaintRenderingContext2D
-CONSOLE MESSAGE: line 151:     getter fillStyle
-CONSOLE MESSAGE: line 151:     getter filter
-CONSOLE MESSAGE: line 151:     getter globalAlpha
-CONSOLE MESSAGE: line 151:     getter globalCompositeOperation
-CONSOLE MESSAGE: line 151:     getter imageSmoothingEnabled
-CONSOLE MESSAGE: line 151:     getter imageSmoothingQuality
-CONSOLE MESSAGE: line 151:     getter lineCap
-CONSOLE MESSAGE: line 151:     getter lineDashOffset
-CONSOLE MESSAGE: line 151:     getter lineJoin
-CONSOLE MESSAGE: line 151:     getter lineWidth
-CONSOLE MESSAGE: line 151:     getter miterLimit
-CONSOLE MESSAGE: line 151:     getter shadowBlur
-CONSOLE MESSAGE: line 151:     getter shadowColor
-CONSOLE MESSAGE: line 151:     getter shadowOffsetX
-CONSOLE MESSAGE: line 151:     getter shadowOffsetY
-CONSOLE MESSAGE: line 151:     getter strokeStyle
-CONSOLE MESSAGE: line 151:     method arc
-CONSOLE MESSAGE: line 151:     method arcTo
-CONSOLE MESSAGE: line 151:     method beginPath
-CONSOLE MESSAGE: line 151:     method bezierCurveTo
-CONSOLE MESSAGE: line 151:     method clearRect
-CONSOLE MESSAGE: line 151:     method clip
-CONSOLE MESSAGE: line 151:     method closePath
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method createLinearGradient
-CONSOLE MESSAGE: line 151:     method createPattern
-CONSOLE MESSAGE: line 151:     method createRadialGradient
-CONSOLE MESSAGE: line 151:     method drawImage
-CONSOLE MESSAGE: line 151:     method ellipse
-CONSOLE MESSAGE: line 151:     method fill
-CONSOLE MESSAGE: line 151:     method fillRect
-CONSOLE MESSAGE: line 151:     method getLineDash
-CONSOLE MESSAGE: line 151:     method getTransform
-CONSOLE MESSAGE: line 151:     method isPointInPath
-CONSOLE MESSAGE: line 151:     method isPointInStroke
-CONSOLE MESSAGE: line 151:     method lineTo
-CONSOLE MESSAGE: line 151:     method moveTo
-CONSOLE MESSAGE: line 151:     method quadraticCurveTo
-CONSOLE MESSAGE: line 151:     method rect
-CONSOLE MESSAGE: line 151:     method resetTransform
-CONSOLE MESSAGE: line 151:     method restore
-CONSOLE MESSAGE: line 151:     method rotate
-CONSOLE MESSAGE: line 151:     method save
-CONSOLE MESSAGE: line 151:     method scale
-CONSOLE MESSAGE: line 151:     method setLineDash
-CONSOLE MESSAGE: line 151:     method setTransform
-CONSOLE MESSAGE: line 151:     method stroke
-CONSOLE MESSAGE: line 151:     method strokeRect
-CONSOLE MESSAGE: line 151:     method transform
-CONSOLE MESSAGE: line 151:     method translate
-CONSOLE MESSAGE: line 151:     setter fillStyle
-CONSOLE MESSAGE: line 151:     setter filter
-CONSOLE MESSAGE: line 151:     setter globalAlpha
-CONSOLE MESSAGE: line 151:     setter globalCompositeOperation
-CONSOLE MESSAGE: line 151:     setter imageSmoothingEnabled
-CONSOLE MESSAGE: line 151:     setter imageSmoothingQuality
-CONSOLE MESSAGE: line 151:     setter lineCap
-CONSOLE MESSAGE: line 151:     setter lineDashOffset
-CONSOLE MESSAGE: line 151:     setter lineJoin
-CONSOLE MESSAGE: line 151:     setter lineWidth
-CONSOLE MESSAGE: line 151:     setter miterLimit
-CONSOLE MESSAGE: line 151:     setter shadowBlur
-CONSOLE MESSAGE: line 151:     setter shadowColor
-CONSOLE MESSAGE: line 151:     setter shadowOffsetX
-CONSOLE MESSAGE: line 151:     setter shadowOffsetY
-CONSOLE MESSAGE: line 151:     setter strokeStyle
-CONSOLE MESSAGE: line 151: interface PaintSize
-CONSOLE MESSAGE: line 151:     getter height
-CONSOLE MESSAGE: line 151:     getter width
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface PaintWorkletGlobalScope : WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface Path2D
-CONSOLE MESSAGE: line 151:     method addPath
-CONSOLE MESSAGE: line 151:     method arc
-CONSOLE MESSAGE: line 151:     method arcTo
-CONSOLE MESSAGE: line 151:     method bezierCurveTo
-CONSOLE MESSAGE: line 151:     method closePath
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method ellipse
-CONSOLE MESSAGE: line 151:     method lineTo
-CONSOLE MESSAGE: line 151:     method moveTo
-CONSOLE MESSAGE: line 151:     method quadraticCurveTo
-CONSOLE MESSAGE: line 151:     method rect
-CONSOLE MESSAGE: line 151: interface ReadableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method cancel
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getReader
-CONSOLE MESSAGE: line 151:     method pipeThrough
-CONSOLE MESSAGE: line 151:     method pipeTo
-CONSOLE MESSAGE: line 151:     method tee
-CONSOLE MESSAGE: line 151: interface StylePropertyMapReadOnly
-CONSOLE MESSAGE: line 151:     getter size
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method entries
-CONSOLE MESSAGE: line 151:     method forEach
-CONSOLE MESSAGE: line 151:     method get
-CONSOLE MESSAGE: line 151:     method getAll
-CONSOLE MESSAGE: line 151:     method has
-CONSOLE MESSAGE: line 151:     method keys
-CONSOLE MESSAGE: line 151:     method values
-CONSOLE MESSAGE: line 151: interface TransformStream
-CONSOLE MESSAGE: line 151:     getter readable
-CONSOLE MESSAGE: line 151:     getter writable
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WorkletGlobalScope
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151: interface WritableStream
-CONSOLE MESSAGE: line 151:     getter locked
-CONSOLE MESSAGE: line 151:     method abort
-CONSOLE MESSAGE: line 151:     method constructor
-CONSOLE MESSAGE: line 151:     method getWriter
-CONSOLE MESSAGE: line 151: global object
-CONSOLE MESSAGE: line 151:     attribute console
-CONSOLE MESSAGE: line 151:     getter devicePixelRatio
-CONSOLE MESSAGE: line 151:     method gc
-CONSOLE MESSAGE: line 151:     method registerPaint
+CONSOLE MESSAGE: line 153: interface ByteLengthQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface CSSImageValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSKeywordValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter value
+CONSOLE MESSAGE: line 153: interface CSSMathInvert : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathMax : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathMin : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathNegate : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathProduct : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathSum : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathValue : CSSNumericValue
+CONSOLE MESSAGE: line 153:     getter operator
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMatrixComponent : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter matrix
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter matrix
+CONSOLE MESSAGE: line 153: interface CSSNumericArray
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSNumericValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     method add
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method div
+CONSOLE MESSAGE: line 153:     method equals
+CONSOLE MESSAGE: line 153:     method max
+CONSOLE MESSAGE: line 153:     method min
+CONSOLE MESSAGE: line 153:     method mul
+CONSOLE MESSAGE: line 153:     method sub
+CONSOLE MESSAGE: line 153:     method to
+CONSOLE MESSAGE: line 153:     method toSum
+CONSOLE MESSAGE: line 153:     method type
+CONSOLE MESSAGE: line 153: interface CSSPerspective : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter length
+CONSOLE MESSAGE: line 153: interface CSSPositionValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153: interface CSSRotate : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter angle
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter angle
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSScale : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSSkew : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter ax
+CONSOLE MESSAGE: line 153:     getter ay
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter ax
+CONSOLE MESSAGE: line 153:     setter ay
+CONSOLE MESSAGE: line 153: interface CSSStyleValue
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method toString
+CONSOLE MESSAGE: line 153: interface CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter is2D
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method toMatrix
+CONSOLE MESSAGE: line 153:     method toString
+CONSOLE MESSAGE: line 153:     setter is2D
+CONSOLE MESSAGE: line 153: interface CSSTransformValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter is2D
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method toMatrix
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSTranslate : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSUnitValue : CSSNumericValue
+CONSOLE MESSAGE: line 153:     getter unit
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter value
+CONSOLE MESSAGE: line 153: interface CSSUnparsedValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSVariableReferenceValue
+CONSOLE MESSAGE: line 153:     getter fallback
+CONSOLE MESSAGE: line 153:     getter variable
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter variable
+CONSOLE MESSAGE: line 153: interface CountQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface PaintRenderingContext2D
+CONSOLE MESSAGE: line 153:     getter fillStyle
+CONSOLE MESSAGE: line 153:     getter filter
+CONSOLE MESSAGE: line 153:     getter globalAlpha
+CONSOLE MESSAGE: line 153:     getter globalCompositeOperation
+CONSOLE MESSAGE: line 153:     getter imageSmoothingEnabled
+CONSOLE MESSAGE: line 153:     getter imageSmoothingQuality
+CONSOLE MESSAGE: line 153:     getter lineCap
+CONSOLE MESSAGE: line 153:     getter lineDashOffset
+CONSOLE MESSAGE: line 153:     getter lineJoin
+CONSOLE MESSAGE: line 153:     getter lineWidth
+CONSOLE MESSAGE: line 153:     getter miterLimit
+CONSOLE MESSAGE: line 153:     getter shadowBlur
+CONSOLE MESSAGE: line 153:     getter shadowColor
+CONSOLE MESSAGE: line 153:     getter shadowOffsetX
+CONSOLE MESSAGE: line 153:     getter shadowOffsetY
+CONSOLE MESSAGE: line 153:     getter strokeStyle
+CONSOLE MESSAGE: line 153:     method arc
+CONSOLE MESSAGE: line 153:     method arcTo
+CONSOLE MESSAGE: line 153:     method beginPath
+CONSOLE MESSAGE: line 153:     method bezierCurveTo
+CONSOLE MESSAGE: line 153:     method clearRect
+CONSOLE MESSAGE: line 153:     method clip
+CONSOLE MESSAGE: line 153:     method closePath
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method createLinearGradient
+CONSOLE MESSAGE: line 153:     method createPattern
+CONSOLE MESSAGE: line 153:     method createRadialGradient
+CONSOLE MESSAGE: line 153:     method drawImage
+CONSOLE MESSAGE: line 153:     method ellipse
+CONSOLE MESSAGE: line 153:     method fill
+CONSOLE MESSAGE: line 153:     method fillRect
+CONSOLE MESSAGE: line 153:     method getLineDash
+CONSOLE MESSAGE: line 153:     method getTransform
+CONSOLE MESSAGE: line 153:     method isPointInPath
+CONSOLE MESSAGE: line 153:     method isPointInStroke
+CONSOLE MESSAGE: line 153:     method lineTo
+CONSOLE MESSAGE: line 153:     method moveTo
+CONSOLE MESSAGE: line 153:     method quadraticCurveTo
+CONSOLE MESSAGE: line 153:     method rect
+CONSOLE MESSAGE: line 153:     method resetTransform
+CONSOLE MESSAGE: line 153:     method restore
+CONSOLE MESSAGE: line 153:     method rotate
+CONSOLE MESSAGE: line 153:     method save
+CONSOLE MESSAGE: line 153:     method scale
+CONSOLE MESSAGE: line 153:     method setLineDash
+CONSOLE MESSAGE: line 153:     method setTransform
+CONSOLE MESSAGE: line 153:     method stroke
+CONSOLE MESSAGE: line 153:     method strokeRect
+CONSOLE MESSAGE: line 153:     method transform
+CONSOLE MESSAGE: line 153:     method translate
+CONSOLE MESSAGE: line 153:     setter fillStyle
+CONSOLE MESSAGE: line 153:     setter filter
+CONSOLE MESSAGE: line 153:     setter globalAlpha
+CONSOLE MESSAGE: line 153:     setter globalCompositeOperation
+CONSOLE MESSAGE: line 153:     setter imageSmoothingEnabled
+CONSOLE MESSAGE: line 153:     setter imageSmoothingQuality
+CONSOLE MESSAGE: line 153:     setter lineCap
+CONSOLE MESSAGE: line 153:     setter lineDashOffset
+CONSOLE MESSAGE: line 153:     setter lineJoin
+CONSOLE MESSAGE: line 153:     setter lineWidth
+CONSOLE MESSAGE: line 153:     setter miterLimit
+CONSOLE MESSAGE: line 153:     setter shadowBlur
+CONSOLE MESSAGE: line 153:     setter shadowColor
+CONSOLE MESSAGE: line 153:     setter shadowOffsetX
+CONSOLE MESSAGE: line 153:     setter shadowOffsetY
+CONSOLE MESSAGE: line 153:     setter strokeStyle
+CONSOLE MESSAGE: line 153: interface PaintSize
+CONSOLE MESSAGE: line 153:     getter height
+CONSOLE MESSAGE: line 153:     getter width
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface PaintWorkletGlobalScope : WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface Path2D
+CONSOLE MESSAGE: line 153:     method addPath
+CONSOLE MESSAGE: line 153:     method arc
+CONSOLE MESSAGE: line 153:     method arcTo
+CONSOLE MESSAGE: line 153:     method bezierCurveTo
+CONSOLE MESSAGE: line 153:     method closePath
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method ellipse
+CONSOLE MESSAGE: line 153:     method lineTo
+CONSOLE MESSAGE: line 153:     method moveTo
+CONSOLE MESSAGE: line 153:     method quadraticCurveTo
+CONSOLE MESSAGE: line 153:     method rect
+CONSOLE MESSAGE: line 153: interface ReadableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method cancel
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getReader
+CONSOLE MESSAGE: line 153:     method pipeThrough
+CONSOLE MESSAGE: line 153:     method pipeTo
+CONSOLE MESSAGE: line 153:     method tee
+CONSOLE MESSAGE: line 153: interface StylePropertyMapReadOnly
+CONSOLE MESSAGE: line 153:     getter size
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method get
+CONSOLE MESSAGE: line 153:     method getAll
+CONSOLE MESSAGE: line 153:     method has
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface TransformStream
+CONSOLE MESSAGE: line 153:     getter readable
+CONSOLE MESSAGE: line 153:     getter writable
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WritableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method abort
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getWriter
+CONSOLE MESSAGE: line 153: global object
+CONSOLE MESSAGE: line 153:     attribute console
+CONSOLE MESSAGE: line 153:     getter devicePixelRatio
+CONSOLE MESSAGE: line 153:     method gc
+CONSOLE MESSAGE: line 153:     method registerPaint
+CONSOLE MESSAGE: line 153: interface ByteLengthQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface CSSImageValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSKeywordValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter value
+CONSOLE MESSAGE: line 153: interface CSSMathInvert : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathMax : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathMin : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathNegate : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathProduct : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathSum : CSSMathValue
+CONSOLE MESSAGE: line 153:     getter values
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMathValue : CSSNumericValue
+CONSOLE MESSAGE: line 153:     getter operator
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface CSSMatrixComponent : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter matrix
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter matrix
+CONSOLE MESSAGE: line 153: interface CSSNumericArray
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSNumericValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     method add
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method div
+CONSOLE MESSAGE: line 153:     method equals
+CONSOLE MESSAGE: line 153:     method max
+CONSOLE MESSAGE: line 153:     method min
+CONSOLE MESSAGE: line 153:     method mul
+CONSOLE MESSAGE: line 153:     method sub
+CONSOLE MESSAGE: line 153:     method to
+CONSOLE MESSAGE: line 153:     method toSum
+CONSOLE MESSAGE: line 153:     method type
+CONSOLE MESSAGE: line 153: interface CSSPerspective : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter length
+CONSOLE MESSAGE: line 153: interface CSSPositionValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153: interface CSSRotate : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter angle
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter angle
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSScale : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSSkew : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter ax
+CONSOLE MESSAGE: line 153:     getter ay
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter ax
+CONSOLE MESSAGE: line 153:     setter ay
+CONSOLE MESSAGE: line 153: interface CSSStyleValue
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method toString
+CONSOLE MESSAGE: line 153: interface CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter is2D
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method toMatrix
+CONSOLE MESSAGE: line 153:     method toString
+CONSOLE MESSAGE: line 153:     setter is2D
+CONSOLE MESSAGE: line 153: interface CSSTransformValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter is2D
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method toMatrix
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSTranslate : CSSTransformComponent
+CONSOLE MESSAGE: line 153:     getter x
+CONSOLE MESSAGE: line 153:     getter y
+CONSOLE MESSAGE: line 153:     getter z
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter x
+CONSOLE MESSAGE: line 153:     setter y
+CONSOLE MESSAGE: line 153:     setter z
+CONSOLE MESSAGE: line 153: interface CSSUnitValue : CSSNumericValue
+CONSOLE MESSAGE: line 153:     getter unit
+CONSOLE MESSAGE: line 153:     getter value
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter value
+CONSOLE MESSAGE: line 153: interface CSSUnparsedValue : CSSStyleValue
+CONSOLE MESSAGE: line 153:     getter length
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface CSSVariableReferenceValue
+CONSOLE MESSAGE: line 153:     getter fallback
+CONSOLE MESSAGE: line 153:     getter variable
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     setter variable
+CONSOLE MESSAGE: line 153: interface CountQueuingStrategy
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method size
+CONSOLE MESSAGE: line 153: interface PaintRenderingContext2D
+CONSOLE MESSAGE: line 153:     getter fillStyle
+CONSOLE MESSAGE: line 153:     getter filter
+CONSOLE MESSAGE: line 153:     getter globalAlpha
+CONSOLE MESSAGE: line 153:     getter globalCompositeOperation
+CONSOLE MESSAGE: line 153:     getter imageSmoothingEnabled
+CONSOLE MESSAGE: line 153:     getter imageSmoothingQuality
+CONSOLE MESSAGE: line 153:     getter lineCap
+CONSOLE MESSAGE: line 153:     getter lineDashOffset
+CONSOLE MESSAGE: line 153:     getter lineJoin
+CONSOLE MESSAGE: line 153:     getter lineWidth
+CONSOLE MESSAGE: line 153:     getter miterLimit
+CONSOLE MESSAGE: line 153:     getter shadowBlur
+CONSOLE MESSAGE: line 153:     getter shadowColor
+CONSOLE MESSAGE: line 153:     getter shadowOffsetX
+CONSOLE MESSAGE: line 153:     getter shadowOffsetY
+CONSOLE MESSAGE: line 153:     getter strokeStyle
+CONSOLE MESSAGE: line 153:     method arc
+CONSOLE MESSAGE: line 153:     method arcTo
+CONSOLE MESSAGE: line 153:     method beginPath
+CONSOLE MESSAGE: line 153:     method bezierCurveTo
+CONSOLE MESSAGE: line 153:     method clearRect
+CONSOLE MESSAGE: line 153:     method clip
+CONSOLE MESSAGE: line 153:     method closePath
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method createLinearGradient
+CONSOLE MESSAGE: line 153:     method createPattern
+CONSOLE MESSAGE: line 153:     method createRadialGradient
+CONSOLE MESSAGE: line 153:     method drawImage
+CONSOLE MESSAGE: line 153:     method ellipse
+CONSOLE MESSAGE: line 153:     method fill
+CONSOLE MESSAGE: line 153:     method fillRect
+CONSOLE MESSAGE: line 153:     method getLineDash
+CONSOLE MESSAGE: line 153:     method getTransform
+CONSOLE MESSAGE: line 153:     method isPointInPath
+CONSOLE MESSAGE: line 153:     method isPointInStroke
+CONSOLE MESSAGE: line 153:     method lineTo
+CONSOLE MESSAGE: line 153:     method moveTo
+CONSOLE MESSAGE: line 153:     method quadraticCurveTo
+CONSOLE MESSAGE: line 153:     method rect
+CONSOLE MESSAGE: line 153:     method resetTransform
+CONSOLE MESSAGE: line 153:     method restore
+CONSOLE MESSAGE: line 153:     method rotate
+CONSOLE MESSAGE: line 153:     method save
+CONSOLE MESSAGE: line 153:     method scale
+CONSOLE MESSAGE: line 153:     method setLineDash
+CONSOLE MESSAGE: line 153:     method setTransform
+CONSOLE MESSAGE: line 153:     method stroke
+CONSOLE MESSAGE: line 153:     method strokeRect
+CONSOLE MESSAGE: line 153:     method transform
+CONSOLE MESSAGE: line 153:     method translate
+CONSOLE MESSAGE: line 153:     setter fillStyle
+CONSOLE MESSAGE: line 153:     setter filter
+CONSOLE MESSAGE: line 153:     setter globalAlpha
+CONSOLE MESSAGE: line 153:     setter globalCompositeOperation
+CONSOLE MESSAGE: line 153:     setter imageSmoothingEnabled
+CONSOLE MESSAGE: line 153:     setter imageSmoothingQuality
+CONSOLE MESSAGE: line 153:     setter lineCap
+CONSOLE MESSAGE: line 153:     setter lineDashOffset
+CONSOLE MESSAGE: line 153:     setter lineJoin
+CONSOLE MESSAGE: line 153:     setter lineWidth
+CONSOLE MESSAGE: line 153:     setter miterLimit
+CONSOLE MESSAGE: line 153:     setter shadowBlur
+CONSOLE MESSAGE: line 153:     setter shadowColor
+CONSOLE MESSAGE: line 153:     setter shadowOffsetX
+CONSOLE MESSAGE: line 153:     setter shadowOffsetY
+CONSOLE MESSAGE: line 153:     setter strokeStyle
+CONSOLE MESSAGE: line 153: interface PaintSize
+CONSOLE MESSAGE: line 153:     getter height
+CONSOLE MESSAGE: line 153:     getter width
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface PaintWorkletGlobalScope : WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface Path2D
+CONSOLE MESSAGE: line 153:     method addPath
+CONSOLE MESSAGE: line 153:     method arc
+CONSOLE MESSAGE: line 153:     method arcTo
+CONSOLE MESSAGE: line 153:     method bezierCurveTo
+CONSOLE MESSAGE: line 153:     method closePath
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method ellipse
+CONSOLE MESSAGE: line 153:     method lineTo
+CONSOLE MESSAGE: line 153:     method moveTo
+CONSOLE MESSAGE: line 153:     method quadraticCurveTo
+CONSOLE MESSAGE: line 153:     method rect
+CONSOLE MESSAGE: line 153: interface ReadableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method cancel
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getReader
+CONSOLE MESSAGE: line 153:     method pipeThrough
+CONSOLE MESSAGE: line 153:     method pipeTo
+CONSOLE MESSAGE: line 153:     method tee
+CONSOLE MESSAGE: line 153: interface StylePropertyMapReadOnly
+CONSOLE MESSAGE: line 153:     getter size
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method entries
+CONSOLE MESSAGE: line 153:     method forEach
+CONSOLE MESSAGE: line 153:     method get
+CONSOLE MESSAGE: line 153:     method getAll
+CONSOLE MESSAGE: line 153:     method has
+CONSOLE MESSAGE: line 153:     method keys
+CONSOLE MESSAGE: line 153:     method values
+CONSOLE MESSAGE: line 153: interface TransformStream
+CONSOLE MESSAGE: line 153:     getter readable
+CONSOLE MESSAGE: line 153:     getter writable
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WorkletGlobalScope
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153: interface WritableStream
+CONSOLE MESSAGE: line 153:     getter locked
+CONSOLE MESSAGE: line 153:     method abort
+CONSOLE MESSAGE: line 153:     method constructor
+CONSOLE MESSAGE: line 153:     method getWriter
+CONSOLE MESSAGE: line 153: global object
+CONSOLE MESSAGE: line 153:     attribute console
+CONSOLE MESSAGE: line 153:     getter devicePixelRatio
+CONSOLE MESSAGE: line 153:     method gc
+CONSOLE MESSAGE: line 153:     method registerPaint
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/resources/global-interface-listing-worklet.js b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/resources/global-interface-listing-worklet.js
index aa455df..996c21e1 100644
--- a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/resources/global-interface-listing-worklet.js
+++ b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/resources/global-interface-listing-worklet.js

@@ -21,6 +21,7 @@
 var js_builtins = new Set([
     'Array',
     'ArrayBuffer',
+    'Atomics',
     'BigInt',
     'BigInt64Array',
     'BigUint64Array',
@@ -50,6 +51,7 @@
     'Reflect',
     'RegExp',
     'Set',
+    'SharedArrayBuffer',
     'String',
     'Symbol',
     'SyntaxError',

diff --git a/third_party/WebKit/LayoutTests/platform/android/crypto/random-values-expected.txt b/third_party/WebKit/LayoutTests/platform/android/crypto/random-values-expected.txt
new file mode 100644
index 0000000..b0012025
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/crypto/random-values-expected.txt

@@ -0,0 +1,13 @@
+Tests crypto.randomValues.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS 'crypto' in self is true
+PASS 'getRandomValues' in self.crypto is true
+PASS self.crypto.__proto__.hasOwnProperty('getRandomValues') is true
+PASS matchingBytes < 100 is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/crypto/subtle/importKey-badParameters-expected.txt b/third_party/WebKit/LayoutTests/platform/android/crypto/subtle/importKey-badParameters-expected.txt
new file mode 100644
index 0000000..73949bf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/crypto/subtle/importKey-badParameters-expected.txt

@@ -0,0 +1,18 @@
+Tests calling cypto.subtle.importKey with bad parameters
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+error is: TypeError: Key data must be a BufferSource for non-JWK formats
+error is: TypeError: Key data must be a BufferSource for non-JWK formats
+error is: TypeError: Algorithm: Not an object
+error is: TypeError: Invalid keyFormat argument
+error is: TypeError: Invalid keyUsages argument
+error is: TypeError: Invalid keyFormat argument
+error is: TypeError: HmacImportParams: hash: Missing or not an AlgorithmIdentifier
+error is: NotSupportedError: SHA-1: Unsupported operation: importKey
+error is: SharedArrayBuffers not enabled.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt b/third_party/WebKit/LayoutTests/platform/android/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt
rename to third_party/WebKit/LayoutTests/platform/android/external/wpt/html/infrastructure/safe-passing-of-structured-data/shared-array-buffers/nested-worker-success-dedicatedworker-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/css/fontface-arraybuffer-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/css/fontface-arraybuffer-expected.txt
new file mode 100644
index 0000000..549324c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/css/fontface-arraybuffer-expected.txt

@@ -0,0 +1,17 @@
+Tests ArrayBuffer / ArrayBufferView constructors of FontFace.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS face1.status is "loaded"
+PASS face2.status is "loaded"
+PASS face3.status is "error"
+PASS rejectionValue.name is "SyntaxError"
+PASS document.getElementById('FontFromArrayBuffer').offsetWidth is document.getElementById('ref').offsetWidth
+PASS document.getElementById('FontFromArrayBufferView').offsetWidth is document.getElementById('ref').offsetWidth
+PASS successfullyParsed is true
+
+TEST COMPLETE
+abc
+abc
+abc

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/dom/geometry-interfaces-dom-matrix-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/dom/geometry-interfaces-dom-matrix-expected.txt
new file mode 100644
index 0000000..bdf0090
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/dom/geometry-interfaces-dom-matrix-expected.txt

@@ -0,0 +1,30 @@
+This is a testharness.js-based test.
+Harness Error. harness_status.status = 1 , harness_status.message = 1 duplicate test name: "DOMMatrix(numberSequence) constructor"
+PASS DOMMatrix() constructor
+PASS DOMMatrix fromFloat32Array - 2D matrix
+PASS DOMMatrix fromFloat64Array - 2D matrix
+PASS DOMMatrix fromFloat32Array - 3D matrix
+PASS DOMMatrix fromFloat64Array - 3D matrix
+PASS DOMMatrix(transformList) - emptyString
+PASS DOMMatrix(transformList) - transformList
+PASS DOMMatrix(numberSequence) constructor
+PASS DOMMatrix(numberSequence) constructor
+PASS DOMMatrix attributes
+PASS DOMMatrix.is2D can never be set to 'true' when it was set to 'false' before calling setMatrixValue()
+PASS DOMMatrix fromFloat*Array - invalid array size of nearby 6
+PASS DOMMatrix fromFloat*Array - invalid array size of nearby 16
+PASS DOMMatrix fromFloat*Array - invalid array size
+PASS DOMMatrix.fromMatrix() with no parameter
+PASS DOMMatrix.fromMatrix() with null
+PASS DOMMatrix.fromMatrix() with undefined
+PASS DOMMatrix.fromMatrix() with empty object
+PASS DOMMatrix.fromMatrix({a: 1, b: 2, c: 3, d: 4, e: 5, f: 6}) should create a 2D DOMMatrix
+PASS DOMMatrix.fromMatrix({m11: 1, m22: 2, m33: 3, m44: 4, m23: 5, m43: 6}) should create a 3D DOMMatrix
+PASS If 2d related properties don't be set, should set to fallback
+PASS DOMMatrix.fromMatrix(): NaN test
+PASS DOMMatrix toJSON() - identity matrix
+PASS DOMMatrix toJSON() - 2D matrix
+PASS DOMMatrix toJSON() - 3D matrix
+PASS DOMMatrix.fromMatrix(): Exception test
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/events/constructors/midi-message-event-constructor-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/events/constructors/midi-message-event-constructor-expected.txt
new file mode 100644
index 0000000..5e399a2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/events/constructors/midi-message-event-constructor-expected.txt

@@ -0,0 +1,20 @@
+This tests the constructor for the MIDIMessageEvent DOM class.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS new MIDIMessageEvent('eventType').bubbles is false
+PASS new MIDIMessageEvent('eventType').cancelable is false
+PASS new MIDIMessageEvent('eventType').data is null
+PASS new MIDIMessageEvent('eventType', { bubbles: false }).bubbles is false
+PASS new MIDIMessageEvent('eventType', { bubbles: true }).bubbles is true
+PASS new MIDIMessageEvent('eventType', { cancelable: false }).cancelable is false
+PASS new MIDIMessageEvent('eventType', { cancelable: true }).cancelable is true
+PASS new MIDIMessageEvent('eventType', { data: data }).data == '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0' is true
+PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).bubbles is true
+PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).cancelable is true
+PASS new MIDIMessageEvent('eventType', { bubbles: true, cancelable: true, data: data }).data == '0,0,0' is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/files/blob-constructor-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/files/blob-constructor-expected.txt
new file mode 100644
index 0000000..0aae9c8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/files/blob-constructor-expected.txt

