diff --git a/DEPS b/DEPS
index 2d82289..472056f 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'dae37da88d88e737164e99c066141f1bf32f7fd5',
+  'v8_revision': '16c2739bc02e8dec32a7d78b6878de4252aea1a7',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -72,7 +72,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
-  'boringssl_revision': 'dc8c1d962e688c01cd8903d40ada70a75f700ad7',
+  'boringssl_revision': '0f28691d3d3d2851079feeb9e3c6baaff99ee455',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling google-toolbox-for-mac
   # and whatever else without interference from each other.
diff --git a/WATCHLISTS b/WATCHLISTS
index 75bf573..0e3c156d 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS
@@ -1504,7 +1504,8 @@
                         'lizeb+watch-android-loading@chromium.org'],
     'android_media': ['avayvod+watch@chromium.org',
                       'mlamouri+watch-media@chromium.org'],
-    'android_studio': ['wnwen+watch@chromium.org'],
+    'android_studio': ['wnwen+watch@chromium.org',
+                       'nyquist+watch@chromium.org'],
     'android_tab': ['avayvod+watch@chromium.org',
                     'dtrainor@chromium.org'],
     'android_uma_settings': ['asvitkine+watch@chromium.org',
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/crash/MinidumpUploaderTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/crash/MinidumpUploaderTest.java
index 4d60fe0..8ceb0c3 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/crash/MinidumpUploaderTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/crash/MinidumpUploaderTest.java
@@ -8,7 +8,7 @@
 
 import android.content.Context;
 import android.os.ParcelFileDescriptor;
-import android.test.suitebuilder.annotation.MediumTest;
+import android.support.test.filters.MediumTest;
 import android.webkit.ValueCallback;
 
 import org.chromium.android_webview.PlatformServiceBridge;
diff --git a/ash/ash_chromeos_strings.grdp b/ash/ash_chromeos_strings.grdp
index 0b5660f..28d49da 100644
--- a/ash/ash_chromeos_strings.grdp
+++ b/ash/ash_chromeos_strings.grdp
@@ -121,10 +121,10 @@
     IPv6 address
   </message>
   <message name="IDS_ASH_STATUS_TRAY_NETWORK_SETTINGS" desc="The label used in the settings entry in the network dialog.">
-    Settings...
+    Network settings
   </message>
   <message name="IDS_ASH_STATUS_TRAY_NETWORK_PROXY_SETTINGS" desc="The label used in the proxy settings entry in the network dialog in the login screen.">
-    Proxy...
+    Proxy settings
   </message>
   <message name="IDS_ASH_STATUS_TRAY_NETWORK_TECHNOLOGY_ENFORCED_BY_POLICY" desc="The label used for tell users that this technology is disabled by the administrator">
     This network setting is disabled by the administrator.
diff --git a/ash/ash_strings.grd b/ash/ash_strings.grd
index ee7ca859..00c6a35 100644
--- a/ash/ash_strings.grd
+++ b/ash/ash_strings.grd
@@ -260,6 +260,9 @@
       <message name="IDS_ASH_STATUS_TRAY_BLUETOOTH_UNPAIRED_DEVICES" desc="The sub-header label for unpaired devices in Bluetooth device list.">
         Unpaired devices
       </message>
+      <message name="IDS_ASH_STATUS_TRAY_BLUETOOTH_SETTINGS" desc="The label used in the tray pop up to open Bluetooth setting page.">
+        Bluetooth settings
+      </message>
 
       <message name="IDS_ASH_STATUS_TRAY_UPDATE" desc="The label used in the tray popup to notify that the user should restart to get system updates.">
         Restart to update
@@ -324,9 +327,8 @@
       <message name="IDS_ASH_STATUS_TRAY_ACCESSIBILITY_VIRTUAL_KEYBOARD" desc="The label used in the accessibility menu of the system tray to toggle on/off the onscreen keyboard.">
         On-screen keyboard
       </message>
-      <message name="IDS_ASH_STATUS_TRAY_ACCESSIBILITY_LEARN_MORE" desc="The label used in the accessibility menu of the system tray
-     to open a webpage (article on help center) containing explanation about accessibility feature.">
-        Learn more...
+      <message name="IDS_ASH_STATUS_TRAY_ACCESSIBILITY_SETTINGS" desc="The label used in the accessibility menu of system tray to open accessibility setting page.">
+        Accessibility settings
       </message>
       <message name="IDS_ASH_STATUS_TRAY_HELP" desc="The accessible text for the help button.">
         Help
@@ -370,6 +372,10 @@
       <message name="IDS_ASH_STYLUS_TOOLS_TITLE" desc="The title of the stylus tools dialog in the ash shelf.">
         Stylus tools
       </message>
+      <message name="IDS_ASH_PALETTE_SETTINGS" desc="The label on the setting button used to open palette setting page.">
+        Stylus settings
+      </message>
+      
 
       <message name="IDS_ASH_TOAST_DISMISS_BUTTON" desc="The text button shown in toasts to close the toast immediately without waiting timeout.">
         DISMISS
diff --git a/ash/common/system/chromeos/bluetooth/tray_bluetooth.cc b/ash/common/system/chromeos/bluetooth/tray_bluetooth.cc
index a6a6c5e..ed7284f 100644
--- a/ash/common/system/chromeos/bluetooth/tray_bluetooth.cc
+++ b/ash/common/system/chromeos/bluetooth/tray_bluetooth.cc
@@ -471,7 +471,8 @@
         TrayPopupUtils::CreateToggleButton(this, IDS_ASH_STATUS_TRAY_BLUETOOTH);
     tri_view()->AddView(TriView::Container::END, toggle_);
 
-    settings_ = CreateSettingsButton(login_);
+    settings_ =
+        CreateSettingsButton(login_, IDS_ASH_STATUS_TRAY_BLUETOOTH_SETTINGS);
     tri_view()->AddView(TriView::Container::END, settings_);
   }
 
diff --git a/ash/common/system/chromeos/palette/palette_tray.cc b/ash/common/system/chromeos/palette/palette_tray.cc
index 5954bc0..31c6778 100644
--- a/ash/common/system/chromeos/palette/palette_tray.cc
+++ b/ash/common/system/chromeos/palette/palette_tray.cc
@@ -95,7 +95,7 @@
                                kSystemMenuHelpIcon, IDS_ASH_STATUS_TRAY_HELP);
       settings_button_ = new SystemMenuButton(
           this, TrayPopupInkDropStyle::HOST_CENTERED, kSystemMenuSettingsIcon,
-          IDS_ASH_STATUS_TRAY_SETTINGS);
+          IDS_ASH_PALETTE_SETTINGS);
     } else {
       gfx::ImageSkia help_icon =
           gfx::CreateVectorIcon(kSystemMenuHelpIcon, kMenuIconColor);
diff --git a/ash/common/system/ime/tray_ime_chromeos.cc b/ash/common/system/ime/tray_ime_chromeos.cc
index 5a23a9d8..0a35ced 100644
--- a/ash/common/system/ime/tray_ime_chromeos.cc
+++ b/ash/common/system/ime/tray_ime_chromeos.cc
@@ -170,7 +170,8 @@
       }
 
       tri_view()->SetContainerVisible(TriView::Container::END, true);
-      settings_button_ = CreateSettingsButton(login_);
+      settings_button_ =
+          CreateSettingsButton(login_, IDS_ASH_STATUS_TRAY_IME_SETTINGS);
       tri_view()->AddView(TriView::Container::END, settings_button_);
     }
   }
diff --git a/ash/common/system/tray/tray_details_view.cc b/ash/common/system/tray/tray_details_view.cc
index e2570fe6..b7749501 100644
--- a/ash/common/system/tray/tray_details_view.cc
+++ b/ash/common/system/tray/tray_details_view.cc
@@ -412,11 +412,13 @@
   child_at(kTitleRowSeparatorIndex)->SetVisible(!visible);
 }
 
-views::CustomButton* TrayDetailsView::CreateSettingsButton(LoginStatus status) {
+views::CustomButton* TrayDetailsView::CreateSettingsButton(
+    LoginStatus status,
+    int setting_accessible_name_id) {
   DCHECK(UseMd());
-  SystemMenuButton* button = new SystemMenuButton(
-      this, TrayPopupInkDropStyle::HOST_CENTERED, kSystemMenuSettingsIcon,
-      IDS_ASH_STATUS_TRAY_SETTINGS);
+  SystemMenuButton* button =
+      new SystemMenuButton(this, TrayPopupInkDropStyle::HOST_CENTERED,
+                           kSystemMenuSettingsIcon, setting_accessible_name_id);
   if (!TrayPopupUtils::CanOpenWebUISettings(status))
     button->SetEnabled(false);
   return button;
diff --git a/ash/common/system/tray/tray_details_view.h b/ash/common/system/tray/tray_details_view.h
index b7021d6..d7046e7 100644
--- a/ash/common/system/tray/tray_details_view.h
+++ b/ash/common/system/tray/tray_details_view.h
@@ -12,6 +12,7 @@
 #include "ash/common/system/tray/tray_constants.h"
 #include "ash/common/system/tray/view_click_listener.h"
 #include "base/macros.h"
+#include "grit/ash_strings.h"
 #include "ui/views/controls/button/button.h"
 #include "ui/views/view.h"
 
@@ -87,7 +88,8 @@
   // Helper functions which create and return the settings and help buttons,
   // respectively, used in the material design top-most header row. The caller
   // assumes ownership of the returned buttons.
-  views::CustomButton* CreateSettingsButton(LoginStatus status);
+  views::CustomButton* CreateSettingsButton(LoginStatus status,
+                                            int setting_accessible_name_id);
   views::CustomButton* CreateHelpButton(LoginStatus status);
 
   TriView* tri_view() { return tri_view_; }
diff --git a/ash/common/system/tray_accessibility.cc b/ash/common/system/tray_accessibility.cc
index 9e1fda5..dbd2df66 100644
--- a/ash/common/system/tray_accessibility.cc
+++ b/ash/common/system/tray_accessibility.cc
@@ -322,7 +322,8 @@
     tri_view()->SetContainerVisible(TriView::Container::END, true);
 
     help_view_ = CreateHelpButton(login_);
-    settings_view_ = CreateSettingsButton(login_);
+    settings_view_ = CreateSettingsButton(
+        login_, IDS_ASH_STATUS_TRAY_ACCESSIBILITY_SETTINGS);
     tri_view()->AddView(TriView::Container::END, help_view_);
     tri_view()->AddView(TriView::Container::END, settings_view_);
   }
diff --git a/ash/system/chromeos/rotation/tray_rotation_lock.cc b/ash/system/chromeos/rotation/tray_rotation_lock.cc
index c4fe50e..fb26bca 100644
--- a/ash/system/chromeos/rotation/tray_rotation_lock.cc
+++ b/ash/system/chromeos/rotation/tray_rotation_lock.cc
@@ -5,10 +5,12 @@
 #include "ash/system/chromeos/rotation/tray_rotation_lock.h"
 
 #include "ash/common/material_design/material_design_controller.h"
+#include "ash/common/system/tray/actionable_view.h"
 #include "ash/common/system/tray/system_tray.h"
 #include "ash/common/system/tray/tray_constants.h"
-#include "ash/common/system/tray/tray_item_more.h"
 #include "ash/common/system/tray/tray_popup_item_style.h"
+#include "ash/common/system/tray/tray_popup_utils.h"
+#include "ash/common/system/tray/tri_view.h"
 #include "ash/common/wm/maximize_mode/maximize_mode_controller.h"
 #include "ash/common/wm_shell.h"
 #include "ash/display/screen_orientation_controller_chromeos.h"
@@ -16,98 +18,143 @@
 #include "ash/shell.h"
 #include "grit/ash_resources.h"
 #include "grit/ash_strings.h"
+#include "ui/accessibility/ax_node_data.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/display/display.h"
 #include "ui/gfx/paint_vector_icon.h"
+#include "ui/views/controls/image_view.h"
+#include "ui/views/controls/label.h"
+#include "ui/views/layout/fill_layout.h"
 
 namespace ash {
 
+namespace {
+
+bool IsMaximizeModeWindowManagerEnabled() {
+  return WmShell::Get()
+      ->maximize_mode_controller()
+      ->IsMaximizeModeWindowManagerEnabled();
+}
+
+bool IsRotationLocked() {
+  return Shell::GetInstance()
+      ->screen_orientation_controller()
+      ->rotation_locked();
+}
+
+}  // namespace
+
 namespace tray {
 
-// Extends TrayItemMore, however does not make use of the chevron, nor of the
-// DetailedView. This was chosen over ActionableView in order to reuse the
-// layout and styling of labels and images. This allows RotationLockDefaultView
-// to maintain the look of other system tray items without code duplication.
-class RotationLockDefaultView : public TrayItemMore, public ShellObserver {
+class RotationLockDefaultView : public ActionableView,
+                                public ShellObserver,
+                                public ScreenOrientationController::Observer {
  public:
   explicit RotationLockDefaultView(SystemTrayItem* owner);
   ~RotationLockDefaultView() override;
 
+ private:
+  // Updates icon and label according to current rotation lock status.
+  void Update();
+
+  // Stop observing rotation lock status.
+  void StopObservingRotation();
+
   // ActionableView:
+  void GetAccessibleNodeData(ui::AXNodeData* node_data) override;
   bool PerformAction(const ui::Event& event) override;
 
   // ShellObserver:
   void OnMaximizeModeStarted() override;
   void OnMaximizeModeEnded() override;
 
- protected:
-  // TrayItemMore:
-  void UpdateStyle() override;
+  // ScreenOrientationController::Obsever:
+  void OnRotationLockChanged(bool rotation_locked) override;
 
- private:
-  void UpdateImage();
+  views::ImageView* icon_;
+  views::Label* label_;
 
   DISALLOW_COPY_AND_ASSIGN(RotationLockDefaultView);
 };
 
 RotationLockDefaultView::RotationLockDefaultView(SystemTrayItem* owner)
-    : TrayItemMore(owner, false) {
-  SetVisible(WmShell::Get()
-                 ->maximize_mode_controller()
-                 ->IsMaximizeModeWindowManagerEnabled());
+    : ActionableView(owner, TrayPopupInkDropStyle::FILL_BOUNDS),
+      icon_(TrayPopupUtils::CreateMainImageView()),
+      label_(TrayPopupUtils::CreateDefaultLabel()) {
+  SetLayoutManager(new views::FillLayout);
+
+  TriView* tri_view = TrayPopupUtils::CreateDefaultRowView();
+  AddChildView(tri_view);
+
+  tri_view->AddView(TriView::Container::START, icon_);
+  tri_view->AddView(TriView::Container::CENTER, label_);
+  tri_view->SetContainerVisible(TriView::Container::END, false);
+
+  Update();
+
+  SetInkDropMode(InkDropHostView::InkDropMode::ON);
+
+  SetVisible(IsMaximizeModeWindowManagerEnabled());
   WmShell::Get()->AddShellObserver(this);
+  if (IsMaximizeModeWindowManagerEnabled())
+    Shell::GetInstance()->screen_orientation_controller()->AddObserver(this);
 }
 
 RotationLockDefaultView::~RotationLockDefaultView() {
+  StopObservingRotation();
   WmShell::Get()->RemoveShellObserver(this);
 }
 
-bool RotationLockDefaultView::PerformAction(const ui::Event& event) {
-  ScreenOrientationController* screen_orientation_controller =
+void RotationLockDefaultView::Update() {
+  TrayPopupItemStyle style(TrayPopupItemStyle::FontStyle::DEFAULT_VIEW_LABEL);
+  icon_->SetImage(gfx::CreateVectorIcon(IsRotationLocked()
+                                            ? kSystemMenuRotationLockLockedIcon
+                                            : kSystemMenuRotationLockAutoIcon,
+                                        kMenuIconSize, style.GetIconColor()));
+
+  base::string16 label = l10n_util::GetStringUTF16(
+      IsRotationLocked() ? IDS_ASH_STATUS_TRAY_ROTATION_LOCK_LOCKED
+                         : IDS_ASH_STATUS_TRAY_ROTATION_LOCK_AUTO);
+  label_->SetText(label);
+  style.SetupLabel(label_);
+
+  Layout();
+  SchedulePaint();
+}
+
+void RotationLockDefaultView::StopObservingRotation() {
+  ScreenOrientationController* controller =
       Shell::GetInstance()->screen_orientation_controller();
-  screen_orientation_controller->SetRotationLocked(
-      !screen_orientation_controller->rotation_locked());
-  UpdateImage();
+  if (controller)
+    controller->RemoveObserver(this);
+}
+
+void RotationLockDefaultView::GetAccessibleNodeData(ui::AXNodeData* node_data) {
+  ActionableView::GetAccessibleNodeData(node_data);
+  if (!label_->text().empty())
+    node_data->SetName(label_->text());
+}
+
+bool RotationLockDefaultView::PerformAction(const ui::Event& event) {
+  Shell::GetInstance()->screen_orientation_controller()->SetRotationLocked(
+      !IsRotationLocked());
   return true;
 }
 
 void RotationLockDefaultView::OnMaximizeModeStarted() {
-  UpdateImage();
+  Update();
   SetVisible(true);
+  Shell::GetInstance()->screen_orientation_controller()->AddObserver(this);
 }
 
 void RotationLockDefaultView::OnMaximizeModeEnded() {
   SetVisible(false);
+  StopObservingRotation();
 }
 