@@ -0,0 +1,36 @@
+Test the Blob constructor.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS (new Blob([])).lastModified is undefined
+PASS (new Blob([], {})).lastModified is undefined
+PASS (new Blob([], {lastModified: new Date()})).lastModified is undefined
+PASS new Blob([new DataView(new ArrayBuffer(100))]).size is 100
+PASS new Blob([new Uint8Array(100)]).size is 100
+PASS new Blob([new Uint8ClampedArray(100)]).size is 100
+PASS new Blob([new Uint16Array(100)]).size is 200
+PASS new Blob([new Uint32Array(100)]).size is 400
+PASS new Blob([new Int8Array(100)]).size is 100
+PASS new Blob([new Int16Array(100)]).size is 200
+PASS new Blob([new Int32Array(100)]).size is 400
+PASS new Blob([new Float32Array(100)]).size is 400
+PASS new Blob([new Float64Array(100)]).size is 800
+PASS new Blob([new Float64Array(100), new Int32Array(100), new Uint8Array(100), new DataView(new ArrayBuffer(100))]).size is 1400
+PASS new Blob([new Blob([new Int32Array(100)]), new Uint8Array(100), new Float32Array(100), new DataView(new ArrayBuffer(100))]).size is 1000
+PASS new Blob([(new DataView(new ArrayBuffer(100))).buffer]).size is 100
+PASS new Blob([(new Uint8Array(100)).buffer]).size is 100
+PASS new Blob([(new Uint8ClampedArray(100)).buffer]).size is 100
+PASS new Blob([(new Uint16Array(100)).buffer]).size is 200
+PASS new Blob([(new Uint32Array(100)).buffer]).size is 400
+PASS new Blob([(new Int8Array(100)).buffer]).size is 100
+PASS new Blob([(new Int16Array(100)).buffer]).size is 200
+PASS new Blob([(new Int32Array(100)).buffer]).size is 400
+PASS new Blob([(new Float32Array(100)).buffer]).size is 400
+PASS new Blob([(new Float64Array(100)).buffer]).size is 800
+PASS new Blob([(new Float64Array(100)).buffer, (new Int32Array(100)).buffer, (new Uint8Array(100)).buffer, (new DataView(new ArrayBuffer(100))).buffer]).size is 1400
+PASS new Blob([new Blob([(new Int32Array(100)).buffer]), (new Uint8Array(100)).buffer, (new Float32Array(100)).buffer, (new DataView(new ArrayBuffer(100))).buffer]).size is 1000
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt
new file mode 100644
index 0000000..1b02504
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/peerconnection/RTCPeerConnection-datachannel-expected.txt

@@ -0,0 +1,47 @@
+CONSOLE WARNING: line 1: maxRetransmitTime is deprecated and will be removed in M70, around October 2018. Please use maxPacketLifeTime instead. See https://www.chromestatus.com/features/5198350873788416 for more details.
+Tests RTCDataChannel.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS dc = pc.createDataChannel("label1"); did not throw exception.
+PASS dc.reliable is true
+PASS dc = pc.createDataChannel("label2", {}); did not throw exception.
+PASS dc.reliable is true
+PASS dc = pc.createDataChannel("label3", {ordered:true}); did not throw exception.
+PASS dc.reliable is true
+PASS dc = pc.createDataChannel("label3", {ordered:false}); did not throw exception.
+PASS dc.reliable is true
+PASS dc.ordered is false
+PASS dc = pc.createDataChannel("label3", {maxRetransmits:0}); did not throw exception.
+PASS dc.reliable is false
+PASS dc = pc.createDataChannel("label3", {maxRetransmitTime:0}); did not throw exception.
+PASS dc.reliable is false
+PASS dc = pc.createDataChannel("label"); did not throw exception.
+PASS dc.readyState is 'connecting'
+PASS pc is connected
+PASS dc_onopen was called
+PASS dc.readyState is 'open'
+PASS dc.label is 'label'
+PASS pc_ondatachannel was called
+PASS dc2.label is 'label'
+PASS dc.send('xyzzy'); did not throw exception.
+PASS dc_onmessage_string was called
+PASS data is 'xyzzy'
+PASS dc.send(buffer); did not throw exception.
+PASS dc_onmessage_arraybuffer was called
+PASS data.byteLength is 2
+PASS array[0] is 17
+PASS array[1] is 19
+PASS data.byteLength is 12
+PASS dc.send(shrunkView); did not throw exception.
+PASS dc_onmessage_dataview was called
+PASS data.byteLength is 10
+PASS array[0] is 1
+PASS array[9] is 10
+PASS dc_onclose was called
+PASS dc.readyState is 'closed'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-atomics-wait-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-atomics-wait-expected.txt
new file mode 100644
index 0000000..f10bb142
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-atomics-wait-expected.txt

@@ -0,0 +1,4 @@
+Test that Atomics.wait is not allowed on the main thread.
+
+SharedArrayBuffers are not enabled -- skipping test.
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-sharedarraybuffer-transfer-expected.txt b/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-sharedarraybuffer-transfer-expected.txt
new file mode 100644
index 0000000..64bf5d6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/fast/workers/worker-sharedarraybuffer-transfer-expected.txt

@@ -0,0 +1,4 @@
+Test sharing SharedArrayBuffers between dedicated workers.
+
+SharedArrayBuffers are not enabled -- skipping test.
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt b/third_party/WebKit/LayoutTests/platform/android/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt
new file mode 100644
index 0000000..d07266d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/http/tests/origin_trials/webexposed/animationworklet-origin-trial-interfaces-worklet-scope-expected.txt

@@ -0,0 +1,37 @@
+CONSOLE MESSAGE: line 13: List all interfaces in the animation worklet global scope.
+CONSOLE MESSAGE: line 151: interface AnimationWorkletGlobalScope : WorkletGlobalScope
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151: interface ByteLengthQueuingStrategy
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151:     method size
+CONSOLE MESSAGE: line 151: interface CountQueuingStrategy
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151:     method size
+CONSOLE MESSAGE: line 151: interface EffectProxy
+CONSOLE MESSAGE: line 151:     getter localTime
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151:     setter localTime
+CONSOLE MESSAGE: line 151: interface ReadableStream
+CONSOLE MESSAGE: line 151:     getter locked
+CONSOLE MESSAGE: line 151:     method cancel
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151:     method getReader
+CONSOLE MESSAGE: line 151:     method pipeThrough
+CONSOLE MESSAGE: line 151:     method pipeTo
+CONSOLE MESSAGE: line 151:     method tee
+CONSOLE MESSAGE: line 151: interface TransformStream
+CONSOLE MESSAGE: line 151:     getter readable
+CONSOLE MESSAGE: line 151:     getter writable
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151: interface WorkletGlobalScope
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151: interface WritableStream
+CONSOLE MESSAGE: line 151:     getter locked
+CONSOLE MESSAGE: line 151:     method abort
+CONSOLE MESSAGE: line 151:     method constructor
+CONSOLE MESSAGE: line 151:     method getWriter
+CONSOLE MESSAGE: line 151: global object
+CONSOLE MESSAGE: line 151:     attribute console
+CONSOLE MESSAGE: line 151:     method gc
+CONSOLE MESSAGE: line 151:     method registerAnimator
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/http/tests/websocket/send-arraybufferview-expected.txt b/third_party/WebKit/LayoutTests/platform/android/http/tests/websocket/send-arraybufferview-expected.txt
new file mode 100644
index 0000000..e939eae9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/http/tests/websocket/send-arraybufferview-expected.txt

@@ -0,0 +1,12 @@
+WebSocket: Send ArrayBufferViews.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+PASS PASS: Message #0.
+PASS PASS: Message #1.
+PASS PASS: Message #2.
+PASS closeEvent.wasClean is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/virtual/threaded/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt b/third_party/WebKit/LayoutTests/platform/android/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/virtual/threaded/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
rename to third_party/WebKit/LayoutTests/platform/android/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt


diff --git a/third_party/WebKit/LayoutTests/platform/android/webaudio/dom-exceptions-expected.txt b/third_party/WebKit/LayoutTests/platform/android/webaudio/dom-exceptions-expected.txt
new file mode 100644
index 0000000..76d29f7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/webaudio/dom-exceptions-expected.txt

@@ -0,0 +1,247 @@
+CONSOLE WARNING: line 39: The Web Audio autoplay policy will be re-enabled in Chrome 70 (October 2018). Please check that your website is compatible with it. https://goo.gl/7K7WLu
+CONSOLE WARNING: line 43: The Web Audio autoplay policy will be re-enabled in Chrome 70 (October 2018). Please check that your website is compatible with it. https://goo.gl/7K7WLu
+CONSOLE WARNING: line 347: The provided value 'fancy' is not a valid enum value of type ChannelCountMode.
+CONSOLE WARNING: line 353: The provided value 'undefined' is not a valid enum value of type ChannelInterpretation.
+CONSOLE WARNING: line 523: The provided value '9x' is not a valid enum value of type OverSampleType.
+CONSOLE WARNING: line 769: The provided value 'junk' is not a valid enum value of type ChannelCountMode.
+CONSOLE WARNING: line 800: The provided value 'junk' is not a valid enum value of type ChannelCountMode.
+This is a testharness.js-based test.
+PASS # AUDIT TASK RUNNER STARTED.
+PASS > [initialize] Initialize contexts for testing
+PASS   context = new AudioContext() did not throw an exception.
+PASS   otherContext = new AudioContext() did not throw an exception.
+PASS < [initialize] All assertions passed. (total 2 assertions)
+PASS > [createBuffer] 
+PASS   context.createBuffer(99, 1, context.sampleRate) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The number of channels provided (99) is outside the range [1, 32].".
+PASS   context.createBuffer(0, 1, context.sampleRate) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The number of channels provided (0) is outside the range [1, 32].".
+PASS   context.createBuffer(1, 1, 1) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The sample rate provided (1) is outside the range [3000, 384000].".
+PASS   context.createBuffer(1, 1, 2999) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The sample rate provided (2999) is outside the range [3000, 384000].".
+PASS   context.createBuffer(1, 1, 384001) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The sample rate provided (384001) is outside the range [3000, 384000].".
+PASS   context.createBuffer(1, 1, 1e6) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The sample rate provided (1.00000e+6) is outside the range [3000, 384000].".
+PASS   context.createBuffer(1, 1, 3000) did not throw an exception.
+PASS   context.createBuffer(1, 1, 192000) did not throw an exception.
+PASS   context.createBuffer(1, 1, 384000) did not throw an exception.
+PASS   context.createBuffer(1, 0, context.sampleRate) threw NotSupportedError: "Failed to execute 'createBuffer' on 'BaseAudioContext': The number of frames provided (0) is less than or equal to the minimum bound (0).".
+PASS   context.createBuffer(new ArrayBuffer(100), true) threw TypeError: "Failed to execute 'createBuffer' on 'BaseAudioContext': 3 arguments required, but only 2 present.".
+PASS < [createBuffer] All assertions passed. (total 11 assertions)
+PASS > [createMediaElementSource] 
+PASS   context.createMediaElementSource(null) threw TypeError: "Failed to execute 'createMediaElementSource' on 'BaseAudioContext': parameter 1 is not of type 'HTMLMediaElement'.".
+PASS < [createMediaElementSource] All assertions passed. (total 1 assertions)
+PASS > [createMediaStreamSource] 
+PASS   context.createMediaStreamSource(null) threw TypeError: "Failed to execute 'createMediaStreamSource' on 'BaseAudioContext': parameter 1 is not of type 'MediaStream'.".
+PASS < [createMediaStreamSource] All assertions passed. (total 1 assertions)
+PASS > [createScriptProcessor] 
+PASS   context.createScriptProcessor(1, 1, 1) threw IndexSizeError: "Failed to execute 'createScriptProcessor' on 'BaseAudioContext': buffer size (1) must be 0 or a power of two between 256 and 16384.".
+PASS   context.createScriptProcessor(4096, 100, 1) threw IndexSizeError: "Failed to execute 'createScriptProcessor' on 'BaseAudioContext': number of input channels (100) exceeds maximum (32).".
+PASS   context.createScriptProcessor(4096, 1, 100) threw IndexSizeError: "Failed to execute 'createScriptProcessor' on 'BaseAudioContext': number of output channels (100) exceeds maximum (32).".
+PASS   context.createScriptProcessor() did not throw an exception.
+PASS   context.createScriptProcessor(0) did not throw an exception.
+PASS < [createScriptProcessor] All assertions passed. (total 5 assertions)
+PASS > [createChannelSplitter] 
+PASS   context.createChannelSplitter(0) threw IndexSizeError: "Failed to execute 'createChannelSplitter' on 'BaseAudioContext': The number of outputs provided (0) is outside the range [1, 32].".
+PASS   context.createChannelSplitter(99) threw IndexSizeError: "Failed to execute 'createChannelSplitter' on 'BaseAudioContext': The number of outputs provided (99) is outside the range [1, 32].".
+PASS   context.createChannelMerger(0) threw IndexSizeError: "Failed to execute 'createChannelMerger' on 'BaseAudioContext': The number of inputs provided (0) is outside the range [1, 32].".
+PASS < [createChannelSplitter] All assertions passed. (total 3 assertions)
+PASS > [createChannelMerger] 
+PASS   context.createChannelMerger(99) threw IndexSizeError: "Failed to execute 'createChannelMerger' on 'BaseAudioContext': The number of inputs provided (99) is outside the range [1, 32].".
+PASS < [createChannelMerger] All assertions passed. (total 1 assertions)
+PASS > [createPeriodicWave] 
+PASS   context.createPeriodicWave(null, null) threw TypeError: "Failed to execute 'createPeriodicWave' on 'BaseAudioContext': The provided value cannot be converted to a sequence.".
+PASS   context.createPeriodicWave(new Float32Array(10), null) threw TypeError: "Failed to execute 'createPeriodicWave' on 'BaseAudioContext': The provided value cannot be converted to a sequence.".
+PASS   context.createPeriodicWave(new Float32Array(4100), new Float32Array(4100)) did not throw an exception.
+PASS   context.createPeriodicWave(new Float32Array(8192), new Float32Array(8192)) did not throw an exception.
+PASS   context.createPeriodicWave(new Float32Array(10000), new Float32Array(10000)) did not throw an exception.
+PASS   context.createPeriodicWave(new Float32Array(10), new Float32Array(7)) threw IndexSizeError: "Failed to execute 'createPeriodicWave' on 'BaseAudioContext': length of real array (10) and length of imaginary array (7) must match.".
+PASS < [createPeriodicWave] All assertions passed. (total 6 assertions)
+PASS > [createAnalyser] 
+PASS   AnalyserNode.fftSize = 42 threw IndexSizeError: "Failed to set the 'fftSize' property on 'AnalyserNode': The value provided (42) is not a power of two.".
+PASS   AnalyserNode.fftSize is not equal to 42.
+PASS   AnalyserNode.fftSize = 16 threw IndexSizeError: "Failed to set the 'fftSize' property on 'AnalyserNode': The FFT size provided (16) is outside the range [32, 32768].".
+PASS   AnalyserNode.fftSize is not equal to 16.
+PASS   AnalyserNode.fftSize = 32768 did not throw an exception.
+PASS   AnalyserNode.fftSize = 65536 threw IndexSizeError: "Failed to set the 'fftSize' property on 'AnalyserNode': The FFT size provided (65536) is outside the range [32, 32768].".
+PASS   AnalyserNode.fftSize is not equal to 65536.
+PASS   AnalyserNode.minDecibels = -10 threw IndexSizeError: "Failed to set the 'minDecibels' property on 'AnalyserNode': The minDecibels provided (-10) is greater than the maximum bound (-30).".
+PASS   AnalyserNode.minDecibels is not equal to -10.
+PASS   AnalyserNode.maxDecibels = -150 threw IndexSizeError: "Failed to set the 'maxDecibels' property on 'AnalyserNode': The maxDecibels provided (-150) is less than the minimum bound (-100).".
+PASS   AnalyserNode.maxDecibels is not equal to -150.
+PASS   AnalyserNode.minDecibels = -30 threw IndexSizeError: "Failed to set the 'minDecibels' property on 'AnalyserNode': The minDecibels provided (-30) is greater than or equal to the maximum bound (-30).".
+PASS   AnalyserNode.minDecibels is not equal to -30.
+PASS   AnalyserNode.maxDecibels = -100 threw IndexSizeError: "Failed to set the 'maxDecibels' property on 'AnalyserNode': The maxDecibels provided (-100) is less than or equal to the minimum bound (-100).".
+PASS   AnalyserNode.maxDecibels is not equal to -100.
+PASS   AnalyserNode.smoothingTimeConstant = -0.1 threw IndexSizeError: "Failed to set the 'smoothingTimeConstant' property on 'AnalyserNode': The smoothing value provided (-0.1) is outside the range [0, 1].".
+PASS   AnalyserNode.smoothingTimeConstant is not equal to -0.1.
+PASS   AnalyserNode.smoothingTimeConstant = 1.5 threw IndexSizeError: "Failed to set the 'smoothingTimeConstant' property on 'AnalyserNode': The smoothing value provided (1.5) is outside the range [0, 1].".
+PASS   AnalyserNode.smoothingTimeConstant is not equal to 1.5.
+PASS   AnalyserNode.getFloatFrequencyData(null) threw TypeError: "Failed to execute 'getFloatFrequencyData' on 'AnalyserNode': parameter 1 is not of type 'Float32Array'.".
+PASS   AnalyserNode.getByteFrequencyData(null) threw TypeError: "Failed to execute 'getByteFrequencyData' on 'AnalyserNode': parameter 1 is not of type 'Uint8Array'.".
+PASS   AnalyserNode.getFloatTimeDomainData(null) threw TypeError: "Failed to execute 'getFloatTimeDomainData' on 'AnalyserNode': parameter 1 is not of type 'Float32Array'.".
+PASS   AnalyserNode.getByteTimeDomainData(null) threw TypeError: "Failed to execute 'getByteTimeDomainData' on 'AnalyserNode': parameter 1 is not of type 'Uint8Array'.".
+PASS   AudioBuffer.getChannelData(2) threw IndexSizeError: "Failed to execute 'getChannelData' on 'AudioBuffer': channel index (2) exceeds number of channels (1)".
+PASS < [createAnalyser] All assertions passed. (total 24 assertions)
+PASS > [Init test nodes] Create test nodes for the following tests
+PASS   node = context.createGain() did not throw an exception.
+PASS   node2 = context.createGain() did not throw an exception.
+PASS < [Init test nodes] All assertions passed. (total 2 assertions)
+PASS > [connections] AudioNode connections
+PASS   node.connect(null, 0, 0) threw TypeError: "Failed to execute 'connect' on 'AudioNode': parameter 1 is not of type 'AudioNode'.".
+PASS   node.connect(context.destination, 100, 0) threw IndexSizeError: "Failed to execute 'connect' on 'AudioNode': output index (100) exceeds number of outputs (1).".
+PASS   node.connect(context.destination, 0, 100) threw IndexSizeError: "Failed to execute 'connect' on 'AudioNode': input index (100) exceeds number of inputs (1).".
+PASS   node.connect(node2.gain, 100) threw IndexSizeError: "Failed to execute 'connect' on 'AudioNode': output index (100) exceeds number of outputs (1).".
+PASS   node.disconnect(99) threw IndexSizeError: "Failed to execute 'disconnect' on 'AudioNode': The output index provided (99) is outside the range [0, 0].".
+PASS   node.connect(otherContext.destination) threw InvalidAccessError: "Failed to execute 'connect' on 'AudioNode': cannot connect to a destination belonging to a different audio context.".
+PASS < [connections] All assertions passed. (total 6 assertions)
+PASS > [channel-stuff] channelCount, channelCountMode, channelInterpretation
+PASS   GainNode.channelCount = 99 threw NotSupportedError: "Failed to set the 'channelCount' property on 'AudioNode': The channel count provided (99) is outside the range [1, 32].".
+PASS   GainNode.channelCount is not equal to 99.
+PASS   node.channelCountMode = "fancy" did not throw an exception.
+PASS   node.channelCountMode is equal to max.
+PASS   node.channelInterpretation = mode did not throw an exception.
+PASS   node.channelInterpretation is equal to speakers.
+PASS   context.destination.channelCount = 99 threw IndexSizeError: [error message omitted].
+PASS < [channel-stuff] All assertions passed. (total 7 assertions)
+PASS > [audioparam] 
+PASS   param.setValueCurveAtTime(null, 0, 0) threw TypeError: "Failed to execute 'setValueCurveAtTime' on 'AudioParam': The provided value cannot be converted to a sequence.".
+PASS   node.gain.exponentialRampToValueAtTime(-1, 0.1) did not throw an exception.
+PASS   node.gain.exponentialRampToValueAtTime(0, 0.1) threw RangeError: "Failed to execute 'exponentialRampToValueAtTime' on 'AudioParam': The float target value provided (0) should not be in the range (-1.40130e-45, 1.40130e-45).".
+PASS   node.gain.exponentialRampToValueAtTime(1e-100, 0.1) threw RangeError: "Failed to execute 'exponentialRampToValueAtTime' on 'AudioParam': The float target value provided (0) should not be in the range (-1.40130e-45, 1.40130e-45).".
+PASS   node.gain.exponentialRampToValueAtTime(Math.pow(2, -149), 0.1) did not throw an exception.
+PASS   node.gain.exponentialRampToValueAtTime(Math.pow(2, -150), 0.1) threw RangeError: "Failed to execute 'exponentialRampToValueAtTime' on 'AudioParam': The float target value provided (0) should not be in the range (-1.40130e-45, 1.40130e-45).".
+PASS < [audioparam] All assertions passed. (total 6 assertions)
+PASS > [biquad] 
+PASS   node.getFrequencyResponse(new Float32Array(1), new Float32Array(1), new Float32Array(1)) did not throw an exception.
+PASS   node.getFrequencyResponse(null, new Float32Array(1), new Float32Array(1)) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 1 is not of type 'Float32Array'.".
+PASS   node.getFrequencyResponse(new Float32Array(1), null, new Float32Array(1)) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 2 is not of type 'Float32Array'.".
+PASS   node.getFrequencyResponse(new Float32Array(1), new Float32Array(1), null) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 3 is not of type 'Float32Array'.".
+PASS < [biquad] All assertions passed. (total 4 assertions)
+PASS > [offline-audio-context] supports 32 channels
+PASS   new OfflineAudioContext(32, 100, context.sampleRate) did not throw an exception.
+PASS < [offline-audio-context] All assertions passed. (total 1 assertions)
+PASS > [invalid-offline-audio-context-parameters] errors for invalid channel counts
+PASS   new OfflineAudioContext(0, 100, context.sampleRate) threw NotSupportedError: "Failed to construct 'OfflineAudioContext': The number of channels provided (0) is outside the range [1, 32].".
+PASS   new OfflineAudioContext(99, 100, context.sampleRate) threw NotSupportedError: "Failed to construct 'OfflineAudioContext': The number of channels provided (99) is outside the range [1, 32].".
+PASS   new OfflineAudioContext(1, 100, 1) threw NotSupportedError: "Failed to construct 'OfflineAudioContext': The sampleRate provided (1) is outside the range [3000, 384000].".
+PASS   new OfflineAudioContext(1, 100, 1e6) threw NotSupportedError: "Failed to construct 'OfflineAudioContext': The sampleRate provided (1.00000e+6) is outside the range [3000, 384000].".
+PASS   new OfflineAudioContext(1, 0, 44100) threw NotSupportedError: "Failed to construct 'OfflineAudioContext': The number of frames provided (0) is less than the minimum bound (1).".
+PASS < [invalid-offline-audio-context-parameters] All assertions passed. (total 5 assertions)
+PASS > [invalid-frame-length] 
+PASS   testContext = new OfflineAudioContext(1, -88200000000000, 44100) did not throw an exception.
+PASS   testContext.startRendering() rejected correctly with NotSupportedError: startRendering failed to create AudioBuffer(1, 1448390656, 44100).
+PASS < [invalid-frame-length] All assertions passed. (total 2 assertions)
+PASS > [waveshaper] 
+PASS   node.oversample = "9x" did not throw an exception.
+PASS   node.oversample is equal to none.
+PASS   node.curve = {} threw TypeError: "Failed to set the 'curve' property on 'WaveShaperNode': The provided value is not of type 'Float32Array'.".
+PASS   node.curve = new Float32Array(1) threw InvalidAccessError: "Failed to set the 'curve' property on 'WaveShaperNode': The curve length provided (1) is less than the minimum bound (2).".
+PASS   node.curve is equal to null.
+PASS   node.curve = new Float32Array(2) did not throw an exception.
+PASS   node.curve = null did not throw an exception.
+PASS < [waveshaper] All assertions passed. (total 7 assertions)
+PASS > [audio-buffer-source] AudioBufferSource start/stop
+PASS   source = context.createBufferSource() did not throw an exception.
+PASS   source.buffer = buffer did not throw an exception.
+PASS   source.buffer = context.createBuffer(1, 10, context.sampleRate) threw InvalidStateError: "Failed to set the 'buffer' property on 'AudioBufferSourceNode': Cannot set buffer to non-null after it has been already been set to a non-null buffer".
+PASS   source.start(-1) threw RangeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The start time provided (-1) is less than the minimum bound (0).".
+PASS   source.start(Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(-Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(NaN) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, -Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, NaN) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, -1) threw RangeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The offset provided (-1) is less than the minimum bound (0).".
+PASS   source.start(1, -Number.MIN_VALUE) threw RangeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The offset provided (-4.94066e-324) is less than the minimum bound (0).".
+PASS   source.start(1, 1, Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, 1, -Infinity) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, 1, NaN) threw TypeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The provided double value is non-finite.".
+PASS   source.start(1, 1, -1) threw RangeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The duration provided (-1) is less than the minimum bound (0).".
+PASS   source.start(1, 1, -Number.MIN_VALUE) threw RangeError: "Failed to execute 'start' on 'AudioBufferSourceNode': The duration provided (-4.94066e-324) is less than the minimum bound (0).".
+PASS   source.start() did not throw an exception.
+PASS   source.stop(-Number.MIN_VALUE) threw RangeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The stop time provided (-4.94066e-324) is less than the minimum bound (0).".
+PASS   source.stop(Infinity) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source.stop(-Infinity) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source.stop(NaN) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source.stop() did not throw an exception.
+PASS   source2 = context.createBufferSource() did not throw an exception.
+PASS   source2.buffer = buffer did not throw an exception.
+PASS   source2.start(0, 0) did not throw an exception.
+PASS   source3 = context.createBufferSource() did not throw an exception.
+PASS   source3.buffer = buffer did not throw an exception.
+PASS   source3.start(0, -1/Infinity) did not throw an exception.
+PASS   source4 = context.createBufferSource() did not throw an exception.
+PASS   source4.start() did not throw an exception.
+PASS   source5 = context.createBufferSource() did not throw an exception.
+PASS   source5.buffer = buffer did not throw an exception.
+PASS   source5.stop() threw InvalidStateError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': cannot call stop without calling start first.".
+PASS   source6 = context.createBufferSource() did not throw an exception.
+PASS   source6.buffer = buffer did not throw an exception.
+PASS   source6.start() did not throw an exception.
+PASS   source6.start() threw InvalidStateError: "Failed to execute 'start' on 'AudioBufferSourceNode': cannot call start more than once.".
+PASS   source7 = context.createBufferSource() did not throw an exception.
+PASS   source7.buffer = buffer did not throw an exception.
+PASS   source7.start() did not throw an exception.
+PASS   source7.stop() did not throw an exception.
+PASS < [audio-buffer-source] All assertions passed. (total 42 assertions)
+PASS > [oscillator] start/stop
+PASS   source8 = context.createOscillator() did not throw an exception.
+PASS   source8.start(-Number.MIN_VALUE) threw RangeError: "Failed to execute 'start' on 'AudioScheduledSourceNode': The start time provided (-4.94066e-324) is less than the minimum bound (0).".
+PASS   source8.start(Infinity) threw TypeError: "Failed to execute 'start' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.start(-Infinity) threw TypeError: "Failed to execute 'start' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.start(NaN) threw TypeError: "Failed to execute 'start' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.start() did not throw an exception.
+PASS   source8.stop(-Number.MIN_VALUE) threw RangeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The stop time provided (-4.94066e-324) is less than the minimum bound (0).".
+PASS   source8.stop(Infinity) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.stop(-Infinity) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.stop(NaN) threw TypeError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': The provided double value is non-finite.".
+PASS   source8.stop() did not throw an exception.
+PASS   osc = context.createOscillator() did not throw an exception.
+PASS   osc.stop() threw InvalidStateError: "Failed to execute 'stop' on 'AudioScheduledSourceNode': cannot call stop without calling start first.".
+PASS   osc1 = context.createOscillator() did not throw an exception.
+PASS   osc1.start() did not throw an exception.
+PASS   osc1.stop() did not throw an exception.
+PASS   osc.setPeriodicWave(null) threw TypeError: "Failed to execute 'setPeriodicWave' on 'OscillatorNode': parameter 1 is not of type 'PeriodicWave'.".
+PASS < [oscillator] All assertions passed. (total 17 assertions)
+PASS > [convolver] 
+PASS   oc = new OfflineAudioContext(1, 44100, 44100) did not throw an exception.
+PASS   conv = oc.createConvolver() did not throw an exception.
+PASS   conv.buffer = {} threw TypeError: "Failed to set the 'buffer' property on 'ConvolverNode': The provided value is not of type 'AudioBuffer'.".
+PASS   conv.buffer = oc.createBuffer(1, 100, 22050) threw NotSupportedError: "Failed to set the 'buffer' property on 'ConvolverNode': The buffer sample rate of 22050 does not match the context rate of 44100 Hz.".
+PASS   conv.buffer is equal to null.
+PASS < [convolver] All assertions passed. (total 5 assertions)
+PASS > [panner] 
+PASS   panner.channelCount = 1 did not throw an exception.
+PASS   panner.channelCount = 2 did not throw an exception.
+PASS   PannerNode.channelCount = 0 threw NotSupportedError: "Failed to set the 'channelCount' property on 'AudioNode': The channelCount provided (0) is outside the range [1, 2].".
+PASS   PannerNode.channelCount is not equal to 0.
+PASS   PannerNode.channelCount = 3 threw NotSupportedError: "Failed to set the 'channelCount' property on 'AudioNode': The channelCount provided (3) is outside the range [1, 2].".
+PASS   PannerNode.channelCount is not equal to 3.
+PASS   PannerNode.channelCountMode = max threw NotSupportedError: "Failed to set the 'channelCountMode' property on 'AudioNode': Panner: 'max' is not allowed".
+PASS   PannerNode.channelCountMode is not equal to max.
+PASS   panner.channelCountMode = "explicit" did not throw an exception.
+PASS   panner.channelCountMode = "clamped-max" did not throw an exception.
+PASS   panner.channelCountMode = "junk" did not throw an exception.
+PASS < [panner] All assertions passed. (total 11 assertions)
+PASS > [script-processor] 
+PASS   script = context.createScriptProcessor(256, 3) did not throw an exception.
+PASS   script.channelCount is equal to 3.
+PASS   script.channelCountMode is equal to explicit.
+PASS   script.channelCount = 3 did not throw an exception.
+PASS   ScriptProcessorNode.channelCount = 1 threw NotSupportedError: "Failed to set the 'channelCount' property on 'AudioNode': channelCount cannot be changed from 3 to 1".
+PASS   ScriptProcessorNode.channelCount is not equal to 1.
+PASS   ScriptProcessorNode.channelCount = 7 threw NotSupportedError: "Failed to set the 'channelCount' property on 'AudioNode': channelCount cannot be changed from 3 to 7".
+PASS   ScriptProcessorNode.channelCount is not equal to 7.
+PASS   script.channelCountMode = "explicit" did not throw an exception.
+PASS   ScriptProcessorNode.channelCountMode = max threw NotSupportedError: "Failed to set the 'channelCountMode' property on 'AudioNode': channelCountMode cannot be changed from 'explicit' to 'max'".
+PASS   ScriptProcessorNode.channelCountMode is not equal to max.
+PASS   ScriptProcessorNode.channelCountMode = clamped-max threw NotSupportedError: "Failed to set the 'channelCountMode' property on 'AudioNode': channelCountMode cannot be changed from 'explicit' to 'clamped-max'".
+PASS   ScriptProcessorNode.channelCountMode is not equal to clamped-max.
+PASS   script.channelCountMode = "junk" did not throw an exception.
+PASS < [script-processor] All assertions passed. (total 14 assertions)
+PASS > [misc] Miscellaneous tests
+PASS   osc.noteOn is equal to undefined.
+PASS   osc.noteOff is equal to undefined.
+PASS   source.noteOn is equal to undefined.
+PASS   source.noteOff is equal to undefined.
+PASS < [misc] All assertions passed. (total 4 assertions)
+PASS # AUDIT TASK RUNNER FINISHED: 24 tasks ran successfully.
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/android/webmidi/send-messages-expected.txt b/third_party/WebKit/LayoutTests/platform/android/webmidi/send-messages-expected.txt
new file mode 100644
index 0000000..27b298d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/android/webmidi/send-messages-expected.txt

@@ -0,0 +1,48 @@
+Test if various kinds of MIDI messages can be validated.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS navigator.requestMIDIAccess is defined.
+PASS output.send([0x00, 0x01]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Running status is not allowed at index 0 (0)..
+PASS output.send([0xf7]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected end of system exclusive message at index 0 (247)..
+PASS output.send([0xf4]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 0 (244)..
+PASS output.send([0xf5]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 0 (245)..
+PASS output.send([0xf9]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 0 (249)..
+PASS output.send([0xfd]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 0 (253)..
+PASS output.send([0x80]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0x80, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0x90]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0x90, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xa0]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xa0, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xb0]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xb0, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xc0]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xd0]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xe0]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xe0, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xf1]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xf2]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xf2, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0xf3]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Message is incomplete..
+PASS output.send([0x80, 0x80, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected status byte at index 1 (128)..
+PASS output.send([0x80, 0x00, 0x80]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected status byte at index 2 (128)..
+PASS output.send([0xf0, 0x80, 0xf7]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': System exclusive message contains a status byte at index 1 (128)..
+PASS output.send([0xf0, 0xf0, 0xf7]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': System exclusive message contains a status byte at index 1 (240)..
+PASS output.send([0xf0, 0xff, 0xf7, 0xf7]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected end of system exclusive message at index 3 (247)..
+PASS output.send([0xf4, 0x80, 0x00, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 0 (244)..
+PASS output.send([0x80, 0xf4, 0x00, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected status byte at index 1 (244)..
+PASS output.send([0x80, 0x00, 0xf4, 0x00]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Unexpected status byte at index 2 (244)..
+PASS output.send([0x80, 0x00, 0x00, 0xf4]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': Reserved status is not allowed at index 3 (244)..
+PASS output.send([0xf0, 0xff, 0xf4, 0xf7]) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': System exclusive message contains a status byte at index 2 (244)..
+PASS output.send([], NaN) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
+PASS output.send([], Infinity) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
+PASS output.send(new Uint8Array(), NaN) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
+PASS output.send(new Uint8Array(), Infinity) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
+PASS output.send(new Uint8Array(new SharedArrayBuffer(4))) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided ArrayBufferView value must not be shared..
+PASS output.send(new Uint8Array(new SharedArrayBuffer(4), 0)) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided ArrayBufferView value must not be shared..
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt
index 536d00b..a2b88cf 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE WARNING: line 78: 'webkitURL' is deprecated. Please use 'URL' instead.
+CONSOLE WARNING: line 80: 'webkitURL' is deprecated. Please use 'URL' instead.
 This test documents all interface attributes and methods on the global window object and element instances.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt
index 4d98413..b32229f 100644
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/stable/webexposed/global-interface-listing-platform-specific-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE WARNING: line 78: 'webkitURL' is deprecated. Please use 'URL' instead.
+CONSOLE WARNING: line 80: 'webkitURL' is deprecated. Please use 'URL' instead.
 This test documents all interface attributes and methods on the global window object and element instances.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

diff --git a/third_party/WebKit/LayoutTests/resources/global-interface-listing.js b/third_party/WebKit/LayoutTests/resources/global-interface-listing.js
index d9d4f204..7d05d90 100644
--- a/third_party/WebKit/LayoutTests/resources/global-interface-listing.js
+++ b/third_party/WebKit/LayoutTests/resources/global-interface-listing.js

@@ -17,6 +17,7 @@
 var jsBuiltins = new Set([
     'Array',
     'ArrayBuffer',
+    'Atomics',
     'BigInt',
     'BigInt64Array',
     'BigUint64Array',
@@ -46,6 +47,7 @@
     'Reflect',
     'RegExp',
     'Set',
+    'SharedArrayBuffer',
     'String',
     'Symbol',
     'SyntaxError',

diff --git a/third_party/WebKit/LayoutTests/virtual/lazyload-image/http/tests/lazyload/README.txt b/third_party/WebKit/LayoutTests/virtual/lazyload-image/http/tests/lazyload/README.txt
new file mode 100644
index 0000000..2de44d9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/lazyload-image/http/tests/lazyload/README.txt

@@ -0,0 +1,3 @@
+# This suite runs the tests in http/tests/lazyload with
+# --enable-features=LazyImageLoading.
+

diff --git a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
index 570198f97..f266c137 100644
--- a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE WARNING: line 78: 'webkitURL' is deprecated. Please use 'URL' instead.
+CONSOLE WARNING: line 80: 'webkitURL' is deprecated. Please use 'URL' instead.
 This test documents all interface attributes and methods on the global window object and element instances.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

diff --git a/third_party/WebKit/LayoutTests/webaudio/dom-exceptions-expected.txt b/third_party/WebKit/LayoutTests/webaudio/dom-exceptions-expected.txt
index 76d29f7..2a08bd8b7 100644
--- a/third_party/WebKit/LayoutTests/webaudio/dom-exceptions-expected.txt
+++ b/third_party/WebKit/LayoutTests/webaudio/dom-exceptions-expected.txt

@@ -77,8 +77,12 @@
 PASS   AnalyserNode.getByteFrequencyData(null) threw TypeError: "Failed to execute 'getByteFrequencyData' on 'AnalyserNode': parameter 1 is not of type 'Uint8Array'.".
 PASS   AnalyserNode.getFloatTimeDomainData(null) threw TypeError: "Failed to execute 'getFloatTimeDomainData' on 'AnalyserNode': parameter 1 is not of type 'Float32Array'.".
 PASS   AnalyserNode.getByteTimeDomainData(null) threw TypeError: "Failed to execute 'getByteTimeDomainData' on 'AnalyserNode': parameter 1 is not of type 'Uint8Array'.".
+PASS   AnalyserNode.getFloatFrequencyData(SharedArrayBuffer view) threw TypeError: "Failed to execute 'getFloatFrequencyData' on 'AnalyserNode': The provided ArrayBufferView value must not be shared.".
+PASS   AnalyserNode.getByteFrequencyData(SharedArrayBuffer view) threw TypeError: "Failed to execute 'getByteFrequencyData' on 'AnalyserNode': The provided ArrayBufferView value must not be shared.".
+PASS   AnalyserNode.getFloatTimeDomainData(SharedArrayBuffer view) threw TypeError: "Failed to execute 'getFloatTimeDomainData' on 'AnalyserNode': The provided ArrayBufferView value must not be shared.".
+PASS   AnalyserNode.getByteTimeDomainData(SharedArrayBuffer view) threw TypeError: "Failed to execute 'getByteTimeDomainData' on 'AnalyserNode': The provided ArrayBufferView value must not be shared.".
 PASS   AudioBuffer.getChannelData(2) threw IndexSizeError: "Failed to execute 'getChannelData' on 'AudioBuffer': channel index (2) exceeds number of channels (1)".
-PASS < [createAnalyser] All assertions passed. (total 24 assertions)
+PASS < [createAnalyser] All assertions passed. (total 28 assertions)
 PASS > [Init test nodes] Create test nodes for the following tests
 PASS   node = context.createGain() did not throw an exception.
 PASS   node2 = context.createGain() did not throw an exception.
@@ -113,7 +117,10 @@
 PASS   node.getFrequencyResponse(null, new Float32Array(1), new Float32Array(1)) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 1 is not of type 'Float32Array'.".
 PASS   node.getFrequencyResponse(new Float32Array(1), null, new Float32Array(1)) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 2 is not of type 'Float32Array'.".
 PASS   node.getFrequencyResponse(new Float32Array(1), new Float32Array(1), null) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': parameter 3 is not of type 'Float32Array'.".
-PASS < [biquad] All assertions passed. (total 4 assertions)
+PASS   node.getFrequencyResponse(shared_view, nonshared_view, nonshared_view) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': The provided ArrayBufferView value must not be shared.".
+PASS   node.getFrequencyResponse(nonshared_view, shared_view, nonshared_view) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': The provided ArrayBufferView value must not be shared.".
+PASS   node.getFrequencyResponse(nonshared_view, nonshared_view, shared_view) threw TypeError: "Failed to execute 'getFrequencyResponse' on 'BiquadFilterNode': The provided ArrayBufferView value must not be shared.".
+PASS < [biquad] All assertions passed. (total 7 assertions)
 PASS > [offline-audio-context] supports 32 channels
 PASS   new OfflineAudioContext(32, 100, context.sampleRate) did not throw an exception.
 PASS < [offline-audio-context] All assertions passed. (total 1 assertions)

diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 7b252d6e..1d819ec 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE WARNING: line 78: 'webkitURL' is deprecated. Please use 'URL' instead.
+CONSOLE WARNING: line 80: 'webkitURL' is deprecated. Please use 'URL' instead.
 This test documents all interface attributes and methods on the global window object and element instances.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-platform-specific-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-platform-specific-expected.txt
index d32b6e85..9dcb6e8 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-platform-specific-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-platform-specific-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE WARNING: line 78: 'webkitURL' is deprecated. Please use 'URL' instead.
+CONSOLE WARNING: line 80: 'webkitURL' is deprecated. Please use 'URL' instead.
 This test documents all interface attributes and methods on the global window object and element instances.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

diff --git a/third_party/WebKit/LayoutTests/webmidi/send-messages-expected.txt b/third_party/WebKit/LayoutTests/webmidi/send-messages-expected.txt
index 45be94a..27b298d 100644
--- a/third_party/WebKit/LayoutTests/webmidi/send-messages-expected.txt
+++ b/third_party/WebKit/LayoutTests/webmidi/send-messages-expected.txt

@@ -40,6 +40,8 @@
 PASS output.send([], Infinity) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
 PASS output.send(new Uint8Array(), NaN) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
 PASS output.send(new Uint8Array(), Infinity) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided double value is non-finite..
+PASS output.send(new Uint8Array(new SharedArrayBuffer(4))) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided ArrayBufferView value must not be shared..
+PASS output.send(new Uint8Array(new SharedArrayBuffer(4), 0)) threw exception TypeError: Failed to execute 'send' on 'MIDIOutput': The provided ArrayBufferView value must not be shared..
 PASS successfullyParsed is true
 
 TEST COMPLETE

diff --git a/third_party/blink/common/BUILD.gn b/third_party/blink/common/BUILD.gn
index 64379e7..af37c59a2 100644
--- a/third_party/blink/common/BUILD.gn
+++ b/third_party/blink/common/BUILD.gn

@@ -6,9 +6,12 @@
 import("//testing/test.gni")
 
 jumbo_source_set("common") {
+  # No target should directly depend on this target since this is just the
+  # source set rather than the actual component that can be linked to.
+  # Dependencies instead should be to //third_party/blink/public/common:common.
   visibility = [
-    "//third_party/blink/*",
-    ":*",
+    "//third_party/blink/public/common",
+    "//third_party/blink/public:all_blink",
   ]
 
   defines = [ "BLINK_COMMON_IMPLEMENTATION=1" ]
@@ -27,6 +30,8 @@
     "features.cc",
     "frame/frame_policy.cc",
     "frame/user_activation_state.cc",
+    "indexeddb/indexeddb_key.cc",
+    "indexeddb/indexeddb_struct_traits.cc",
     "manifest/manifest.cc",
     "manifest/manifest_icon_selector.cc",
     "manifest/manifest_share_target_util.cc",
@@ -98,6 +103,7 @@
     "device_memory/approximated_device_memory_unittest.cc",
     "feature_policy/feature_policy_unittest.cc",
     "frame/user_activation_state_unittest.cc",
+    "indexeddb/indexeddb_key_unittest.cc",
     "manifest/manifest_icon_selector_unittest.cc",
     "manifest/manifest_share_target_util_unittest.cc",
     "mime_util/mime_util_unittest.cc",
@@ -129,6 +135,5 @@
       "font_unique_name_lookup/font_table_matcher_unittest.cc",
       "font_unique_name_lookup/icu_fold_case_util_unittest.cc",
     ]
-    deps += [ ":common" ]
   }
 }

diff --git a/third_party/blink/common/indexeddb/OWNERS b/third_party/blink/common/indexeddb/OWNERS
new file mode 100644
index 0000000..54e6f8d
--- /dev/null
+++ b/third_party/blink/common/indexeddb/OWNERS

@@ -0,0 +1,11 @@
+file://content/browser/indexed_db/OWNERS
+
+pwnall@chromium.org
+
+per-file *_struct_traits*.*=set noparent
+per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *.typemap=set noparent
+per-file *.typemap=file://ipc/SECURITY_OWNERS
+
+# TEAM: storage-dev@chromium.org
+# COMPONENT: Blink>Storage>IndexedDB

diff --git a/content/common/indexed_db/indexed_db_key.cc b/third_party/blink/common/indexeddb/indexeddb_key.cc
similarity index 96%
rename from content/common/indexed_db/indexed_db_key.cc
rename to third_party/blink/common/indexeddb/indexeddb_key.cc
index 740569e..9f5e6fe2 100644
--- a/content/common/indexed_db/indexed_db_key.cc
+++ b/third_party/blink/common/indexeddb/indexeddb_key.cc

@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/indexed_db/indexed_db_key.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
 
 #include <string>
 
-namespace content {
+namespace blink {
 
 using blink::WebIDBKeyType;
 using blink::kWebIDBKeyTypeArray;
@@ -30,7 +30,7 @@
   return size;
 }
 
-template<typename T>
+template <typename T>
 int Compare(const T& a, const T& b) {
   // Using '<' for both comparisons here is as generic as possible (for e.g.
   // objects which only define operator<() and not operator>() or operator==())
@@ -140,4 +140,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace blink

diff --git a/content/common/indexed_db/indexed_db_key_unittest.cc b/third_party/blink/common/indexeddb/indexeddb_key_unittest.cc
similarity index 92%
rename from content/common/indexed_db/indexed_db_key_unittest.cc
rename to third_party/blink/common/indexeddb/indexeddb_key_unittest.cc
index 30f1c81..ea3199d 100644
--- a/content/common/indexed_db/indexed_db_key_unittest.cc
+++ b/third_party/blink/common/indexeddb/indexeddb_key_unittest.cc

@@ -2,15 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+
 #include <stddef.h>
 
 #include <vector>
 
 #include "base/strings/string16.h"
-#include "content/common/indexed_db/indexed_db_key.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace content {
+namespace blink {
 
 namespace {
 
@@ -55,4 +56,4 @@
 
 }  // namespace
 
-}  // namespace content
+}  // namespace blink

diff --git a/third_party/blink/common/indexeddb/indexeddb_struct_traits.cc b/third_party/blink/common/indexeddb/indexeddb_struct_traits.cc
new file mode 100644
index 0000000..3b2d3541
--- /dev/null
+++ b/third_party/blink/common/indexeddb/indexeddb_struct_traits.cc

@@ -0,0 +1,212 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h"
+
+#include "base/stl_util.h"
+#include "mojo/public/cpp/base/string16_mojom_traits.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+
+namespace mojo {
+
+using blink::mojom::IDBCursorDirection;
+using blink::mojom::IDBDataLoss;
+using blink::mojom::IDBOperationType;
+
+// static
+IDBCursorDirection
+EnumTraits<IDBCursorDirection, blink::WebIDBCursorDirection>::ToMojom(
+    blink::WebIDBCursorDirection input) {
+  switch (input) {
+    case blink::kWebIDBCursorDirectionNext:
+      return IDBCursorDirection::Next;
+    case blink::kWebIDBCursorDirectionNextNoDuplicate:
+      return IDBCursorDirection::NextNoDuplicate;
+    case blink::kWebIDBCursorDirectionPrev:
+      return IDBCursorDirection::Prev;
+    case blink::kWebIDBCursorDirectionPrevNoDuplicate:
+      return IDBCursorDirection::PrevNoDuplicate;
+  }
+  NOTREACHED();
+  return IDBCursorDirection::Next;
+}
+
+// static
+bool EnumTraits<IDBCursorDirection, blink::WebIDBCursorDirection>::FromMojom(
+    IDBCursorDirection input,
+    blink::WebIDBCursorDirection* output) {
+  switch (input) {
+    case IDBCursorDirection::Next:
+      *output = blink::kWebIDBCursorDirectionNext;
+      return true;
+    case IDBCursorDirection::NextNoDuplicate:
+      *output = blink::kWebIDBCursorDirectionNextNoDuplicate;
+      return true;
+    case IDBCursorDirection::Prev:
+      *output = blink::kWebIDBCursorDirectionPrev;
+      return true;
+    case IDBCursorDirection::PrevNoDuplicate:
+      *output = blink::kWebIDBCursorDirectionPrevNoDuplicate;
+      return true;
+  }
+  return false;
+}
+
+// static
+IDBDataLoss EnumTraits<IDBDataLoss, blink::WebIDBDataLoss>::ToMojom(
+    blink::WebIDBDataLoss input) {
+  switch (input) {
+    case blink::kWebIDBDataLossNone:
+      return IDBDataLoss::None;
+    case blink::kWebIDBDataLossTotal:
+      return IDBDataLoss::Total;
+  }
+  NOTREACHED();
+  return IDBDataLoss::None;
+}
+
+// static
+bool EnumTraits<IDBDataLoss, blink::WebIDBDataLoss>::FromMojom(
+    IDBDataLoss input,
+    blink::WebIDBDataLoss* output) {
+  switch (input) {
+    case IDBDataLoss::None:
+      *output = blink::kWebIDBDataLossNone;
+      return true;
+    case IDBDataLoss::Total:
+      *output = blink::kWebIDBDataLossTotal;
+      return true;
+  }
+  return false;
+}
+
+// static
+blink::mojom::IDBKeyDataPtr
+StructTraits<blink::mojom::IDBKeyDataView, blink::IndexedDBKey>::data(
+    const blink::IndexedDBKey& key) {
+  auto data = blink::mojom::IDBKeyData::New();
+  switch (key.type()) {
+    case blink::kWebIDBKeyTypeInvalid:
+      data->set_other(blink::mojom::IDBDatalessKeyType::Invalid);
+      return data;
+    case blink::kWebIDBKeyTypeArray:
+      data->set_key_array(key.array());
+      return data;
+    case blink::kWebIDBKeyTypeBinary:
+      data->set_binary(std::vector<uint8_t>(
+          key.binary().data(), key.binary().data() + key.binary().size()));
+      return data;
+    case blink::kWebIDBKeyTypeString:
+      data->set_string(key.string());
+      return data;
+    case blink::kWebIDBKeyTypeDate:
+      data->set_date(key.date());
+      return data;
+    case blink::kWebIDBKeyTypeNumber:
+      data->set_number(key.number());
+      return data;
+    case blink::kWebIDBKeyTypeNull:
+      data->set_other(blink::mojom::IDBDatalessKeyType::Null);
+      return data;
+    case blink::kWebIDBKeyTypeMin:
+      break;
+  }
+  NOTREACHED();
+  return data;
+}
+
+// static
+bool StructTraits<blink::mojom::IDBKeyDataView, blink::IndexedDBKey>::Read(
+    blink::mojom::IDBKeyDataView data,
+    blink::IndexedDBKey* out) {
+  blink::mojom::IDBKeyDataDataView data_view;
+  data.GetDataDataView(&data_view);
+
+  switch (data_view.tag()) {
+    case blink::mojom::IDBKeyDataDataView::Tag::KEY_ARRAY: {
+      std::vector<blink::IndexedDBKey> array;
+      if (!data_view.ReadKeyArray(&array))
+        return false;
+      *out = blink::IndexedDBKey(array);
+      return true;
+    }
+    case blink::mojom::IDBKeyDataDataView::Tag::BINARY: {
+      std::vector<uint8_t> binary;
+      if (!data_view.ReadBinary(&binary))
+        return false;
+      *out = blink::IndexedDBKey(
+          std::string(binary.data(), binary.data() + binary.size()));
+      return true;
+    }
+    case blink::mojom::IDBKeyDataDataView::Tag::STRING: {
+      base::string16 string;
+      if (!data_view.ReadString(&string))
+        return false;
+      *out = blink::IndexedDBKey(string);
+      return true;
+    }
+    case blink::mojom::IDBKeyDataDataView::Tag::DATE:
+      *out = blink::IndexedDBKey(data_view.date(), blink::kWebIDBKeyTypeDate);
+      return true;
+    case blink::mojom::IDBKeyDataDataView::Tag::NUMBER:
+      *out =
+          blink::IndexedDBKey(data_view.number(), blink::kWebIDBKeyTypeNumber);
+      return true;
+    case blink::mojom::IDBKeyDataDataView::Tag::OTHER:
+      switch (data_view.other()) {
+        case blink::mojom::IDBDatalessKeyType::Invalid:
+          *out = blink::IndexedDBKey(blink::kWebIDBKeyTypeInvalid);
+          return true;
+        case blink::mojom::IDBDatalessKeyType::Null:
+          *out = blink::IndexedDBKey(blink::kWebIDBKeyTypeNull);
+          return true;
+      }
+  }
+
+  return false;
+}
+
+// static
+IDBOperationType
+EnumTraits<IDBOperationType, blink::WebIDBOperationType>::ToMojom(
+    blink::WebIDBOperationType input) {
+  switch (input) {
+    case blink::kWebIDBAdd:
+      return IDBOperationType::Add;
+    case blink::kWebIDBPut:
+      return IDBOperationType::Put;
+    case blink::kWebIDBDelete:
+      return IDBOperationType::Delete;
+    case blink::kWebIDBClear:
+      return IDBOperationType::Clear;
+    case blink::kWebIDBOperationTypeCount:
+      // WebIDBOperationTypeCount is not a valid option.
+      break;
+  }
+  NOTREACHED();
+  return IDBOperationType::Add;
+}
+
+// static
+bool EnumTraits<IDBOperationType, blink::WebIDBOperationType>::FromMojom(
+    IDBOperationType input,
+    blink::WebIDBOperationType* output) {
+  switch (input) {
+    case IDBOperationType::Add:
+      *output = blink::kWebIDBAdd;
+      return true;
+    case IDBOperationType::Put:
+      *output = blink::kWebIDBPut;
+      return true;
+    case IDBOperationType::Delete:
+      *output = blink::kWebIDBDelete;
+      return true;
+    case IDBOperationType::Clear:
+      *output = blink::kWebIDBClear;
+      return true;
+  }
+  return false;
+}
+
+}  // namespace mojo

diff --git a/third_party/blink/public/BUILD.gn b/third_party/blink/public/BUILD.gn
index 545af712..793b27f 100644
--- a/third_party/blink/public/BUILD.gn
+++ b/third_party/blink/public/BUILD.gn

@@ -141,7 +141,6 @@
     "platform/modules/indexeddb/web_idb_key_range.h",
     "platform/modules/indexeddb/web_idb_metadata.h",
     "platform/modules/indexeddb/web_idb_observation.h",
-    "platform/modules/indexeddb/web_idb_types.h",
     "platform/modules/indexeddb/web_idb_value.h",
     "platform/modules/installedapp/web_related_application.h",
     "platform/modules/installedapp/web_related_apps_fetcher.h",

diff --git a/third_party/blink/public/common/BUILD.gn b/third_party/blink/public/common/BUILD.gn
index b74382d..a333e84 100644
--- a/third_party/blink/public/common/BUILD.gn
+++ b/third_party/blink/public/common/BUILD.gn

@@ -46,6 +46,9 @@
     "frame/user_activation_state.h",
     "frame/user_activation_update_source.h",
     "frame/user_activation_update_type.h",
+    "indexeddb/indexeddb_key.h",
+    "indexeddb/indexeddb_struct_traits.h",
+    "indexeddb/web_idb_types.h",
     "manifest/manifest.h",
     "manifest/manifest_icon_selector.h",
     "manifest/manifest_share_target_util.h",
@@ -71,7 +74,8 @@
   ]
 
   public_deps = [
-    "//third_party/blink/public/mojom:mojom_core",
+    "//skia",
+    "//third_party/blink/public/mojom:mojom_core_headers",
   ]
 
   deps = [

diff --git a/third_party/blink/public/common/indexeddb/OWNERS b/third_party/blink/public/common/indexeddb/OWNERS
new file mode 100644
index 0000000..54e6f8d
--- /dev/null
+++ b/third_party/blink/public/common/indexeddb/OWNERS

@@ -0,0 +1,11 @@
+file://content/browser/indexed_db/OWNERS
+
+pwnall@chromium.org
+
+per-file *_struct_traits*.*=set noparent
+per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *.typemap=set noparent
+per-file *.typemap=file://ipc/SECURITY_OWNERS
+
+# TEAM: storage-dev@chromium.org
+# COMPONENT: Blink>Storage>IndexedDB

diff --git a/third_party/blink/public/common/indexeddb/indexeddb.typemap b/third_party/blink/public/common/indexeddb/indexeddb.typemap
new file mode 100644
index 0000000..79fab39
--- /dev/null
+++ b/third_party/blink/public/common/indexeddb/indexeddb.typemap

@@ -0,0 +1,17 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//third_party/blink/public/mojom/indexeddb/indexeddb.mojom"
+public_headers = [
+  "//third_party/blink/public/common/indexeddb/indexeddb_key.h",
+  "//third_party/blink/public/common/indexeddb/web_idb_types.h",
+]
+traits_headers =
+    [ "//third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h" ]
+type_mappings = [
+  "blink.mojom.IDBCursorDirection=blink::WebIDBCursorDirection",
+  "blink.mojom.IDBDataLoss=blink::WebIDBDataLoss",
+  "blink.mojom.IDBKey=blink::IndexedDBKey",
+  "blink.mojom.IDBOperationType=blink::WebIDBOperationType",
+]

diff --git a/content/common/indexed_db/indexed_db_key.h b/third_party/blink/public/common/indexeddb/indexeddb_key.h
similarity index 82%
rename from content/common/indexed_db/indexed_db_key.h
rename to third_party/blink/public/common/indexeddb/indexeddb_key.h
index 411f1c5..78e891e 100644
--- a/content/common/indexed_db/indexed_db_key.h
+++ b/third_party/blink/public/common/indexeddb/indexeddb_key.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_INDEXED_DB_INDEXED_DB_KEY_H_
-#define CONTENT_COMMON_INDEXED_DB_INDEXED_DB_KEY_H_
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_KEY_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_KEY_H_
 
 #include <stddef.h>
 
@@ -12,12 +12,12 @@
 
 #include "base/logging.h"
 #include "base/strings/string16.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/common/common_export.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 
-namespace content {
+namespace blink {
 
-class CONTENT_EXPORT IndexedDBKey {
+class BLINK_COMMON_EXPORT IndexedDBKey {
  public:
   typedef std::vector<IndexedDBKey> KeyArray;
 
@@ -76,6 +76,6 @@
 // An index id, and corresponding set of keys to insert.
 using IndexedDBIndexKeys = std::pair<int64_t, std::vector<IndexedDBKey>>;
 
-}  // namespace content
+}  // namespace blink
 
-#endif  // CONTENT_COMMON_INDEXED_DB_INDEXED_DB_KEY_H_
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_KEY_H_

diff --git a/third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h b/third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h
new file mode 100644
index 0000000..ec323fd40
--- /dev/null
+++ b/third_party/blink/public/common/indexeddb/indexeddb_struct_traits.h

@@ -0,0 +1,49 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_STRUCT_TRAITS_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_STRUCT_TRAITS_H_
+
+#include "third_party/blink/common/common_export.h"
+#include "third_party/blink/public/common/indexeddb/indexeddb_key.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
+
+namespace mojo {
+
+template <>
+struct BLINK_COMMON_EXPORT
+    EnumTraits<blink::mojom::IDBCursorDirection, blink::WebIDBCursorDirection> {
+  static blink::mojom::IDBCursorDirection ToMojom(
+      blink::WebIDBCursorDirection input);
+  static bool FromMojom(blink::mojom::IDBCursorDirection input,
+                        blink::WebIDBCursorDirection* output);
+};
+
+template <>
+struct BLINK_COMMON_EXPORT
+    EnumTraits<blink::mojom::IDBDataLoss, blink::WebIDBDataLoss> {
+  static blink::mojom::IDBDataLoss ToMojom(blink::WebIDBDataLoss input);
+  static bool FromMojom(blink::mojom::IDBDataLoss input,
+                        blink::WebIDBDataLoss* output);
+};
+
+template <>
+struct BLINK_COMMON_EXPORT
+    StructTraits<blink::mojom::IDBKeyDataView, blink::IndexedDBKey> {
+  static blink::mojom::IDBKeyDataPtr data(const blink::IndexedDBKey& key);
+  static bool Read(blink::mojom::IDBKeyDataView data, blink::IndexedDBKey* out);
+};
+
+template <>
+struct BLINK_COMMON_EXPORT
+    EnumTraits<blink::mojom::IDBOperationType, blink::WebIDBOperationType> {
+  static blink::mojom::IDBOperationType ToMojom(
+      blink::WebIDBOperationType input);
+  static bool FromMojom(blink::mojom::IDBOperationType input,
+                        blink::WebIDBOperationType* output);
+};
+
+}  // namespace mojo
+
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_INDEXEDDB_STRUCT_TRAITS_H_

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_types.h b/third_party/blink/public/common/indexeddb/web_idb_types.h
similarity index 89%
rename from third_party/blink/public/platform/modules/indexeddb/web_idb_types.h
rename to third_party/blink/public/common/indexeddb/web_idb_types.h
index 08981cf..2728e86 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_types.h
+++ b/third_party/blink/public/common/indexeddb/web_idb_types.h

@@ -23,11 +23,13 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_TYPES_H_
-#define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_TYPES_H_
+#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_WEB_IDB_TYPES_H_
+#define THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_WEB_IDB_TYPES_H_
 
 namespace blink {
 
+// TODO(cmp): Deprecate these in favor of the blink.mojom.IDB* enum types.
+
 enum WebIDBKeyType {
   kWebIDBKeyTypeInvalid = 0,
   kWebIDBKeyTypeArray,
@@ -84,4 +86,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_TYPES_H_
+#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_INDEXEDDB_WEB_IDB_TYPES_H_

diff --git a/third_party/blink/public/mojom/BUILD.gn b/third_party/blink/public/mojom/BUILD.gn
index cd9eb7b..db937e58 100644
--- a/third_party/blink/public/mojom/BUILD.gn
+++ b/third_party/blink/public/mojom/BUILD.gn