-void RotationLockDefaultView::UpdateStyle() {
-  TrayItemMore::UpdateStyle();
-  UpdateImage();
-}
-
-void RotationLockDefaultView::UpdateImage() {
-  const bool rotation_locked =
-      Shell::GetInstance()->screen_orientation_controller()->rotation_locked();
-  if (MaterialDesignController::UseMaterialDesignSystemIcons()) {
-    std::unique_ptr<TrayPopupItemStyle> style = CreateStyle();
-    SetImage(gfx::CreateVectorIcon(rotation_locked
-                                       ? kSystemMenuRotationLockLockedIcon
-                                       : kSystemMenuRotationLockAutoIcon,
-                                   kMenuIconSize, style->GetIconColor()));
-  } else {
-    ui::ResourceBundle& bundle = ui::ResourceBundle::GetSharedInstance();
-    const int resource_id = rotation_locked
-                                ? IDR_AURA_UBER_TRAY_AUTO_ROTATION_LOCKED_DARK
-                                : IDR_AURA_UBER_TRAY_AUTO_ROTATION_DARK;
-    SetImage(*bundle.GetImageNamed(resource_id).ToImageSkia());
-  }
-
-  base::string16 label = l10n_util::GetStringUTF16(
-      rotation_locked ? IDS_ASH_STATUS_TRAY_ROTATION_LOCK_LOCKED
-                      : IDS_ASH_STATUS_TRAY_ROTATION_LOCK_AUTO);
-  SetLabel(label);
-  SetAccessibleName(label);
+void RotationLockDefaultView::OnRotationLockChanged(bool rotation_locked) {
+  Update();
 }
 
 }  // namespace tray
@@ -115,14 +162,12 @@
 TrayRotationLock::TrayRotationLock(SystemTray* system_tray)
     : TrayImageItem(system_tray,
                     IDR_AURA_UBER_TRAY_AUTO_ROTATION_LOCKED,
-                    UMA_ROTATION_LOCK),
-      observing_rotation_(false),
-      observing_shell_(true) {
+                    UMA_ROTATION_LOCK) {
   WmShell::Get()->AddShellObserver(this);
 }
 
 TrayRotationLock::~TrayRotationLock() {
-  StopObservingShell();
+  WmShell::Get()->RemoveShellObserver(this);
 }
 
 void TrayRotationLock::OnRotationLockChanged(bool rotation_locked) {
@@ -136,10 +181,8 @@
 }
 
 void TrayRotationLock::OnMaximizeModeStarted() {
-  tray_view()->SetVisible(
-      Shell::GetInstance()->screen_orientation_controller()->rotation_locked());
+  tray_view()->SetVisible(IsRotationLocked());
   Shell::GetInstance()->screen_orientation_controller()->AddObserver(this);
-  observing_rotation_ = true;
 }
 
 void TrayRotationLock::OnMaximizeModeEnded() {
@@ -149,7 +192,7 @@
 
 void TrayRotationLock::DestroyTrayView() {
   StopObservingRotation();
-  StopObservingShell();
+  WmShell::Get()->RemoveShellObserver(this);
   TrayImageItem::DestroyTrayView();
 }
 
@@ -158,13 +201,8 @@
 }
 
 bool TrayRotationLock::ShouldBeVisible() {
-  return OnPrimaryDisplay() &&
-         WmShell::Get()
-             ->maximize_mode_controller()
-             ->IsMaximizeModeWindowManagerEnabled() &&
-         Shell::GetInstance()
-             ->screen_orientation_controller()
-             ->rotation_locked();
+  return OnPrimaryDisplay() && IsMaximizeModeWindowManagerEnabled() &&
+         IsRotationLocked();
 }
 
 bool TrayRotationLock::OnPrimaryDisplay() const {
@@ -175,20 +213,10 @@
 }
 
 void TrayRotationLock::StopObservingRotation() {
-  if (!observing_rotation_)
-    return;
   ScreenOrientationController* controller =
       Shell::GetInstance()->screen_orientation_controller();
   if (controller)
     controller->RemoveObserver(this);
-  observing_rotation_ = false;
-}
-
-void TrayRotationLock::StopObservingShell() {
-  if (!observing_shell_)
-    return;
-  WmShell::Get()->RemoveShellObserver(this);
-  observing_shell_ = false;
 }
 
 }  // namespace ash
diff --git a/ash/system/chromeos/rotation/tray_rotation_lock.h b/ash/system/chromeos/rotation/tray_rotation_lock.h
index 0576f42..109376c 100644
--- a/ash/system/chromeos/rotation/tray_rotation_lock.h
+++ b/ash/system/chromeos/rotation/tray_rotation_lock.h
@@ -56,15 +56,6 @@
   // currently observing.
   void StopObservingRotation();
 
-  // Removes TrayRotationLock as a ShellObserver if currently observing.
-  void StopObservingShell();
-
-  // True while added as a ScreenOrientationController::Observer.
-  bool observing_rotation_;
-
-  // True while added as a ShellObserver.
-  bool observing_shell_;
-
   DISALLOW_COPY_AND_ASSIGN(TrayRotationLock);
 };
 
diff --git a/base/files/file_descriptor_watcher_posix.cc b/base/files/file_descriptor_watcher_posix.cc
index 49ac5d4..9746e35e 100644
--- a/base/files/file_descriptor_watcher_posix.cc
+++ b/base/files/file_descriptor_watcher_posix.cc
@@ -92,7 +92,10 @@
     WeakPtr<Controller> controller,
     MessageLoopForIO::Mode mode,
     int fd)
-    : controller_(controller), mode_(mode), fd_(fd) {
+    : file_descriptor_watcher_(FROM_HERE),
+      controller_(controller),
+      mode_(mode),
+      fd_(fd) {
   DCHECK(callback_task_runner_);
   thread_checker_.DetachFromThread();
 }
diff --git a/base/message_loop/message_loop_unittest.cc b/base/message_loop/message_loop_unittest.cc
index 26344283..14fe1ee 100644
--- a/base/message_loop/message_loop_unittest.cc
+++ b/base/message_loop/message_loop_unittest.cc
@@ -739,7 +739,7 @@
   int fd = pipefds[1];
   {
     // Arrange for controller to live longer than message loop.
-    MessageLoopForIO::FileDescriptorWatcher controller;
+    MessageLoopForIO::FileDescriptorWatcher controller(FROM_HERE);
     {
       MessageLoopForIO message_loop;
 
@@ -766,7 +766,7 @@
     // Arrange for message loop to live longer than controller.
     MessageLoopForIO message_loop;
     {
-      MessageLoopForIO::FileDescriptorWatcher controller;
+      MessageLoopForIO::FileDescriptorWatcher controller(FROM_HERE);
 
       QuitDelegate delegate;
       message_loop.WatchFileDescriptor(fd,
diff --git a/base/message_loop/message_pump_io_ios.cc b/base/message_loop/message_pump_io_ios.cc
index b464f74..85cb2555 100644
--- a/base/message_loop/message_pump_io_ios.cc
+++ b/base/message_loop/message_pump_io_ios.cc
@@ -6,13 +6,14 @@
 
 namespace base {
 
-MessagePumpIOSForIO::FileDescriptorWatcher::FileDescriptorWatcher()
+MessagePumpIOSForIO::FileDescriptorWatcher::FileDescriptorWatcher(
+    const tracked_objects::Location& from_here)
     : is_persistent_(false),
       fdref_(NULL),
       callback_types_(0),
       fd_source_(NULL),
-      watcher_(NULL) {
-}
+      watcher_(NULL),
+      created_from_location_(from_here) {}
 
 MessagePumpIOSForIO::FileDescriptorWatcher::~FileDescriptorWatcher() {
   StopWatchingFileDescriptor();
diff --git a/base/message_loop/message_pump_io_ios.h b/base/message_loop/message_pump_io_ios.h
index bb6cd50..f48e957 100644
--- a/base/message_loop/message_pump_io_ios.h
+++ b/base/message_loop/message_pump_io_ios.h
@@ -6,6 +6,7 @@
 #define BASE_MESSAGE_LOOP_MESSAGE_PUMP_IO_IOS_H_
 
 #include "base/base_export.h"
+#include "base/location.h"
 #include "base/mac/scoped_cffiledescriptorref.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/macros.h"
@@ -36,7 +37,7 @@
   // Object returned by WatchFileDescriptor to manage further watching.
   class FileDescriptorWatcher {
    public:
-    FileDescriptorWatcher();
+    explicit FileDescriptorWatcher(const tracked_objects::Location& from_here);
     ~FileDescriptorWatcher();  // Implicitly calls StopWatchingFileDescriptor.
 
     // NOTE: These methods aren't called StartWatching()/StopWatching() to
@@ -46,6 +47,10 @@
     // to do.
     bool StopWatchingFileDescriptor();
 
+    const tracked_objects::Location& created_from_location() {
+      return created_from_location_;
+    }
+
    private:
     friend class MessagePumpIOSForIO;
     friend class MessagePumpIOSForIOTest;
@@ -72,6 +77,8 @@
     base::WeakPtr<MessagePumpIOSForIO> pump_;
     Watcher* watcher_;
 
+    tracked_objects::Location created_from_location_;
+
     DISALLOW_COPY_AND_ASSIGN(FileDescriptorWatcher);
   };
 
diff --git a/base/message_loop/message_pump_io_ios_unittest.cc b/base/message_loop/message_pump_io_ios_unittest.cc
index 19519aa7..6976ee8 100644
--- a/base/message_loop/message_pump_io_ios_unittest.cc
+++ b/base/message_loop/message_pump_io_ios_unittest.cc
@@ -76,7 +76,7 @@
 // Test to make sure that we catch calling WatchFileDescriptor off of the wrong
 // thread.
 TEST_F(MessagePumpIOSForIOTest, TestWatchingFromBadThread) {
-  MessagePumpIOSForIO::FileDescriptorWatcher watcher;
+  MessagePumpIOSForIO::FileDescriptorWatcher watcher(FROM_HERE);
   StupidWatcher delegate;
 
   ASSERT_DCHECK_DEATH(
@@ -120,7 +120,7 @@
 TEST_F(MessagePumpIOSForIOTest, DeleteWatcher) {
   std::unique_ptr<MessagePumpIOSForIO> pump(new MessagePumpIOSForIO);
   MessagePumpIOSForIO::FileDescriptorWatcher* watcher =
-      new MessagePumpIOSForIO::FileDescriptorWatcher;
+      new MessagePumpIOSForIO::FileDescriptorWatcher(FROM_HERE);
   DeleteWatcher delegate(watcher);
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpIOSForIO::WATCH_READ_WRITE, watcher, &delegate);
@@ -155,7 +155,7 @@
 
 TEST_F(MessagePumpIOSForIOTest, StopWatcher) {
   std::unique_ptr<MessagePumpIOSForIO> pump(new MessagePumpIOSForIO);
-  MessagePumpIOSForIO::FileDescriptorWatcher watcher;
+  MessagePumpIOSForIO::FileDescriptorWatcher watcher(FROM_HERE);
   StopWatcher delegate(&watcher, pump.get());
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpIOSForIO::WATCH_READ_WRITE, &watcher, &delegate);
@@ -166,7 +166,7 @@
 
 TEST_F(MessagePumpIOSForIOTest, StopWatcherAndWatchSomethingElse) {
   std::unique_ptr<MessagePumpIOSForIO> pump(new MessagePumpIOSForIO);
-  MessagePumpIOSForIO::FileDescriptorWatcher watcher;
+  MessagePumpIOSForIO::FileDescriptorWatcher watcher(FROM_HERE);
   StopWatcher delegate(&watcher, pump.get(), alternate_pipefds_[1]);
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpIOSForIO::WATCH_READ_WRITE, &watcher, &delegate);
diff --git a/base/message_loop/message_pump_libevent.cc b/base/message_loop/message_pump_libevent.cc
index bc7f14db..48cb98a3 100644
--- a/base/message_loop/message_pump_libevent.cc
+++ b/base/message_loop/message_pump_libevent.cc
@@ -43,12 +43,13 @@
 
 namespace base {
 
-MessagePumpLibevent::FileDescriptorWatcher::FileDescriptorWatcher()
+MessagePumpLibevent::FileDescriptorWatcher::FileDescriptorWatcher(
+    const tracked_objects::Location& from_here)
     : event_(NULL),
       pump_(NULL),
       watcher_(NULL),
-      was_destroyed_(NULL) {
-}
+      was_destroyed_(NULL),
+      created_from_location_(from_here) {}
 
 MessagePumpLibevent::FileDescriptorWatcher::~FileDescriptorWatcher() {
   if (event_) {
@@ -315,8 +316,11 @@
   FileDescriptorWatcher* controller =
       static_cast<FileDescriptorWatcher*>(context);
   DCHECK(controller);
-  TRACE_EVENT1("toplevel", "MessagePumpLibevent::OnLibeventNotification",
-               "fd", fd);
+  TRACE_EVENT2("toplevel", "MessagePumpLibevent::OnLibeventNotification",
+               "src_file", controller->created_from_location().file_name(),
+               "src_func", controller->created_from_location().function_name());
+  TRACE_HEAP_PROFILER_API_SCOPED_TASK_EXECUTION heap_profiler_scope(
+      controller->created_from_location().file_name());
 
   MessagePumpLibevent* pump = controller->pump();
   pump->processed_io_events_ = true;
diff --git a/base/message_loop/message_pump_libevent.h b/base/message_loop/message_pump_libevent.h
index 752dc92..1124560d 100644
--- a/base/message_loop/message_pump_libevent.h
+++ b/base/message_loop/message_pump_libevent.h
@@ -6,6 +6,7 @@
 #define BASE_MESSAGE_LOOP_MESSAGE_PUMP_LIBEVENT_H_
 
 #include "base/compiler_specific.h"
+#include "base/location.h"
 #include "base/macros.h"
 #include "base/message_loop/message_pump.h"
 #include "base/threading/thread_checker.h"
@@ -37,7 +38,7 @@
   // Object returned by WatchFileDescriptor to manage further watching.
   class FileDescriptorWatcher {
    public:
-    FileDescriptorWatcher();
+    explicit FileDescriptorWatcher(const tracked_objects::Location& from_here);
     ~FileDescriptorWatcher();  // Implicitly calls StopWatchingFileDescriptor.
 
     // NOTE: These methods aren't called StartWatching()/StopWatching() to
@@ -47,6 +48,10 @@
     // to do.
     bool StopWatchingFileDescriptor();
 
+    const tracked_objects::Location& created_from_location() {
+      return created_from_location_;
+    }
+
    private:
     friend class MessagePumpLibevent;
     friend class MessagePumpLibeventTest;
@@ -73,6 +78,8 @@
     // destructor.
     bool* was_destroyed_;
 
+    const tracked_objects::Location created_from_location_;
+
     DISALLOW_COPY_AND_ASSIGN(FileDescriptorWatcher);
   };
 
diff --git a/base/message_loop/message_pump_libevent_unittest.cc b/base/message_loop/message_pump_libevent_unittest.cc
index a23b3543f..3e7a200a 100644
--- a/base/message_loop/message_pump_libevent_unittest.cc
+++ b/base/message_loop/message_pump_libevent_unittest.cc
@@ -88,7 +88,7 @@
 #define MAYBE_TestWatchingFromBadThread TestWatchingFromBadThread
 #endif
 TEST_F(MessagePumpLibeventTest, MAYBE_TestWatchingFromBadThread) {
-  MessagePumpLibevent::FileDescriptorWatcher watcher;
+  MessagePumpLibevent::FileDescriptorWatcher watcher(FROM_HERE);
   StupidWatcher delegate;
 
   ASSERT_DCHECK_DEATH(
@@ -137,7 +137,7 @@
 TEST_F(MessagePumpLibeventTest, DeleteWatcher) {
   std::unique_ptr<MessagePumpLibevent> pump(new MessagePumpLibevent);
   MessagePumpLibevent::FileDescriptorWatcher* watcher =
-      new MessagePumpLibevent::FileDescriptorWatcher;
+      new MessagePumpLibevent::FileDescriptorWatcher(FROM_HERE);
   DeleteWatcher delegate(watcher);
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpLibevent::WATCH_READ_WRITE, watcher, &delegate);
@@ -161,7 +161,7 @@
 
 TEST_F(MessagePumpLibeventTest, StopWatcher) {
   std::unique_ptr<MessagePumpLibevent> pump(new MessagePumpLibevent);
-  MessagePumpLibevent::FileDescriptorWatcher watcher;
+  MessagePumpLibevent::FileDescriptorWatcher watcher(FROM_HERE);
   StopWatcher delegate(&watcher);
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpLibevent::WATCH_READ_WRITE, &watcher, &delegate);
@@ -196,7 +196,7 @@
 
 TEST_F(MessagePumpLibeventTest, NestedPumpWatcher) {
   std::unique_ptr<MessagePumpLibevent> pump(new MessagePumpLibevent);
-  MessagePumpLibevent::FileDescriptorWatcher watcher;
+  MessagePumpLibevent::FileDescriptorWatcher watcher(FROM_HERE);
   NestedPumpWatcher delegate;
   pump->WatchFileDescriptor(pipefds_[1],
       false, MessagePumpLibevent::WATCH_READ, &watcher, &delegate);
@@ -244,7 +244,7 @@
   MessagePumpLibevent* pump = new MessagePumpLibevent;  // owned by |loop|.
   MessageLoop loop(WrapUnique(pump));
   RunLoop run_loop;
-  MessagePumpLibevent::FileDescriptorWatcher controller;
+  MessagePumpLibevent::FileDescriptorWatcher controller(FROM_HERE);
   QuitWatcher delegate(&controller, &run_loop);
   WaitableEvent event(WaitableEvent::ResetPolicy::AUTOMATIC,
                       WaitableEvent::InitialState::NOT_SIGNALED);
diff --git a/base/profiler/stack_sampling_profiler_unittest.cc b/base/profiler/stack_sampling_profiler_unittest.cc
index 16205ac2..0b300d5 100644
--- a/base/profiler/stack_sampling_profiler_unittest.cc
+++ b/base/profiler/stack_sampling_profiler_unittest.cc
@@ -547,7 +547,7 @@
     // the same stack as |wait_until_unloaded|, if not we should have the full
     // stack. The important thing is that we should not crash.
 
-    if ((sample.frames.end() - 1) - end_frame == 2) {
+    if (sample.frames.end() - end_frame == 2) {
       // This is the same case as |wait_until_unloaded|.
       return;
     }
diff --git a/build/config/win/BUILD.gn b/build/config/win/BUILD.gn
index e00bfcb..a7db829 100644
--- a/build/config/win/BUILD.gn
+++ b/build/config/win/BUILD.gn
@@ -252,6 +252,15 @@
     ldflags += [ "/DYNAMICBASE" ]
   }
 
+  # Control Flow Guard (CFG)
+  # https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065.aspx
+  # /DYNAMICBASE (ASLR) is turned off in debug builds, therefore CFG can’t be
+  # turned on either.
+  if (!is_debug) {
+    # Turn on CFG in msvc linker, regardless of compiler used.
+    ldflags += [ "/guard:cf" ]
+  }
+
   if (win_linker_timing) {
     ldflags += [
       "/time",
@@ -260,17 +269,6 @@
   }
 }
 
-# Control Flow Guard (CFG)
-# https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065.aspx
-config("win_msvc_cfg") {
-  # /DYNAMICBASE (ASLR) is turned off in debug builds, therefore CFG can’t be
-  # turned on either.
-  if (!is_clang && !is_debug) {
-    cflags = [ "/guard:cf" ]
-    ldflags = [ "/guard:cf" ]
-  }
-}
-
 # CRT --------------------------------------------------------------------------
 
 # Configures how the runtime library (CRT) is going to be used.
diff --git a/cc/ipc/struct_traits_unittest.cc b/cc/ipc/struct_traits_unittest.cc
index 06313bb0..b804c44 100644
--- a/cc/ipc/struct_traits_unittest.cc
+++ b/cc/ipc/struct_traits_unittest.cc
@@ -1055,7 +1055,8 @@
   const bool is_overlay_candidate = true;
   const bool secure_output_only = true;
   const bool nearest_neighbor = true;
-  const gfx::ColorSpace color_space(4, 5, 9, gfx::ColorSpace::RangeID::LIMITED);
+  const gfx::ColorSpace color_space =
+      gfx::ColorSpace::CreateVideo(4, 5, 9, gfx::ColorSpace::RangeID::LIMITED);
 #if defined(OS_ANDROID)
   const bool is_backed_by_surface_texture = true;
   const bool wants_promotion_hint = true;
diff --git a/cc/output/gl_renderer.cc b/cc/output/gl_renderer.cc
index cb76e74..ff1b838 100644
--- a/cc/output/gl_renderer.cc
+++ b/cc/output/gl_renderer.cc
@@ -2109,6 +2109,9 @@
         break;
     }
   }
+  // Invalid or unspecified color spaces should be treated as REC709.
+  if (!src_color_space.IsValid())
+    src_color_space = gfx::ColorSpace::CreateREC709();
 
   ResourceProvider::ScopedSamplerGL y_plane_lock(
       resource_provider_, quad->y_plane_resource_id(), GL_TEXTURE1, GL_LINEAR);
diff --git a/cc/trees/layer_tree_host_unittest.cc b/cc/trees/layer_tree_host_unittest.cc
index 0bac7ba..751366c7 100644
--- a/cc/trees/layer_tree_host_unittest.cc
+++ b/cc/trees/layer_tree_host_unittest.cc
@@ -3148,112 +3148,6 @@
 
 SINGLE_AND_MULTI_THREAD_TEST_F(LayerTreeHostTestNumFramesPending);
 
-class LayerTreeHostTestResourcelessSoftwareDraw : public LayerTreeHostTest {
- protected:
-  void InitializeSettings(LayerTreeSettings* settings) override {
-    settings->using_synchronous_renderer_compositor = true;
-  }
-
-  void SetupTree() override {
-    root_layer_ = FakePictureLayer::Create(&client_);
-    root_layer_->SetIsDrawable(true);
-    root_layer_->SetBounds(gfx::Size(50, 50));
-
-    parent_layer_ = FakePictureLayer::Create(&client_);
-    parent_layer_->SetIsDrawable(true);
-    parent_layer_->SetBounds(gfx::Size(50, 50));
-    parent_layer_->SetForceRenderSurfaceForTesting(true);
-
-    child_layer_ = FakePictureLayer::Create(&client_);
-    child_layer_->SetIsDrawable(true);
-    child_layer_->SetBounds(gfx::Size(50, 50));
-
-    root_layer_->AddChild(parent_layer_);
-    parent_layer_->AddChild(child_layer_);
-    layer_tree_host()->SetRootLayer(root_layer_);
-
-    LayerTreeHostTest::SetupTree();
-    client_.set_bounds(root_layer_->bounds());
-  }
-
-  std::unique_ptr<TestCompositorFrameSink> CreateCompositorFrameSink(
-      scoped_refptr<ContextProvider> compositor_context_provider,
-      scoped_refptr<ContextProvider> worker_context_provider) override {
-    auto on_draw_callback =
-        base::Bind(&LayerTreeHostTestResourcelessSoftwareDraw::CallOnDraw,
-                   base::Unretained(this));
-    auto frame_sink = base::MakeUnique<OnDrawCompositorFrameSink>(
-        compositor_context_provider, std::move(worker_context_provider),
-        shared_bitmap_manager(), gpu_memory_buffer_manager(),
-        layer_tree_host()->GetSettings().renderer_settings,
-        ImplThreadTaskRunner(), false /* synchronous_composite */,
-        false /* force_disable_reclaim_resources */,
-        std::move(on_draw_callback));
-    compositor_frame_sink_ = frame_sink.get();
-    return std::move(frame_sink);
-  }
-
-  void BeginTest() override { PostSetNeedsCommitToMainThread(); }
-
-  void CallOnDraw() {
-    if (!TestEnded()) {
-      // Synchronous compositor does not draw unless told to do so by the output
-      // surface. But it needs to be done on a new stack frame.
-      bool resourceless_software_draw = true;
-      ImplThreadTaskRunner()->PostTask(
-          FROM_HERE, base::Bind(&OnDrawCompositorFrameSink::OnDraw,
-                                base::Unretained(compositor_frame_sink_),
-                                resourceless_software_draw));
-    }
-  }
-
-  DrawResult PrepareToDrawOnThread(LayerTreeHostImpl* host_impl,
-                                   LayerTreeHostImpl::FrameData* frame_data,
-                                   DrawResult draw_result) override {
-    if (host_impl->GetDrawMode() == DRAW_MODE_RESOURCELESS_SOFTWARE) {
-      EXPECT_EQ(1u, frame_data->render_passes.size());
-      // Has at least 3 quads for each layer.
-      RenderPass* render_pass = frame_data->render_passes[0].get();
-      EXPECT_GE(render_pass->quad_list.size(), 3u);
-    } else {
-      EXPECT_EQ(2u, frame_data->render_passes.size());
-
-      // At least root layer quad in root render pass.
-      EXPECT_GE(frame_data->render_passes[0]->quad_list.size(), 1u);
-      // At least parent and child layer quads in parent render pass.
-      EXPECT_GE(frame_data->render_passes[1]->quad_list.size(), 2u);
-    }
-    return draw_result;
-  }
-
-  void DrawLayersOnThread(LayerTreeHostImpl* host_impl) override {
-    draw_count_++;
-    switch (draw_count_) {
-      case 1:
-        host_impl->SetNeedsRedraw();
-        break;
-      case 2:
-        EndTest();
-        break;
-      default:
-        NOTREACHED();
-    }
-  }
-
-  void AfterTest() override {}
-
- private:
-  OnDrawCompositorFrameSink* compositor_frame_sink_ = nullptr;
-  FakeContentLayerClient client_;
-  scoped_refptr<Layer> root_layer_;
-  scoped_refptr<Layer> parent_layer_;
-  scoped_refptr<Layer> child_layer_;
-  int draw_count_ = 0;
-};
-
-// Resourceless is not used for SingleThreadProxy, so it is unimplemented.
-MULTI_THREAD_TEST_F(LayerTreeHostTestResourcelessSoftwareDraw);
-
 // Test for UI Resource management.
 class LayerTreeHostTestUIResource : public LayerTreeHostTest {
  public:
diff --git a/cc/trees/layer_tree_impl.cc b/cc/trees/layer_tree_impl.cc
index ca0f858..3398897 100644
--- a/cc/trees/layer_tree_impl.cc
+++ b/cc/trees/layer_tree_impl.cc
@@ -987,8 +987,9 @@
     TRACE_EVENT2(
         "cc", "LayerTreeImpl::UpdateDrawProperties::CalculateDrawProperties",
         "IsActive", IsActiveTree(), "SourceFrameNumber", source_frame_number_);
-    bool can_render_to_separate_surface =
-        (!is_in_resourceless_software_draw_mode());
+    // TODO(crbug.com/692780): Remove this option entirely once this get to
+    // stable and proves it works.
+    bool can_render_to_separate_surface = true;
 
     // We verify visible rect calculations whenever we verify clip tree
     // calculations except when this function is explicitly passed a flag asking
diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
index 1a2185f..b5213243 100644
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn
@@ -213,9 +213,6 @@
         "/DELAYLOAD:ole32.dll",
         "/DELAYLOAD:oleaut32.dll",
       ]
-
-      # Turn on CFG for this project.
-      configs += [ "//build/config/win:win_msvc_cfg" ]
     } else if (use_aura) {
       # Non-Windows aura entrypoint.
       sources += [ "app/chrome_exe_main_aura.cc" ]
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 9c38976..8330e32 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -1624,6 +1624,9 @@
   <message name="IDS_SETTINGS_RESET_VIEW_REPORTED_SETTINGS" desc="Label of a link that when clicked displays the settings that will be reported to Google for analysis.">
     View report settings
   </message>
+  <message name="IDS_SETTINGS_RESET_AUTOMATED_DIALOG_TITLE" desc="The title of the dialog informing the user that automated resetting of some settings occurred.">
+    Some settings were reset
+  </message>
 
   <!-- Search Page -->
   <message name="IDS_SETTINGS_SEARCH" desc="Name of the settings page which displays search engine preferences.">
@@ -1786,6 +1789,18 @@
   <message name="IDS_SETTINGS_SITE_SETTINGS_UNSANDBOXED_PLUGINS" desc="Label for the unsandboxed plugin access site settings.">
     Unsandboxed plugin access
   </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES" desc="Label for the MIDI devices in site settings.">
+    MIDI devices
+  </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_ASK" desc="The ask label for MIDI devices in site settings.">
+    Ask when a site wants to use system exclusive messages to access MIDI devices
+  </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_ASK_RECOMMENDED" desc="The ask label for MIDI devices in site settings (with the 'recommended' suffix).">
+    Ask when a site wants to use system exclusive messages to access MIDI devices (recommended)
+  </message>
+  <message name="IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_BLOCK" desc="The block label for MIDI devices in site settings.">
+    Do not allow any sites to use system exclusive messages to access MIDI devices
+  </message>
   <message name="IDS_SETTINGS_SITE_SETTINGS_USB_DEVICES" desc="Label for the USB devices in site settings.">
     USB devices
   </message>
diff --git a/chrome/browser/apps/app_shim/unix_domain_socket_acceptor.cc b/chrome/browser/apps/app_shim/unix_domain_socket_acceptor.cc
index 662ba09..9764c607e 100644
--- a/chrome/browser/apps/app_shim/unix_domain_socket_acceptor.cc
+++ b/chrome/browser/apps/app_shim/unix_domain_socket_acceptor.cc
@@ -14,7 +14,8 @@
 
 UnixDomainSocketAcceptor::UnixDomainSocketAcceptor(const base::FilePath& path,
                                                    Delegate* delegate)
-    : named_pipe_(path.value()),
+    : server_listen_connection_watcher_(FROM_HERE),
+      named_pipe_(path.value()),
       delegate_(delegate),
       listen_handle_(mojo::edk::CreateServerHandle(named_pipe_)) {
   DCHECK(delegate_);
diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
index 2698c53..b14a7890 100644
--- a/chrome/browser/apps/guest_view/web_view_browsertest.cc
+++ b/chrome/browser/apps/guest_view/web_view_browsertest.cc
@@ -2405,9 +2405,23 @@
 
 IN_PROC_BROWSER_TEST_P(WebViewTest, ClearData) {
   ASSERT_TRUE(StartEmbeddedTestServer());  // For serving guest pages.
-  ASSERT_TRUE(RunPlatformAppTestWithArg(
-      "platform_apps/web_view/common", "cleardata"))
-          << message_;
+  ASSERT_TRUE(
+      RunPlatformAppTestWithArg("platform_apps/web_view/common", "cleardata"))
+      << message_;
+}
+
+IN_PROC_BROWSER_TEST_P(WebViewTest, ClearSessionCookies) {
+  ASSERT_TRUE(StartEmbeddedTestServer());  // For serving guest pages.
+  ASSERT_TRUE(RunPlatformAppTestWithArg("platform_apps/web_view/common",
+                                        "cleardata_session"))
+      << message_;
+}
+
+IN_PROC_BROWSER_TEST_P(WebViewTest, ClearPersistentCookies) {
+  ASSERT_TRUE(StartEmbeddedTestServer());  // For serving guest pages.
+  ASSERT_TRUE(RunPlatformAppTestWithArg("platform_apps/web_view/common",
+                                        "cleardata_persistent"))
+      << message_;
 }
 