@@ -28,6 +28,7 @@
     "filesystem/file_system.mojom",
     "filesystem/file_writer.mojom",
     "frame/find_in_page.mojom",
+    "indexeddb/indexeddb.mojom",
     "leak_detector/leak_detector.mojom",
     "loader/navigation_predictor.mojom",
     "loader/pause_subresource_loading_handle.mojom",

diff --git a/third_party/blink/public/mojom/frame/find_in_page.mojom b/third_party/blink/public/mojom/frame/find_in_page.mojom
index 691dc8a..9d94007 100644
--- a/third_party/blink/public/mojom/frame/find_in_page.mojom
+++ b/third_party/blink/public/mojom/frame/find_in_page.mojom

@@ -7,6 +7,13 @@
 import "ui/gfx/geometry/mojo/geometry.mojom";
 
 interface FindInPage {
+  // If |options.find_next| is false, this is a "Start Find" call.
+  // It starts a new find-in-page session with id |request_id|.
+  // If |options.find_next| is true, this is a "Find Next" call.
+  // It asks the active/highlighted match for session with id |request_id|
+  // to be moved either forward if |options.forward| is true, or backwards
+  // if |options.forward| is false.
+  Find(int32 request_id, string search_text, FindOptions options);
 
   // Notifies the frame that we are no longer interested in searching. This
   // will abort any asynchronous scoping effort already under way and erase
@@ -61,16 +68,17 @@
 // Per-frame client of FindInPage.
 interface FindInPageClient {
   // Sets the number of matches of the frame to |number_of_matches|.
-  // If |final_update| is true, there will be no more update to the number of
-  // matches or active match for this frame.
+  // If |final_update| is kFinalUpdate, there will be no more update to the
+  // number of matches or active match for this frame.
   SetNumberOfMatches(int32 request_id, uint32 number_of_matches,
                      FindMatchUpdateType update_type);
 
-  // Sets the current active match rect and ordinal. This is the final
-  // find update for the frame, notifying the browser side that there will be
-  // no more update to number of matches or active match for this frame.
+  // Sets the current active match rect and ordinal.
+  // If |final_update| is kFinalUpdate, there will be no more update to the
+  // number of matches or active match for this frame.
   SetActiveMatch(int32 request_id, gfx.mojom.Rect active_match_rect,
-                 int32 active_match_ordinal);
+                 int32 active_match_ordinal,
+                 FindMatchUpdateType update_type);
 };
 
 // This enum defines what actions the renderer should take next when
@@ -89,3 +97,18 @@
   kFinalUpdate,
   kMoreUpdatesComing
 };
+
+struct FindOptions {
+ // Whether to search forward or backward within the page.
+  bool forward;
+
+  // Whether search should be case-sensitive.
+  bool match_case;
+
+  // Whether this operation is the first request or a follow-up.
+  bool find_next;
+
+  // Force a re-search of the frame: typically used when forcing a re-search
+  // after the frame navigates.
+  bool force;
+};

diff --git a/third_party/blink/public/mojom/indexeddb/OWNERS b/third_party/blink/public/mojom/indexeddb/OWNERS
new file mode 100644
index 0000000..d43b54a
--- /dev/null
+++ b/third_party/blink/public/mojom/indexeddb/OWNERS

@@ -0,0 +1,7 @@
+file://storage/browser/blob/OWNERS
+
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+
+# TEAM: storage-dev@chromium.org
+# COMPONENT: Blink>Storage>IndexedDB

diff --git a/third_party/blink/public/mojom/indexeddb/indexeddb.mojom b/third_party/blink/public/mojom/indexeddb/indexeddb.mojom
new file mode 100644
index 0000000..4fc508c7
--- /dev/null
+++ b/third_party/blink/public/mojom/indexeddb/indexeddb.mojom

@@ -0,0 +1,78 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module blink.mojom;
+
+import "mojo/public/mojom/base/file_path.mojom";
+import "mojo/public/mojom/base/string16.mojom";
+import "mojo/public/mojom/base/string16.mojom";
+import "mojo/public/mojom/base/time.mojom";
+import "third_party/blink/public/mojom/blob/blob.mojom";
+import "url/mojom/origin.mojom";
+
+enum IDBCursorDirection {
+  Next,
+  NextNoDuplicate,
+  Prev,
+  PrevNoDuplicate,
+};
+
+enum IDBDataLoss {
+  None,
+  Total,
+};
+
+// Represents key types that hold no data and so cannot be options in the
+// IDBKeyData union.
+// TODO(jsbell): These types should be cleaned up end-to-end, leaving only the
+// dataful options.
+enum IDBDatalessKeyType {
+  Invalid,
+  Null,
+};
+
+union IDBKeyData {
+  array<IDBKey> key_array;
+  array<uint8> binary;
+  mojo_base.mojom.String16 string;
+  double date;
+  double number;
+  IDBDatalessKeyType other;
+};
+
+// Defined as a structure so that it can by typemapped with StructTraits.
+struct IDBKey {
+  IDBKeyData data;
+};
+
+enum IDBOperationType {
+  Add,
+  Put,
+  Delete,
+  Clear,
+};
+
+struct IDBFileInfo {
+  mojo_base.mojom.FilePath path;
+  mojo_base.mojom.String16 name;
+  mojo_base.mojom.Time last_modified;
+};
+
+struct IDBBlobInfo {
+  blink.mojom.Blob blob;
+  string uuid;
+  mojo_base.mojom.String16 mime_type;
+  int64 size;
+  IDBFileInfo? file;
+};
+
+struct IDBValue {
+  string bits;
+  array<IDBBlobInfo> blob_or_file_info;
+};
+
+struct IDBObserverTransaction {
+  int64 id;
+  array<int64> scope;
+};

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h b/third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h
index b436b9fa..831488d 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h
+++ b/third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h

@@ -26,9 +26,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_CURSOR_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_CURSOR_H_
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_callbacks.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_string.h"
 

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_database.h b/third_party/blink/public/platform/modules/indexeddb/web_idb_database.h
index c652950..0db2c387 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_database.h
+++ b/third_party/blink/public/platform/modules/indexeddb/web_idb_database.h

@@ -26,9 +26,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_DATABASE_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_DATABASE_H_
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_metadata.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_blob_info.h"
 #include "third_party/blink/public/platform/web_common.h"
 

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_key.h b/third_party/blink/public/platform/modules/indexeddb/web_idb_key.h
index 22c204aed..dafbc10 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_key.h
+++ b/third_party/blink/public/platform/modules/indexeddb/web_idb_key.h

@@ -28,7 +28,7 @@
 
 #include <memory>
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/platform/web_private_ptr.h"

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h b/third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h
index c1e3d5c..3ceceab1 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h
+++ b/third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h

@@ -26,7 +26,7 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_KEY_PATH_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_KEY_PATH_H_
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_vector.h"

diff --git a/third_party/blink/public/platform/modules/indexeddb/web_idb_observation.h b/third_party/blink/public/platform/modules/indexeddb/web_idb_observation.h
index 6b11b5cd..dd0a1903 100644
--- a/third_party/blink/public/platform/modules/indexeddb/web_idb_observation.h
+++ b/third_party/blink/public/platform/modules/indexeddb/web_idb_observation.h

@@ -5,8 +5,8 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_OBSERVATION_H_
 #define THIRD_PARTY_BLINK_PUBLIC_PLATFORM_MODULES_INDEXEDDB_WEB_IDB_OBSERVATION_H_
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key_range.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_value.h"
 
 namespace blink {

diff --git a/third_party/blink/public/public_typemaps.gni b/third_party/blink/public/public_typemaps.gni
index b6175f8..7912f689 100644
--- a/third_party/blink/public/public_typemaps.gni
+++ b/third_party/blink/public/public_typemaps.gni

@@ -6,6 +6,7 @@
 typemaps = [
   "//third_party/blink/public/platform/content_security_policy.typemap",
   "//third_party/blink/public/platform/referrer_policy.typemap",
+  "//third_party/blink/public/common/indexeddb/indexeddb.typemap",
   "//third_party/blink/public/common/screen_orientation/screen_orientation_lock_types.typemap",
   "//third_party/blink/public/common/manifest/display_mode.typemap",
   "//third_party/blink/public/common/manifest/manifest.typemap",

diff --git a/third_party/blink/public/web/web_find_options.h b/third_party/blink/public/web/web_find_options.h
index 0e7d2319..c1a9760 100644
--- a/third_party/blink/public/web/web_find_options.h
+++ b/third_party/blink/public/web/web_find_options.h

@@ -46,14 +46,6 @@
   // Whether this operation is the first request or a follow-up.
   bool find_next;
 
-  // Whether this operation should look for matches only at the start of words.
-  bool word_start;
-
-  // When combined with wordStart, accepts a match in the middle of a word if
-  // the match begins with an uppercase letter followed by a lowercase or
-  // non-letter. Accepts several other intra-word matches.
-  bool medial_capital_as_word_start;
-
   // Force a re-search of the frame: typically used when forcing a re-search
   // after the frame navigates.
   bool force;
@@ -62,8 +54,6 @@
       : forward(true),
         match_case(false),
         find_next(false),
-        word_start(false),
-        medial_capital_as_word_start(false),
         force(false) {}
 };
 

diff --git a/third_party/blink/public/web/web_local_frame.h b/third_party/blink/public/web/web_local_frame.h
index 8bb6744..33322a5 100644
--- a/third_party/blink/public/web/web_local_frame.h
+++ b/third_party/blink/public/web/web_local_frame.h

@@ -46,7 +46,6 @@
 class WebFrameWidget;
 class WebInputMethodController;
 class WebPerformance;
-class WebPlugin;
 class WebRange;
 class WebSecurityOrigin;
 class WebScriptExecutionCallback;
@@ -651,12 +650,6 @@
 
   // Find-in-page -----------------------------------------------------------
 
-  // Begins a find request, which includes finding the next find match (using
-  // find()) and scoping the frame for find matches if needed.
-  virtual void RequestFind(int identifier,
-                           const WebString& search_text,
-                           const WebFindOptions&) = 0;
-
   // Searches a frame for a given string.
   //
   // If a match is found, this function will select it (scrolling down to
@@ -686,11 +679,11 @@
   // default behavior will be restored.
   virtual void SetTickmarks(const WebVector<WebRect>&) = 0;
 
-  virtual WebPlugin* GetWebPluginForFind() = 0;
-
   // Notifies how many matches have been found in this frame so far, for a
   // given identifier.  |final_update| specifies whether this is the last
   // update for this frame.
+  // TODO(rakina): Make WebPluginContainer call FindInPage directly and remove
+  // this.
   virtual void ReportFindInPageMatchCount(int identifier,
                                           int count,
                                           bool final_update) = 0;
@@ -703,6 +696,8 @@
   // where on the screen the selection rect is currently located.
   // |final_update| specifies whether this is the last update for this
   // frame.
+  // TODO(rakina): Make WebPluginContainer call FindInPage directly and remove
+  // this.
   virtual void ReportFindInPageSelection(int identifier,
                                          int active_match_ordinal,
                                          const WebRect& selection,

diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
index a5c8b8e..62b41e50 100644
--- a/third_party/blink/public/web/web_local_frame_client.h
+++ b/third_party/blink/public/web/web_local_frame_client.h

@@ -696,14 +696,6 @@
       WebScrollDirection direction,
       WebScrollGranularity granularity) {}
 
-  // Find-in-page notifications ------------------------------------------
-
-  virtual void SendFindReply(int request_id,
-                             int match_count,
-                             int ordinal,
-                             const WebRect& selection_rect,
-                             bool final_status_update) {}
-
   // MediaStream -----------------------------------------------------
 
   // A new WebRTCPeerConnectionHandler is created.

diff --git a/third_party/blink/public/web/web_security_policy.h b/third_party/blink/public/web/web_security_policy.h
index 571c86f..82cf7f43 100644
--- a/third_party/blink/public/web/web_security_policy.h
+++ b/third_party/blink/public/web/web_security_policy.h

@@ -83,12 +83,6 @@
       const WebString& destination_protocol,
       const WebString& destination_host,
       bool disallow_destination_subdomains);
-  BLINK_EXPORT static void RemoveOriginAccessBlacklistEntry(
-      const WebURL& source_origin,
-      const WebString& destination_protocol,
-      const WebString& destination_host,
-      bool allow_destination_subdomains);
-  BLINK_EXPORT static void ResetOriginAccessBlacklists();
 
   // Support for whitelisting origins or hostname patterns to treat them as
   // trustworthy. This method does not do any canonicalization; the caller is

diff --git a/third_party/blink/renderer/README.md b/third_party/blink/renderer/README.md
index 5f1eb64..e8077e3 100644
--- a/third_party/blink/renderer/README.md
+++ b/third_party/blink/renderer/README.md

@@ -1,6 +1,10 @@
+## Blink architecture overview
+
+See [this "How Blink works" document](https://docs.google.com/document/d/1aitSOucL0VHZa9Z2vbRJSyAIsAz24kX8LFByQ5xQnUg/edit#).
+
 ## `blink/renderer` directory structure
 
-This document describes a high-level architecture of `blink/renderer`,
+This section describes a high-level architecture of `blink/renderer`,
 which contains most of the Web Platform implementation, and runs exclusively
 in the renderer process.
 On the other hand, [`common/`](../common) and [`public/common`](../public/common)

diff --git a/third_party/blink/renderer/core/BUILD.gn b/third_party/blink/renderer/core/BUILD.gn
index c0b073b..a7c17fec 100644
--- a/third_party/blink/renderer/core/BUILD.gn
+++ b/third_party/blink/renderer/core/BUILD.gn

@@ -512,6 +512,7 @@
       "../build/scripts/core/css/properties/make_css_property_subclasses.py"
   in_files = [ "css/properties/CSSPropertyMethods.json5" ]
   other_inputs = [
+    "css/CSSProperties.json5",
     "../build/scripts/core/css/properties/templates/css_property_subclass.h.tmpl",
     "../build/scripts/core/css/properties/templates/css_property_subclass.cc.tmpl",
   ]
@@ -555,6 +556,12 @@
     "$blink_core_output_dir/css/properties/longhands/background_size.cc",
     "$blink_core_output_dir/css/properties/longhands/baseline_shift.h",
     "$blink_core_output_dir/css/properties/longhands/block_size.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_end_color.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_end_style.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_end_width.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_start_color.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_start_style.h",
+    "$blink_core_output_dir/css/properties/longhands/border_block_start_width.h",
     "$blink_core_output_dir/css/properties/longhands/border_bottom_color.h",
     "$blink_core_output_dir/css/properties/longhands/border_bottom_color.cc",
     "$blink_core_output_dir/css/properties/longhands/border_bottom_left_radius.h",
@@ -567,6 +574,12 @@
     "$blink_core_output_dir/css/properties/longhands/border_image_slice.h",
     "$blink_core_output_dir/css/properties/longhands/border_image_source.h",
     "$blink_core_output_dir/css/properties/longhands/border_image_width.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_end_color.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_end_style.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_end_width.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_start_color.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_start_style.h",
+    "$blink_core_output_dir/css/properties/longhands/border_inline_start_width.h",
     "$blink_core_output_dir/css/properties/longhands/border_left_color.h",
     "$blink_core_output_dir/css/properties/longhands/border_left_color.cc",
     "$blink_core_output_dir/css/properties/longhands/border_left_style.h",
@@ -672,6 +685,10 @@
     "$blink_core_output_dir/css/properties/longhands/image_orientation.h",
     "$blink_core_output_dir/css/properties/longhands/image_rendering.h",
     "$blink_core_output_dir/css/properties/longhands/inline_size.h",
+    "$blink_core_output_dir/css/properties/longhands/inset_block_end.h",
+    "$blink_core_output_dir/css/properties/longhands/inset_block_start.h",
+    "$blink_core_output_dir/css/properties/longhands/inset_inline_end.h",
+    "$blink_core_output_dir/css/properties/longhands/inset_inline_start.h",
     "$blink_core_output_dir/css/properties/longhands/isolation.h",
     "$blink_core_output_dir/css/properties/longhands/justify_content.h",
     "$blink_core_output_dir/css/properties/longhands/justify_items.h",
@@ -685,7 +702,11 @@
     "$blink_core_output_dir/css/properties/longhands/list_style_image.h",
     "$blink_core_output_dir/css/properties/longhands/list_style_position.h",
     "$blink_core_output_dir/css/properties/longhands/list_style_type.h",
+    "$blink_core_output_dir/css/properties/longhands/margin_block_start.h",
+    "$blink_core_output_dir/css/properties/longhands/margin_block_end.h",
     "$blink_core_output_dir/css/properties/longhands/margin_bottom.h",
+    "$blink_core_output_dir/css/properties/longhands/margin_inline_start.h",
+    "$blink_core_output_dir/css/properties/longhands/margin_inline_end.h",
     "$blink_core_output_dir/css/properties/longhands/margin_left.h",
     "$blink_core_output_dir/css/properties/longhands/margin_right.h",
     "$blink_core_output_dir/css/properties/longhands/margin_top.h",
@@ -729,7 +750,11 @@
     "$blink_core_output_dir/css/properties/longhands/overflow_y.h",
     "$blink_core_output_dir/css/properties/longhands/overscroll_behavior_x.h",
     "$blink_core_output_dir/css/properties/longhands/overscroll_behavior_y.h",
+    "$blink_core_output_dir/css/properties/longhands/padding_block_start.h",
+    "$blink_core_output_dir/css/properties/longhands/padding_block_end.h",
     "$blink_core_output_dir/css/properties/longhands/padding_bottom.h",
+    "$blink_core_output_dir/css/properties/longhands/padding_inline_start.h",
+    "$blink_core_output_dir/css/properties/longhands/padding_inline_end.h",
     "$blink_core_output_dir/css/properties/longhands/padding_left.h",
     "$blink_core_output_dir/css/properties/longhands/padding_right.h",
     "$blink_core_output_dir/css/properties/longhands/padding_top.h",
@@ -994,16 +1019,31 @@
   script =
       "../build/scripts/core/css/properties/make_css_property_subclasses.py"
   in_files = [ "css/properties/CSSPropertyMethods.json5" ]
-  other_inputs = [ "../build/scripts/core/css/properties/templates/css_property_subclass.h.tmpl" ]
+  other_inputs = [
+    "css/CSSProperties.json5",
+    "../build/scripts/core/css/properties/templates/css_property_subclass.h.tmpl",
+  ]
   outputs = [
     "$blink_core_output_dir/css/properties/shorthands/animation.h",
     "$blink_core_output_dir/css/properties/shorthands/background.h",
     "$blink_core_output_dir/css/properties/shorthands/background_position.h",
     "$blink_core_output_dir/css/properties/shorthands/background_repeat.h",
     "$blink_core_output_dir/css/properties/shorthands/border.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block_color.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block_end.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block_start.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block_style.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_block_width.h",
     "$blink_core_output_dir/css/properties/shorthands/border_bottom.h",
     "$blink_core_output_dir/css/properties/shorthands/border_color.h",
     "$blink_core_output_dir/css/properties/shorthands/border_image.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline_color.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline_end.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline_start.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline_style.h",
+    "$blink_core_output_dir/css/properties/shorthands/border_inline_width.h",
     "$blink_core_output_dir/css/properties/shorthands/border_left.h",
     "$blink_core_output_dir/css/properties/shorthands/border_radius.h",
     "$blink_core_output_dir/css/properties/shorthands/border_right.h",
@@ -1027,14 +1067,21 @@
     "$blink_core_output_dir/css/properties/shorthands/grid_gap.h",
     "$blink_core_output_dir/css/properties/shorthands/grid_row.h",
     "$blink_core_output_dir/css/properties/shorthands/grid_template.h",
+    "$blink_core_output_dir/css/properties/shorthands/inset.h",
+    "$blink_core_output_dir/css/properties/shorthands/inset_block.h",
+    "$blink_core_output_dir/css/properties/shorthands/inset_inline.h",
     "$blink_core_output_dir/css/properties/shorthands/list_style.h",
     "$blink_core_output_dir/css/properties/shorthands/margin.h",
+    "$blink_core_output_dir/css/properties/shorthands/margin_block.h",
+    "$blink_core_output_dir/css/properties/shorthands/margin_inline.h",
     "$blink_core_output_dir/css/properties/shorthands/marker.h",
     "$blink_core_output_dir/css/properties/shorthands/offset.h",
     "$blink_core_output_dir/css/properties/shorthands/outline.h",
     "$blink_core_output_dir/css/properties/shorthands/overflow.h",
     "$blink_core_output_dir/css/properties/shorthands/overscroll_behavior.h",
     "$blink_core_output_dir/css/properties/shorthands/padding.h",
+    "$blink_core_output_dir/css/properties/shorthands/padding_block.h",
+    "$blink_core_output_dir/css/properties/shorthands/padding_inline.h",
     "$blink_core_output_dir/css/properties/shorthands/page_break_after.h",
     "$blink_core_output_dir/css/properties/shorthands/page_break_before.h",
     "$blink_core_output_dir/css/properties/shorthands/page_break_inside.h",

diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index feed67e5..7bdf3e3 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc

@@ -183,6 +183,7 @@
 #include "third_party/blink/renderer/core/html/html_unknown_element.h"
 #include "third_party/blink/renderer/core/html/imports/html_import_loader.h"
 #include "third_party/blink/renderer/core/html/imports/html_imports_controller.h"
+#include "third_party/blink/renderer/core/html/lazy_load_image_observer.h"
 #include "third_party/blink/renderer/core/html/parser/html_document_parser.h"
 #include "third_party/blink/renderer/core/html/parser/html_parser_idioms.h"
 #include "third_party/blink/renderer/core/html/parser/nesting_level_incrementer.h"
@@ -7421,6 +7422,7 @@
   visitor->Trace(policy_);
   visitor->Trace(slot_assignment_engine_);
   visitor->Trace(viewport_data_);
+  visitor->Trace(lazy_load_image_observer_);
   Supplementable<Document>::Trace(visitor);
   TreeScope::Trace(visitor);
   ContainerNode::Trace(visitor);
@@ -7483,6 +7485,12 @@
   return false;
 }
 
+LazyLoadImageObserver& Document::EnsureLazyLoadImageObserver() {
+  if (!lazy_load_image_observer_)
+    lazy_load_image_observer_ = new LazyLoadImageObserver(*this);
+  return *lazy_load_image_observer_;
+}
+
 template class CORE_TEMPLATE_EXPORT Supplement<Document>;
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/dom/document.h b/third_party/blink/renderer/core/dom/document.h
index 7b38e0a..6a72583 100644
--- a/third_party/blink/renderer/core/dom/document.h
+++ b/third_party/blink/renderer/core/dom/document.h

@@ -136,6 +136,7 @@
 class LayoutPoint;
 class ReattachLegacyLayoutObjectList;
 class LayoutView;
+class LazyLoadImageObserver;
 class LiveNodeListBase;
 class LocalDOMWindow;
 class Locale;
@@ -1451,6 +1452,8 @@
 
   bool IsVerticalScrollEnforced() const { return is_vertical_scroll_enforced_; }
 
+  LazyLoadImageObserver& EnsureLazyLoadImageObserver();
+
   // TODO(binji): See http://crbug.com/798572. This implementation shares the
   // same agent cluster ID for any one document. The proper implementation of
   // this function must follow the rules described here:
@@ -1890,6 +1893,8 @@
   // This is set through feature policy 'vertical-scroll'.
   bool is_vertical_scroll_enforced_ = false;
 
+  Member<LazyLoadImageObserver> lazy_load_image_observer_;
+
   // https://tc39.github.io/ecma262/#sec-agent-clusters
   const base::UnguessableToken agent_cluster_id_;
 };

diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index 8c2bd4b..7f3f11b 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc

@@ -3893,6 +3893,10 @@
   EnsureElementRareData().SetComputedStyle(std::move(style));
 }
 
+void Element::ClearComputedStyle() {
+  EnsureElementRareData().ClearComputedStyle();
+}
+
 AtomicString Element::ComputeInheritedLanguage() const {
   const Node* n = this;
   AtomicString value;

diff --git a/third_party/blink/renderer/core/dom/element.h b/third_party/blink/renderer/core/dom/element.h
index 0e89134..010134b 100644
--- a/third_party/blink/renderer/core/dom/element.h
+++ b/third_party/blink/renderer/core/dom/element.h

@@ -547,6 +547,8 @@
   bool ShouldStoreNonLayoutObjectComputedStyle(const ComputedStyle&) const;
   void StoreNonLayoutObjectComputedStyle(scoped_refptr<ComputedStyle>);
 
+  void ClearComputedStyle();
+
   // Methods for indicating the style is affected by dynamic updates (e.g.,
   // children changing, our position changing in our sibling list, etc.)
   bool StyleAffectedByEmpty() const {

diff --git a/third_party/blink/renderer/core/editing/commands/split_text_node_command.cc b/third_party/blink/renderer/core/editing/commands/split_text_node_command.cc
index a4c4c14b..75e449b 100644
--- a/third_party/blink/renderer/core/editing/commands/split_text_node_command.cc
+++ b/third_party/blink/renderer/core/editing/commands/split_text_node_command.cc

@@ -58,7 +58,7 @@
 
   text1_ = Text::Create(GetDocument(), prefix_text);
   DCHECK(text1_);
-  GetDocument().Markers().MoveMarkers(text2_.Get(), offset_, text1_.Get());
+  GetDocument().Markers().MoveMarkers(*text2_, offset_, *text1_);
 
   InsertText1AndTrimText2();
 }
@@ -74,8 +74,7 @@
   text2_->insertData(0, prefix_text, ASSERT_NO_EXCEPTION);
   GetDocument().UpdateStyleAndLayout();
 
-  GetDocument().Markers().MoveMarkers(text1_.Get(), prefix_text.length(),
-                                      text2_.Get());
+  GetDocument().Markers().MoveMarkers(*text1_, prefix_text.length(), *text2_);
   text1_->remove(ASSERT_NO_EXCEPTION);
 }
 
@@ -87,7 +86,7 @@
   if (!parent || !HasEditableStyle(*parent))
     return;
 
-  GetDocument().Markers().MoveMarkers(text2_.Get(), offset_, text1_.Get());
+  GetDocument().Markers().MoveMarkers(*text2_, offset_, *text1_);
 
   InsertText1AndTrimText2();
 }

diff --git a/third_party/blink/renderer/core/editing/editing_utilities.cc b/third_party/blink/renderer/core/editing/editing_utilities.cc
index 362ee91..e207f0b2 100644
--- a/third_party/blink/renderer/core/editing/editing_utilities.cc
+++ b/third_party/blink/renderer/core/editing/editing_utilities.cc

@@ -458,7 +458,7 @@
 }
 
 bool IsEditablePosition(const Position& position) {
-  const Node* node = position.ParentAnchoredEquivalent().AnchorNode();
+  const Node* node = position.ComputeContainerNode();
   if (!node)
     return false;
   DCHECK(node->GetDocument().IsActive());

diff --git a/third_party/blink/renderer/core/editing/editing_utilities_test.cc b/third_party/blink/renderer/core/editing/editing_utilities_test.cc
index 64c533d..6e7fc9e 100644
--- a/third_party/blink/renderer/core/editing/editing_utilities_test.cc
+++ b/third_party/blink/renderer/core/editing/editing_utilities_test.cc

@@ -104,6 +104,22 @@
             EnclosingNodeOfType(PositionInFlatTree(one, 0), IsEnclosingBlock));
 }
 
+// http://crbug.com/873088
+TEST_F(EditingUtilitiesTest, IsEditablePositionWithHr) {
+  SetBodyContent("<hr contenteditable id=target>");
+  Element& target = *GetDocument().getElementById("target");
+  EXPECT_FALSE(IsEditablePosition(Position::BeforeNode(target)));
+  EXPECT_TRUE(IsEditablePosition(Position(target, 0)));
+}
+
+// http://crbug.com/873088
+TEST_F(EditingUtilitiesTest, IsEditablePositionWithSpan) {
+  SetBodyContent("<span contenteditable id=target>abc</span>");
+  Element& target = *GetDocument().getElementById("target");
+  EXPECT_FALSE(IsEditablePosition(Position::BeforeNode(target)));
+  EXPECT_TRUE(IsEditablePosition(Position(target, 0)));
+}
+
 TEST_F(EditingUtilitiesTest, isEditablePositionWithTable) {
   // We would like to have below DOM tree without HTML, HEAD and BODY element.
   //   <table id=table><caption>foo</caption></table>

diff --git a/third_party/blink/renderer/core/editing/finder/find_options.h b/third_party/blink/renderer/core/editing/finder/find_options.h
index 06c9863..6058284 100644
--- a/third_party/blink/renderer/core/editing/finder/find_options.h
+++ b/third_party/blink/renderer/core/editing/finder/find_options.h

@@ -30,18 +30,13 @@
 
 enum FindOptionFlag {
   kCaseInsensitive = 1 << 0,
-  kAtWordStarts = 1 << 1,
-  // When combined with AtWordStarts, accepts a match in the middle of a word if
-  // the match begins with an uppercase letter followed by a lowercase or
-  // non-letter. Accepts several other intra-word matches.
-  kTreatMedialCapitalAsWordStart = 1 << 2,
-  kBackwards = 1 << 3,
-  kWrapAround = 1 << 4,
-  kStartInSelection = 1 << 5,
-  kWholeWord = 1 << 6,  // WholeWord should imply AtWordStarts
+  kBackwards = 1 << 1,
+  kWrapAround = 1 << 2,
+  kStartInSelection = 1 << 3,
+  kWholeWord = 1 << 4,
   // TODO(yosin) Once find UI works on flat tree and it doesn't use
   // |rangeOfString()|, we should get rid of |FindAPICall| enum member.
-  kFindAPICall = 1 << 7,  // Used for Window.find or execCommand('find')
+  kFindAPICall = 1 << 5,  // Used for Window.find or execCommand('find')
 };
 
 typedef unsigned FindOptions;

diff --git a/third_party/blink/renderer/core/editing/finder/text_finder.cc b/third_party/blink/renderer/core/editing/finder/text_finder.cc
index 9eb03b4..ae1fb5a 100644
--- a/third_party/blink/renderer/core/editing/finder/text_finder.cc
+++ b/third_party/blink/renderer/core/editing/finder/text_finder.cc

@@ -164,9 +164,6 @@
       (options.forward ? 0 : kBackwards) |
       (options.match_case ? 0 : kCaseInsensitive) |
       (wrap_within_frame ? kWrapAround : 0) |
-      (options.word_start ? kAtWordStarts : 0) |
-      (options.medial_capital_as_word_start ? kTreatMedialCapitalAsWordStart
-                                            : 0) |
       (options.find_next ? 0 : kStartInSelection);
   active_match_ = Editor::FindRangeOfString(
       *OwnerFrame().GetFrame()->GetDocument(), search_text,

diff --git a/third_party/blink/renderer/core/editing/iterators/search_buffer.cc b/third_party/blink/renderer/core/editing/iterators/search_buffer.cc
index 8a66dd1..c1bca6a 100644
--- a/third_party/blink/renderer/core/editing/iterators/search_buffer.cc
+++ b/third_party/blink/renderer/core/editing/iterators/search_buffer.cc