 // Regression test for https://crbug.com/615429.
diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
index 12d6b2f1..bc890bf 100644
--- a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
+++ b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
@@ -45,17 +45,18 @@
 // This list should be kept in sync with chrome/common/url_constants.h.
 // Only include useful sub-pages, confirmation alerts are not useful.
 const char* const kChromeSettingsSubPages[] = {
-    chrome::kAutofillSubPage,
-    chrome::kClearBrowserDataSubPage,
-    chrome::kContentSettingsSubPage,
-    chrome::kImportDataSubPage,
-    chrome::kLanguageOptionsSubPage,
-    chrome::kPasswordManagerSubPage,
-    chrome::kResetProfileSettingsSubPage,
-    chrome::kSearchEnginesSubPage,
-    chrome::kSyncSetupSubPage,
+    chrome::kAutofillSubPage,        chrome::kClearBrowserDataSubPage,
+    chrome::kContentSettingsSubPage, chrome::kLanguageOptionsSubPage,
+    chrome::kPasswordManagerSubPage, chrome::kResetProfileSettingsSubPage,
+    chrome::kSearchEnginesSubPage,   chrome::kSyncSetupSubPage,
 #if defined(OS_CHROMEOS)
-    chrome::kInternetOptionsSubPage,
+    chrome::kAccessibilitySubPage,   chrome::kBluetoothSubPage,
+    chrome::kDateTimeSubPage,        chrome::kDisplaySubPage,
+    chrome::kInternetSubPage,        chrome::kPowerSubPage,
+    chrome::kStylusSubPage,
+#else
+    chrome::kCreateProfileSubPage,   chrome::kImportDataSubPage,
+    chrome::kManageProfileSubPage,
 #endif
 };
 
diff --git a/chrome/browser/browser_about_handler.cc b/chrome/browser/browser_about_handler.cc
index 48cd0a17..a89d62b 100644
--- a/chrome/browser/browser_about_handler.cc
+++ b/chrome/browser/browser_about_handler.cc
@@ -80,7 +80,8 @@
     }
   // Redirect chrome://settings/extensions (legacy URL).
   } else if (host == chrome::kChromeUISettingsHost &&
-      url->path() == std::string("/") + chrome::kExtensionsSubPage) {
+             url->path() ==
+                 std::string("/") + chrome::kDeprecatedExtensionsSubPage) {
     host = chrome::kChromeUIUberHost;
     path = chrome::kChromeUIExtensionsHost;
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
diff --git a/chrome/browser/chrome_browser_field_trials.cc b/chrome/browser/chrome_browser_field_trials.cc
index afe5154..904a1213 100644
--- a/chrome/browser/chrome_browser_field_trials.cc
+++ b/chrome/browser/chrome_browser_field_trials.cc
@@ -67,9 +67,9 @@
 
   // Create persistent/shared memory and allow histograms to be stored in
   // it. Memory that is not actualy used won't be physically mapped by the
-  // system. BrowserMetrics usage, as reported in UMA, peaked around 3.0MiB
-  // as of 2016-12-20.
-  const size_t kAllocSize = 5 << 20;     // 5 MiB
+  // system. BrowserMetrics usage, as reported in UMA, has the 99.9 percentile
+  // around 4MiB as of 2017-02-16.
+  const size_t kAllocSize = 8 << 20;     // 8 MiB
   const uint32_t kAllocId = 0x935DDD43;  // SHA1(BrowserMetrics)
   std::string storage = variations::GetVariationParamValueByFeature(
       base::kPersistentHistogramsFeature, "storage");
diff --git a/chrome/browser/chrome_browser_main_extra_parts_exo.cc b/chrome/browser/chrome_browser_main_extra_parts_exo.cc
index af9342b..8f4e277 100644
--- a/chrome/browser/chrome_browser_main_extra_parts_exo.cc
+++ b/chrome/browser/chrome_browser_main_extra_parts_exo.cc
@@ -90,7 +90,8 @@
 class ChromeBrowserMainExtraPartsExo::WaylandWatcher
     : public base::MessagePumpLibevent::Watcher {
  public:
-  explicit WaylandWatcher(exo::wayland::Server* server) : server_(server) {
+  explicit WaylandWatcher(exo::wayland::Server* server)
+      : controller_(FROM_HERE), server_(server) {
     base::MessageLoopForUI::current()->WatchFileDescriptor(
         server_->GetFileDescriptor(),
         true,  // persistent
diff --git a/chrome/browser/global_keyboard_shortcuts_cocoa_mac.mm b/chrome/browser/global_keyboard_shortcuts_cocoa_mac.mm
index b92ff44..88543bc4 100644
--- a/chrome/browser/global_keyboard_shortcuts_cocoa_mac.mm
+++ b/chrome/browser/global_keyboard_shortcuts_cocoa_mac.mm
@@ -15,61 +15,70 @@
 // (DelayedWindowKeyboardShortcut).
 
 const std::vector<KeyboardShortcutData>& GetWindowKeyboardShortcutTable() {
+  // clang-format off
   CR_DEFINE_STATIC_LOCAL(std::vector<KeyboardShortcutData>, result, ({
-      // cmd   shift  cntrl  option
-      // ---   -----  -----  ------
-      // '{' / '}' characters should be matched earlier than virtual key code
-      // (therefore we can match alt-8 as '{' on german keyboards).
-      {true, false, false, false, 0, '}', IDC_SELECT_NEXT_TAB},
-      {true, false, false, false, 0, '{', IDC_SELECT_PREVIOUS_TAB},
-      {false, false, true, false, kVK_PageDown, 0, IDC_SELECT_NEXT_TAB},
-      {false, false, true, false, kVK_Tab, 0, IDC_SELECT_NEXT_TAB},
-      {false, false, true, false, kVK_PageUp, 0, IDC_SELECT_PREVIOUS_TAB},
-      {false, true, true, false, kVK_Tab, 0, IDC_SELECT_PREVIOUS_TAB},
-      // Cmd-0..8 select the Nth tab, with cmd-9 being "last tab".
-      {true, false, false, false, kVK_ANSI_1, 0, IDC_SELECT_TAB_0},
-      {true, false, false, false, kVK_ANSI_Keypad1, 0, IDC_SELECT_TAB_0},
-      {true, false, false, false, kVK_ANSI_2, 0, IDC_SELECT_TAB_1},
-      {true, false, false, false, kVK_ANSI_Keypad2, 0, IDC_SELECT_TAB_1},
-      {true, false, false, false, kVK_ANSI_3, 0, IDC_SELECT_TAB_2},
-      {true, false, false, false, kVK_ANSI_Keypad3, 0, IDC_SELECT_TAB_2},
-      {true, false, false, false, kVK_ANSI_4, 0, IDC_SELECT_TAB_3},
-      {true, false, false, false, kVK_ANSI_Keypad4, 0, IDC_SELECT_TAB_3},
-      {true, false, false, false, kVK_ANSI_5, 0, IDC_SELECT_TAB_4},
-      {true, false, false, false, kVK_ANSI_Keypad5, 0, IDC_SELECT_TAB_4},
-      {true, false, false, false, kVK_ANSI_6, 0, IDC_SELECT_TAB_5},
-      {true, false, false, false, kVK_ANSI_Keypad6, 0, IDC_SELECT_TAB_5},
-      {true, false, false, false, kVK_ANSI_7, 0, IDC_SELECT_TAB_6},
-      {true, false, false, false, kVK_ANSI_Keypad7, 0, IDC_SELECT_TAB_6},
-      {true, false, false, false, kVK_ANSI_8, 0, IDC_SELECT_TAB_7},
-      {true, false, false, false, kVK_ANSI_Keypad8, 0, IDC_SELECT_TAB_7},
-      {true, false, false, false, kVK_ANSI_9, 0, IDC_SELECT_LAST_TAB},
-      {true, false, false, false, kVK_ANSI_Keypad9, 0, IDC_SELECT_LAST_TAB},
-      {true, true, false, false, kVK_ANSI_M, 0, IDC_SHOW_AVATAR_MENU},
-      {true, false, false, true, kVK_ANSI_L, 0, IDC_SHOW_DOWNLOADS},
+    //cmd   shift  cntrl  option vkeycode      char command
+    //---   -----  -----  ------ --------      ---- -------
+    // '{' / '}' characters should be matched earlier than virtual key codes
+    // (so we can match alt-8 as '{' on German keyboards).
+    {true,  false, false, false, 0,            '}', IDC_SELECT_NEXT_TAB},
+    {true,  false, false, false, 0,            '{', IDC_SELECT_PREVIOUS_TAB},
+    {false, false, true,  false, kVK_PageDown, 0,   IDC_SELECT_NEXT_TAB},
+    {false, false, true,  false, kVK_Tab,      0,   IDC_SELECT_NEXT_TAB},
+    {false, false, true,  false, kVK_PageUp,   0,   IDC_SELECT_PREVIOUS_TAB},
+    {false, true,  true,  false, kVK_Tab,      0,   IDC_SELECT_PREVIOUS_TAB},
+
+    //cmd  shift  cntrl  option vkeycode          char command
+    //---  -----  -----  ------ --------          ---- -------
+    // Cmd-0..8 select the nth tab, with cmd-9 being "last tab".
+    {true, false, false, false, kVK_ANSI_1,       0,   IDC_SELECT_TAB_0},
+    {true, false, false, false, kVK_ANSI_Keypad1, 0,   IDC_SELECT_TAB_0},
+    {true, false, false, false, kVK_ANSI_2,       0,   IDC_SELECT_TAB_1},
+    {true, false, false, false, kVK_ANSI_Keypad2, 0,   IDC_SELECT_TAB_1},
+    {true, false, false, false, kVK_ANSI_3,       0,   IDC_SELECT_TAB_2},
+    {true, false, false, false, kVK_ANSI_Keypad3, 0,   IDC_SELECT_TAB_2},
+    {true, false, false, false, kVK_ANSI_4,       0,   IDC_SELECT_TAB_3},
+    {true, false, false, false, kVK_ANSI_Keypad4, 0,   IDC_SELECT_TAB_3},
+    {true, false, false, false, kVK_ANSI_5,       0,   IDC_SELECT_TAB_4},
+    {true, false, false, false, kVK_ANSI_Keypad5, 0,   IDC_SELECT_TAB_4},
+    {true, false, false, false, kVK_ANSI_6,       0,   IDC_SELECT_TAB_5},
+    {true, false, false, false, kVK_ANSI_Keypad6, 0,   IDC_SELECT_TAB_5},
+    {true, false, false, false, kVK_ANSI_7,       0,   IDC_SELECT_TAB_6},
+    {true, false, false, false, kVK_ANSI_Keypad7, 0,   IDC_SELECT_TAB_6},
+    {true, false, false, false, kVK_ANSI_8,       0,   IDC_SELECT_TAB_7},
+    {true, false, false, false, kVK_ANSI_Keypad8, 0,   IDC_SELECT_TAB_7},
+    {true, false, false, false, kVK_ANSI_9,       0,   IDC_SELECT_LAST_TAB},
+    {true, false, false, false, kVK_ANSI_Keypad9, 0,   IDC_SELECT_LAST_TAB},
+    {true, true,  false, false, kVK_ANSI_M,       0,   IDC_SHOW_AVATAR_MENU},
+    {true, false, false, true,  kVK_ANSI_L,       0,   IDC_SHOW_DOWNLOADS},
   }));
+  // clang-format on
   return result;
 }
 
 const std::vector<KeyboardShortcutData>&
 GetDelayedWindowKeyboardShortcutTable() {
+  // clang-format off
   CR_DEFINE_STATIC_LOCAL(std::vector<KeyboardShortcutData>, result, ({
-    //cmd   shift  cntrl  option
-    //---   -----  -----  ------
-    {false, false, false, false, kVK_Escape,        0, IDC_STOP},
+    //cmd   shift  cntrl  option vkeycode    char command
+    //---   -----  -----  ------ --------    ---- -------
+    {false, false, false, false, kVK_Escape, 0,   IDC_STOP},
   }));
+  // clang-format on
   return result;
 }
 
 const std::vector<KeyboardShortcutData>& GetBrowserKeyboardShortcutTable() {
+  // clang-format off
   CR_DEFINE_STATIC_LOCAL(std::vector<KeyboardShortcutData>, result, ({
-    //cmd   shift  cntrl  option
-    //---   -----  -----  ------
-    {true,  false, false, false, kVK_LeftArrow,    0,   IDC_BACK},
-    {true,  false, false, false, kVK_RightArrow,   0,   IDC_FORWARD},
-    {false, false, false, false, kVK_Delete,       0,   IDC_BACKSPACE_BACK},
-    {false, true,  false, false, kVK_Delete,       0,   IDC_BACKSPACE_FORWARD},
-    {true,  true,  false, false, 0,                'c', IDC_DEV_TOOLS_INSPECT},
+    //cmd   shift  cntrl  option vkeycode        char command
+    //---   -----  -----  ------ --------        ---- -------
+    {true,  false, false, false, kVK_LeftArrow,  0,   IDC_BACK},
+    {true,  false, false, false, kVK_RightArrow, 0,   IDC_FORWARD},
+    {false, false, false, false, kVK_Delete,     0,   IDC_BACKSPACE_BACK},
+    {false, true,  false, false, kVK_Delete,     0,   IDC_BACKSPACE_FORWARD},
+    {true,  true,  false, false, 0,              'c', IDC_DEV_TOOLS_INSPECT},
   }));
+  // clang-format on
   return result;
 }
diff --git a/chrome/browser/global_keyboard_shortcuts_views_mac.mm b/chrome/browser/global_keyboard_shortcuts_views_mac.mm
index 663b02f98..0303ba5 100644
--- a/chrome/browser/global_keyboard_shortcuts_views_mac.mm
+++ b/chrome/browser/global_keyboard_shortcuts_views_mac.mm
@@ -10,14 +10,16 @@
 // (crbug.com/25946).
 
 const std::vector<KeyboardShortcutData>& GetWindowKeyboardShortcutTable() {
+  // clang-format off
   CR_DEFINE_STATIC_LOCAL(std::vector<KeyboardShortcutData>, result, ({
-      // cmd   shift  cntrl  option
-      // ---   -----  -----  ------
-      // '{' / '}' characters should be matched earlier than virtual key code
-      // (therefore we can match alt-8 as '{' on german keyboards).
-      {true, false, false, false, 0, '}', IDC_SELECT_NEXT_TAB},
-      {true, false, false, false, 0, '{', IDC_SELECT_PREVIOUS_TAB},
+    //cmd  shift  cntrl  option vkeycode char command
+    //---  -----  -----  ------ -------- ---- -------
+    // '{' / '}' characters should be matched earlier than virtual key codes
+    // (so we can match alt-8 as '{' on German keyboards).
+    {true, false, false, false, 0,       '}', IDC_SELECT_NEXT_TAB},
+    {true, false, false, false, 0,       '{', IDC_SELECT_PREVIOUS_TAB},
   }));
+  // clang-format on
   return result;
 }
 
diff --git a/chrome/browser/resources/PRESUBMIT.py b/chrome/browser/resources/PRESUBMIT.py
index 38260bc..3f14fe7 100644
--- a/chrome/browser/resources/PRESUBMIT.py
+++ b/chrome/browser/resources/PRESUBMIT.py
@@ -114,24 +114,9 @@
 
 
 def PostUploadHook(cl, change, output_api):
-  rietveld_obj = cl.RpcServer()
-  description = rietveld_obj.get_description(cl.issue)
-
-  existing_bots = (change.CQ_INCLUDE_TRYBOTS or '').split(';')
-  clean_bots = set(filter(None, map(lambda s: s.strip(), existing_bots)))
-  new_bots = clean_bots | set(
-      ['master.tryserver.chromium.linux:closure_compilation'])
-  new_tag = 'CQ_INCLUDE_TRYBOTS=%s' % ';'.join(new_bots)
-
-  if clean_bots:
-    tag_reg = '^CQ_INCLUDE_TRYBOTS=.*$'
-    new_description = re.sub(tag_reg, new_tag, description, flags=re.M | re.I)
-  else:
-    new_description = description + '\n' + new_tag
-
-  if new_description == description:
-    return []
-
-  rietveld_obj.update_description(cl.issue, new_description)
-  return [output_api.PresubmitNotifyResult(
-      'Automatically added optional Closure bots to run on CQ.')]
+  return output_api.EnsureCQIncludeTrybotsAreAdded(
+    cl,
+    [
+      'master.tryserver.chromium.linux:closure_compilation',
+    ],
+    'Automatically added optional Closure bots to run on CQ.')
diff --git a/chrome/browser/resources/settings/about_page/channel_switcher_dialog.js b/chrome/browser/resources/settings/about_page/channel_switcher_dialog.js
index 3cd8913f..b98a22d 100644
--- a/chrome/browser/resources/settings/about_page/channel_switcher_dialog.js
+++ b/chrome/browser/resources/settings/about_page/channel_switcher_dialog.js
@@ -52,7 +52,9 @@
       this.currentChannel_ = info.currentChannel;
       this.targetChannel_ = info.targetChannel;
       // Pre-populate radio group with target channel.
-      this.$$('paper-radio-group').select(this.targetChannel_);
+      var radioGroup = this.$$('paper-radio-group');
+      radioGroup.select(this.targetChannel_);
+      radioGroup.focus();
     }.bind(this));
   },
 
diff --git a/chrome/browser/resources/settings/basic_page/basic_page.html b/chrome/browser/resources/settings/basic_page/basic_page.html
index 7c14422..47041e1 100644
--- a/chrome/browser/resources/settings/basic_page/basic_page.html
+++ b/chrome/browser/resources/settings/basic_page/basic_page.html
@@ -88,8 +88,8 @@
     <template is="dom-if" if="[[showBasicPage_(
         currentRoute_, inSearchMode, hasExpandedSection_)]]">
       <div id="basicPage">
-        <template is="dom-if" if="[[showResetProfileBanner_]]">
-          <settings-reset-profile-banner on-reset-done="onResetDone_">
+        <template is="dom-if" if="[[showResetProfileBanner_]]" restamp>
+          <settings-reset-profile-banner on-close="onResetProfileBannerClosed_">
           </settings-reset-profile-banner>
         </template>
 <if expr="chromeos">
diff --git a/chrome/browser/resources/settings/basic_page/basic_page.js b/chrome/browser/resources/settings/basic_page/basic_page.js
index 5dbf99c2..39599606 100644
--- a/chrome/browser/resources/settings/basic_page/basic_page.js
+++ b/chrome/browser/resources/settings/basic_page/basic_page.js
@@ -132,7 +132,7 @@
 // </if>
 