@@ -56,7 +56,7 @@
       prefix_length_(0),
       number_of_characters_just_appended_(0),
       at_break_(true),
-      needs_more_context_(options & kAtWordStarts),
+      needs_more_context_(options & kWholeWord),
       target_requires_kana_workaround_(ContainsKanaLetters(target)) {
   DCHECK(!target.IsEmpty()) << target;
   target.AppendTo(target_);
@@ -72,14 +72,14 @@
       std::max(target_length * 8, kMinimumSearchBufferSize));
   overlap_ = buffer_.capacity() / 4;
 
-  if ((options_ & kAtWordStarts) && target_length) {
+  if ((options_ & kWholeWord) && target_length) {
     const UChar32 target_first_character =
         GetCodePointAt(target_.data(), 0, target_length);
     // Characters in the separator category never really occur at the beginning
     // of a word, so if the target begins with such a character, we just ignore
     // the AtWordStart option.
     if (IsSeparator(target_first_character)) {
-      options_ &= ~kAtWordStarts;
+      options_ &= ~kWholeWord;
       needs_more_context_ = false;
     }
   }
@@ -176,7 +176,7 @@
 }
 
 inline bool SearchBuffer::IsWordStartMatch(size_t start, size_t length) const {
-  DCHECK(options_ & kAtWordStarts);
+  DCHECK(options_ & kWholeWord);
 
   if (!start)
     return true;
@@ -185,41 +185,6 @@
   int offset = start;
   UChar32 first_character = GetCodePointAt(buffer_.data(), offset, size);
 
-  if (options_ & kTreatMedialCapitalAsWordStart) {
-    UChar32 previous_character;
-    U16_PREV(buffer_.data(), 0, offset, previous_character);
-
-    if (IsSeparator(first_character)) {
-      // The start of a separator run is a word start (".org" in "webkit.org").
-      if (!IsSeparator(previous_character))
-        return true;
-    } else if (IsASCIIUpper(first_character)) {
-      // The start of an uppercase run is a word start ("Kit" in "WebKit").
-      if (!IsASCIIUpper(previous_character))
-        return true;
-      // The last character of an uppercase run followed by a non-separator,
-      // non-digit is a word start ("Request" in "XMLHTTPRequest").
-      offset = start;
-      U16_FWD_1(buffer_.data(), offset, size);
-      UChar32 next_character = 0;
-      if (offset < size)
-        next_character = GetCodePointAt(buffer_.data(), offset, size);
-      if (!IsASCIIUpper(next_character) && !IsASCIIDigit(next_character) &&
-          !IsSeparator(next_character))
-        return true;
-    } else if (IsASCIIDigit(first_character)) {
-      // The start of a digit run is a word start ("2" in "WebKit2").
-      if (!IsASCIIDigit(previous_character))
-        return true;
-    } else if (IsSeparator(previous_character) ||
-               IsASCIIDigit(previous_character)) {
-      // The start of a non-separator, non-uppercase, non-digit run is a word
-      // start, except after an uppercase. ("org" in "webkit.org", but not "ore"
-      // in "WebCore").
-      return true;
-    }
-  }
-
   // Chinese and Japanese lack word boundary marks, and there is no clear
   // agreement on what constitutes a word, so treat the position before any CJK
   // character as a word start.
@@ -264,7 +229,7 @@
   // possibly including a combining character that's not yet in the buffer.
   if (!at_break_ && match.start >= size - overlap_) {
     size_t overlap = overlap_;
-    if (options_ & kAtWordStarts) {
+    if (options_ & kWholeWord) {
       // Ensure that there is sufficient context before matchStart the next time
       // around for determining if it is at a word boundary.
       int word_boundary_context_start = match.start;
@@ -285,7 +250,7 @@
 
   // If this match is "bad", move on to the next match.
   if (IsBadMatch(buffer_.data() + match.start, match.length) ||
-      ((options_ & kAtWordStarts) &&
+      ((options_ & kWholeWord) &&
        !IsWordStartMatch(match.start, match.length))) {
     goto nextMatch;
   }

diff --git a/third_party/blink/renderer/core/editing/iterators/search_buffer.h b/third_party/blink/renderer/core/editing/iterators/search_buffer.h
index dbe606fc2..f7754d3 100644
--- a/third_party/blink/renderer/core/editing/iterators/search_buffer.h
+++ b/third_party/blink/renderer/core/editing/iterators/search_buffer.h

@@ -45,9 +45,7 @@
 // Keeps enough of the previous text to be able to search in the future, but no
 // more. Non-breaking spaces are always equal to normal spaces. Case folding is
 // also done if the CaseInsensitive option is specified. Matches are further
-// filtered if the AtWordStarts option is specified, although some matches
-// inside a word are permitted if TreatMedialCapitalAsWordStart is specified as
-// well.
+// filtered if it should be starting at a word start (WholeWord is set).
 class SearchBuffer {
   STACK_ALLOCATED();
 

diff --git a/third_party/blink/renderer/core/editing/markers/document_marker_controller.cc b/third_party/blink/renderer/core/editing/markers/document_marker_controller.cc
index 4b83c72..936f7199 100644
--- a/third_party/blink/renderer/core/editing/markers/document_marker_controller.cc
+++ b/third_party/blink/renderer/core/editing/markers/document_marker_controller.cc

@@ -295,9 +295,9 @@
 
 // Moves markers from src_node to dst_node. Markers are moved if their start
 // offset is less than length. Markers that run past that point are truncated.
-void DocumentMarkerController::MoveMarkers(const Node* src_node,
+void DocumentMarkerController::MoveMarkers(const Text& src_node,
                                            int length,
-                                           const Node* dst_node) {
+                                           const Text& dst_node) {
   if (length <= 0)
     return;
 
@@ -305,15 +305,15 @@
     return;
   DCHECK(!markers_.IsEmpty());
 
-  MarkerLists* src_markers = markers_.at(src_node);
+  MarkerLists* const src_markers = markers_.at(&src_node);
   if (!src_markers)
     return;
 
-  if (!markers_.Contains(dst_node)) {
-    markers_.insert(dst_node,
+  if (!markers_.Contains(&dst_node)) {
+    markers_.insert(&dst_node,
                     new MarkerLists(DocumentMarker::kMarkerTypeIndexesCount));
   }
-  MarkerLists* dst_markers = markers_.at(dst_node);
+  MarkerLists* const dst_markers = markers_.at(&dst_node);
 
   bool doc_dirty = false;
   for (DocumentMarker::MarkerType type : DocumentMarker::MarkerTypes::All()) {
@@ -332,7 +332,7 @@
   if (!doc_dirty)
     return;
 
-  InvalidatePaintForNode(*dst_node);
+  InvalidatePaintForNode(dst_node);
 }
 
 void DocumentMarkerController::RemoveMarkersInternal(

diff --git a/third_party/blink/renderer/core/editing/markers/document_marker_controller.h b/third_party/blink/renderer/core/editing/markers/document_marker_controller.h
index 129b913..f7b3d9b 100644
--- a/third_party/blink/renderer/core/editing/markers/document_marker_controller.h
+++ b/third_party/blink/renderer/core/editing/markers/document_marker_controller.h

@@ -73,7 +73,7 @@
   void AddSuggestionMarker(const EphemeralRange&,
                            const SuggestionMarkerProperties&);
 
-  void MoveMarkers(const Node* src_node, int length, const Node* dst_node);
+  void MoveMarkers(const Text& src_node, int length, const Text& dst_node);
 
   void PrepareForDestruction();
   void RemoveMarkersInRange(const EphemeralRange&, DocumentMarker::MarkerTypes);

diff --git a/third_party/blink/renderer/core/exported/web_frame_test.cc b/third_party/blink/renderer/core/exported/web_frame_test.cc
index 73260439..9d1d3952 100644
--- a/third_party/blink/renderer/core/exported/web_frame_test.cc
+++ b/third_party/blink/renderer/core/exported/web_frame_test.cc

@@ -40,6 +40,7 @@
 #include "build/build_config.h"
 #include "cc/layers/picture_layer.h"
 #include "cc/trees/layer_tree_host.h"
+#include "mojo/public/cpp/bindings/binding.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/page/launching_process_state.h"
@@ -5033,24 +5034,37 @@
   FrameTestHelpers::ReloadFrame(web_view_helper.GetWebView()->MainFrameImpl());
 }
 
-class FindUpdateWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
+class TestFindInPageClient : public mojom::blink::FindInPageClient {
  public:
-  FindUpdateWebFrameClient()
-      : find_results_are_ready_(false), count_(-1), active_index_(-1) {}
-  ~FindUpdateWebFrameClient() override = default;
+  TestFindInPageClient()
+      : find_results_are_ready_(false),
+        count_(-1),
+        active_index_(-1),
+        binding_(this) {}
 
-  // FrameTestHelpers::TestWebFrameClient:
-  void SendFindReply(int request_id,
-                     int match_count,
-                     int ordinal,
-                     const WebRect& selection_rect,
-                     bool final_status_update) override {
-    if (match_count != -1)
-      count_ = match_count;
-    if (ordinal != -1)
-      active_index_ = ordinal;
-    if (final_status_update)
-      find_results_are_ready_ = true;
+  ~TestFindInPageClient() override = default;
+
+  void SetFrame(WebLocalFrameImpl* frame) {
+    mojom::blink::FindInPageClientPtr client;
+    binding_.Bind(MakeRequest(&client));
+    frame->GetFindInPage()->SetClient(std::move(client));
+  }
+  void SetNumberOfMatches(
+      int request_id,
+      unsigned int current_number_of_matches,
+      mojom::blink::FindMatchUpdateType final_update) final {
+    count_ = current_number_of_matches;
+    find_results_are_ready_ =
+        (final_update == mojom::blink::FindMatchUpdateType::kFinalUpdate);
+  }
+
+  void SetActiveMatch(int request_id,
+                      const WebRect& active_match_rect,
+                      int active_match_ordinal,
+                      mojom::blink::FindMatchUpdateType final_update) final {
+    active_index_ = active_match_ordinal;
+    find_results_are_ready_ =
+        (final_update == mojom::blink::FindMatchUpdateType::kFinalUpdate);
   }
 
   bool FindResultsAreReady() const { return find_results_are_ready_; }
@@ -5061,15 +5075,16 @@
   bool find_results_are_ready_;
   int count_;
   int active_index_;
+  mojo::Binding<mojom::blink::FindInPageClient> binding_;
 };
 
 TEST_F(WebFrameTest, FindInPageMatchRects) {
   RegisterMockedHttpURLLoad("find_in_page_frame.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
   web_view_helper.InitializeAndLoad(base_url_ + "find_in_page_frame.html",
-                                    &client);
+                                    &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   web_view_helper.GetWebView()->SetMaximumLegibleScale(1.f);
   web_view_helper.GetWebView()->UpdateAllLifecyclePhases();
@@ -5085,6 +5100,8 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
   EXPECT_TRUE(main_frame->Find(kFindIdentifier, search_text, options, false));
 
   main_frame->EnsureTextFinder().ResetMatchCount();
@@ -5096,7 +5113,7 @@
   }
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
 
   WebVector<WebFloatRect> web_match_rects =
       main_frame->EnsureTextFinder().FindMatchRects();
@@ -5140,10 +5157,10 @@
 TEST_F(WebFrameTest, FindInPageActiveIndex) {
   RegisterMockedHttpURLLoad("find_match_count.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
   web_view_helper.InitializeAndLoad(base_url_ + "find_match_count.html",
-                                    &client);
+                                    &frame_client);
   web_view_helper.GetWebView()->Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5154,6 +5171,9 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
+
   EXPECT_TRUE(main_frame->Find(kFindIdentifier, search_text, options, false));
   main_frame->EnsureTextFinder().ResetMatchCount();
 
@@ -5175,8 +5195,8 @@
   }
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
-  EXPECT_EQ(kActiveIndex, client.ActiveIndex());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
+  EXPECT_EQ(kActiveIndex, find_in_page_client.ActiveIndex());
 
   const char* kFindStringNew = "e";
   WebString search_text_new = WebString::FromUTF8(kFindStringNew);
@@ -5192,17 +5212,18 @@
   }
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
-  EXPECT_EQ(kActiveIndex, client.ActiveIndex());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
+  EXPECT_EQ(kActiveIndex, find_in_page_client.ActiveIndex());
 }
 
 TEST_F(WebFrameTest, FindOnDetachedFrame) {
   RegisterMockedHttpURLLoad("find_in_page.html");
   RegisterMockedHttpURLLoad("find_in_page_frame.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html", &client);
+  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html",
+                                    &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5212,6 +5233,9 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient main_find_in_page_client;
+  main_find_in_page_client.SetFrame(main_frame);
+
   WebLocalFrameImpl* second_frame =
       ToWebLocalFrameImpl(main_frame->TraverseNext());
 
@@ -5223,7 +5247,7 @@
       second_frame->Find(kFindIdentifier, search_text, options, false));
 
   RunPendingTasks();
-  EXPECT_FALSE(client.FindResultsAreReady());
+  EXPECT_FALSE(main_find_in_page_client.FindResultsAreReady());
 
   main_frame->EnsureTextFinder().ResetMatchCount();
 
@@ -5234,16 +5258,17 @@
   }
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(main_find_in_page_client.FindResultsAreReady());
 }
 
 TEST_F(WebFrameTest, FindDetachFrameBeforeScopeStrings) {
   RegisterMockedHttpURLLoad("find_in_page.html");
   RegisterMockedHttpURLLoad("find_in_page_frame.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html", &client);
+  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html",
+                                    &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5253,6 +5278,8 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
 
   for (WebFrame* frame = main_frame; frame; frame = frame->TraverseNext()) {
     EXPECT_TRUE(frame->ToWebLocalFrame()->Find(kFindIdentifier, search_text,
@@ -5260,7 +5287,7 @@
   }
 
   RunPendingTasks();
-  EXPECT_FALSE(client.FindResultsAreReady());
+  EXPECT_FALSE(find_in_page_client.FindResultsAreReady());
 
   // Detach the frame between finding and scoping.
   RemoveElementById(main_frame, "frame");
@@ -5274,16 +5301,17 @@
   }
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
 }
 
 TEST_F(WebFrameTest, FindDetachFrameWhileScopingStrings) {
   RegisterMockedHttpURLLoad("find_in_page.html");
   RegisterMockedHttpURLLoad("find_in_page_frame.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html", &client);
+  web_view_helper.InitializeAndLoad(base_url_ + "find_in_page.html",
+                                    &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5293,6 +5321,8 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
 
   for (WebFrame* frame = main_frame; frame; frame = frame->TraverseNext()) {
     EXPECT_TRUE(frame->ToWebLocalFrame()->Find(kFindIdentifier, search_text,
@@ -5300,7 +5330,7 @@
   }
 
   RunPendingTasks();
-  EXPECT_FALSE(client.FindResultsAreReady());
+  EXPECT_FALSE(find_in_page_client.FindResultsAreReady());
 
   main_frame->EnsureTextFinder().ResetMatchCount();
 
@@ -5315,16 +5345,16 @@
   RemoveElementById(main_frame, "frame");
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
 }
 
 TEST_F(WebFrameTest, ResetMatchCount) {
   RegisterMockedHttpURLLoad("find_in_generated_frame.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
   web_view_helper.InitializeAndLoad(base_url_ + "find_in_generated_frame.html",
-                                    &client);
+                                    &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5334,6 +5364,8 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
 
   // Check that child frame exists.
   EXPECT_TRUE(!!main_frame->TraverseNext());
@@ -5344,7 +5376,7 @@
   }
 
   RunPendingTasks();
-  EXPECT_FALSE(client.FindResultsAreReady());
+  EXPECT_FALSE(find_in_page_client.FindResultsAreReady());
 
   main_frame->EnsureTextFinder().ResetMatchCount();
 }
@@ -5352,9 +5384,9 @@
 TEST_F(WebFrameTest, SetTickmarks) {
   RegisterMockedHttpURLLoad("find.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.InitializeAndLoad(base_url_ + "find.html", &client);
+  web_view_helper.InitializeAndLoad(base_url_ + "find.html", &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
@@ -5364,6 +5396,8 @@
   WebFindOptions options;
   WebString search_text = WebString::FromUTF8(kFindString);
   WebLocalFrameImpl* main_frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(main_frame);
   EXPECT_TRUE(main_frame->Find(kFindIdentifier, search_text, options, false));
 
   main_frame->EnsureTextFinder().ResetMatchCount();
@@ -5371,7 +5405,7 @@
       kFindIdentifier, search_text, options);
 
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
 
   // Get the tickmarks for the original find request.
   LocalFrameView* frame_view = web_view_helper.LocalMainFrame()->GetFrameView();
@@ -5405,13 +5439,16 @@
 TEST_F(WebFrameTest, FindInPageJavaScriptUpdatesDOM) {
   RegisterMockedHttpURLLoad("find.html");
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.InitializeAndLoad(base_url_ + "find.html", &client);
+  web_view_helper.InitializeAndLoad(base_url_ + "find.html", &frame_client);
   web_view_helper.Resize(WebSize(640, 480));
   RunPendingTasks();
 
   WebLocalFrameImpl* frame = web_view_helper.LocalMainFrame();
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(frame);
+
   const int kFindIdentifier = 12345;
   static const char* kFindString = "foo";
   WebString search_text = WebString::FromUTF8(kFindString);
@@ -5422,7 +5459,7 @@
   frame->EnsureTextFinder().StartScopingStringMatches(kFindIdentifier,
                                                       search_text, options);
   RunPendingTasks();
-  EXPECT_TRUE(client.FindResultsAreReady());
+  EXPECT_TRUE(find_in_page_client.FindResultsAreReady());
 
   // Find in a <div> element.
   options.find_next = true;
@@ -5481,9 +5518,9 @@
       "bar foo bar foo bar foo bar foo bar foo bar foo bar foo bar foo bar foo "
       "bar foo bar foo abc bar <div id='new_text'></div>";
 
-  FindUpdateWebFrameClient client;
+  FrameTestHelpers::TestWebFrameClient frame_client;
   FrameTestHelpers::WebViewHelper web_view_helper;
-  web_view_helper.Initialize(&client);
+  web_view_helper.Initialize(&frame_client);
 
   WebLocalFrameImpl* frame = web_view_helper.LocalMainFrame();
   FrameTestHelpers::LoadHTMLString(frame, html,
@@ -5492,30 +5529,35 @@
   web_view_helper.GetWebView()->SetFocus(true);
   RunPendingTasks();
 
+  TestFindInPageClient find_in_page_client;
+  find_in_page_client.SetFrame(frame);
   const int kFindIdentifier = 12345;
-  WebFindOptions options;
 
+  mojom::blink::FindOptionsPtr options(mojom::blink::FindOptions::New());
+  options->find_next = false;
+  options->forward = true;
   // The first search that will start the scoping process.
-  frame->RequestFind(kFindIdentifier, search_pattern, options);
-  EXPECT_FALSE(client.FindResultsAreReady());
-  EXPECT_EQ(1, client.Count());
+  frame->GetFindInPage()->Find(kFindIdentifier, search_pattern,
+                               std::move(options));
+  EXPECT_FALSE(find_in_page_client.FindResultsAreReady());
   EXPECT_TRUE(frame->EnsureTextFinder().ScopingInProgress());
-
   // The scoping won't find all the entries on the first run due to the fake
   // timer.
   while (frame->EnsureTextFinder().ScopingInProgress())
     RunPendingTasks();
 
-  EXPECT_EQ(2, client.Count());
-  EXPECT_EQ(1, client.ActiveIndex());
-
-  options.find_next = true;
-
+  EXPECT_EQ(2, find_in_page_client.Count());
+  EXPECT_EQ(1, find_in_page_client.ActiveIndex());
+  mojom::blink::FindOptionsPtr options2(mojom::blink::FindOptions::New());
+  options2->find_next = true;
+  options2->forward = true;
   // The second search will jump to the next match without any scoping.
-  frame->RequestFind(kFindIdentifier, search_pattern, options);
-
-  EXPECT_EQ(2, client.Count());
-  EXPECT_EQ(2, client.ActiveIndex());
+  frame->GetFindInPage()->Find(kFindIdentifier, search_pattern,
+                               std::move(options2));
+  // Run pending tasks to make sure IncreaseMatchCount calls passes.
+  RunPendingTasks();
+  EXPECT_EQ(2, find_in_page_client.Count());
+  EXPECT_EQ(2, find_in_page_client.ActiveIndex());
   EXPECT_FALSE(frame->EnsureTextFinder().ScopingInProgress());
 
   // Insert new text, which contains occurence of |searchText|.
@@ -5523,16 +5565,20 @@
       WebScriptSource("var textDiv = document.getElementById('new_text');"
                       "textDiv.innerHTML = 'foo abc';"));
 
+  mojom::blink::FindOptionsPtr options3(mojom::blink::FindOptions::New());
+  options3->find_next = true;
+  options3->forward = true;
   // The third search will find a new match and initiate a new scoping.
-  frame->RequestFind(kFindIdentifier, search_pattern, options);
+  frame->GetFindInPage()->Find(kFindIdentifier, search_pattern,
+                               std::move(options3));
 
   EXPECT_TRUE(frame->EnsureTextFinder().ScopingInProgress());
 
   while (frame->EnsureTextFinder().ScopingInProgress())
     RunPendingTasks();
 
-  EXPECT_EQ(3, client.Count());
-  EXPECT_EQ(3, client.ActiveIndex());
+  EXPECT_EQ(3, find_in_page_client.Count());
+  EXPECT_EQ(3, find_in_page_client.ActiveIndex());
 }
 
 TEST_F(WebFrameTest, FindInPageStopFindActionKeepSelectionInAnotherDocument) {

diff --git a/third_party/blink/renderer/core/exported/web_security_policy.cc b/third_party/blink/renderer/core/exported/web_security_policy.cc
index 591e376a..288a80d 100644
--- a/third_party/blink/renderer/core/exported/web_security_policy.cc
+++ b/third_party/blink/renderer/core/exported/web_security_policy.cc

@@ -95,20 +95,6 @@
       destination_host, allow_destination_subdomains);
 }
 
-void WebSecurityPolicy::RemoveOriginAccessBlacklistEntry(
-    const WebURL& source_origin,
-    const WebString& destination_protocol,
-    const WebString& destination_host,
-    bool allow_destination_subdomains) {
-  SecurityPolicy::RemoveOriginAccessBlacklistEntry(
-      *SecurityOrigin::Create(source_origin), destination_protocol,
-      destination_host, allow_destination_subdomains);
-}
-
-void WebSecurityPolicy::ResetOriginAccessBlacklists() {
-  SecurityPolicy::ResetOriginAccessBlacklists();
-}
-
 void WebSecurityPolicy::AddOriginTrustworthyWhiteList(const WebString& origin) {
   SecurityPolicy::AddOriginTrustworthyWhiteList(origin);
 }

diff --git a/third_party/blink/renderer/core/frame/find_in_page.cc b/third_party/blink/renderer/core/frame/find_in_page.cc
index 1ddb382..e9c698a 100644
--- a/third_party/blink/renderer/core/frame/find_in_page.cc
+++ b/third_party/blink/renderer/core/frame/find_in_page.cc

@@ -39,6 +39,8 @@
 #include "third_party/blink/renderer/core/editing/finder/text_finder.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
+#include "third_party/blink/renderer/core/page/focus_controller.h"
+#include "third_party/blink/renderer/core/page/page.h"
 
 namespace blink {
 
@@ -58,19 +60,31 @@
       WTF::BindRepeating(&FindInPage::BindToRequest, WrapWeakPersistent(this)));
 }
 
-void WebLocalFrameImpl::RequestFind(int identifier,
-                                    const WebString& search_text,
-                                    const WebFindOptions& options) {
-  find_in_page_->RequestFind(identifier, search_text, options);
-}
+void FindInPage::Find(int request_id,
+                      const String& search_text,
+                      mojom::blink::FindOptionsPtr options) {
+  DCHECK(!search_text.IsEmpty());
+  blink::WebPlugin* plugin = GetWebPluginForFind();
+  // Check if the plugin still exists in the document.
+  if (plugin) {
+    if (options->find_next) {
+      // Just navigate back/forward.
+      plugin->SelectFindResult(options->forward, request_id);
+      LocalFrame* core_frame = frame_->GetFrame();
+      core_frame->GetPage()->GetFocusController().SetFocusedFrame(core_frame);
+    } else if (!plugin->StartFind(search_text, options->match_case,
+                                  request_id)) {
+      // Send "no results"
+      ReportFindInPageMatchCount(request_id, 0 /* count */,
+                                 true /* final_update */);
+    }
+    return;
+  }
 
-void FindInPage::RequestFind(int identifier,
-                             const WebString& search_text,
-                             const WebFindOptions& options) {
   // Send "no results" if this frame has no visible content.
-  if (!frame_->HasVisibleContent() && !options.force) {
-    frame_->ReportFindInPageMatchCount(identifier, 0 /* count */,
-                                       true /* finalUpdate */);
+  if (!frame_->HasVisibleContent() && !options->force) {
+    ReportFindInPageMatchCount(request_id, 0 /* count */,
+                               true /* final_update */);
     return;
   }
 
@@ -78,18 +92,24 @@
   bool result = false;
   bool active_now = false;
 
+  WebFindOptions web_options;
+  web_options.forward = options->forward;
+  web_options.match_case = options->match_case;
+  web_options.find_next = options->find_next;
+  web_options.force = options->force;
+
   // Search for an active match only if this frame is focused or if this is a
   // find next request.
-  if (frame_->IsFocused() || options.find_next) {
-    result = frame_->Find(identifier, search_text, options,
-                          false /* wrapWithinFrame */, &active_now);
+  if (frame_->IsFocused() || options->find_next) {
+    result = FindInternal(request_id, search_text, web_options,
+                          false /* wrap_within_frame */, &active_now);
   }
 
-  if (result && !options.find_next) {
+  if (result && !options->find_next) {
     // Indicate that at least one match has been found. 1 here means
     // possibly more matches could be coming.
-    frame_->ReportFindInPageMatchCount(identifier, 1 /* count */,
-                                       false /* final_update */);
+    ReportFindInPageMatchCount(request_id, 1 /* count */,
+                               false /* final_update */);
   }
 
   // There are three cases in which scoping is needed:
@@ -110,17 +130,17 @@
   //
   // If none of these cases are true, then we just report the current match
   // count without scoping.
-  if (/* (1) */ options.find_next && /* (2) */ current_selection.IsNull() &&
+  if (/* (1) */ options->find_next && /* (2) */ current_selection.IsNull() &&
       /* (3) */ !(result && !active_now)) {
     // Force report of the actual count.
-    EnsureTextFinder().IncreaseMatchCount(identifier, 0);
+    EnsureTextFinder().IncreaseMatchCount(request_id, 0);
     return;
   }
 
   // Start a new scoping request. If the scoping function determines that it
   // needs to scope, it will defer until later.
-  EnsureTextFinder().StartScopingStringMatches(identifier, search_text,
-                                               options);
+  EnsureTextFinder().StartScopingStringMatches(request_id, search_text,
+                                               web_options);
 }
 
 bool WebLocalFrameImpl::Find(int identifier,
@@ -128,15 +148,15 @@
                              const WebFindOptions& options,
                              bool wrap_within_frame,
                              bool* active_now) {
-  return find_in_page_->Find(identifier, search_text, options,
-                             wrap_within_frame, active_now);
+  return find_in_page_->FindInternal(identifier, search_text, options,
+                                     wrap_within_frame, active_now);
 }
 
-bool FindInPage::Find(int identifier,
-                      const WebString& search_text,
-                      const WebFindOptions& options,
-                      bool wrap_within_frame,
-                      bool* active_now) {
+bool FindInPage::FindInternal(int identifier,
+                              const WebString& search_text,
+                              const WebFindOptions& options,
+                              bool wrap_within_frame,
+                              bool* active_now) {
   if (!frame_->GetFrame())
     return false;
 
@@ -207,15 +227,11 @@
     // Something went wrong, so send a no-op reply (force the frame to report
     // the current match count) in case the host is waiting for a response due
     // to rate-limiting.
-    int number_of_matches = EnsureTextFinder().TotalMatchCount();
-    mojom::blink::FindMatchUpdateType update_type =
-        mojom::blink::FindMatchUpdateType::kMoreUpdatesComing;
-    if (!EnsureTextFinder().FrameScoping() || !number_of_matches)
-      update_type = mojom::blink::FindMatchUpdateType::kFinalUpdate;
-    client_->SetNumberOfMatches(request_id, number_of_matches, update_type);
+    EnsureTextFinder().IncreaseMatchCount(request_id, 0);
     return;
   }
-  client_->SetActiveMatch(request_id, active_match_rect, ordinal);
+  ReportFindInPageSelection(request_id, ordinal, active_match_rect,
+                            true /* final_update */);
 }
 
 void FindInPage::SetClient(mojom::blink::FindInPageClientPtr client) {
@@ -284,10 +300,6 @@
   return plugin_find_handler_;
 }
 
-WebPlugin* WebLocalFrameImpl::GetWebPluginForFind() {
-  return find_in_page_->GetWebPluginForFind();
-}
-
 WebPlugin* FindInPage::GetWebPluginForFind() {
   if (frame_->GetDocument().IsPluginDocument())
     return frame_->GetDocument().To<WebPluginDocument>().Plugin();
@@ -312,10 +324,19 @@
 void WebLocalFrameImpl::ReportFindInPageMatchCount(int request_id,
                                                    int count,
                                                    bool final_update) {
-  if (!Client())
+  find_in_page_->ReportFindInPageMatchCount(request_id, count, final_update);
+}
+
+void FindInPage::ReportFindInPageMatchCount(int request_id,
+                                            int count,
+                                            bool final_update) {
+  // In tests, |client_| might not be set.
+  if (!client_)
     return;
-  Client()->SendFindReply(request_id, count, -1 /* active_match_ordinal */,
-                          WebRect(), final_update);
+  client_->SetNumberOfMatches(
+      request_id, count,
+      final_update ? mojom::blink::FindMatchUpdateType::kFinalUpdate
+                   : mojom::blink::FindMatchUpdateType::kMoreUpdatesComing);
 }
 
 void WebLocalFrameImpl::ReportFindInPageSelection(
@@ -323,10 +344,21 @@
     int active_match_ordinal,
     const blink::WebRect& selection_rect,
     bool final_update) {
-  if (!Client())
+  find_in_page_->ReportFindInPageSelection(request_id, active_match_ordinal,
+                                           selection_rect, final_update);
+}
+
+void FindInPage::ReportFindInPageSelection(int request_id,
+                                           int active_match_ordinal,
+                                           const blink::WebRect& selection_rect,
+                                           bool final_update) {
+  // In tests, |client_| might not be set.
+  if (!client_)
     return;
-  Client()->SendFindReply(request_id, -1 /* match_count */,
-                          active_match_ordinal, selection_rect, final_update);
+  client_->SetActiveMatch(
+      request_id, selection_rect, active_match_ordinal,
+      final_update ? mojom::blink::FindMatchUpdateType::kFinalUpdate
+                   : mojom::blink::FindMatchUpdateType::kMoreUpdatesComing);
 }
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/frame/find_in_page.h b/third_party/blink/renderer/core/frame/find_in_page.h
index 68ec387..b2b8f66 100644
--- a/third_party/blink/renderer/core/frame/find_in_page.h
+++ b/third_party/blink/renderer/core/frame/find_in_page.h

@@ -35,15 +35,11 @@
     return new FindInPage(frame, interface_registry);
   }
 
-  void RequestFind(int identifier,
-                   const WebString& search_text,
-                   const WebFindOptions&);
-
-  bool Find(int identifier,
-            const WebString& search_text,
-            const WebFindOptions&,
-            bool wrap_within_frame,
-            bool* active_now = nullptr);
+  bool FindInternal(int identifier,
+                    const WebString& search_text,
+                    const WebFindOptions&,
+                    bool wrap_within_frame,
+                    bool* active_now = nullptr);
 
   void SetTickmarks(const WebVector<WebRect>&);
 
@@ -54,7 +50,17 @@
   // coordinates.
   WebFloatRect ActiveFindMatchRect();
 
+  void ReportFindInPageMatchCount(int request_id, int count, bool final_update);
+
+  void ReportFindInPageSelection(int request_id,
+                                 int active_match_ordinal,
+                                 const blink::WebRect& selection_rect,
+                                 bool final_update);
+
   // mojom::blink::FindInPage overrides
+  void Find(int request_id,
+            const String& search_text,
+            mojom::blink::FindOptionsPtr) final;
 
   void SetClient(mojom::blink::FindInPageClientPtr) final;
 

diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
index 1bf6ed2..c44619d 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/third_party/blink/renderer/core/frame/local_dom_window.cc

@@ -891,7 +891,7 @@
   // FIXME (13016): Support searchInFrames and showDialog
   FindOptions options =
       (backwards ? kBackwards : 0) | (case_sensitive ? 0 : kCaseInsensitive) |
-      (wrap ? kWrapAround : 0) | (whole_word ? kWholeWord | kAtWordStarts : 0);
+      (wrap ? kWrapAround : 0) | (whole_word ? kWholeWord : 0);
   return Editor::FindString(*GetFrame(), string, options);
 }
 

diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
index 9378ac5..ef81bd1f 100644
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc

@@ -1276,6 +1276,20 @@
   }
 }
 
+bool LocalFrame::MaybeAllowLazyLoadingImage(FetchParameters& params) const {
+  if (!RuntimeEnabledFeatures::LazyImageLoadingEnabled())
+    return false;
+  if (params.GetPlaceholderImageRequestType() ==
+      FetchParameters::PlaceholderImageRequestType::kAllowPlaceholder) {
+    return false;
+  }
+  if (Owner() && !Owner()->ShouldLazyLoadChildren())
+    return false;
+
+  params.SetAllowImagePlaceholder();
+  return true;
+}
+
 WebURLLoaderFactory* LocalFrame::GetURLLoaderFactory() {
   if (!url_loader_factory_)
     url_loader_factory_ = Client()->CreateURLLoaderFactory();

diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/blink/renderer/core/frame/local_frame.h
index a2998aa..1191396 100644
--- a/third_party/blink/renderer/core/frame/local_frame.h
+++ b/third_party/blink/renderer/core/frame/local_frame.h

@@ -295,6 +295,11 @@
   // the embedder decides that Client Lo-Fi should be used for this request.
   void MaybeAllowImagePlaceholder(FetchParameters&) const;
 
+  // Convenience function to allow loading image placeholders for the request if
+  // lazyloading the image is possible. Returns if lazyloading the image is
+  // possible.
+  bool MaybeAllowLazyLoadingImage(FetchParameters&) const;
+
   // The returned value is a off-heap raw-ptr and should not be stored.
   WebURLLoaderFactory* GetURLLoaderFactory();
 

diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.h b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
index 4b736228..d17f81f 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.h
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.h

@@ -305,9 +305,6 @@
   void DidCallAddSearchProvider() override;
   void DidCallIsSearchProviderInstalled() override;
   void ReplaceSelection(const WebString&) override;
-  void RequestFind(int identifier,
-                   const WebString& search_text,
-                   const WebFindOptions&) override;
   bool Find(int identifier,
             const WebString& search_text,
             const WebFindOptions&,
@@ -315,7 +312,6 @@
             bool* active_now = nullptr) override;
   void StopFindingForTesting(mojom::StopFindAction) override;
   void SetTickmarks(const WebVector<WebRect>&) override;
-  WebPlugin* GetWebPluginForFind() override;
   void ReportFindInPageMatchCount(int identifier,
                                   int count,
                                   bool final_update) override;

diff --git a/third_party/blink/renderer/core/html/BUILD.gn b/third_party/blink/renderer/core/html/BUILD.gn
index fe667fb..bcb101f 100644
--- a/third_party/blink/renderer/core/html/BUILD.gn
+++ b/third_party/blink/renderer/core/html/BUILD.gn

@@ -457,6 +457,8 @@
     "imports/link_import.h",
     "lazy_load_frame_observer.cc",
     "lazy_load_frame_observer.h",
+    "lazy_load_image_observer.cc",
+    "lazy_load_image_observer.h",
     "link_manifest.cc",
     "link_manifest.h",
     "link_rel_attribute.cc",

diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
index 14a6964d..08400ac 100644
--- a/third_party/blink/renderer/core/html/html_image_element.h
+++ b/third_party/blink/renderer/core/html/html_image_element.h

@@ -87,6 +87,9 @@
   ImageResource* CachedImageResourceForImageDocument() const {
     return GetImageLoader().ImageResourceForImageDocument();
   }
+  void LoadDeferredImage() {
+    GetImageLoader().LoadDeferredImage(referrer_policy_);
+  }
   void SetImageForTest(ImageResourceContent* content) {
     GetImageLoader().SetImageForTest(content);
   }
@@ -139,6 +142,8 @@
   FormAssociated* ToFormAssociatedOrNull() override { return this; };
   void AssociateWith(HTMLFormElement*) override;
 
+  bool ElementCreatedByParser() const { return element_created_by_parser_; }
+
  protected:
   // Controls how an image element appears in the layout. See:
   // https://html.spec.whatwg.org/multipage/embedded-content.html#image-request

diff --git a/third_party/blink/renderer/core/html/lazy_load_image_observer.cc b/third_party/blink/renderer/core/html/lazy_load_image_observer.cc
new file mode 100644
index 0000000..4ed22107
--- /dev/null
+++ b/third_party/blink/renderer/core/html/lazy_load_image_observer.cc

@@ -0,0 +1,70 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/html/lazy_load_image_observer.h"
+
+#include "build/build_config.h"
+#include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/dom/element.h"
+#include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/html/html_image_element.h"
+#include "third_party/blink/renderer/core/html_element_type_helpers.h"
+#include "third_party/blink/renderer/core/inspector/console_message.h"
+#include "third_party/blink/renderer/core/intersection_observer/intersection_observer.h"
+#include "third_party/blink/renderer/core/intersection_observer/intersection_observer_entry.h"
+#include "third_party/blink/renderer/core/style/computed_style.h"
+
+namespace blink {
+
+void LazyLoadImageObserver::StartMonitoring(Element* element) {
+  if (LocalFrame* frame = element->GetDocument().GetFrame()) {
+    if (Document* document = frame->LocalFrameRoot().GetDocument()) {
+      document->EnsureLazyLoadImageObserver()
+          .lazy_load_intersection_observer_->observe(element);
+    }
+  }
+}
+
+void LazyLoadImageObserver::StopMonitoring(Element* element) {
+  if (LocalFrame* frame = element->GetDocument().GetFrame()) {
+    if (Document* document = frame->LocalFrameRoot().GetDocument()) {
+      document->EnsureLazyLoadImageObserver()
+          .lazy_load_intersection_observer_->unobserve(element);
+    }
+  }
+}
+
+LazyLoadImageObserver::LazyLoadImageObserver(Document& document) {
+  DCHECK(RuntimeEnabledFeatures::LazyImageLoadingEnabled());
+  document.AddConsoleMessage(ConsoleMessage::Create(
+      kInterventionMessageSource, kInfoMessageLevel,
+      "Images loaded lazily and replaced with placeholders. Load events are "
+      "deferred. See https://crbug.com/846170"));
+  lazy_load_intersection_observer_ = IntersectionObserver::Create(
+      {Length(kLazyLoadRootMarginPx, kFixed)},
+      {std::numeric_limits<float>::min()}, &document,
+      WTF::BindRepeating(&LazyLoadImageObserver::LoadIfNearViewport,
+                         WrapWeakPersistent(this)));
+}
+
+void LazyLoadImageObserver::LoadIfNearViewport(
+    const HeapVector<Member<IntersectionObserverEntry>>& entries) {
+  DCHECK(!entries.IsEmpty());
+
+  for (auto entry : entries) {
+    if (!entry->isIntersecting())
+      continue;
+    Element* element = entry->target();
+    if (auto* image_element = ToHTMLImageElementOrNull(element))
+      image_element->LoadDeferredImage();
+
+    lazy_load_intersection_observer_->unobserve(element);
+  }
+}
+
+void LazyLoadImageObserver::Trace(Visitor* visitor) {
+  visitor->Trace(lazy_load_intersection_observer_);
+}
+
+}  // namespace blink

diff --git a/third_party/blink/renderer/core/html/lazy_load_image_observer.h b/third_party/blink/renderer/core/html/lazy_load_image_observer.h
new file mode 100644
index 0000000..808334d
--- /dev/null
+++ b/third_party/blink/renderer/core/html/lazy_load_image_observer.h

@@ -0,0 +1,44 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_HTML_LAZY_LOAD_IMAGE_OBSERVER_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_HTML_LAZY_LOAD_IMAGE_OBSERVER_H_
+
+#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+#include "third_party/blink/renderer/platform/heap/heap_allocator.h"
+#include "third_party/blink/renderer/platform/heap/member.h"
+
+namespace blink {
+
+class Document;
+class Element;
+class IntersectionObserver;
+class IntersectionObserverEntry;
+class Visitor;
+
+class LazyLoadImageObserver final
+    : public GarbageCollected<LazyLoadImageObserver> {
+ public:
+  explicit LazyLoadImageObserver(Document&);
+
+  static void StartMonitoring(Element*);
+  static void StopMonitoring(Element*);
+
+  void Trace(Visitor*);
+
+ private:
+  // TODO(rajendrant): Make the root margins configurable via field trial params
+  // instead of just hardcoding the value here.
+  static constexpr int kLazyLoadRootMarginPx = 800;
+
+  void LoadIfNearViewport(const HeapVector<Member<IntersectionObserverEntry>>&);
+
+  // The intersection observer responsible for loading the image once it's near
+  // the viewport.
+  Member<IntersectionObserver> lazy_load_intersection_observer_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_HTML_LAZY_LOAD_IMAGE_OBSERVER_H_

diff --git a/third_party/blink/renderer/core/layout/line/inline_box.cc b/third_party/blink/renderer/core/layout/line/inline_box.cc
index 91a6f93..abf45f2 100644
--- a/third_party/blink/renderer/core/layout/line/inline_box.cc
+++ b/third_party/blink/renderer/core/layout/line/inline_box.cc

@@ -21,6 +21,7 @@
 
 #include "third_party/blink/renderer/core/layout/api/line_layout_api_shim.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_block_flow.h"
+#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/core/layout/hit_test_location.h"
 #include "third_party/blink/renderer/core/layout/layout_block_flow.h"
 #include "third_party/blink/renderer/core/layout/line/inline_flow_box.h"
@@ -303,8 +304,8 @@
   return (leaf && leaf->IsLineBreak()) ? nullptr : leaf;
 }
 
-SelectionState InlineBox::GetSelectionState() const {
-  return GetLineLayoutItem().GetSelectionState();
+bool InlineBox::IsSelected() const {
+  return GetLineLayoutItem().GetSelectionState() != SelectionState::kNone;
 }
 
 bool InlineBox::CanAccommodateEllipsis(bool ltr,

diff --git a/third_party/blink/renderer/core/layout/line/inline_box.h b/third_party/blink/renderer/core/layout/line/inline_box.h
index 68b713b..853def8 100644
--- a/third_party/blink/renderer/core/layout/line/inline_box.h
+++ b/third_party/blink/renderer/core/layout/line/inline_box.h

@@ -26,7 +26,6 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_box_model.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_item.h"
-#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/platform/fonts/font_vertical_position_type.h"
 #include "third_party/blink/renderer/platform/graphics/paint/display_item_client.h"
 #include "third_party/blink/renderer/platform/text/text_direction.h"
@@ -308,7 +307,7 @@
 
   virtual void DirtyLineBoxes();
 
-  virtual SelectionState GetSelectionState() const;
+  virtual bool IsSelected() const;
 
   virtual bool CanAccommodateEllipsis(bool ltr,
                                       LayoutUnit block_edge,

diff --git a/third_party/blink/renderer/core/layout/line/inline_flow_box.cc b/third_party/blink/renderer/core/layout/line/inline_flow_box.cc
index 3f9a3fa..07e0c550 100644
--- a/third_party/blink/renderer/core/layout/line/inline_flow_box.cc
+++ b/third_party/blink/renderer/core/layout/line/inline_flow_box.cc

@@ -1423,10 +1423,6 @@
   return leaf;
 }
 
-SelectionState InlineFlowBox::GetSelectionState() const {
-  return SelectionState::kNone;
-}
-
 bool InlineFlowBox::CanAccommodateEllipsis(bool ltr,
                                            LayoutUnit block_edge,
                                            LayoutUnit ellipsis_width) const {

diff --git a/third_party/blink/renderer/core/layout/line/inline_flow_box.h b/third_party/blink/renderer/core/layout/line/inline_flow_box.h
index 410e182..f49c483 100644
--- a/third_party/blink/renderer/core/layout/line/inline_flow_box.h
+++ b/third_party/blink/renderer/core/layout/line/inline_flow_box.h

@@ -22,7 +22,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_LINE_INLINE_FLOW_BOX_H_
 
 #include <memory>
-#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/core/layout/line/inline_box.h"
 #include "third_party/blink/renderer/core/layout/overflow_model.h"
 #include "third_party/blink/renderer/core/style/shadow_data.h"
@@ -261,7 +260,7 @@
 
   void RemoveChild(InlineBox* child, MarkLineBoxes);
 
-  SelectionState GetSelectionState() const override;
+  bool IsSelected() const override { return false; }
 
   bool CanAccommodateEllipsis(bool ltr,
                               LayoutUnit block_edge,

diff --git a/third_party/blink/renderer/core/layout/line/inline_text_box.cc b/third_party/blink/renderer/core/layout/line/inline_text_box.cc
index faeeee7..0583fae 100644
--- a/third_party/blink/renderer/core/layout/line/inline_text_box.cc
+++ b/third_party/blink/renderer/core/layout/line/inline_text_box.cc

@@ -30,6 +30,7 @@
 #include "third_party/blink/renderer/core/layout/api/line_layout_br.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_ruby_run.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_ruby_text.h"
+#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/core/layout/hit_test_result.h"
 #include "third_party/blink/renderer/core/layout/line/abstract_inline_text_box.h"
 #include "third_party/blink/renderer/core/layout/line/ellipsis_box.h"
@@ -210,6 +211,10 @@
   return state;
 }
 
+bool InlineTextBox::IsSelected() const {
+  return GetSelectionState() != SelectionState::kNone;
+}
+
 bool InlineTextBox::HasWrappedSelectionNewline() const {
   DCHECK(!GetLineLayoutItem().NeedsLayout());
 
@@ -236,13 +241,12 @@
   if (NextForSameLayoutObject())
     return true;
   auto root_block = Root().Block();
-  if (root_block.IsInline() &&
-      root_block.GetSelectionState() != SelectionState::kEnd &&
-      root_block.GetSelectionState() != SelectionState::kStartAndEnd &&
-      root_block.InlineBoxWrapper() &&
-      ((is_ltr && root_block.InlineBoxWrapper()->NextOnLine()) ||
-       (!is_ltr && root_block.InlineBoxWrapper()->PrevOnLine()))) {
-    return false;
+  if (root_block.IsInline() && root_block.InlineBoxWrapper()) {
+    const InlineBox* next_root =
+        is_ltr ? root_block.InlineBoxWrapper()->NextOnLine()
+               : root_block.InlineBoxWrapper()->PrevOnLine();
+    if (next_root)
+      return false;
   }
 
   return true;

diff --git a/third_party/blink/renderer/core/layout/line/inline_text_box.h b/third_party/blink/renderer/core/layout/line/inline_text_box.h
index 4e398c1..bf4667f0 100644
--- a/third_party/blink/renderer/core/layout/line/inline_text_box.h
+++ b/third_party/blink/renderer/core/layout/line/inline_text_box.h

@@ -171,11 +171,12 @@
   void AttachLine() final;
 
  public:
-  SelectionState GetSelectionState() const final;
+  bool IsSelected() const final;
   bool HasWrappedSelectionNewline() const;
   float NewlineSpaceWidth() const;
 
  private:
+  SelectionState GetSelectionState() const;
   void SetTruncation(unsigned);
 
   void ClearTruncation() final;

diff --git a/third_party/blink/renderer/core/layout/line/root_inline_box.cc b/third_party/blink/renderer/core/layout/line/root_inline_box.cc
index 04f3b7e..603f56b 100644
--- a/third_party/blink/renderer/core/layout/line/root_inline_box.cc
+++ b/third_party/blink/renderer/core/layout/line/root_inline_box.cc

@@ -342,37 +342,18 @@
   return result;
 }
 
-SelectionState RootInlineBox::GetSelectionState() const {
+bool RootInlineBox::IsSelected() const {
   // Walk over all of the selected boxes.
-  SelectionState state = SelectionState::kNone;
   for (InlineBox* box = FirstLeafChild(); box; box = box->NextLeafChild()) {
-    SelectionState box_state = box->GetSelectionState();
-    if ((box_state == SelectionState::kStart &&
-         state == SelectionState::kEnd) ||
-        (box_state == SelectionState::kEnd &&
-         state == SelectionState::kStart)) {
-      state = SelectionState::kStartAndEnd;
-    } else if (state == SelectionState::kNone ||
-               ((box_state == SelectionState::kStart ||
-                 box_state == SelectionState::kEnd) &&
-                (state == SelectionState::kNone ||
-                 state == SelectionState::kInside))) {
-      state = box_state;
-    } else if (box_state == SelectionState::kNone &&
-               state == SelectionState::kStart) {
-      // We are past the end of the selection.
-      state = SelectionState::kStartAndEnd;
-    }
-    if (state == SelectionState::kStartAndEnd)
-      break;
+    if (box->IsSelected())
+      return true;
   }
-
-  return state;
+  return false;
 }
 
 InlineBox* RootInlineBox::FirstSelectedBox() const {
   for (InlineBox* box = FirstLeafChild(); box; box = box->NextLeafChild()) {
-    if (box->GetSelectionState() != SelectionState::kNone)
+    if (box->IsSelected())
       return box;
   }
 
@@ -381,7 +362,7 @@
 
 InlineBox* RootInlineBox::LastSelectedBox() const {
   for (InlineBox* box = LastLeafChild(); box; box = box->PrevLeafChild()) {
-    if (box->GetSelectionState() != SelectionState::kNone)
+    if (box->IsSelected())
       return box;
   }
 

diff --git a/third_party/blink/renderer/core/layout/line/root_inline_box.h b/third_party/blink/renderer/core/layout/line/root_inline_box.h
index 522cb2f..3f2ee123a 100644
--- a/third_party/blink/renderer/core/layout/line/root_inline_box.h
+++ b/third_party/blink/renderer/core/layout/line/root_inline_box.h

@@ -24,7 +24,6 @@
 #include <memory>
 
 #include "third_party/blink/renderer/core/layout/api/line_layout_item.h"
-#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/core/layout/line/inline_flow_box.h"
 #include "third_party/blink/renderer/platform/text/bidi_context.h"
 
@@ -145,7 +144,7 @@
                    LayoutUnit line_top,
                    LayoutUnit line_bottom) override;
 
-  SelectionState GetSelectionState() const final;
+  bool IsSelected() const final;
   InlineBox* FirstSelectedBox() const;
   InlineBox* LastSelectedBox() const;
 

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.cc
index 7f33e95a..3d907a5 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.cc

@@ -7,6 +7,7 @@
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h"
+#include "third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h"
 
 namespace blink {
 
@@ -181,30 +182,6 @@
   DISALLOW_COPY_AND_ASSIGN(LayoutInlineCollector);
 };
 
-// The visitor emitting all fragments generated from the given LayoutObject.
-class LayoutObjectCollector final : public NGPhysicalFragmentCollectorBase {
-  STACK_ALLOCATED();
-
- public:
-  explicit LayoutObjectCollector(const LayoutObject* layout_object)
-      : target_(layout_object) {}
-
-  Vector<Result> CollectFrom(const NGPhysicalFragment& fragment) final {
-    return CollectExclusivelyFrom(fragment);
-  }
-
- private:
-  void Visit() final {
-    if (GetFragment().GetLayoutObject() == target_)
-      Emit();
-    VisitChildren();
-  }
-
-  const LayoutObject* target_;
-
-  DISALLOW_COPY_AND_ASSIGN(LayoutObjectCollector);
-};
-
 // The visitor emitting ancestors of the given fragment in bottom-up order.
 class AncestorCollector : public NGPhysicalFragmentCollectorBase {
   STACK_ALLOCATED();
@@ -271,11 +248,21 @@
 Vector<Result> NGInlineFragmentTraversal::SelfFragmentsOf(
     const NGPhysicalContainerFragment& container,
     const LayoutObject* layout_object) {
-  if (layout_object->IsLayoutInline()) {
-    return LayoutInlineCollector(ToLayoutInline(*layout_object))
-        .CollectFrom(container);
+  if (const LayoutInline* layout_inline = ToLayoutInlineOrNull(layout_object)) {
+    // TODO(crbug.com/874361): Stop partial culling of inline boxes, so that we
+    // can simply check existence of paint fragments below.
+    if (!layout_inline->HasSelfPaintingLayer()) {
+      return LayoutInlineCollector(ToLayoutInline(*layout_object))
+          .CollectFrom(container);
+    }
   }
-  return LayoutObjectCollector(layout_object).CollectFrom(container);
+  Vector<Result> result;
+  for (const NGPaintFragment* fragment :
+       NGPaintFragment::InlineFragmentsFor(layout_object)) {
+    result.push_back(Result{&fragment->PhysicalFragment(),
+                            fragment->InlineOffsetToContainerBox()});
+  }
+  return result;
 }
 
 // static

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.h
index ef8bfd61..5c063598 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_fragment_traversal.h

@@ -44,6 +44,14 @@
 
   // Returns list of inline fragments produced from the specified LayoutObject.
   // The search is restricted in the subtree of |container|.
+  // Note: When |target| is a LayoutInline, some/all of its own box fragments
+  // may be absent from the fragment tree, in which case the nearest box/text
+  // descendant fragments are returned.
+  // Note 2: Most callers should use the enclosing block flow fragment of
+  // |target| as |container|. The only exception is
+  // LayoutInline::HitTestCulledInline().
+  // TODO(xiaochengh): As |container| is redundant in most cases, split this
+  // function into two variants that takes/omits |container|.
   static Vector<NGPhysicalFragmentWithOffset> SelfFragmentsOf(
       const NGPhysicalContainerFragment& container,
       const LayoutObject* target);

diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index 3e6793e..7ef8deca 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc

@@ -217,8 +217,10 @@
   DCHECK(!client || type == Resource::kCSSStyleSheet);
   switch (type) {
     case Resource::kImage:
-      if (frame_)
+      if (frame_) {
         frame_->MaybeAllowImagePlaceholder(params);
+        frame_->MaybeAllowLazyLoadingImage(params);
+      }
       resource = ImageResource::Fetch(params, Fetcher());
       break;
     case Resource::kScript:

diff --git a/third_party/blink/renderer/core/loader/image_loader.cc b/third_party/blink/renderer/core/loader/image_loader.cc
index a9fdb27..3cf2973b 100644
--- a/third_party/blink/renderer/core/loader/image_loader.cc
+++ b/third_party/blink/renderer/core/loader/image_loader.cc

@@ -39,6 +39,7 @@
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/html/cross_origin_attribute.h"
 #include "third_party/blink/renderer/core/html/html_image_element.h"
+#include "third_party/blink/renderer/core/html/lazy_load_image_observer.h"
 #include "third_party/blink/renderer/core/html/parser/html_parser_idioms.h"
 #include "third_party/blink/renderer/core/layout/layout_image.h"
 #include "third_party/blink/renderer/core/layout/layout_video.h"
@@ -145,7 +146,8 @@
     : element_(element),
       image_complete_(true),
       loading_image_document_(false),
-      suppress_error_events_(false) {
+      suppress_error_events_(false),
+      lazy_image_load_state_(LazyImageLoadState::kNone) {
   RESOURCE_LOADING_DVLOG(1) << "new ImageLoader " << this;
 }
 
@@ -355,8 +357,14 @@
   if (!new_image_content) {
     image_resource_for_image_document_ = nullptr;
     image_complete_ = true;
+    if (lazy_image_load_state_ == LazyImageLoadState::kDeferred) {
+      LazyLoadImageObserver::StopMonitoring(GetElement());
+      lazy_image_load_state_ = LazyImageLoadState::kFullImage;
+    }
   } else {
     image_complete_ = false;
+    if (lazy_image_load_state_ == LazyImageLoadState::kDeferred)
+      LazyLoadImageObserver::StartMonitoring(GetElement());
   }
   delay_until_image_notify_finished_ = nullptr;
 }
@@ -432,8 +440,16 @@
     ConfigureRequest(params, bypass_behavior, *element_,
                      document.GetFrame()->GetClientHintsPreferences());
 
-    if (update_behavior != kUpdateForcedReload && document.GetFrame())
-      document.GetFrame()->MaybeAllowImagePlaceholder(params);
+    if (update_behavior != kUpdateForcedReload &&
+        lazy_image_load_state_ == LazyImageLoadState::kNone) {
+      const auto* frame = document.GetFrame();
+      frame->MaybeAllowImagePlaceholder(params);
+      auto* html_image = ToHTMLImageElementOrNull(GetElement());
+      if (html_image && html_image->ElementCreatedByParser() &&
+          frame->MaybeAllowLazyLoadingImage(params)) {
+        lazy_image_load_state_ = LazyImageLoadState::kDeferred;
+      }
+    }
 
     new_image_content = ImageResourceContent::Fetch(params, document.Fetcher());
 
@@ -551,6 +567,10 @@
     image_content_ = nullptr;
     image_resource_for_image_document_ = nullptr;
     delay_until_image_notify_finished_ = nullptr;
+    if (lazy_image_load_state_ != LazyImageLoadState::kNone) {
+      LazyLoadImageObserver::StopMonitoring(GetElement());
+      lazy_image_load_state_ = LazyImageLoadState::kNone;
+    }
   }
 
   // Don't load images for inactive documents. We don't want to slow down the
@@ -627,6 +647,23 @@
   else
     CHECK(!image_complete_);
 
+  if (lazy_image_load_state_ == LazyImageLoadState::kDeferred) {
+    // LazyImages: if a placeholder is loaded, suppress load events and do not
+    // consider the image as loaded, except for unblocking document load events.
+    // The final image load (including load events) occurs when the
+    // non-placeholder image loading (triggered by LoadDeferredImage()) is
+    // finished.
+    if (image_content_ && image_content_->GetImage()->IsPlaceholderImage()) {
+      delay_until_image_notify_finished_ = nullptr;
+      return;
+    }
+    // A placeholder was requested, but the result was an error or a full image.
+    // In these cases, consider this as the final image and suppress further
+    // reloading and proceed to the image load completion process below.
+    LazyLoadImageObserver::StopMonitoring(GetElement());
+    lazy_image_load_state_ = LazyImageLoadState::kFullImage;
+  }
+
   image_complete_ = true;
   delay_until_image_notify_finished_ = nullptr;
 
@@ -783,6 +820,14 @@
   return request->promise();
 }
 
+void ImageLoader::LoadDeferredImage(ReferrerPolicy referrer_policy) {
+  if (lazy_image_load_state_ != LazyImageLoadState::kDeferred)
+    return;
+  DCHECK(!image_complete_);
+  lazy_image_load_state_ = LazyImageLoadState::kFullImage;
+  UpdateFromElement(kUpdateNormal, referrer_policy);
+}
+
 void ImageLoader::ElementDidMoveToNewDocument() {
   if (delay_until_do_update_from_element_) {
     delay_until_do_update_from_element_->DocumentChanged(

diff --git a/third_party/blink/renderer/core/loader/image_loader.h b/third_party/blink/renderer/core/loader/image_loader.h
index decee89e..10e6da2 100644
--- a/third_party/blink/renderer/core/loader/image_loader.h
+++ b/third_party/blink/renderer/core/loader/image_loader.h

@@ -121,6 +121,8 @@
 
   ScriptPromise Decode(ScriptState*, ExceptionState&);
 
+  void LoadDeferredImage(ReferrerPolicy);
+
  protected:
   void ImageChanged(ImageResourceContent*,
                     CanDeferInvalidation,
@@ -132,6 +134,21 @@
 
   enum class UpdateType { kAsync, kSync };
 
+  // LazyImages: Defer the image load until the image is near the viewport.
+  // https://docs.google.com/document/d/1jF1eSOhqTEt0L1WBCccGwH9chxLd9d1Ez0zo11obj14
+  // The state transition is better captured in the below doc.
+  // https://docs.google.com/document/d/1Ym0EOwyZJmaB5afnCVPu0SFb8EWLBj_facm2fK9kgC0/
+  enum class LazyImageLoadState {
+    kNone,      // LazyImages not active.
+    kDeferred,  // Placeholder is loading/loaded. Full image load not started.
+                // Once the placeholder is loaded, document load event is
+                // unblocked, but image load event is not fired yet.
+    kFullImage  // Full image is loading/loaded, due to element coming near the
+                // viewport or if a placeholder load actually fetched the full
+                // image. image_complete_ can differentiate if the fetch is
+                // complete or not. After the fetch, image load event is fired.
+  };
+
   // Called from the task or from updateFromElement to initiate the load.
   void DoUpdateFromElement(BypassMainWorldBehavior,
                            UpdateFromElementBehavior,
@@ -212,6 +229,8 @@
   bool loading_image_document_ : 1;
   bool suppress_error_events_ : 1;
 
+  LazyImageLoadState lazy_image_load_state_;
+
   // DecodeRequest represents a single request to the Decode() function. The
   // decode requests have one of the following states:
   //

diff --git a/third_party/blink/renderer/core/paint/inline_text_box_painter.cc b/third_party/blink/renderer/core/paint/inline_text_box_painter.cc
index 4d6a58f2..c174e18a 100644
--- a/third_party/blink/renderer/core/paint/inline_text_box_painter.cc
+++ b/third_party/blink/renderer/core/paint/inline_text_box_painter.cc