   /** @private */
-  onResetDone_: function() {
+  onResetProfileBannerClosed_: function() {
     this.showResetProfileBanner_ = false;
   },
 
diff --git a/chrome/browser/resources/settings/icons.html b/chrome/browser/resources/settings/icons.html
index 1795b00d..a581d03 100644
--- a/chrome/browser/resources/settings/icons.html
+++ b/chrome/browser/resources/settings/icons.html
@@ -78,6 +78,9 @@
       <g id="mic"><path d="M12 14c1.66 0 2.99-1.34 2.99-3L15 5c0-1.66-1.34-3-3-3S9 3.34 9 5v6c0 1.66 1.34 3 3 3zm5.3-3c0 3-2.54 5.1-5.3 5.1S6.7 14 6.7 11H5c0 3.41 2.72 6.23 6 6.72V21h2v-3.28c3.28-.48 6-3.3 6-6.72h-1.7z"></path></g>
 <if expr="chromeos">
       <g id="mouse"><path d="M13 1.07V9h7c0-4.08-3.05-7.44-7-7.93zM4 15c0 4.42 3.58 8 8 8s8-3.58 8-8v-4H4v4zm7-13.93C7.05 1.56 4 4.92 4 9h7V1.07z"></path></g>
+</if>
+      <g id="music-note"><path d="M12 3v10.55c-.59-.34-1.27-.55-2-.55-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V7h4V3h-6z"></path></g>
+<if expr="chromeos">
       <g id="network-wifi"><path fill-opacity=".3" d="M12.01 21.49L23.64 7c-.45-.34-4.93-4-11.64-4C5.28 3 .81 6.66.36 7l11.63 14.49.01.01.01-.01z"></path><path d="M3.53 10.95l8.46 10.54.01.01.01-.01 8.46-10.54C20.04 10.62 16.81 8 12 8c-4.81 0-8.04 2.62-8.47 2.95z"></path></g>
 </if>
       <g id="notifications"><path d="M12 22c1.1 0 2-.9 2-2h-4c0 1.1.89 2 2 2zm6-6v-5c0-3.07-1.64-5.64-4.5-6.32V4c0-.83-.67-1.5-1.5-1.5s-1.5.67-1.5 1.5v.68C7.63 5.36 6 7.92 6 11v5l-2 2v1h16v-1l-2-2z"></path></g>
diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/chrome/browser/resources/settings/privacy_page/privacy_page.html
index ef4f07f..a50f367 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page.html
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page.html
@@ -390,6 +390,19 @@
           </category-setting-exceptions>
         </settings-subpage>
       </template>
+      <template is="dom-if" route-path="/content/midiDevices" no-search>
+        <settings-subpage page-title="$i18n{siteSettingsMidiDevices}">
+          <category-default-setting
+              toggle-off-label="$i18n{siteSettingsMidiDevicesBlock}"
+              toggle-on-label=
+                  "$i18n{siteSettingsMidiDevicesAskRecommended}"
+              category="{{ContentSettingsTypes.MIDI_DEVICES}}">
+          </category-default-setting>
+          <category-setting-exceptions
+              category="{{ContentSettingsTypes.MIDI_DEVICES}}">
+          </category-setting-exceptions>
+        </settings-subpage>
+      </template>
       <template is="dom-if" route-path="/content/usbDevices" no-search>
         <settings-subpage page-title="$i18n{siteSettingsUsbDevices}">
           <usb-devices></usb-devices>
diff --git a/chrome/browser/resources/settings/reset_page/reset_profile_banner.html b/chrome/browser/resources/settings/reset_page/reset_profile_banner.html
index 16285e1..dffea73 100644
--- a/chrome/browser/resources/settings/reset_page/reset_profile_banner.html
+++ b/chrome/browser/resources/settings/reset_page/reset_profile_banner.html
@@ -1,73 +1,31 @@
-<link rel="import" href="chrome://resources/cr_elements/icons.html">
 <link rel="import" href="chrome://resources/html/polymer.html">
+<link rel="import" href="chrome://resources/cr_elements/cr_dialog/cr_dialog.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/paper-icon-button/paper-icon-button.html">
 <link rel="import" href="reset_browser_proxy.html">
-<link rel="import" href="reset_profile_dialog.html">
+<link rel="import" href="../route.html">
 
 <dom-module id="settings-reset-profile-banner">
   <template>
-      <style>
-        #banner-content {
-          background-color: white;
-          border: 1px solid #c8c8c8;
-          border-radius: 3px;
-          margin-bottom: 24px;
-        }
-
-        #top-row {
-          display: flex;
-          justify-content: flex-end;
-        }
-
-        #main-body {
-          align-items: center;
-          display: flex;
-          padding: 0 17px 17px;
-        }
-
-        #description {
-          -webkit-margin-start: 18px;
-          flex: 1;
-        }
-
-        #close {
-          height: 30px;
-        }
-
-        #reset {
-          -webkit-margin-start: 30px;
-          background-color: rgb(66, 133, 244);
-          color: white;
-          font-weight: 500;
-        }
-
-        a {
-          color: rgb(66, 133, 244);
-          text-decoration: none;
-        }
-      </style>
-    <div id="banner-content">
-      <div id="top-row">
-        <paper-icon-button icon="cr:clear" on-tap="onCloseTap_" id="close">
-        </paper-icon-button>
-      </div>
-      <div id="main-body">
+    <style include="settings-shared"></style>
+    <dialog is="cr-dialog" id="dialog" ignore-popstate>
+      <div class="title">$i18n{resetAutomatedDialogTitle}</div>
+      <div class="body">
         <span id="description">
           $i18n{resetProfileBannerDescription}
           <a id="learnMore"
              href="$i18nRaw{resetProfileBannerLearnMoreUrl}"
              target="_blank">$i18n{learnMore}</a>
         </span>
-        <paper-button id="reset" on-tap="showDialog_">
+      </div>
+      <div class="button-container">
+        <paper-button class="cancel-button" on-tap="onOkTap_" id="ok">
+          $i18n{ok}
+        </paper-button>
+        <paper-button class="action-button" on-tap="onResetTap_" id="reset">
           $i18n{resetProfileBannerButton}
         </paper-button>
       </div>
-    </div>
-    <template is="dom-if" if="[[showResetProfileDialog_]]" restamp>
-      <settings-reset-profile-dialog on-close="onDialogClose_">
-      </settings-reset-profile-dialog>
-    </template>
+    </dialog>
   </template>
   <script src="reset_profile_banner.js"></script>
 </dom-module>
diff --git a/chrome/browser/resources/settings/reset_page/reset_profile_banner.js b/chrome/browser/resources/settings/reset_page/reset_profile_banner.js
index 758582f..965efd65 100644
--- a/chrome/browser/resources/settings/reset_page/reset_profile_banner.js
+++ b/chrome/browser/resources/settings/reset_page/reset_profile_banner.js
@@ -4,37 +4,35 @@
 
 /**
  * @fileoverview
- * 'settings-reset-profile-banner' is the banner shown for clearing profile
- * settings.
+ * 'settings-reset-profile-banner' is the banner shown for propmting the user to
+ * clear profile settings.
  */
 Polymer({
+  // TODO(dpapad): Rename to settings-reset-warning-dialog.
   is: 'settings-reset-profile-banner',
 
-  properties: {
-    showResetProfileDialog_: {
-      type: Boolean,
-      value: false,
-    },
+  listeners: {
+    'cancel': 'onCancel_',
+  },
+
+  /** @override */
+  attached: function() {
+    this.$.dialog.showModal();
   },
 
   /** @private */
-  onCloseTap_: function() {
+  onOkTap_: function() {
+    this.$.dialog.cancel();
+  },
+
+  /** @private */
+  onCancel_: function() {
     settings.ResetBrowserProxyImpl.getInstance().onHideResetProfileBanner();
-    this.remove();
-  },
-
-  /**
-   * Shows a <settings-reset-profile-dialog>.
-   * @param {!Event} e
-   * @private
-   */
-  showDialog_: function(e) {
-    e.preventDefault();
-    this.showResetProfileDialog_ = true;
   },
 
   /** @private */
-  onDialogClose_: function() {
-    this.showResetProfileDialog_ = false;
+  onResetTap_: function() {
+    this.$.dialog.close();
+    settings.navigateTo(settings.Route.RESET_DIALOG);
   },
 });
diff --git a/chrome/browser/resources/settings/route.js b/chrome/browser/resources/settings/route.js
index 7457f60..dd1bdd7 100644
--- a/chrome/browser/resources/settings/route.js
+++ b/chrome/browser/resources/settings/route.js
@@ -170,6 +170,7 @@
   r.SITE_SETTINGS_POPUPS = r.SITE_SETTINGS.createChild('popups');
   r.SITE_SETTINGS_UNSANDBOXED_PLUGINS =
       r.SITE_SETTINGS.createChild('unsandboxedPlugins');
+  r.SITE_SETTINGS_MIDI_DEVICES = r.SITE_SETTINGS.createChild('midiDevices');
   r.SITE_SETTINGS_USB_DEVICES = r.SITE_SETTINGS.createChild('usbDevices');
   r.SITE_SETTINGS_ZOOM_LEVELS = r.SITE_SETTINGS.createChild('zoomLevels');
   r.SITE_SETTINGS_PDF_DOCUMENTS = r.SITE_SETTINGS.createChild('pdfDocuments');
diff --git a/chrome/browser/resources/settings/search_engines_page/search_engine_entry.html b/chrome/browser/resources/settings/search_engines_page/search_engine_entry.html
index 3dad3645..d74e520b 100644
--- a/chrome/browser/resources/settings/search_engines_page/search_engine_entry.html
+++ b/chrome/browser/resources/settings/search_engines_page/search_engine_entry.html
@@ -24,6 +24,7 @@
       #name-column,
       #keyword-column {
         flex: 3;
+        word-break: break-word;
       }
 
       .favicon-image + div {
diff --git a/chrome/browser/resources/settings/site_settings/category_default_setting.js b/chrome/browser/resources/settings/site_settings/category_default_setting.js
index ea44b06..f481cc5d 100644
--- a/chrome/browser/resources/settings/site_settings/category_default_setting.js
+++ b/chrome/browser/resources/settings/site_settings/category_default_setting.js
@@ -92,6 +92,7 @@
       case settings.ContentSettingsTypes.MIC:
       case settings.ContentSettingsTypes.NOTIFICATIONS:
       case settings.ContentSettingsTypes.UNSANDBOXED_PLUGINS:
+      case settings.ContentSettingsTypes.MIDI_DEVICES:
         // "Ask" vs "Blocked".
         this.browserProxy.setDefaultValueForContentType(
             this.category,
diff --git a/chrome/browser/resources/settings/site_settings/constants.js b/chrome/browser/resources/settings/site_settings/constants.js
index f3d38cd..e11e3bf 100644
--- a/chrome/browser/resources/settings/site_settings/constants.js
+++ b/chrome/browser/resources/settings/site_settings/constants.js
@@ -26,6 +26,7 @@
   UNSANDBOXED_PLUGINS: 'ppapi-broker',
   AUTOMATIC_DOWNLOADS: 'multiple-automatic-downloads',
   BACKGROUND_SYNC: 'background-sync',
+  MIDI_DEVICES: 'midi-sysex',
   USB_DEVICES: 'usb-chooser-data',
   ZOOM_LEVELS: 'zoom-levels',
 // <if expr="chromeos">
diff --git a/chrome/browser/resources/settings/site_settings_page/site_settings_page.html b/chrome/browser/resources/settings/site_settings_page/site_settings_page.html
index a0474299..a2f49dd 100644
--- a/chrome/browser/resources/settings/site_settings_page/site_settings_page.html
+++ b/chrome/browser/resources/settings/site_settings_page/site_settings_page.html
@@ -258,6 +258,23 @@
             aria-describedby="handlersSecondary"></button>
       </div>
     </template>
+    <div class="settings-box two-line"
+        category$="[[ContentSettingsTypes.MIDI_DEVICES]]"
+        data-route="SITE_SETTINGS_MIDI_DEVICES"
+        on-tap="onTapNavigate_" actionable>
+      <iron-icon icon="settings:music-note"></iron-icon>
+      <div class="middle">
+        $i18n{siteSettingsMidiDevices}
+        <div class="secondary" id="midiDevicesSecondary">
+          [[defaultSettingLabel_(
+              default_.midiSysex,
+              '$i18nPolymer{siteSettingsMidiDevicesAsk}',
+              '$i18nPolymer{siteSettingsMidiDevicesBlock}')]]
+        </div>
+      </div>
+      <button class="subpage-arrow" is="paper-icon-button-light"
+          aria-label="$i18n{siteSettingsMidiDevices}"></button>
+    </div>
     <div class="settings-box" category$="[[ContentSettingsTypes.ZOOM_LEVELS]]"
         data-route="SITE_SETTINGS_ZOOM_LEVELS"
         on-tap="onTapNavigate_" actionable>
diff --git a/chrome/browser/ssl/chrome_expect_ct_reporter_unittest.cc b/chrome/browser/ssl/chrome_expect_ct_reporter_unittest.cc
index 7b25db4..e3dc12d 100644
--- a/chrome/browser/ssl/chrome_expect_ct_reporter_unittest.cc
+++ b/chrome/browser/ssl/chrome_expect_ct_reporter_unittest.cc
@@ -341,6 +341,9 @@
 
 // Test that no report is sent when the feature is not enabled.
 TEST(ChromeExpectCTReporterTest, FeatureDisabled) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndDisableFeature(features::kExpectCTReporting);
+
   base::MessageLoop message_loop;
   base::HistogramTester histograms;
   histograms.ExpectTotalCount(kSendHistogramName, 0);
@@ -374,9 +377,6 @@
   base::HistogramTester histograms;
   histograms.ExpectTotalCount(kSendHistogramName, 0);
 
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(features::kExpectCTReporting);
-
   TestCertificateReportSender* sender = new TestCertificateReportSender();
   net::TestURLRequestContext context;
   ChromeExpectCTReporter reporter(&context);
@@ -394,9 +394,6 @@
 
 // Test that if a report fails to send, the UMA metric is recorded.
 TEST_F(ChromeExpectCTReporterWaitTest, SendReportFailure) {
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(features::kExpectCTReporting);
-
   base::HistogramTester histograms;
   histograms.ExpectTotalCount(kFailureHistogramName, 0);
   histograms.ExpectTotalCount(kSendHistogramName, 0);
@@ -429,9 +426,6 @@
   histograms.ExpectTotalCount(kFailureHistogramName, 0);
   histograms.ExpectTotalCount(kSendHistogramName, 0);
 
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(features::kExpectCTReporting);
-
   TestCertificateReportSender* sender = new TestCertificateReportSender();
   net::TestURLRequestContext context;
   ChromeExpectCTReporter reporter(&context);
diff --git a/chrome/browser/ui/ash/system_tray_client.cc b/chrome/browser/ui/ash/system_tray_client.cc
index 9c94470b..311cc75e 100644
--- a/chrome/browser/ui/ash/system_tray_client.cc
+++ b/chrome/browser/ui/ash/system_tray_client.cc
@@ -8,6 +8,7 @@
 #include "ash/common/wm_shell.h"
 #include "ash/public/cpp/shell_window_ids.h"
 #include "ash/shell.h"
+#include "base/feature_list.h"
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_process_platform_part.h"
@@ -27,6 +28,7 @@
 #include "chrome/browser/ui/scoped_tabbed_browser_displayer.h"
 #include "chrome/browser/ui/singleton_tabs.h"
 #include "chrome/browser/upgrade_detector.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/url_constants.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/session_manager_client.h"
@@ -52,9 +54,6 @@
 
 namespace {
 
-const char kDisplaySettingsSubPageName[] = "display";
-const char kPaletteSettingsSubPageName[] = "stylus-overlay";
-
 SystemTrayClient* g_instance = nullptr;
 
 void ShowSettingsSubPageForActiveUser(const std::string& sub_page) {
@@ -226,12 +225,12 @@
 
 void SystemTrayClient::ShowDisplaySettings() {
   content::RecordAction(base::UserMetricsAction("ShowDisplayOptions"));
-  ShowSettingsSubPageForActiveUser(kDisplaySettingsSubPageName);
+  ShowSettingsSubPageForActiveUser(chrome::kDisplaySubPage);
 }
 
 void SystemTrayClient::ShowPowerSettings() {
   content::RecordAction(base::UserMetricsAction("Tray_ShowPowerOptions"));
-  ShowSettingsSubPageForActiveUser(chrome::kPowerOptionsSubPage);
+  ShowSettingsSubPageForActiveUser(chrome::kPowerSubPage);
 }
 
 void SystemTrayClient::ShowChromeSlow() {
@@ -270,7 +269,7 @@
 
 void SystemTrayClient::ShowPaletteSettings() {
   content::RecordAction(base::UserMetricsAction("ShowPaletteOptions"));
-  ShowSettingsSubPageForActiveUser(kPaletteSettingsSubPageName);
+  ShowSettingsSubPageForActiveUser(chrome::kStylusSubPage);
 }
 
 void SystemTrayClient::ShowPublicAccountInfo() {
@@ -321,9 +320,12 @@
     return;
   }
 
-  std::string page = chrome::kInternetOptionsSubPage;
-  if (!network_id.empty())
+  std::string page = chrome::kInternetSubPage;
+  if (!network_id.empty()) {
+    if (base::FeatureList::IsEnabled(features::kMaterialDesignSettings))
+      page = chrome::kNetworkDetailSubPage;
     page += "?guid=" + net::EscapeUrlEncodedData(network_id, true);
+  }
   content::RecordAction(base::UserMetricsAction("OpenInternetOptionsDialog"));
   ShowSettingsSubPageForActiveUser(page);
 }
diff --git a/chrome/browser/ui/chrome_pages.cc b/chrome/browser/ui/chrome_pages.cc
index 443970a..6dea3c41 100644
--- a/chrome/browser/ui/chrome_pages.cc
+++ b/chrome/browser/ui/chrome_pages.cc
@@ -262,16 +262,7 @@
 }
 
 GURL GetSettingsUrl(const std::string& sub_page) {
-  std::string url = std::string(kChromeUISettingsURL) + sub_page;
-#if defined(OS_CHROMEOS)
-  if (sub_page.find(kInternetOptionsSubPage, 0) != std::string::npos) {
-    std::string::size_type loc = sub_page.find("?", 0);
-    std::string network_page =
-        loc != std::string::npos ? sub_page.substr(loc) : std::string();
-    url = std::string(kChromeUISettingsURL) + network_page;
-  }
-#endif
-  return GURL(url);
+  return GURL(std::string(kChromeUISettingsURL) + sub_page);
 }
 
 bool IsSettingsSubPage(const GURL& url, const std::string& sub_page) {
@@ -323,6 +314,15 @@
     } else if (sub_page == chrome::kDateTimeSubPage) {
       sub_page_path = GenerateContentSettingsSearchQueryPath(
           IDS_OPTIONS_SETTINGS_SECTION_TITLE_DATETIME);
+    } else if (sub_page == chrome::kStylusSubPage ||
+               sub_page == chrome::kPowerSubPage) {
+      sub_page_path += "-overlay";
+    }
+  } else {
+    if (sub_page == chrome::kPowerSubPage) {
+      // TODO(stevenjbj/derat): Remove this once we have a 'power' subpage,
+      // crbug.com/633455.
+      sub_page_path = "device";
     }
   }
 #endif
diff --git a/chrome/browser/ui/cocoa/tabs/tab_strip_controller.mm b/chrome/browser/ui/cocoa/tabs/tab_strip_controller.mm
index ac56c5b..760d031 100644
--- a/chrome/browser/ui/cocoa/tabs/tab_strip_controller.mm
+++ b/chrome/browser/ui/cocoa/tabs/tab_strip_controller.mm
@@ -2206,13 +2206,21 @@
     DCHECK(disposition == WindowOpenDisposition::NEW_FOREGROUND_TAB);
     NSInteger lastIndex = [tabArray_ count] - 1;
     NSRect overRect = [[[tabArray_ objectAtIndex:lastIndex] view] frame];
-    arrowPos.x = overRect.origin.x + overRect.size.width - kTabOverlap / 2.0;
+    if (cocoa_l10n_util::ShouldDoExperimentalRTLLayout()) {
+      arrowPos.x = NSMinX(overRect) + kTabOverlap / 2.0;
+    } else {
+      arrowPos.x = NSMaxX(overRect) - kTabOverlap / 2.0;
+    }
   } else {
     NSRect overRect = [[[tabArray_ objectAtIndex:index] view] frame];
     switch (disposition) {
       case WindowOpenDisposition::NEW_FOREGROUND_TAB:
-        // Insert tab (to the left of the given tab).
-        arrowPos.x = overRect.origin.x + kTabOverlap / 2.0;
+        // Insert tab (before the given tab).
+        if (cocoa_l10n_util::ShouldDoExperimentalRTLLayout()) {
+          arrowPos.x = NSMaxX(overRect) - kTabOverlap / 2.0;
+        } else {
+          arrowPos.x = NSMinX(overRect) + kTabOverlap / 2.0;
+        }
         break;
       case WindowOpenDisposition::CURRENT_TAB:
         // Overwrite the given tab.
diff --git a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
index d676a7a..cf4114ca 100644
--- a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
+++ b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
@@ -35,6 +35,8 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_list_prefs.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_utils.h"
 #include "chrome/browser/ui/views/apps/app_info_dialog/arc_app_info_links_panel.h"
 #endif
 
@@ -110,12 +112,7 @@
 AppInfoDialog::AppInfoDialog(gfx::NativeWindow parent_window,
                              Profile* profile,
                              const extensions::Extension* app)
-    : dialog_header_(NULL),
-      dialog_body_(NULL),
-      dialog_footer_(NULL),
-      profile_(profile),
-      app_id_(app->id()),
-      extension_registry_(NULL) {
+    : profile_(profile), app_id_(app->id()) {
   views::BoxLayout* layout =
       new views::BoxLayout(views::BoxLayout::kVertical, 0, 0, 0);
   SetLayoutManager(layout);
@@ -146,10 +143,17 @@
   dialog_body_contents->AddChildView(new AppInfoPermissionsPanel(profile, app));
 
 #if defined(OS_CHROMEOS)
-  // When ARC is enabled, show the "Manage supported links" link for Chrome.
-  if (arc::ArcSessionManager::Get()->IsArcPlayStoreEnabled() &&
-      app->id() == extension_misc::kChromeAppId)
-    dialog_body_contents->AddChildView(new ArcAppInfoLinksPanel(profile, app));
+  // When ARC is enabled and the Settings app is available, show the
+  // "Manage supported links" link for Chrome.
+  if (app->id() == extension_misc::kChromeAppId &&
+      arc::ArcSessionManager::Get()->IsArcPlayStoreEnabled()) {
+    const ArcAppListPrefs* arc_app_list_prefs = ArcAppListPrefs::Get(profile);
+    if (arc_app_list_prefs &&
+        arc_app_list_prefs->IsRegistered(arc::kSettingsAppId)) {
+      arc_app_info_links_ = new ArcAppInfoLinksPanel(profile, app);
+      dialog_body_contents->AddChildView(arc_app_info_links_);
+    }
+  }
 #endif
 
   // Clip the scrollable view so that the scrollbar appears. As long as this
diff --git a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.h b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.h
index add262f..c936dbd0 100644
--- a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.h
+++ b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.h
@@ -34,10 +34,11 @@
                 const extensions::Extension* app);
   ~AppInfoDialog() override;
 
+  views::View* arc_app_info_links_for_test() { return arc_app_info_links_; }
+
  private:
   FRIEND_TEST_ALL_PREFIXES(AppInfoDialogAshTest,
                            PinButtonsAreFocusedAfterPinUnpin);
-
   // Closes the dialog.
   void Close();
 
@@ -51,13 +52,14 @@
   void OnShutdown(extensions::ExtensionRegistry* registry) override;
 
   // UI elements of the dialog.
-  views::View* dialog_header_;
-  views::ScrollView* dialog_body_;
-  views::View* dialog_footer_;
+  views::View* dialog_header_ = nullptr;
+  views::ScrollView* dialog_body_ = nullptr;
+  views::View* dialog_footer_ = nullptr;
+  views::View* arc_app_info_links_ = nullptr;
 
   Profile* profile_;
   std::string app_id_;
-  extensions::ExtensionRegistry* extension_registry_;
+  extensions::ExtensionRegistry* extension_registry_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(AppInfoDialog);
 };
diff --git a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views_unittest.cc b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views_unittest.cc
index 73ad28d..0a158f95 100644
--- a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views_unittest.cc
+++ b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views_unittest.cc
@@ -14,6 +14,7 @@
 #include "chrome/browser/extensions/test_extension_environment.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/views/apps/app_info_dialog/app_info_header_panel.h"
+#include "chrome/common/extensions/extension_constants.h"
 #include "chrome/test/base/browser_with_test_window_test.h"
 #include "chrome/test/base/testing_profile.h"
 #include "extensions/browser/extension_system.h"
@@ -25,9 +26,26 @@
 #include "ui/views/window/dialog_delegate.h"
 
 #if defined(OS_CHROMEOS)
-#include "chrome/browser/chromeos/arc/arc_session_manager.h"
-#include "components/arc/arc_session_runner.h"
-#include "components/arc/test/fake_arc_session.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_list_prefs.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_test.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_utils.h"
+#endif
+
+#if defined(OS_CHROMEOS)
+namespace {
+
+std::vector<arc::mojom::AppInfoPtr> GetArcSettingsAppInfo() {
+  std::vector<arc::mojom::AppInfoPtr> apps;
+  arc::mojom::AppInfoPtr app(arc::mojom::AppInfo::New());
+  app->name = "settings";
+  app->package_name = "com.android.settings";
+  app->activity = "com.android.settings.Settings";
+  app->sticky = false;
+  apps.push_back(std::move(app));
+  return apps;
+}
+
+}  // namespace
 #endif
 
 namespace test {
@@ -69,35 +87,19 @@
   void SetUp() override {
     BrowserWithTestWindowTest::SetUp();
 #if defined(OS_CHROMEOS)
-    arc::ArcSessionManager::DisableUIForTesting();
-    arc_session_manager_ = base::MakeUnique<arc::ArcSessionManager>(
-        base::MakeUnique<arc::ArcSessionRunner>(
-            base::Bind(arc::FakeArcSession::Create)));
-    arc_session_manager_->OnPrimaryUserProfilePrepared(
-        extension_environment_.profile());
+    arc_test_.SetUp(extension_environment_.profile());
 #endif
-    widget_ = views::DialogDelegate::CreateDialogWidget(
-        new views::DialogDelegateView(), GetContext(), nullptr);
-    widget_->AddObserver(this);
     extension_ = extension_environment_.MakePackagedApp(kTestExtensionId, true);
-    dialog_ = new AppInfoDialog(widget_->GetNativeWindow(),
-                                extension_environment_.profile(),
-                                extension_.get());
-
-    widget_->GetContentsView()->AddChildView(dialog_);
-    widget_->Show();
+    chrome_app_ = extension_environment_.MakePackagedApp(
+        extension_misc::kChromeAppId, true);
   }
 
   void TearDown() override {
-    if (!widget_destroyed_)
-      widget_->CloseNow();
-    EXPECT_TRUE(widget_destroyed_);
+    CloseAppInfo();
     extension_ = nullptr;
+    chrome_app_ = nullptr;
 #if defined(OS_CHROMEOS)
-    if (arc_session_manager_) {
-      arc_session_manager_->Shutdown();
-      arc_session_manager_ = nullptr;
-    }
+    arc_test_.TearDown();
 #endif
     BrowserWithTestWindowTest::TearDown();
   }
@@ -109,17 +111,41 @@
 
   void DestroyProfile(TestingProfile* profile) override {
 #if defined(OS_CHROMEOS)
-    if (arc_session_manager_) {
-      arc_session_manager_->Shutdown();
-      arc_session_manager_ = nullptr;
-    }
+    arc_test_.TearDown();
 #endif
   }
 
  protected:
+  void ShowAppInfo(const std::string& app_id) {
+    ShowAppInfoForProfile(app_id, extension_environment_.profile());
+  }
+
+  void ShowAppInfoForProfile(const std::string& app_id, Profile* profile) {
+    const extensions::Extension* extension =
+        extensions::ExtensionSystem::Get(profile)
+            ->extension_service()
+            ->GetExtensionById(app_id, true);
+    DCHECK(extension);
+
+    DCHECK(!widget_);
+    widget_ = views::DialogDelegate::CreateDialogWidget(
+        new views::DialogDelegateView(), GetContext(), nullptr);
+    widget_->AddObserver(this);
+    dialog_ = new AppInfoDialog(widget_->GetNativeWindow(), profile, extension);
+
+    widget_->GetContentsView()->AddChildView(dialog_);
+    widget_->Show();
+  }
+
+  void CloseAppInfo() {
+    if (widget_)
+      widget_->CloseNow();
+    base::RunLoop().RunUntilIdle();
+    DCHECK(!widget_);
+  }
+
   // Overridden from views::WidgetObserver:
   void OnWidgetDestroyed(views::Widget* widget) override {
-    widget_destroyed_ = true;
     widget_->RemoveObserver(this);
     widget_ = NULL;
   }
@@ -134,12 +160,12 @@
 
  protected:
   views::Widget* widget_ = nullptr;
-  bool widget_destroyed_ = false;
   AppInfoDialog* dialog_ = nullptr;  // Owned by |widget_|'s views hierarchy.
   scoped_refptr<extensions::Extension> extension_;
+  scoped_refptr<extensions::Extension> chrome_app_;
   extensions::TestExtensionEnvironment extension_environment_;
 #if defined(OS_CHROMEOS)
-  std::unique_ptr<arc::ArcSessionManager> arc_session_manager_;
+  ArcAppTest arc_test_;
 #endif
 
  private:
@@ -148,26 +174,28 @@
 
 // Tests that the dialog closes when the current app is uninstalled.
 TEST_F(AppInfoDialogViewsTest, UninstallingAppClosesDialog) {
+  ShowAppInfo(kTestExtensionId);
+  ASSERT_TRUE(widget_);
   EXPECT_FALSE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
   UninstallApp(kTestExtensionId);
   base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(widget_destroyed_);
+  EXPECT_FALSE(widget_);
 }
 
 // Tests that the dialog does not close when a different app is uninstalled.
 TEST_F(AppInfoDialogViewsTest, UninstallingOtherAppDoesNotCloseDialog) {
+  ShowAppInfo(kTestExtensionId);
   extension_environment_.MakePackagedApp(kTestOtherExtensionId, true);
-
+  ASSERT_TRUE(widget_);
   EXPECT_FALSE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
   UninstallApp(kTestOtherExtensionId);
   base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(widget_destroyed_);
+  EXPECT_TRUE(widget_);
 }
 