@@ -140,9 +140,9 @@
   bool is_printing = paint_info.IsPrinting();
 
   // Determine whether or not we're selected.
-  bool have_selection =
-      !is_printing && paint_info.phase != PaintPhase::kTextClip &&
-      inline_text_box_.GetSelectionState() != SelectionState::kNone;
+  bool have_selection = !is_printing &&
+                        paint_info.phase != PaintPhase::kTextClip &&
+                        inline_text_box_.IsSelected();
   if (!have_selection && paint_info.phase == PaintPhase::kSelection) {
     // When only painting the selection, don't bother to paint if there is none.
     return;

diff --git a/third_party/blink/renderer/core/paint/svg_inline_text_box_painter.cc b/third_party/blink/renderer/core/paint/svg_inline_text_box_painter.cc
index 8c2fc6fe..6a66bff 100644
--- a/third_party/blink/renderer/core/paint/svg_inline_text_box_painter.cc
+++ b/third_party/blink/renderer/core/paint/svg_inline_text_box_painter.cc

@@ -11,7 +11,6 @@
 #include "third_party/blink/renderer/core/editing/markers/text_match_marker.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/layout/api/line_layout_api_shim.h"
-#include "third_party/blink/renderer/core/layout/api/selection_state.h"
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
 #include "third_party/blink/renderer/core/layout/line/inline_flow_box.h"
 #include "third_party/blink/renderer/core/layout/svg/layout_svg_inline_text.h"
@@ -49,7 +48,7 @@
   // pattern or feImage (element reference.)
   if (paint_info.IsRenderingResourceSubtree())
     return false;
-  return svg_inline_text_box_.GetSelectionState() != SelectionState::kNone;
+  return svg_inline_text_box_.IsSelected();
 }
 
 static bool HasShadow(const PaintInfo& paint_info, const ComputedStyle& style) {

diff --git a/third_party/blink/renderer/core/paint/svg_root_inline_box_painter.cc b/third_party/blink/renderer/core/paint/svg_root_inline_box_painter.cc
index 8c7b6fb..0967354 100644
--- a/third_party/blink/renderer/core/paint/svg_root_inline_box_painter.cc
+++ b/third_party/blink/renderer/core/paint/svg_root_inline_box_painter.cc

@@ -23,8 +23,7 @@
          paint_info.phase == PaintPhase::kSelection);
 
   bool has_selection =
-      !paint_info.IsPrinting() &&
-      svg_root_inline_box_.GetSelectionState() != SelectionState::kNone;
+      !paint_info.IsPrinting() && svg_root_inline_box_.IsSelected();
 
   PaintInfo paint_info_before_filtering(paint_info);
   if (has_selection && !DrawingRecorder::UseCachedDrawingIfPossible(

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_cursor.h b/third_party/blink/renderer/modules/indexeddb/idb_cursor.h
index 1ef44a2f..64cec7cd 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_cursor.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_cursor.h

@@ -28,8 +28,8 @@
 
 #include <memory>
 #include "base/memory/scoped_refptr.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
 #include "third_party/blink/renderer/bindings/modules/v8/idb_object_store_or_idb_index.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_key.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_cursor_with_value.h b/third_party/blink/renderer/modules/indexeddb/idb_cursor_with_value.h
index d1cf066..91223d4 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_cursor_with_value.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_cursor_with_value.h

@@ -27,8 +27,8 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_CURSOR_WITH_VALUE_H_
 
 #include <memory>
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_cursor.h"
 #include "third_party/blink/renderer/modules/indexeddb/indexed_db.h"
 

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_database.cc b/third_party/blink/renderer/modules/indexeddb/idb_database.cc
index d3921b0..6a1da96d 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_database.cc
+++ b/third_party/blink/renderer/modules/indexeddb/idb_database.cc

@@ -27,11 +27,11 @@
 
 #include "base/atomic_sequence_num.h"
 #include "base/optional.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_callbacks.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key_path.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_observation.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_binding_for_modules.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_idb_observer_callback.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_index.h b/third_party/blink/renderer/modules/indexeddb/idb_index.h
index 00bc1ac..99a4824 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_index.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_index.h

@@ -26,9 +26,9 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_INDEX_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_INDEX_H_
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_cursor.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_key_path.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_key_range.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_key.cc b/third_party/blink/renderer/modules/indexeddb/idb_key.cc
index e2a6651..114db34 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_key.cc
+++ b/third_party/blink/renderer/modules/indexeddb/idb_key.cc

@@ -28,8 +28,8 @@
 #include <algorithm>
 #include <memory>
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_key.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 
 namespace blink {

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_key_path.cc b/third_party/blink/renderer/modules/indexeddb/idb_key_path.cc
index 35d8248..3e1c12b 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_key_path.cc
+++ b/third_party/blink/renderer/modules/indexeddb/idb_key_path.cc

@@ -25,7 +25,7 @@
 
 #include "third_party/blink/renderer/modules/indexeddb/idb_key_path.h"
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/platform/wtf/ascii_ctype.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 #include "third_party/blink/renderer/platform/wtf/dtoa.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_object_store.h b/third_party/blink/renderer/modules/indexeddb/idb_object_store.h
index 8284b43f..4174356a 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_object_store.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_object_store.h

@@ -27,9 +27,9 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_OBJECT_STORE_H_
 
 #include "base/memory/scoped_refptr.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_cursor.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_index.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_observation.h b/third_party/blink/renderer/modules/indexeddb/idb_observation.h
index 7ad94c5..f9a97d65 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_observation.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_observation.h

@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_observer.h b/third_party/blink/renderer/modules/indexeddb/idb_observer.h
index 78ac326..b51ec3c 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_observer.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_observer.h

@@ -5,7 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_OBSERVER_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_OBSERVER_H_
 
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_request.h b/third_party/blink/renderer/modules/indexeddb/idb_request.h
index 34e4217..8d4ad30 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_request.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_request.h

@@ -33,8 +33,8 @@
 
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/web_blob_info.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_transaction.h b/third_party/blink/renderer/modules/indexeddb/idb_transaction.h
index bf07fc65..bfb15df 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_transaction.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_transaction.h

@@ -28,8 +28,8 @@
 
 #include <memory>
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_database.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/core/dom/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/dom/dom_string_list.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/idb_version_change_event.h b/third_party/blink/renderer/modules/indexeddb/idb_version_change_event.h
index 55d4faf..f3a15b9c 100644
--- a/third_party/blink/renderer/modules/indexeddb/idb_version_change_event.h
+++ b/third_party/blink/renderer/modules/indexeddb/idb_version_change_event.h

@@ -27,7 +27,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_INDEXEDDB_IDB_VERSION_CHANGE_EVENT_H_
 
 #include "base/optional.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.h"
 #include "third_party/blink/renderer/modules/event_modules.h"
 #include "third_party/blink/renderer/modules/indexeddb/idb_any.h"

diff --git a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
index 12eead2..d077611 100644
--- a/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc
+++ b/third_party/blink/renderer/modules/indexeddb/inspector_indexed_db_agent.cc

@@ -33,8 +33,8 @@
 #include <memory>
 #include <utility>
 
+#include "third_party/blink/public/common/indexeddb/web_idb_types.h"
 #include "third_party/blink/public/platform/modules/indexeddb/web_idb_cursor.h"
-#include "third_party/blink/public/platform/modules/indexeddb/web_idb_types.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/core/dom/document.h"

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc
index bffcec96..5673b15 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element.cc

@@ -300,6 +300,11 @@
   if (!mouse_event.HasPosition())
     return true;
 
+  // TODO(https://crbug.com/873839): In what cases do we hit this?
+  // If the internal button or computed style are unavailable, default to yes.
+  if (!internal_button_ || !GetComputedStyle())
+    return true;
+
   // Find the zoom-adjusted internal button bounding box.
   DOMRect* box = internal_button_->getBoundingClientRect();
   float zoom = ComputedStyleRef().EffectiveZoom() /

diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element_test.cc
index 9ca6ab5..d27a455 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_overlay_play_button_element_test.cc

@@ -8,15 +8,30 @@
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
 #include "third_party/blink/renderer/core/event_type_names.h"
+#include "third_party/blink/renderer/core/events/mouse_event.h"
+#include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
 
 namespace blink {
 
 class MediaControlOverlayPlayButtonElementTest : public PageTestBase {
  public:
   void SetUp() final {
-    // Create page and instance of AnimatedArrow to run tests on.
+    // Create page with video element with controls.
     PageTestBase::SetUp();
+    HTMLVideoElement* media_element = HTMLVideoElement::Create(GetDocument());
+    media_element->SetBooleanAttribute(HTMLNames::controlsAttr, true);
+    GetDocument().body()->AppendChild(media_element);
+
+    // Create instance of MediaControlOverlayPlayButtonElement for tests.
+    MediaControlsImpl* media_controls =
+        static_cast<MediaControlsImpl*>(media_element->GetMediaControls());
+    ASSERT_NE(nullptr, media_controls);
+    overlay_play_button_ =
+        new MediaControlOverlayPlayButtonElement(*media_controls);
+
+    // Create instance of AnimatedArrow to run tests on.
     arrow_element_ = new MediaControlOverlayPlayButtonElement::AnimatedArrow(
         "test", GetDocument());
     GetDocument().body()->AppendChild(arrow_element_);
@@ -42,6 +57,22 @@
     GetElementById("arrow-3")->DispatchEvent(*event);
   }
 
+  void RemoveInternalButton() {
+    overlay_play_button_->internal_button_ = nullptr;
+  }
+
+  void RemoveComputedStyle() { overlay_play_button_->ClearComputedStyle(); }
+
+  void TestKeepEventInNode() {
+    MouseEventInit mouse_initializer;
+    mouse_initializer.setView(GetDocument().domWindow());
+    mouse_initializer.setButton(1);
+
+    MouseEvent* mouse_event =
+        MouseEvent::Create(nullptr, EventTypeNames::click, mouse_initializer);
+    overlay_play_button_->KeepEventInNode(*mouse_event);
+  }
+
  private:
   bool SVGElementHasDisplayValue() {
     return GetElementById("jump")->InlineStyle()->HasProperty(
@@ -54,6 +85,7 @@
     return GetDocument().body()->getElementById(id);
   }
 
+  Persistent<MediaControlOverlayPlayButtonElement> overlay_play_button_;
   Persistent<MediaControlOverlayPlayButtonElement::AnimatedArrow>
       arrow_element_;
 };
@@ -79,4 +111,16 @@
   ExpectPresentAndShown();
 }
 
+TEST_F(MediaControlOverlayPlayButtonElementTest,
+       KeepEventInNodeDoesntCrashWithoutInternalButton) {
+  RemoveInternalButton();
+  TestKeepEventInNode();
+}
+
+TEST_F(MediaControlOverlayPlayButtonElementTest,
+       KeepEventInNodeDoesntCrashWithoutComputedStyle) {
+  RemoveComputedStyle();
+  TestKeepEventInNode();
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/platform/weborigin/security_policy.cc b/third_party/blink/renderer/platform/weborigin/security_policy.cc
index 1147ed18..f2a20bc 100644
--- a/third_party/blink/renderer/platform/weborigin/security_policy.cc
+++ b/third_party/blink/renderer/platform/weborigin/security_policy.cc

@@ -353,16 +353,6 @@
                        GetOriginAccessBlacklistMap());
 }
 
-void SecurityPolicy::RemoveOriginAccessBlacklistEntry(
-    const SecurityOrigin& source_origin,
-    const String& destination_protocol,
-    const String& destination_domain,
-    bool allow_destination_subdomains) {
-  RemoveOriginAccessEntry(source_origin, destination_protocol,
-                          destination_domain, allow_destination_subdomains,
-                          GetOriginAccessBlacklistMap());
-}
-
 void SecurityPolicy::ResetOriginAccessBlacklists() {
   DCHECK(IsMainThread());
   GetOriginAccessBlacklistMap().clear();

diff --git a/third_party/blink/renderer/platform/weborigin/security_policy.h b/third_party/blink/renderer/platform/weborigin/security_policy.h
index 30f338e..d2a61b5 100644
--- a/third_party/blink/renderer/platform/weborigin/security_policy.h
+++ b/third_party/blink/renderer/platform/weborigin/security_policy.h

@@ -82,11 +82,6 @@
                                             const String& destination_protocol,
                                             const String& destination_domain,
                                             bool allow_destination_subdomains);
-  static void RemoveOriginAccessBlacklistEntry(
-      const SecurityOrigin& source_origin,
-      const String& destination_protocol,
-      const String& destination_domain,
-      bool allow_destination_subdomains);
   static void ResetOriginAccessBlacklists();
 
   static bool IsAccessWhiteListed(const SecurityOrigin* active_origin,

diff --git a/tools/binary_size/libsupersize/canned_queries.py b/tools/binary_size/libsupersize/canned_queries.py
index 95c0e466..1d9a5770 100644
--- a/tools/binary_size/libsupersize/canned_queries.py
+++ b/tools/binary_size/libsupersize/canned_queries.py

@@ -36,7 +36,7 @@
       self.groups.extend(others_by_path)
 
     logging.debug('Finalized')
-    return models.SymbolGroup(self.groups, is_sorted=True)
+    return models.SymbolGroup(self.groups)
 
 
 def _CategorizeByChromeComponent(symbols):

diff --git a/tools/binary_size/libsupersize/describe.py b/tools/binary_size/libsupersize/describe.py
index dc8403d..af56481 100644
--- a/tools/binary_size/libsupersize/describe.py
+++ b/tools/binary_size/libsupersize/describe.py

@@ -278,7 +278,28 @@
     indent_prefix = '> ' * indent
     diff_prefix = ''
     total = group.pss
+    # is_default_sorted ==> sorted by abs(PSS) from largest to smallest.
+    if group.is_default_sorted:
+      # Skip long tail of small symbols (useful for diffs where aliases change).
+      # Long tail is defined as:
+      #   * Accounts for < .5% of PSS
+      #   * Symbols are smaller than 1.0 byte (by PSS)
+      #   * Always show at least 50 symbols.
+      min_remaining_pss_to_show = max(1024, total / 1000 * 5)
+      min_symbol_pss_to_show = 1.0
+      min_symbols_to_show = 50
+
     for index, s in enumerate(group):
+      if group.is_default_sorted and not self.verbose:
+        remaining_pss = total - running_total
+        if (index >= min_symbols_to_show and
+            abs(remaining_pss) < min_remaining_pss_to_show and
+            abs(s.pss) < min_symbol_pss_to_show):
+          remaining_count = len(group) - index
+          yield '{}Skipping {} tiny symbols comprising {} bytes.'.format(
+              indent_prefix, remaining_count, _FormatPss(remaining_pss))
+          break
+
       if group.IsBss() or not s.IsBss():
         running_total += s.pss
         running_percent = _Divide(running_total, total)

diff --git a/tools/binary_size/libsupersize/html_report.py b/tools/binary_size/libsupersize/html_report.py
index 53570ce..351af86 100644
--- a/tools/binary_size/libsupersize/html_report.py
+++ b/tools/binary_size/libsupersize/html_report.py

@@ -6,6 +6,7 @@
 
 import codecs
 import collections
+import itertools
 import json
 import logging
 import os
@@ -13,6 +14,7 @@
 import archive
 import diff
 import models
+import path_util
 
 
 _SYMBOL_TYPE_VTABLE = 'v'
@@ -42,7 +44,14 @@
   'o': 'Other small entries',
 }
 
-_DEFAULT_SYMBOL_COUNT = 250000
+# Always emit this many distict symbols (if present), even when small.
+# No need to optimize file size at this point).
+_MIN_SYMBOL_COUNT = 1000
+# Small symbols grouped into "other" symbols may not comprise more than this
+# fraction of total size.
+_MAX_OTHER_SYMBOL_COVERAGE = .05
+# Don't insert "other" symbols smaller than this (just noise at this point).
+_MIN_OTHER_PSS = 1
 
 
 def _GetSymbolType(symbol):
@@ -54,11 +63,10 @@
   return symbol_type
 
 
-def _GetOrAddFileNode(symbol, file_nodes, components):
-  path = symbol.source_path or symbol.object_path
+def _GetOrAddFileNode(path, component, file_nodes, components):
   file_node = file_nodes.get(path)
   if file_node is None:
-    component_index = components.GetOrAdd(symbol.component)
+    component_index = components.GetOrAdd(component)
     file_node = {
       _COMPACT_FILE_PATH_KEY: path,
       _COMPACT_FILE_COMPONENT_INDEX_KEY: component_index,
@@ -88,6 +96,29 @@
     return index
 
 
+def _PartitionSymbols(symbols):
+  # Dex methods (type "m") are whitelisted for the method_count mode on the
+  # UI. It's important to see details on all the methods.
+  dex_symbols = symbols.WhereIsDex()
+  ordered_symbols = dex_symbols.Inverted().Sorted()
+
+  abs_pss_target = (1 - _MAX_OTHER_SYMBOL_COVERAGE) * sum(
+      abs(s.pss) for s in ordered_symbols)
+  running_abs_pss = 0
+  ordered_count = 0
+  for ordered_count, s in enumerate(ordered_symbols):
+    running_abs_pss += abs(s.pss)
+    if running_abs_pss > abs_pss_target and ordered_count >= _MIN_SYMBOL_COUNT:
+      break
+
+  main_symbols = itertools.chain(dex_symbols, ordered_symbols[:ordered_count])
+  extra_symbols = ordered_symbols[ordered_count:]
+
+  logging.info('Found %d large symbols, %s small symbols',
+               len(dex_symbols) + ordered_count, len(extra_symbols))
+  return main_symbols, extra_symbols
+
+
 def _MakeTreeViewList(symbols, include_all_symbols):
   """Builds JSON data of the symbols for the tree view HTML report.
 
@@ -100,27 +131,18 @@
   """
   file_nodes = {}
   components = IndexedSet()
+  # Dict of path -> type -> accumulated pss.
+  small_symbol_pss = collections.defaultdict(
+      lambda: collections.defaultdict(float))
 
-  # Build a container for symbols smaller than min_symbol_size
-  small_symbols = collections.defaultdict(dict)
-
-  # Dex methods (type "m") are whitelisted for the method_count mode on the
-  # UI. It's important to see details on all the methods.
-  dex_symbols = symbols.WhereIsDex()
-  ordered_symbols = dex_symbols.Inverted().Sorted()
   if include_all_symbols:
-    symbol_count = len(ordered_symbols)
+    main_symbols, extra_symbols = symbols, []
   else:
-    symbol_count = max(_DEFAULT_SYMBOL_COUNT - len(dex_symbols), 0)
+    logging.info('Partitioning symbols...')
+    main_symbols, extra_symbols = _PartitionSymbols(symbols)
 
-  main_symbols = dex_symbols + ordered_symbols[:symbol_count]
-  extra_symbols = ordered_symbols[symbol_count:]
-
-  logging.info('Found %d large symbols, %s small symbols',
-               len(main_symbols), len(extra_symbols))
-
-  # Bundle symbols by the file they belong to,
-  # and add all the file buckets into file_nodes
+  # Bundle symbols by the file they belong to.
+  # Add all the file buckets into file_nodes.
   for symbol in main_symbols:
     symbol_type = _GetSymbolType(symbol)
     symbol_size = round(symbol.pss, 2)
@@ -130,7 +152,9 @@
     if symbol.IsDelta() and symbol.diff_status == models.DIFF_STATUS_REMOVED:
       symbol_count = -1
 
-    file_node = _GetOrAddFileNode(symbol, file_nodes, components)
+    path = symbol.source_path or symbol.object_path
+    file_node = _GetOrAddFileNode(
+        path, symbol.component, file_nodes, components)
 
     is_dex_method = symbol_type == _SYMBOL_TYPE_DEX_METHOD
     symbol_entry = {
@@ -149,23 +173,37 @@
       symbol_entry[_COMPACT_SYMBOL_FLAGS_KEY] = symbol.flags
     file_node[_COMPACT_FILE_SYMBOLS_KEY].append(symbol_entry)
 
+  # Collect small symbols into a per-path dict.
   for symbol in extra_symbols:
     symbol_type = _GetSymbolType(symbol)
+    path = symbol.source_path or symbol.object_path
+    tup = (path, symbol.component)
+    small_symbol_pss[tup][symbol_type] += symbol.pss
 
-    file_node = _GetOrAddFileNode(symbol, file_nodes, components)
-    path = file_node[_COMPACT_FILE_PATH_KEY]
-
-    small_type_symbol = small_symbols[path].get(symbol_type)
-    if small_type_symbol is None:
-      small_type_symbol = {
-        _COMPACT_SYMBOL_NAME_KEY: _SMALL_SYMBOL_DESCRIPTIONS[symbol_type],
-        _COMPACT_SYMBOL_TYPE_KEY: symbol_type,
-        _COMPACT_SYMBOL_BYTE_SIZE_KEY: 0,
-      }
-      small_symbols[path][symbol_type] = small_type_symbol
-      file_node[_COMPACT_FILE_SYMBOLS_KEY].append(small_type_symbol)
-
-    small_type_symbol[_COMPACT_SYMBOL_BYTE_SIZE_KEY] += symbol.pss
+  # Insert small symbols.
+  inserted_smalls_count = 0
+  inserted_smalls_abs_pss = 0
+  skipped_smalls_count = 0
+  skipped_smalls_abs_pss = 0
+  for tup, type_to_pss in small_symbol_pss.iteritems():
+    path, component = tup
+    for symbol_type, pss in type_to_pss.iteritems():
+      if abs(pss) < _MIN_OTHER_PSS:
+        skipped_smalls_count += 1
+        skipped_smalls_abs_pss += abs(pss)
+      else:
+        inserted_smalls_count += 1
+        inserted_smalls_abs_pss += abs(pss)
+        file_node = _GetOrAddFileNode(path, component, file_nodes, components)
+        file_node[_COMPACT_FILE_SYMBOLS_KEY].append({
+          _COMPACT_SYMBOL_NAME_KEY: _SMALL_SYMBOL_DESCRIPTIONS[symbol_type],
+          _COMPACT_SYMBOL_TYPE_KEY: symbol_type,
+          _COMPACT_SYMBOL_BYTE_SIZE_KEY: pss,
+        })
+  logging.debug(
+      'Created %d "other" symbols with PSS=%.1f. Omitted %d with PSS=%.1f',
+      inserted_smalls_count, inserted_smalls_abs_pss, skipped_smalls_count,
+      skipped_smalls_abs_pss)
 
   meta = {
     'components': components.value_list,
@@ -200,7 +238,6 @@
   else:
     symbols = size_info.raw_symbols
 
-  logging.info('Creating JSON objects')
   meta, tree_nodes = _MakeTreeViewList(symbols, all_symbols)
   meta.update({
     'diff_mode': diff_mode,
@@ -242,9 +279,9 @@
 
 
 def AddArguments(parser):
-  parser.add_argument('input_file',
+  parser.add_argument('input_size_file',
                       help='Path to input .size file.')
-  parser.add_argument('--report-file', metavar='PATH', required=True,
+  parser.add_argument('output_report_file',
                       help='Write generated data to the specified '
                            '.ndjson file.')
   parser.add_argument('--all-symbols', action='store_true',
@@ -255,22 +292,23 @@
 
 
 def Run(args, parser):
-  if not args.input_file.endswith('.size'):
+  if not args.input_size_file.endswith('.size'):
     parser.error('Input must end with ".size"')
   if args.diff_with and not args.diff_with.endswith('.size'):
     parser.error('Diff input must end with ".size"')
-  if not args.report_file.endswith('.ndjson'):
+  if not args.output_report_file.endswith('.ndjson'):
     parser.error('Output must end with ".ndjson"')
 
-  with codecs.open(args.report_file, 'w', encoding='ascii') as out_file:
+  with codecs.open(args.output_report_file, 'w', encoding='ascii') as out_file:
     BuildReport(
       out_file,
-      size_file=(args.input_file, None),
+      size_file=(args.input_size_file, None),
       before_size_file=(args.diff_with, None),
       all_symbols=args.all_symbols
     )
 
-  logging.warning('Report saved to %s', args.report_file)
-  logging.warning('Open server by running: \n'
-                  'tools/binary_size/supersize start_server %s',
-                  args.report_file)
+  logging.warning('Report saved to %s', args.output_report_file)
+  supersize_path = os.path.relpath(os.path.join(
+      path_util.SRC_ROOT, 'tools', 'binary_size', 'supersize'))
+  logging.warning('Open server by running: \n    %s start_server %s',
+                  supersize_path, args.output_report_file)

diff --git a/tools/binary_size/libsupersize/models.py b/tools/binary_size/libsupersize/models.py
index 39107bd..c379d0c 100644
--- a/tools/binary_size/libsupersize/models.py
+++ b/tools/binary_size/libsupersize/models.py

@@ -569,12 +569,13 @@
       'template_name',
       'name',
       'section_name',
-      'is_sorted',
+      'is_default_sorted',  # True for groups created by Sorted()
   )
 
   # template_name and full_name are useful when clustering symbol clones.
   def __init__(self, symbols, filtered_symbols=None, full_name=None,
-               template_name=None, name='', section_name=None, is_sorted=False):
+               template_name=None, name='', section_name=None,
+               is_default_sorted=False):
     self._padding = None
     self._size = None
     self._pss = None
@@ -584,7 +585,7 @@
     self.template_name = template_name if template_name is not None else name
     self.name = name or ''
     self.section_name = section_name or SECTION_MULTIPLE
-    self.is_sorted = is_sorted
+    self.is_default_sorted = is_default_sorted
 
   def __repr__(self):
     return 'Group(full_name=%s,count=%d,size=%d)' % (
@@ -624,7 +625,7 @@
   def __add__(self, other):
     self_ids = set(id(s) for s in self)
     after_symbols = self._symbols + [s for s in other if id(s) not in self_ids]
-    return self._CreateTransformed(after_symbols, is_sorted=False)
+    return self._CreateTransformed(after_symbols, is_default_sorted=False)
 
   def index(self, item):
     return self._symbols.index(item)
@@ -712,29 +713,28 @@
 
   def _CreateTransformed(self, symbols, filtered_symbols=None, full_name=None,
                          template_name=None, name=None, section_name=None,
-                         is_sorted=None):
-    if is_sorted is None:
-      is_sorted = self.is_sorted
+                         is_default_sorted=None):
+    if is_default_sorted is None:
+      is_default_sorted = self.is_default_sorted
     if section_name is None:
       section_name = self.section_name
     return self.__class__(symbols, filtered_symbols=filtered_symbols,
                           full_name=full_name, template_name=template_name,
                           name=name, section_name=section_name,
-                          is_sorted=is_sorted)
+                          is_default_sorted=is_default_sorted)
 
   def Sorted(self, cmp_func=None, key=None, reverse=False):
+    """Sorts by abs(PSS)."""
+    is_default_sorted = False
     if cmp_func is None and key is None:
-      if self.IsDelta():
-        key = lambda s: (s.diff_status == DIFF_STATUS_UNCHANGED, s.IsBss(),
-                         s.size_without_padding == 0, -abs(s.pss), s.name)
-      else:
-        key = lambda s: (
-            s.IsBss(), s.size_without_padding == 0, -abs(s.pss), s.name)
+      is_default_sorted = not reverse
+      # Sort by PSS, but ensure ties are broken in a consistent manner.
+      key = lambda s: (-abs(s.pss), s.full_name, s.object_path, s.section_name)
 
     after_symbols = sorted(self._symbols, cmp_func, key, reverse)
     return self._CreateTransformed(
         after_symbols, filtered_symbols=self._filtered_symbols,
-        is_sorted=True)
+        is_default_sorted=is_default_sorted)
 
   def SortedByName(self, reverse=False):
     return self.Sorted(key=(lambda s:s.name), reverse=reverse)
@@ -873,7 +873,7 @@
     """
     return self._CreateTransformed(
         self._filtered_symbols, filtered_symbols=self._symbols,
-        section_name=SECTION_MULTIPLE, is_sorted=False)
+        section_name=SECTION_MULTIPLE, is_default_sorted=False)
 
   def GroupedBy(self, func, min_count=0, group_factory=None):
     """Returns a SymbolGroup of SymbolGroups, indexed by |func|.

diff --git a/tools/binary_size/libsupersize/testdata/Console.golden b/tools/binary_size/libsupersize/testdata/Console.golden
index d4200c740..61b661fa 100644
--- a/tools/binary_size/libsupersize/testdata/Console.golden
+++ b/tools/binary_size/libsupersize/testdata/Console.golden

@@ -4,7 +4,7 @@
 SizeInfo: metadata, native_symbols, pak_symbols, raw_symbols, section_sizes, size_path, symbols
 Symbol: FlagsString, IsBss, IsDelta, IsDex, IsGeneratedByToolchain, IsGroup, IsNative, IsOther, IsOverhead, IsPak, IsStringLiteral, IterLeafSymbols, address, aliases, component, end_address, flags, full_name, generated_source, is_anonymous, name, num_aliases, object_path, padding, padding_pss, pss, pss_without_padding, section, section_name, size, size_without_padding, source_path, template_name
 
-SymbolGroup (extends Symbol): CountUniqueSymbols, Filter, GroupedBy, GroupedByAliases, GroupedByComponent, GroupedByFullName, GroupedByName, GroupedByPath, GroupedBySectionName, Inverted, IterUniqueSymbols, SetName, Sorted, SortedByAddress, SortedByCount, SortedByName, WhereAddressInRange, WhereComponentMatches, WhereFullNameMatches, WhereGeneratedByToolchain, WhereHasAnyAttribution, WhereHasComponent, WhereHasPath, WhereInSection, WhereIsDex, WhereIsGroup, WhereIsNative, WhereIsPak, WhereIsTemplate, WhereMatches, WhereNameMatches, WhereObjectPathMatches, WherePathMatches, WherePssBiggerThan, WhereSizeBiggerThan, WhereSourceIsGenerated, WhereSourcePathMatches, WhereTemplateNameMatches, index, is_sorted
+SymbolGroup (extends Symbol): CountUniqueSymbols, Filter, GroupedBy, GroupedByAliases, GroupedByComponent, GroupedByFullName, GroupedByName, GroupedByPath, GroupedBySectionName, Inverted, IterUniqueSymbols, SetName, Sorted, SortedByAddress, SortedByCount, SortedByName, WhereAddressInRange, WhereComponentMatches, WhereFullNameMatches, WhereGeneratedByToolchain, WhereHasAnyAttribution, WhereHasComponent, WhereHasPath, WhereInSection, WhereIsDex, WhereIsGroup, WhereIsNative, WhereIsPak, WhereIsTemplate, WhereMatches, WhereNameMatches, WhereObjectPathMatches, WherePathMatches, WherePssBiggerThan, WhereSizeBiggerThan, WhereSourceIsGenerated, WhereSourcePathMatches, WhereTemplateNameMatches, index, is_default_sorted
 
 DeltaSizeInfo: after, before, native_symbols, pak_symbols, raw_symbols, section_sizes, symbols
 DeltaSymbol (extends Symbol): after_symbol, before_symbol, diff_status

diff --git a/tools/binary_size/libsupersize/testdata/Diff_Basic.golden b/tools/binary_size/libsupersize/testdata/Diff_Basic.golden
index c6ee462..5d61aa7 100644
--- a/tools/binary_size/libsupersize/testdata/Diff_Basic.golden
+++ b/tools/binary_size/libsupersize/testdata/Diff_Basic.golden