 // Tests that the dialog closes when the current profile is destroyed.
 TEST_F(AppInfoDialogViewsTest, DestroyedProfileClosesDialog) {
+  ShowAppInfo(kTestExtensionId);
   // First delete the test browser window. This ensures the test harness isn't
   // surprised by it being closed in response to the profile deletion below.
   // Note the base class doesn't own the profile, so that part is skipped.
@@ -177,16 +205,17 @@
   // triggered by the DeleteProfile() call rather than the line above.
   base::RunLoop().RunUntilIdle();
 
+  ASSERT_TRUE(widget_);
   EXPECT_FALSE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
   extension_environment_.DeleteProfile();
 
   base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(widget_destroyed_);
+  EXPECT_FALSE(widget_);
 }
 
 // Tests that the dialog does not close when a different profile is destroyed.
 TEST_F(AppInfoDialogViewsTest, DestroyedOtherProfileDoesNotCloseDialog) {
+  ShowAppInfo(kTestExtensionId);
   std::unique_ptr<TestingProfile> other_profile(new TestingProfile);
   extension_environment_.CreateExtensionServiceForProfile(other_profile.get());
 
@@ -196,16 +225,17 @@
       ->extension_service()
       ->AddExtension(other_app.get());
 
+  ASSERT_TRUE(widget_);
   EXPECT_FALSE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
   other_profile.reset();
   base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(widget_destroyed_);
+  EXPECT_TRUE(widget_);
 }
 
 // Tests that clicking the View in Store link opens a browser tab and closes the
 // dialog cleanly.
 TEST_F(AppInfoDialogViewsTest, ViewInStore) {
+  ShowAppInfo(kTestExtensionId);
   EXPECT_TRUE(extension_->from_webstore());  // Otherwise there is no link.
   views::Link* link = test::AppInfoDialogTestApi(dialog_).view_in_store_link();
   EXPECT_TRUE(link);
@@ -213,12 +243,12 @@
   TabStripModel* tabs = browser()->tab_strip_model();
   EXPECT_EQ(0, tabs->count());
 
+  ASSERT_TRUE(widget_);
   EXPECT_FALSE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
   link->OnKeyPressed(ui::KeyEvent(ui::ET_KEY_PRESSED, ui::VKEY_SPACE, 0));
 
+  ASSERT_TRUE(widget_);
   EXPECT_TRUE(widget_->IsClosed());
-  EXPECT_FALSE(widget_destroyed_);
 
   EXPECT_EQ(1, tabs->count());
   content::WebContents* web_contents = tabs->GetWebContentsAt(0);
@@ -229,5 +259,44 @@
   EXPECT_EQ(GURL(url), web_contents->GetURL());
 
   base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(widget_destroyed_);
+  EXPECT_FALSE(widget_);
 }
+
+#if defined(OS_CHROMEOS)
+TEST_F(AppInfoDialogViewsTest, ArcAppInfoLinks) {
+  ShowAppInfo(extension_misc::kChromeAppId);
+  EXPECT_FALSE(widget_->IsClosed());
+  // App Info should not have ARC App info links section because ARC Settings
+  // app is not available yet.
+  EXPECT_FALSE(dialog_->arc_app_info_links_for_test());
+
+  // Re-show App Info but with ARC Settings app enabled.
+  CloseAppInfo();
+  ArcAppListPrefs* arc_prefs =
+      ArcAppListPrefs::Get(extension_environment_.profile());
+  ASSERT_TRUE(arc_prefs);
+  arc::mojom::AppHost* app_host = arc_prefs;
+  app_host->OnAppListRefreshed(GetArcSettingsAppInfo());
+  EXPECT_TRUE(arc_prefs->IsRegistered(arc::kSettingsAppId));
+  ShowAppInfo(extension_misc::kChromeAppId);
+  EXPECT_FALSE(widget_->IsClosed());
+  EXPECT_TRUE(dialog_->arc_app_info_links_for_test());
+
+  // Re-show App Info but for non-primary profile.
+  CloseAppInfo();
+  std::unique_ptr<TestingProfile> other_profile =
+      base::MakeUnique<TestingProfile>();
+  extension_environment_.CreateExtensionServiceForProfile(other_profile.get());
+  scoped_refptr<const extensions::Extension> other_app =
+      extension_environment_.MakePackagedApp(extension_misc::kChromeAppId,
+                                             true);
+  extensions::ExtensionSystem::Get(other_profile.get())
+      ->extension_service()
+      ->AddExtension(other_app.get());
+  ShowAppInfoForProfile(extension_misc::kChromeAppId, other_profile.get());
+  EXPECT_FALSE(widget_->IsClosed());
+  // The ARC App info links are not available if ARC is not allowed for
+  // secondary profile.
+  EXPECT_FALSE(dialog_->arc_app_info_links_for_test());
+}
+#endif
diff --git a/chrome/browser/ui/views/payments/payment_request_views_util.h b/chrome/browser/ui/views/payments/payment_request_views_util.h
index 5622023..de9c6a3bf 100644
--- a/chrome/browser/ui/views/payments/payment_request_views_util.h
+++ b/chrome/browser/ui/views/payments/payment_request_views_util.h
@@ -24,6 +24,9 @@
 
 constexpr int kPaymentRequestRowHorizontalInsets = 14;
 constexpr int kPaymentRequestRowVerticalInsets = 8;
+// Extra inset relative to the header when a right edge should line up with the
+// close button's X rather than its invisible right edge.
+constexpr int kPaymentRequestRowExtraRightInset = 8;
 
 enum class PaymentRequestCommonTags {
   BACK_BUTTON_TAG = 0,
diff --git a/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc b/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
index 9c7db212..95fc1af 100644
--- a/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
+++ b/chrome/browser/ui/views/payments/payment_sheet_view_controller.cc
@@ -106,11 +106,10 @@
 
   // The rows have extra inset compared to the header so that their right edge
   // lines up with the close button's X rather than its invisible right edge.
-  constexpr int kRowExtraRightInset = 8;
-  layout->SetInsets(kPaymentRequestRowVerticalInsets,
-                    kPaymentRequestRowHorizontalInsets,
-                    kPaymentRequestRowVerticalInsets,
-                    kPaymentRequestRowHorizontalInsets + kRowExtraRightInset);
+  layout->SetInsets(
+      kPaymentRequestRowVerticalInsets, kPaymentRequestRowHorizontalInsets,
+      kPaymentRequestRowVerticalInsets,
+      kPaymentRequestRowHorizontalInsets + kPaymentRequestRowExtraRightInset);
   row->SetLayoutManager(layout);
 
   views::ColumnSet* columns = layout->AddColumnSet(0);
diff --git a/chrome/browser/ui/views/payments/shipping_list_view_controller.cc b/chrome/browser/ui/views/payments/shipping_list_view_controller.cc
index ccf6155e..5109745f 100644
--- a/chrome/browser/ui/views/payments/shipping_list_view_controller.cc
+++ b/chrome/browser/ui/views/payments/shipping_list_view_controller.cc
@@ -8,11 +8,13 @@
 #include <utility>
 
 #include "chrome/browser/ui/views/payments/payment_request_dialog_view.h"
+#include "chrome/browser/ui/views/payments/payment_request_row_view.h"
 #include "chrome/browser/ui/views/payments/payment_request_views_util.h"
 #include "components/payments/payment_request.h"
 #include "components/strings/grit/components_strings.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/views/layout/box_layout.h"
+#include "ui/views/layout/grid_layout.h"
 
 namespace payments {
 
@@ -36,8 +38,8 @@
   for (auto* profile : request()->shipping_profiles()) {
     // TODO(tmartino): Pass an actual locale in place of empty string.
     content_view->AddChildView(
-        GetShippingAddressLabel(AddressStyleType::DETAILED, std::string(),
-                                *profile)
+        CreateAddressRow(GetShippingAddressLabel(AddressStyleType::DETAILED,
+                                                 std::string(), *profile))
             .release());
   }
 
@@ -49,4 +51,28 @@
       std::move(content_view));
 }
 
+std::unique_ptr<views::Button> ShippingListViewController::CreateAddressRow(
+    std::unique_ptr<views::View> content) {
+  std::unique_ptr<PaymentRequestRowView> row =
+      base::MakeUnique<PaymentRequestRowView>(this);
+  views::GridLayout* layout = new views::GridLayout(row.get());
+  row->SetLayoutManager(layout);
+
+  layout->SetInsets(
+      kPaymentRequestRowVerticalInsets, kPaymentRequestRowHorizontalInsets,
+      kPaymentRequestRowVerticalInsets,
+      kPaymentRequestRowHorizontalInsets + kPaymentRequestRowExtraRightInset);
+
+  // Add a column listing the address.
+  views::ColumnSet* columns = layout->AddColumnSet(0);
+  columns->AddColumn(views::GridLayout::FILL, views::GridLayout::FILL, 1,
+                     views::GridLayout::USE_PREF, 0, 0);
+
+  layout->StartRow(0, 0);
+  content->set_can_process_events_within_subtree(false);
+  layout->AddView(content.release());
+
+  return std::move(row);
+}
+
 }  // namespace payments
diff --git a/chrome/browser/ui/views/payments/shipping_list_view_controller.h b/chrome/browser/ui/views/payments/shipping_list_view_controller.h
index 971570a..22b4ae5 100644
--- a/chrome/browser/ui/views/payments/shipping_list_view_controller.h
+++ b/chrome/browser/ui/views/payments/shipping_list_view_controller.h
@@ -26,6 +26,9 @@
   std::unique_ptr<views::View> CreateView() override;
 
  private:
+  std::unique_ptr<views::Button> CreateAddressRow(
+      std::unique_ptr<views::View> content);
+
   DISALLOW_COPY_AND_ASSIGN(ShippingListViewController);
 };
 
diff --git a/chrome/browser/ui/views/toolbar/app_menu.cc b/chrome/browser/ui/views/toolbar/app_menu.cc
index 6d940d5..c55221d 100644
--- a/chrome/browser/ui/views/toolbar/app_menu.cc
+++ b/chrome/browser/ui/views/toolbar/app_menu.cc
@@ -857,7 +857,9 @@
 }
 
 bool AppMenu::GetShouldUseNormalForegroundColor(int command_id) const {
-  return IsRecentTabsCommand(command_id);
+  // Use the normal foreground color instead of the disabled color for the
+  // recent tab headers. Only the headers from that submenu have font lists.
+  return IsRecentTabsCommand(command_id) && GetLabelFontList(command_id);
 }
 
 base::string16 AppMenu::GetTooltipText(int command_id,
diff --git a/chrome/browser/ui/webui/bidi_checker_web_ui_test.cc b/chrome/browser/ui/webui/bidi_checker_web_ui_test.cc
index cee30a6..1b8ffc0 100644
--- a/chrome/browser/ui/webui/bidi_checker_web_ui_test.cc
+++ b/chrome/browser/ui/webui/bidi_checker_web_ui_test.cc
@@ -433,6 +433,7 @@
   RunBidiCheckerOnPage(url);
 }
 
+#if !defined(OS_CHROMEOS)
 //========================================
 // chrome://settings-frame/manageProfile
 //========================================
@@ -450,6 +451,7 @@
   url += chrome::kManageProfileSubPage;
   RunBidiCheckerOnPage(url);
 }
+#endif  // !defined(OS_CHROMEOS)
 
 //===================================================
 // chrome://settings-frame/contentExceptions#cookies
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 9f4fc0d..0078484 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -713,7 +713,8 @@
     {"powerwashDialogButton", IDS_SETTINGS_RESTART},
     {"powerwashLearnMoreUrl", IDS_FACTORY_RESET_HELP_URL},
 #endif
-    // Automatic reset banner.
+    // Automatic reset banner (now a dialog).
+    {"resetAutomatedDialogTitle", IDS_SETTINGS_RESET_AUTOMATED_DIALOG_TITLE},
     {"resetProfileBannerButton",
      IDS_AUTOMATIC_SETTINGS_RESET_BANNER_RESET_BUTTON_TEXT},
     {"resetProfileBannerDescription", IDS_AUTOMATIC_SETTINGS_RESET_BANNER_TEXT},
@@ -1632,6 +1633,12 @@
     {"siteSettingsPopups", IDS_SETTINGS_SITE_SETTINGS_POPUPS},
     {"siteSettingsUnsandboxedPlugins",
      IDS_SETTINGS_SITE_SETTINGS_UNSANDBOXED_PLUGINS},
+    {"siteSettingsMidiDevices", IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES},
+    {"siteSettingsMidiDevicesAsk", IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_ASK},
+    {"siteSettingsMidiDevicesAskRecommended",
+     IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_ASK_RECOMMENDED},
+    {"siteSettingsMidiDevicesBlock",
+     IDS_SETTINGS_SITE_SETTINGS_MIDI_DEVICES_BLOCK},
     {"siteSettingsUsbDevices", IDS_SETTINGS_SITE_SETTINGS_USB_DEVICES},
     {"siteSettingsZoomLevels", IDS_SETTINGS_SITE_SETTINGS_ZOOM_LEVELS},
     {"siteSettingsNoZoomedSites", IDS_SETTINGS_SITE_SETTINGS_NO_ZOOMED_SITES},
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index eb72147..4f62bd8 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -97,7 +97,7 @@
 // Enables Expect CT reporting, which sends reports for opted-in sites
 // that don't serve sufficient Certificate Transparency information.
 const base::Feature kExpectCTReporting{"ExpectCTReporting",
-                                       base::FEATURE_DISABLED_BY_DEFAULT};
+                                       base::FEATURE_ENABLED_BY_DEFAULT};
 
 // An experimental fullscreen prototype that allows pages to map browser and
 // system-reserved keyboard shortcuts.
diff --git a/chrome/common/extensions/api/webview_tag.json b/chrome/common/extensions/api/webview_tag.json
index 0263954..7692c7a 100644
--- a/chrome/common/extensions/api/webview_tag.json
+++ b/chrome/common/extensions/api/webview_tag.json
@@ -32,6 +32,8 @@
           "appcache": { "type": "boolean", "optional": true, "description": "Websites' appcaches." },
           "cache": { "type": "boolean", "optional": true, "description": "Since Chrome 43.<br>The browser's cache. Note: when removing data, this clears the entire cache; it is not limited to the range you specify." },
           "cookies": { "type": "boolean", "optional": true, "description": "The partition's cookies." },
+          "sessionCookies": { "type": "boolean", "optional": true, "description": "The partition's session cookies." },
+          "persistentCookies": { "type": "boolean", "optional": true, "description": "The partition's persistent cookies." },
           "fileSystems": { "type": "boolean", "optional": true, "description": "Websites' filesystems." },
           "indexedDB": { "type": "boolean", "optional": true, "description": "Websites' IndexedDB data." },
           "localStorage": { "type": "boolean", "optional": true, "description": "Websites' local storage data." },
diff --git a/chrome/common/service_process_util_posix.cc b/chrome/common/service_process_util_posix.cc
index b372856..451f395 100644
--- a/chrome/common/service_process_util_posix.cc
+++ b/chrome/common/service_process_util_posix.cc
@@ -80,7 +80,8 @@
   }
 }
 
-ServiceProcessState::StateData::StateData() : set_action(false) {
+ServiceProcessState::StateData::StateData()
+    : watcher(FROM_HERE), set_action(false) {
   memset(sockets, -1, sizeof(sockets));
   memset(&old_action, 0, sizeof(old_action));
 }
diff --git a/chrome/common/url_constants.cc b/chrome/common/url_constants.cc
index 40612f8..aa45e9b 100644
--- a/chrome/common/url_constants.cc
+++ b/chrome/common/url_constants.cc
@@ -352,20 +352,21 @@
 #endif
 #endif
 