@@ -64,14 +64,14 @@
                source_path= 	object_path=
                flags={}  name=IDS_WEB_FONT_FAMILY
                     full_name=../../ui/strings/app_locale_settings.grd: IDS_WEB_FONT_FAMILY
-- 2)       -112 (100.0%) p@0x0        -9 (9->0)  num_aliases=1
-               source_path= 	object_path=
-               flags={}  name=IDS_WEB_FONT_SIZE
-                    full_name=../../ui/strings/app_locale_settings.grd: IDS_WEB_FONT_SIZE
-~ 3)       -130 (116.1%) p@0x0        -18 (0->0)  num_aliases=1
+~ 2)       -121 (108.0%) p@0x0        -18 (0->0)  num_aliases=1
                source_path= 	object_path=
                flags={}  name=../../../mock_apk/assets/en-US.pak
                     full_name=foo: ../../../mock_apk/assets/en-US.pak
+- 3)       -130 (116.1%) p@0x0        -9 (9->0)  num_aliases=1
+               source_path= 	object_path=
+               flags={}  name=IDS_WEB_FONT_SIZE
+                    full_name=../../ui/strings/app_locale_settings.grd: IDS_WEB_FONT_SIZE
 ~ 4)       -120 (107.1%) r@0x284e398  +10 (22->32)  num_aliases=1
                source_path=third_party/container/container.c 	object_path=third_party/sub/ContiguousContainer.o
                flags={}  name=chrome::mojom::FilePatcher::Name_

diff --git a/tools/mb/mb_config.pyl b/tools/mb/mb_config.pyl
index 7ff7545..258ccb87 100644
--- a/tools/mb/mb_config.pyl
+++ b/tools/mb/mb_config.pyl

@@ -275,19 +275,10 @@
     },
 
     'chromium.infra.codesearch': {
-      'codesearch-gen-chromium-android': {
-        'android': 'codesearch_gen_chromium_android_bot',
-      },
-      'codesearch-gen-chromium-chromiumos': {
-        'chromeos': 'codesearch_gen_chromium_chromiumos_bot',
-        'linux': 'codesearch_gen_chromium_linux_bot',
-      },
-      'codesearch-gen-chromium-linux': {
-        'linux': 'codesearch_gen_chromium_linux_bot',
-      },
-      'codesearch-gen-chromium-win': {
-        'win': 'codesearch_gen_chromium_win_bot',
-      },
+      'codesearch-gen-chromium-android': 'codesearch_gen_chromium_android_bot',
+      'codesearch-gen-chromium-chromiumos': 'codesearch_gen_chromium_chromiumos_bot',
+      'codesearch-gen-chromium-linux': 'codesearch_gen_chromium_linux_bot',
+      'codesearch-gen-chromium-win': 'codesearch_gen_chromium_win_bot',
     },
 
     'chromium.linux': {

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index a9354a3..93b735c 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -1687,6 +1687,14 @@
   <int value="21" label="Already provisioned"/>
 </enum>
 
+<enum name="ArcSdkVersionUpgradeType">
+  <summary>Defines the types of ARC SDK version upgrade</summary>
+  <int value="0" label="NO_UPGRADE"/>
+  <int value="1" label="UNKNOWN_UPGRADE"/>
+  <int value="2" label="N_TO_P"/>
+  <int value="3" label="M_TO_P"/>
+</enum>
+
 <enum name="ArcSupervisionTransitionResult">
   <summary>
     Defines Arc supervision transition success and failure reasons

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 581fddd..3251a34 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -3830,6 +3830,15 @@
   </summary>
 </histogram>
 
+<histogram name="Arc.SdkVersionUpgradeType" enum="ArcSdkVersionUpgradeType">
+  <owner>niwa@google.com</owner>
+  <owner>yusukes@google.com</owner>
+  <summary>
+    The types of ARC SDK version upgrade. (e.g. Upgrade from N to P) Reported
+    when SDK version upgrade is detected during ARC boot.
+  </summary>
+</histogram>
+
 <histogram name="Arc.ShutdownTime" units="ms">
   <owner>elijahtaylor@google.com</owner>
   <summary>
@@ -10122,6 +10131,19 @@
 </histogram>
 
 <histogram name="BlueZ.ChipLost" units="seconds">
+  <obsolete>
+    Replaced 08/2018 by BlueZ.ChipLost2 for more suspend/resume filtering even
+    when the Bluetooth adapter is turned off.
+  </obsolete>
+  <owner>sonnysasaka@chromium.org</owner>
+  <summary>
+    This is specific to Chrome OS. Records a duration of a Bluetooth adapter
+    being lost caused by hardware disconnection. This helps us better understand
+    the Bluetooth controller drop issue in the field.
+  </summary>
+</histogram>
+
+<histogram name="BlueZ.ChipLost2" units="seconds">
   <owner>sonnysasaka@chromium.org</owner>
   <summary>
     This is specific to Chrome OS. Records a duration of a Bluetooth adapter
@@ -31674,6 +31696,78 @@
   </summary>
 </histogram>
 
+<histogram name="Fingerprint.Unlock.EnrolledFingerCount" units="count"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>Counts the number of fingers enrolled by the user.</summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.Match.Duration.Capture" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took to capture the fingerprint image in the 'match'
+    case.
+  </summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.Match.Duration.Matcher" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took to run matcher in the 'match' case.
+  </summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.Match.Duration.Overall" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took between the detection of a finger and the 'match'
+    event being sent to the AP.
+  </summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.NoMatch.Duration.Capture" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took to capture the fingerprint image in the 'no-match'
+    case.
+  </summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.NoMatch.Duration.Matcher" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took to run the matcher in the 'no-match' case.
+  </summary>
+</histogram>
+
+<histogram name="Fingerprint.Unlock.NoMatch.Duration.Overall" units="ms"
+    expires_after="2019-08-14">
+  <owner>norvez@chromium.org</owner>
+  <owner>xiaoyinh@chromium.org</owner>
+  <owner>zalcorn@chromium.org</owner>
+  <summary>
+    Measures the time it took between the detection of a finger and the
+    'no-match' event being sent to the AP.
+  </summary>
+</histogram>
+
 <histogram name="Fingerprint.UnlockEnabled" enum="BooleanEnabled"
     expires_after="2019-08-09">
   <owner>xiaoyinh@chromium.org</owner>

diff --git a/ui/android/delegated_frame_host_android.cc b/ui/android/delegated_frame_host_android.cc
index 0bea6fc..5e52550 100644
--- a/ui/android/delegated_frame_host_android.cc
+++ b/ui/android/delegated_frame_host_android.cc

@@ -332,7 +332,7 @@
 
   expected_pixel_size_ = pixel_size;
   if (registered_parent_compositor_) {
-    if (HasSavedFrame() && content_layer_->bounds() != expected_pixel_size_) {
+    if (content_layer_->bounds() != expected_pixel_size_) {
       compositor_pending_resize_lock_ =
           registered_parent_compositor_->GetCompositorLock(this,
                                                            ResizeTimeout());

diff --git a/ui/android/delegated_frame_host_android_unittest.cc b/ui/android/delegated_frame_host_android_unittest.cc
index eb9e7065..4de0f9e601 100644
--- a/ui/android/delegated_frame_host_android_unittest.cc
+++ b/ui/android/delegated_frame_host_android_unittest.cc

@@ -54,6 +54,7 @@
   MOCK_METHOD2(DoGetCompositorLock,
                CompositorLock*(CompositorLockClient*, base::TimeDelta));
   MOCK_CONST_METHOD0(IsDrawingFirstVisibleFrame, bool());
+  MOCK_METHOD1(SetVSyncPaused, void(bool));
 
   // Helpers for move-only types:
   void RequestCopyOfOutputOnRootLayer(

diff --git a/ui/android/window_android.cc b/ui/android/window_android.cc
index f099ea08..e20c88f9f 100644
--- a/ui/android/window_android.cc
+++ b/ui/android/window_android.cc

@@ -191,6 +191,8 @@
   compositor_ = compositor;
   for (WindowAndroidObserver& observer : observer_list_)
     observer.OnAttachCompositor();
+
+  compositor_->SetVSyncPaused(vsync_paused_);
 }
 
 void WindowAndroid::DetachCompositor() {
@@ -271,6 +273,11 @@
 void WindowAndroid::SetVSyncPaused(JNIEnv* env,
                                    const JavaParamRef<jobject>& obj,
                                    bool paused) {
+  vsync_paused_ = paused;
+
+  if (compositor_)
+    compositor_->SetVSyncPaused(paused);
+
   begin_frame_source_->OnPauseChanged(paused);
 }
 

diff --git a/ui/android/window_android.h b/ui/android/window_android.h
index 9e37271..15cee966 100644
--- a/ui/android/window_android.h
+++ b/ui/android/window_android.h

@@ -119,6 +119,7 @@
   bool needs_begin_frames_;
   std::list<base::Closure> vsync_complete_callbacks_;
   float mouse_wheel_scroll_factor_;
+  bool vsync_paused_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(WindowAndroid);
 };

diff --git a/ui/android/window_android_compositor.h b/ui/android/window_android_compositor.h
index 7446d2a..df542c7 100644
--- a/ui/android/window_android_compositor.h
+++ b/ui/android/window_android_compositor.h

@@ -37,6 +37,7 @@
       CompositorLockClient* client,
       base::TimeDelta timeout) = 0;
   virtual bool IsDrawingFirstVisibleFrame() const = 0;
+  virtual void SetVSyncPaused(bool paused) = 0;
 };
 
 }  // namespace ui

diff --git a/ui/aura/window_targeter.cc b/ui/aura/window_targeter.cc
index fbf6f6f..7703af7 100644
--- a/ui/aura/window_targeter.cc
+++ b/ui/aura/window_targeter.cc

@@ -127,7 +127,11 @@
     // This is used for bezel gesture events (eg. swiping in from screen edge).
     display::Display display =
         display::Screen::GetScreen()->GetDisplayNearestWindow(root_window);
-    gfx::Point screen_location = event.root_location();
+    // event.location() is in |root_window|'s coordinate system at this point.
+    // Using event.root_location() breaks calculations in mus clients, because
+    // event.root_location() is in the display-root's coordinate system, but
+    // |root_window| is actually the top-level window of the mus client.
+    gfx::Point screen_location = event.location();
     if (client::GetScreenPositionClient(root_window)) {
       client::GetScreenPositionClient(root_window)
           ->ConvertPointToScreen(root_window, &screen_location);

diff --git a/ui/aura/window_targeter_unittest.cc b/ui/aura/window_targeter_unittest.cc
index 6334cb1..3d8e91a 100644
--- a/ui/aura/window_targeter_unittest.cc
+++ b/ui/aura/window_targeter_unittest.cc

@@ -11,6 +11,8 @@
 #include "ui/aura/test/aura_test_base.h"
 #include "ui/aura/test/test_window_delegate.h"
 #include "ui/aura/window.h"
+#include "ui/display/display.h"
+#include "ui/display/screen.h"
 #include "ui/events/event_utils.h"
 #include "ui/events/test/test_event_handler.h"
 
@@ -56,12 +58,10 @@
   Window* one = CreateNormalWindow(2, window.get(), &delegate);
   Window* two = CreateNormalWindow(3, window.get(), &delegate);
 
-  window->SetBounds(gfx::Rect(0, 0, 100, 100));
+  window->SetBounds(gfx::Rect(0, 0, 1000, 1000));
   one->SetBounds(gfx::Rect(0, 0, 500, 100));
   two->SetBounds(gfx::Rect(501, 0, 500, 1000));
 
-  root_window()->Show();
-
   ui::test::TestEventHandler handler;
   one->AddPreTargetHandler(&handler);
 
@@ -78,6 +78,47 @@
   one->RemovePreTargetHandler(&handler);
 }
 
+TEST_P(WindowTargeterTest, FindTargetInRootWindow) {
+  WindowTargeter targeter;
+
+  display::Display display =
+      display::Screen::GetScreen()->GetDisplayNearestWindow(root_window());
+  EXPECT_EQ(display.bounds(), root_window()->GetBoundsInScreen());
+  EXPECT_EQ(display.bounds(), gfx::Rect(0, 0, 800, 600));
+
+  // Mouse and touch presses inside the display yield null targets.
+  gfx::Point inside = display.bounds().CenterPoint();
+  ui::MouseEvent mouse1(ui::ET_MOUSE_PRESSED, inside, inside,
+                        ui::EventTimeForNow(), ui::EF_NONE, ui::EF_NONE);
+  ui::TouchEvent touch1(ui::ET_TOUCH_PRESSED, inside, ui::EventTimeForNow(),
+                        ui::PointerDetails());
+  touch1.set_root_location(inside);
+  EXPECT_EQ(nullptr, targeter.FindTargetInRootWindow(root_window(), mouse1));
+  EXPECT_EQ(nullptr, targeter.FindTargetInRootWindow(root_window(), touch1));
+
+  // Touch presses outside the display yields the root window as a target.
+  gfx::Point outside(display.bounds().right() + 10, inside.y());
+  ui::MouseEvent mouse2(ui::ET_MOUSE_PRESSED, outside, outside,
+                        ui::EventTimeForNow(), ui::EF_NONE, ui::EF_NONE);
+  ui::TouchEvent touch2(ui::ET_TOUCH_PRESSED, outside, ui::EventTimeForNow(),
+                        ui::PointerDetails());
+  touch2.set_root_location(outside);
+  EXPECT_EQ(nullptr, targeter.FindTargetInRootWindow(root_window(), mouse2));
+  EXPECT_EQ(root_window(),
+            targeter.FindTargetInRootWindow(root_window(), touch2));
+
+  // Simulate a mus client root (top level app window) with bottom-right bounds.
+  // Touches in the root and display should yield null targets crbug.com/873763.
+  // (mus clients root locations are display coords, not client-root coords)
+  root_window()->SetBounds(gfx::Rect(600, 500, 200, 100));
+  gfx::Point root_touch_coords(199, 99);
+  gfx::Point display_touch_coords(799, 699);
+  ui::TouchEvent touch3(ui::ET_TOUCH_PRESSED, root_touch_coords,
+                        ui::EventTimeForNow(), ui::PointerDetails());
+  touch3.set_root_location(display_touch_coords);
+  EXPECT_EQ(nullptr, targeter.FindTargetInRootWindow(root_window(), touch3));
+}
+
 TEST_P(WindowTargeterTest, ScopedWindowTargeter) {
   test::TestWindowDelegate delegate;
   std::unique_ptr<Window> window(

diff --git a/ui/chromeos/search_box/search_box_view_base.cc b/ui/chromeos/search_box/search_box_view_base.cc
index 39235f95..5e0c503 100644
--- a/ui/chromeos/search_box/search_box_view_base.cc
+++ b/ui/chromeos/search_box/search_box_view_base.cc

@@ -14,9 +14,14 @@
 #include "ui/chromeos/search_box/search_box_view_delegate.h"
 #include "ui/events/event.h"
 #include "ui/gfx/canvas.h"
+#include "ui/gfx/color_palette.h"
 #include "ui/gfx/color_utils.h"
 #include "ui/gfx/geometry/insets.h"
 #include "ui/gfx/image/image_skia.h"
+#include "ui/views/animation/flood_fill_ink_drop_ripple.h"
+#include "ui/views/animation/ink_drop_highlight.h"
+#include "ui/views/animation/ink_drop_impl.h"
+#include "ui/views/animation/ink_drop_mask.h"
 #include "ui/views/background.h"
 #include "ui/views/border.h"
 #include "ui/views/context_menu_controller.h"
@@ -34,6 +39,8 @@
 
 constexpr int kInnerPadding = 16;
 
+constexpr int kButtonSizeDip = 48;
+
 // Preferred width of search box.
 constexpr int kSearchBoxPreferredWidth = 544;
 
@@ -88,6 +95,14 @@
     // Avoid drawing default dashed focus and draw customized focus in
     // OnPaintBackground();
     SetFocusPainter(nullptr);
+
+    SetPaintToLayer();
+    layer()->SetFillsBoundsOpaquely(false);
+    SetInkDropMode(InkDropMode::ON);
+
+    SetPreferredSize({kButtonSizeDip, kButtonSizeDip});
+    SetImageAlignment(HorizontalAlignment::ALIGN_CENTER,
+                      VerticalAlignment::ALIGN_MIDDLE);
   }
   ~SearchBoxImageButton() override {}
 
@@ -107,11 +122,49 @@
 
   void OnBlur() override { SchedulePaint(); }
 
+  // views::InkDropHost overrides:
+  std::unique_ptr<views::InkDrop> CreateInkDrop() override {
+    return CreateDefaultFloodFillInkDropImpl();
+  }
+
+  std::unique_ptr<views::InkDropRipple> CreateInkDropRipple() const override {
+    const gfx::Point center = GetLocalBounds().CenterPoint();
+    const int ripple_radius = GetInkDropRadius();
+    gfx::Rect bounds(center.x() - ripple_radius, center.y() - ripple_radius,
+                     2 * ripple_radius, 2 * ripple_radius);
+    constexpr SkColor ripple_color = SkColorSetA(gfx::kGoogleGrey900, 0x17);
+
+    return std::make_unique<views::FloodFillInkDropRipple>(
+        size(), GetLocalBounds().InsetsFrom(bounds),
+        GetInkDropCenterBasedOnLastEvent(), ripple_color, 1.0f);
+  }
+
+  std::unique_ptr<views::InkDropMask> CreateInkDropMask() const override {
+    return std::make_unique<views::CircleInkDropMask>(
+        size(), GetLocalBounds().CenterPoint(), GetInkDropRadius());
+  }
+
+  std::unique_ptr<views::InkDropHighlight> CreateInkDropHighlight()
+      const override {
+    constexpr SkColor ripple_color = SkColorSetA(gfx::kGoogleGrey900, 0x12);
+    return std::make_unique<views::InkDropHighlight>(
+        gfx::PointF(GetLocalBounds().CenterPoint()),
+        std::make_unique<views::CircleLayerDelegate>(ripple_color,
+                                                     GetInkDropRadius()));
+  }
+
  private:
+  int GetInkDropRadius() const { return width() / 2; }
+
   // views::View overrides:
   void OnPaintBackground(gfx::Canvas* canvas) override {
-    if (state() == STATE_PRESSED || HasFocus()) {
-      canvas->FillRect(gfx::Rect(size()), kSelectedColor);
+    if (HasFocus()) {
+      cc::PaintFlags circle_flags;
+      circle_flags.setAntiAlias(true);
+      circle_flags.setColor(kSelectedColor);
+      circle_flags.setStyle(cc::PaintFlags::kFill_Style);
+      canvas->DrawCircle(GetLocalBounds().CenterPoint(), GetInkDropRadius(),
+                         circle_flags);
     }
   }
 
@@ -184,7 +237,7 @@
 
   search_box_->SetBorder(views::NullBorder());
   search_box_->SetTextColor(kSearchTextColor);
-  search_box_->SetBackgroundColor(background_color_);
+  search_box_->SetBackgroundColor(SK_ColorTRANSPARENT);
   search_box_->set_controller(this);
   search_box_->SetTextInputType(ui::TEXT_INPUT_TYPE_SEARCH);
   search_box_->SetTextInputFlags(ui::TEXT_INPUT_FLAG_AUTOCORRECT_OFF);
@@ -207,6 +260,11 @@
   search_box_right_space_->SetPreferredSize(gfx::Size(kSearchIconSize, 0));
   content_container_->AddChildView(search_box_right_space_);
 
+  assistant_button_ = new SearchBoxImageButton(this);
+  // Default hidden, child class should decide if it should shown.
+  assistant_button_->SetVisible(false);
+  content_container_->AddChildView(assistant_button_);
+
   close_button_ = new SearchBoxImageButton(this);
   content_container_->AddChildView(close_button_);
 }
@@ -218,6 +276,7 @@
   layer()->SetFillsBoundsOpaquely(false);
   layer()->SetMasksToBounds(true);
   UpdateSearchBoxBorder();
+  SetupAssistantButton();
   SetupBackButton();
   SetupCloseButton();
   ModelChanged();
@@ -234,6 +293,10 @@
   return view_bounds;
 }
 
+views::ImageButton* SearchBoxViewBase::assistant_button() {
+  return static_cast<views::ImageButton*>(assistant_button_);
+}
+
 views::ImageButton* SearchBoxViewBase::back_button() {
   return static_cast<views::ImageButton*>(back_button_);
 }
@@ -275,7 +338,7 @@
 
   UpdateSearchBoxBorder();
   UpdateKeyboardVisibility();
-  UpdateCloseButtonVisisbility();
+  UpdateButtonsVisisbility();
 
   NotifyActiveChanged();
 
@@ -331,7 +394,9 @@
 
 void SearchBoxViewBase::ButtonPressed(views::Button* sender,
                                       const ui::Event& event) {
-  if (back_button_ && sender == back_button_) {
+  if (assistant_button_ && sender == assistant_button_) {
+    delegate_->AssistantButtonPressed();
+  } else if (back_button_ && sender == back_button_) {
     delegate_->BackButtonPressed();
   } else if (close_button_ && sender == close_button_) {
     ClearSearch();
@@ -360,7 +425,7 @@
 
 void SearchBoxViewBase::ClearSearch() {
   search_box_->SetText(base::string16());
-  UpdateCloseButtonVisisbility();
+  UpdateButtonsVisisbility();
   // Updates model and fires query changed manually because SetText() above
   // does not generate ContentsChanged() notification.
   UpdateModel(false);
@@ -395,15 +460,22 @@
       SK_ColorTRANSPARENT == color ? kDefaultSearchboxColor : color;
 }
 
-void SearchBoxViewBase::UpdateCloseButtonVisisbility() {
-  if (!close_button_)
-    return;
-  bool should_show_close_button_ =
+void SearchBoxViewBase::UpdateButtonsVisisbility() {
+  DCHECK(close_button_ && assistant_button_);
+
+  bool should_show_close_button =
       !search_box_->text().empty() ||
       (show_close_button_when_active_ && is_search_box_active_);
-  if (close_button_->visible() == should_show_close_button_)
+  bool should_show_assistant_button =
+      show_assistant_button_ && !should_show_close_button;
+
+  if (close_button_->visible() == should_show_close_button &&
+      assistant_button_->visible() == should_show_assistant_button) {
     return;
-  close_button_->SetVisible(should_show_close_button_);
+  }
+
+  close_button_->SetVisible(should_show_close_button);
+  assistant_button_->SetVisible(should_show_assistant_button);
   content_container_->Layout();
 }
 
@@ -414,7 +486,7 @@
   UpdateModel(true);
   NotifyQueryChanged();
   SetSearchBoxActive(true, ui::ET_KEY_PRESSED);
-  UpdateCloseButtonVisisbility();
+  UpdateButtonsVisisbility();
 }
 
 bool SearchBoxViewBase::HandleMouseEvent(views::Textfield* sender,
@@ -440,6 +512,11 @@
   search_icon_->SetImage(image);
 }
 
+void SearchBoxViewBase::SetShowAssistantButton(bool show) {
+  show_assistant_button_ = show;
+  UpdateButtonsVisisbility();
+}
+
 void SearchBoxViewBase::HandleSearchBoxEvent(ui::LocatedEvent* located_event) {
   if (located_event->type() == ui::ET_MOUSE_PRESSED ||
       located_event->type() == ui::ET_GESTURE_TAP) {
@@ -462,7 +539,6 @@
   if (is_search_box_active_)
     color = kSearchBoxBackgroundDefault;
   GetSearchBoxBackground()->set_color(color);
-  search_box_->SetBackgroundColor(color);
 }
 
 SearchBoxBackground* SearchBoxViewBase::GetSearchBoxBackground() const {

diff --git a/ui/chromeos/search_box/search_box_view_base.h b/ui/chromeos/search_box/search_box_view_base.h
index 8e464355..d8e0784 100644
--- a/ui/chromeos/search_box/search_box_view_base.h
+++ b/ui/chromeos/search_box/search_box_view_base.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_
-#define UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_
+#ifndef UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_
+#define UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_
 
 #include <vector>
 
@@ -66,6 +66,7 @@
   gfx::Rect GetViewBoundsForSearchBoxContentsBounds(
       const gfx::Rect& rect) const;
 
+  views::ImageButton* assistant_button();
   views::ImageButton* back_button();
   views::ImageButton* close_button();
   views::Textfield* search_box() { return search_box_; }
@@ -113,6 +114,8 @@
     show_close_button_when_active_ = show_button;
   }
 
+  bool show_assistant_button() { return show_assistant_button_; }
+
   void OnOnSearchBoxFocusedChanged();
 
   // Whether the trimmed query in the search box is empty.
@@ -139,7 +142,7 @@
   SkColor search_box_color() const { return search_box_color_; }
 
   // Updates the visibility of close button.
-  void UpdateCloseButtonVisisbility();
+  void UpdateButtonsVisisbility();
 
   // Overridden from views::TextfieldController:
   void ContentsChanged(views::Textfield* sender,
@@ -161,6 +164,8 @@
 
   void SetSearchIconImage(gfx::ImageSkia image);
 
+  void SetShowAssistantButton(bool show);
+
   // Detects |ET_MOUSE_PRESSED| and |ET_GESTURE_TAP| events on the white
   // background of the search box.
   virtual void HandleSearchBoxEvent(ui::LocatedEvent* located_event);
@@ -184,11 +189,12 @@
   virtual void UpdateSearchBoxBorder() = 0;
 
   // Setup button's image, accessible name, and tooltip text etc.
+  virtual void SetupAssistantButton() = 0;
   virtual void SetupCloseButton() = 0;
   virtual void SetupBackButton() = 0;
 
   // Records in histograms the activation of the searchbox.
-  virtual void RecordSearchBoxActivationHistogram(ui::EventType event_type){};
+  virtual void RecordSearchBoxActivationHistogram(ui::EventType event_type) {}
 
   // Gets the search box background.
   SearchBoxBackground* GetSearchBoxBackground() const;
@@ -198,6 +204,7 @@
   // Owned by views hierarchy.
   views::View* content_container_;
   views::ImageView* search_icon_ = nullptr;
+  SearchBoxImageButton* assistant_button_ = nullptr;
   SearchBoxImageButton* back_button_ = nullptr;
   SearchBoxImageButton* close_button_ = nullptr;
   views::Textfield* search_box_;
@@ -210,6 +217,8 @@
   bool is_search_box_active_ = false;
   // Whether to show close button if the search box is active.
   bool show_close_button_when_active_ = false;
+  // Whether to show assistant button.
+  bool show_assistant_button_ = false;
   // Whether tablet mode is active.
   bool is_tablet_mode_ = false;
   // The current background color.
@@ -222,4 +231,4 @@
 
 }  // namespace search_box
 
-#endif  // UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_
+#endif  // UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_BASE_H_

diff --git a/ui/chromeos/search_box/search_box_view_delegate.h b/ui/chromeos/search_box/search_box_view_delegate.h
index d2e25ff8..002a58e 100644
--- a/ui/chromeos/search_box/search_box_view_delegate.h
+++ b/ui/chromeos/search_box/search_box_view_delegate.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_
-#define UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_
+#ifndef UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_
+#define UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_
 
 #include "ui/chromeos/search_box/search_box_export.h"
 
@@ -17,6 +17,9 @@
   virtual void QueryChanged(SearchBoxViewBase* sender) = 0;
 
   // Invoked when the back button has been pressed.
+  virtual void AssistantButtonPressed() = 0;
+
+  // Invoked when the back button has been pressed.
   virtual void BackButtonPressed() = 0;
 
   // Invoked when search box active status has changed.
@@ -28,4 +31,4 @@
 
 }  // namespace search_box
 
-#endif  // UI_CHOMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_
+#endif  // UI_CHROMEOS_SEARCH_BOX_SEARCH_BOX_VIEW_DELEGATE_H_

diff --git a/ui/file_manager/file_manager/background/js/volume_manager_impl.js b/ui/file_manager/file_manager/background/js/volume_manager_impl.js
index 5a2b19c4..536de88 100644
--- a/ui/file_manager/file_manager/background/js/volume_manager_impl.js
+++ b/ui/file_manager/file_manager/background/js/volume_manager_impl.js

@@ -199,10 +199,6 @@
       case 'unmount':
         var volumeId = event.volumeMetadata.volumeId;
         var status = event.status;
-        if (status === VolumeManagerCommon.VolumeError.PATH_UNMOUNTED) {
-          console.warn('Volume already unmounted: ', volumeId);
-          status = 'success';
-        }
         var requestKey = this.makeRequestKey_('unmount', volumeId);
         var requested = requestKey in this.requests_;
         var volumeInfoIndex =

diff --git a/ui/file_manager/file_manager/common/js/volume_manager_common.js b/ui/file_manager/file_manager/common/js/volume_manager_common.js
index 32be21fa0..9af962c9 100644
--- a/ui/file_manager/file_manager/common/js/volume_manager_common.js
+++ b/ui/file_manager/file_manager/common/js/volume_manager_common.js

@@ -174,8 +174,7 @@
   INVALID_DEVICE_PATH: 'error_invalid_device_path',
   UNKNOWN_FILESYSTEM: 'error_unknown_filesystem',
   UNSUPPORTED_FILESYSTEM: 'error_unsupported_filesystem',
-  INVALID_ARCHIVE: 'error_invalid_archive',
-  PATH_UNMOUNTED: 'error_path_unmounted'
+  INVALID_ARCHIVE: 'error_invalid_archive'
 };
 Object.freeze(VolumeManagerCommon.VolumeError);
 

diff --git a/ui/strings/ui_strings.grd b/ui/strings/ui_strings.grd
index 31f846e..5269edc 100644
--- a/ui/strings/ui_strings.grd
+++ b/ui/strings/ui_strings.grd

@@ -794,6 +794,9 @@
       <message name="IDS_APP_LIST_CLEAR_SEARCHBOX" desc="Tooltip for the button that clears all text from the search box in the app list.">
         Clear searchbox text
       </message>
+      <message name="IDS_APP_LIST_START_ASSISTANT" desc="Tooltip for the button that starts Google Assistant from the search box in the app list.">
+        Start Google Assistant
+      </message>
       <message name="IDS_APP_LIST_PAGE_SWITCHER" desc="Tooltip for page switcher for each page in fullscreen view which shows all apps.">
         Page <ph name="selected_page">$1<ex>1</ex></ph> of <ph name="total_page_num">$2<ex>3</ex></ph>
       </message>

diff --git a/ui/webui/resources/cr_components/chromeos/network/network_config.js b/ui/webui/resources/cr_components/chromeos/network/network_config.js
index f1ac994..445d569 100644
--- a/ui/webui/resources/cr_components/chromeos/network/network_config.js
+++ b/ui/webui/resources/cr_components/chromeos/network/network_config.js

@@ -405,7 +405,7 @@
   focusFirstInput_: function() {
     Polymer.dom.flush();
     var e = this.$$(
-        'cr-input:not([disabled]),' +
+        'cr-input:not([readonly]),' +
         'network-password-input:not([disabled]),' +
         'network-config-select:not([disabled])');
     if (e)