-// Option sub pages.
-// Add sub page paths to kChromeSettingsSubPages in builtin_provider.cc to be
-// listed by the built-in AutocompleteProvider.
+// Settings sub pages.
+
+// NOTE: Add sub page paths to kChromeSettingsSubPages in
+// chrome_autocomplete_provider_client.cc to be listed by the built-in
+// AutocompleteProvider.
+
 const char kAutofillSubPage[] = "autofill";
 const char kClearBrowserDataSubPage[] = "clearBrowserData";
 const char kContentSettingsSubPage[] = "content";
-const char kCreateProfileSubPage[] = "createProfile";
 const char kDeprecatedOptionsContentSettingsExceptionsSubPage[] =
     "contentExceptions";
-const char kExtensionsSubPage[] = "extensions";
+const char kDeprecatedExtensionsSubPage[] = "extensions";
 const char kHandlerSettingsSubPage[] = "handlers";
 const char kImportDataSubPage[] = "importData";
 const char kLanguageOptionsSubPage[] = "languages";
-const char kManageProfileSubPage[] = "manageProfile";
 const char kPasswordManagerSubPage[] = "passwords";
 const char kResetProfileSettingsSubPage[] = "resetProfileSettings";
 const char kSearchEnginesSubPage[] = "searchEngines";
@@ -375,11 +376,17 @@
     "triggeredResetProfileSettings";
 #if defined(OS_CHROMEOS)
 const char kAccessibilitySubPage[] = "accessibility";
-const char kBluetoothSubPage[] = "bluetooth";
+const char kBluetoothSubPage[] = "bluetoothDevices";
 const char kDateTimeSubPage[] = "dateTime";
 const char kDeprecatedOptionsSearchSubPage[] = "search";
-const char kInternetOptionsSubPage[] = "internet";
-const char kPowerOptionsSubPage[] = "power-overlay";
+const char kDisplaySubPage[] = "display";
+const char kInternetSubPage[] = "internet";
+const char kNetworkDetailSubPage[] = "networkDetail";
+const char kPowerSubPage[] = "power";
+const char kStylusSubPage[] = "stylus";
+#else
+const char kCreateProfileSubPage[] = "createProfile";
+const char kManageProfileSubPage[] = "manageProfile";
 #endif
 
 // Extension sub pages.
diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
index 21bb703..6448961 100644
--- a/chrome/common/url_constants.h
+++ b/chrome/common/url_constants.h
@@ -335,7 +335,7 @@
 extern const char kContentSettingsSubPage[];
 extern const char kCreateProfileSubPage[];
 extern const char kDeprecatedOptionsContentSettingsExceptionsSubPage[];
-extern const char kExtensionsSubPage[];
+extern const char kDeprecatedExtensionsSubPage[];
 extern const char kHandlerSettingsSubPage[];
 extern const char kImportDataSubPage[];
 extern const char kLanguageOptionsSubPage[];
@@ -350,9 +350,12 @@
 extern const char kAccessibilitySubPage[];
 extern const char kBluetoothSubPage[];
 extern const char kDateTimeSubPage[];
+extern const char kDisplaySubPage[];
 extern const char kDeprecatedOptionsSearchSubPage[];
-extern const char kInternetOptionsSubPage[];
-extern const char kPowerOptionsSubPage[];
+extern const char kInternetSubPage[];
+extern const char kNetworkDetailSubPage[];
+extern const char kPowerSubPage[];
+extern const char kStylusSubPage[];
 #endif
 
 // Extensions sub pages.
diff --git a/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/bootstrap.js b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/bootstrap.js
new file mode 100644
index 0000000..bdb7fdb
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/bootstrap.js
@@ -0,0 +1,69 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+config.IS_CHROME_TEST = true;
+// Guest served from TestServer.
+config.IS_JS_ONLY_GUEST = false;
+config.TEST_DIR = 'cleardata_persistent';
+
+var clearDataTests = {};
+
+// step1. Ask guest to load load session (bar) and persistent (foo) cookies.
+// step2. Guest responds saying it has added cookies.
+// embedder clears persistent cookie data of the guest via clearData API.
+// step3. Ask guest for cookies that were set in step1.
+// step4. Guest responds with cookie values, embedder verifies persistent cookie
+// is unset but session cookie is still set.
+
+var run = function() {
+  var container = document.createElement('div');
+  container.id = 'webview-tag-container';
+  document.body.appendChild(container);
+
+  chrome.test.getConfig(function(chromeConfig) {
+    window.console.log('getConfig: ' + chromeConfig);
+    utils.setUp(chromeConfig, config);
+    embedder.loadGuest(function() {
+      chrome.test.runTests([
+        clearDataTests.testCookies
+      ]);
+    }, function(data) {
+      var handled = true;
+      switch (data[0]) {
+        case 'step2.cookies-added':
+          window.console.log('embedder, on message: ' + data[0]);
+          var onDataCleared = function() {
+            window.console.log('embedder.onDataCleared');
+            embedder.webview.contentWindow.postMessage(
+                JSON.stringify(['step3.get-cookies', 'foo', 'bar']), '*');
+          };
+          embedder.webview.clearData(
+              { 'since': 1 }, { 'persistentCookies': true },
+              onDataCleared);
+          break;
+        case 'step4.got-cookies':
+          window.console.log('embedder, on message: ' + data[0]);
+          var cookies = data[1];
+          // fooValue was a persistent cookie, which should be gone.
+          chrome.test.assertEq([null, 'barValue'], cookies);
+          chrome.test.succeed();
+          break;
+        default:
+          handled = false;
+          break;
+      }
+      return handled;
+    });
+  });
+};
+
+// Tests.
+clearDataTests.testCookies = function testCookies() {
+  window.console.log('clearDataTests.testCookies');
+  embedder.webview.contentWindow.postMessage(
+      JSON.stringify(['step1.add-cookies']), '*');
+};
+
+// Run test(s).
+run();
diff --git a/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/guest.html b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/guest.html
new file mode 100644
index 0000000..06b3449
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_persistent/guest.html
@@ -0,0 +1,95 @@
+<!doctype html>
+<!--
+ * Copyright 2017 The Chromium Authors. All rights reserved.  Use of this
+ * source code is governed by a BSD-style license that can be found in the
+ * LICENSE file.
+-->
+<html>
+  <head>
+    <script type="text/javascript">
+      // A guest that stores and deletes cookies.
+      // Note that the embedder has to initiate a postMessage first so that
+      // the guest has a reference to the embedder's window.
+
+      // The window reference of the embedder to send post message reply.
+      var embedderWindowChannel = null;
+
+      // A value that uniquely identifies the guest sending the messages to the
+      // embedder.
+      var channelId = 0;
+      var notifyEmbedder = function (msgArray) {
+        var msg = msgArray.concat([channelId]);
+        embedderWindowChannel.postMessage(JSON.stringify(msg), '*');
+      };
+
+      var SPLIT_RE_ = /\s*;\s*/;
+      var setCookie = function(name, value) { // Just a random future time.
+        var futureDate = new Date((+new Date) + 10000 * 1000);
+        document.cookie =
+            name + '=' + value + ';expires=' + futureDate.toUTCString();
+      };
+      var setSessionCookie = function (name, value) { // Session cookie.
+          document.cookie = name + '=' + value;
+      };
+      var getCookie = function (name) {
+        var nameEq = name + '=';
+        var parts = (document.cookie || '').split(SPLIT_RE_);
+        for (var i = 0; i < parts.length; ++i) {
+          var part = parts[i];
+          if (part.startsWith(nameEq)) {
+            return part.substr(nameEq.length);
+          }
+          if (part == name) {
+            return '';
+          }
+        }
+        return undefined;
+      };
+
+      var addCookies = function() {
+        window.console.log('setCookie: foo = fooValue');
+        setCookie('foo', 'fooValue');
+        window.console.log('setSessionCookie: bar = barValue');
+        setSessionCookie('bar', 'barValue');
+        notifyEmbedder(['step2.cookies-added']);
+      };
+
+      var onPostMessageReceived = function(e) {
+        embedderWindowChannel = e.source;
+        var data = JSON.parse(e.data);
+        if (data[0] == 'create-channel') {
+          window.console.log('guest: create-channel');
+          channelId = data[1];
+          notifyEmbedder(['channel-created']);
+          return;
+        }
+
+        window.console.log('guest.onPostMessageReceived: ' + data[0]);
+        // Tests.
+        // These logs trigger event listeners in the embedder.
+        switch (data[0]) {
+          case 'step1.add-cookies':
+            window.console.log('guest.' + data[0]);
+            addCookies();
+            break;
+          case 'step3.get-cookies':
+            window.console.log('guest.' + data[0]);
+            var retValues = ['step4.got-cookies'];
+            var cookieValues = [];
+            for (var i = 1; i < data.length; ++i) {
+              cookieValues.push(getCookie(data[i]));
+            }
+            retValues.push(cookieValues);
+            notifyEmbedder(retValues);
+            break;
+          default:
+            break;
+        }
+      };
+      window.addEventListener('message', onPostMessageReceived, false);
+    </script>
+  </head>
+  <body>
+    <div>Guest that stores and retrieves certain cookies.</div>
+  </body>
+</html>
diff --git a/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/bootstrap.js b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/bootstrap.js
new file mode 100644
index 0000000..11c7ce27b
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/bootstrap.js
@@ -0,0 +1,69 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+config.IS_CHROME_TEST = true;
+// Guest served from TestServer.
+config.IS_JS_ONLY_GUEST = false;
+config.TEST_DIR = 'cleardata_session';
+
+var clearDataTests = {};
+
+// step1. Ask guest to load load session (bar) and persistent (foo) cookies.
+// step2. Guest responds saying it has added cookies.
+// embedder clears session cookie data of the guest via clearData API.
+// step3. Ask guest for cookies that were set in step1.
+// step4. Guest responds with cookie values, embedder verifies session cookie is
+// unset but persistent cookie is still set.
+
+var run = function() {
+  var container = document.createElement('div');
+  container.id = 'webview-tag-container';
+  document.body.appendChild(container);
+
+  chrome.test.getConfig(function(chromeConfig) {
+    window.console.log('getConfig: ' + chromeConfig);
+    utils.setUp(chromeConfig, config);
+    embedder.loadGuest(function() {
+      chrome.test.runTests([
+        clearDataTests.testCookies
+      ]);
+    }, function(data) {
+      var handled = true;
+      switch (data[0]) {
+        case 'step2.cookies-added':
+          window.console.log('embedder, on message: ' + data[0]);
+          var onDataCleared = function() {
+            window.console.log('embedder.onDataCleared');
+            embedder.webview.contentWindow.postMessage(
+                JSON.stringify(['step3.get-cookies', 'foo', 'bar']), '*');
+          };
+          embedder.webview.clearData(
+              { 'since': 1 }, { 'sessionCookies': true },
+              onDataCleared);
+          break;
+        case 'step4.got-cookies':
+          window.console.log('embedder, on message: ' + data[0]);
+          var cookies = data[1];
+          // barValue was a session cookie, which should be gone.
+          chrome.test.assertEq(['fooValue', null], cookies);
+          chrome.test.succeed();
+          break;
+        default:
+          handled = false;
+          break;
+      }
+      return handled;
+    });
+  });
+};
+
+// Tests.
+clearDataTests.testCookies = function testCookies() {
+  window.console.log('clearDataTests.testCookies');
+  embedder.webview.contentWindow.postMessage(
+      JSON.stringify(['step1.add-cookies']), '*');
+};
+
+// Run test(s).
+run();
diff --git a/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/guest.html b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/guest.html
new file mode 100644
index 0000000..37d2be0
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/web_view/common/cleardata_session/guest.html
@@ -0,0 +1,95 @@
+<!doctype html>
+<!--
+ * Copyright 2017 The Chromium Authors. All rights reserved.  Use of this
+ * source code is governed by a BSD-style license that can be found in the
+ * LICENSE file.
+-->
+<html>
+  <head>
+    <script type="text/javascript">
+      // A guest that stores and deletes cookies.
+      // Note that the embedder has to initiate a postMessage first so that
+      // the guest has a reference to the embedder's window.
+
+      // The window reference of the embedder to send post message reply.
+      var embedderWindowChannel = null;
+
+      // A value that uniquely identifies the guest sending the messages to the
+      // embedder.
+      var channelId = 0;
+      var notifyEmbedder = function(msgArray) {
+        var msg = msgArray.concat([channelId]);
+        embedderWindowChannel.postMessage(JSON.stringify(msg), '*');
+      };
+
+      var SPLIT_RE_ = /\s*;\s*/;
+      var setCookie = function(name, value) { // Just a random future time.
+        var futureDate = new Date((+new Date) + 10000 * 1000);
+        document.cookie =
+            name + '=' + value + ';expires=' + futureDate.toUTCString();
+      };
+      var setSessionCookie = function (name, value) { // Session cookie.
+          document.cookie = name + '=' + value;
+      };
+      var getCookie = function (name) {
+        var nameEq = name + '=';
+        var parts = (document.cookie || '').split(SPLIT_RE_);
+        for (var i = 0; i < parts.length; ++i) {
+          var part = parts[i];
+          if (part.startsWith(nameEq)) {
+            return part.substr(nameEq.length);
+          }
+          if (part == name) {
+            return '';
+          }
+        }
+        return undefined;
+      };
+
+      var addCookies = function() {
+        window.console.log('setCookie: foo = fooValue');
+        setCookie('foo', 'fooValue');
+        window.console.log('setSessionCookie: bar = barValue');
+        setSessionCookie('bar', 'barValue');
+        notifyEmbedder(['step2.cookies-added']);
+      };
+
+      var onPostMessageReceived = function(e) {
+        embedderWindowChannel = e.source;
+        var data = JSON.parse(e.data);
+        if (data[0] == 'create-channel') {
+          window.console.log('guest: create-channel');
+          channelId = data[1];
+          notifyEmbedder(['channel-created']);
+          return;
+        }
+
+        window.console.log('guest.onPostMessageReceived: ' + data[0]);
+        // Tests.
+        // These logs trigger event listeners in the embedder.
+        switch (data[0]) {
+          case 'step1.add-cookies':
+            window.console.log('guest.' + data[0]);
+            addCookies();
+            break;
+          case 'step3.get-cookies':
+            window.console.log('guest.' + data[0]);
+            var retValues = ['step4.got-cookies'];
+            var cookieValues = [];
+            for (var i = 1; i < data.length; ++i) {
+              cookieValues.push(getCookie(data[i]));
+            }
+            retValues.push(cookieValues);
+            notifyEmbedder(retValues);
+            break;
+          default:
+            break;
+        }
+      };
+      window.addEventListener('message', onPostMessageReceived, false);
+    </script>
+  </head>
+  <body>
+    <div>Guest that stores and retrieves certain cookies.</div>
+  </body>
+</html>
diff --git a/chrome/test/data/webui/settings/reset_profile_banner_test.js b/chrome/test/data/webui/settings/reset_profile_banner_test.js
index 811bc99..a01829a 100644
--- a/chrome/test/data/webui/settings/reset_profile_banner_test.js
+++ b/chrome/test/data/webui/settings/reset_profile_banner_test.js
@@ -12,40 +12,26 @@
     PolymerTest.clearBody();
     resetBanner = document.createElement('settings-reset-profile-banner');
     document.body.appendChild(resetBanner);
+    assertTrue(resetBanner.$.dialog.open);
   });
 
   teardown(function() { resetBanner.remove(); });
 
-  // Tests that the reset profile banner
-  //  - opens the reset profile dialog when the reset button is clicked.
-  //  - reset happens when clicking on the dialog's reset button.
-  //  - the reset profile dialog is closed after reset is done.
+  // Tests that the reset profile banner navigates to the Reset profile dialog
+  // URL when the "reset all settings" button is clicked.
   test('ResetBannerReset', function() {
-    var dialog = resetBanner.$$('settings-reset-profile-dialog');
-    assertFalse(!!dialog);
+    assertNotEquals(settings.Route.RESET_DIALOG, settings.getCurrentRoute());
     MockInteractions.tap(resetBanner.$.reset);
-    Polymer.dom.flush();
-    assertTrue(resetBanner.showResetProfileDialog_)
-    dialog = resetBanner.$$('settings-reset-profile-dialog');
-    assertTrue(!!dialog);
-
-    MockInteractions.tap(dialog.$.reset);
-
-    return browserProxy.whenCalled('performResetProfileSettings')
-        .then(PolymerTest.flushTasks)
-        .then(function() {
-          assertFalse(resetBanner.showResetProfileDialog_);
-          dialog = resetBanner.$$('settings-reset-profile-dialog');
-          assertFalse(!!dialog);
-        });
+    assertEquals(settings.Route.RESET_DIALOG, settings.getCurrentRoute());
+    assertFalse(resetBanner.$.dialog.open);
   });
 
-  // Tests that the reset profile banner removes itself from the DOM when
-  // the close button is clicked and that |onHideResetProfileBanner| is
-  // called.
-  test('ResetBannerClose', function() {
-    MockInteractions.tap(resetBanner.$.close);
-    assertFalse(!!resetBanner.parentNode);
-    return browserProxy.whenCalled('onHideResetProfileBanner');
+  // Tests that the reset profile banner closes itself when the OK button is
+  // clicked and that |onHideResetProfileBanner| is called.
+  test('ResetBannerOk', function() {
+    MockInteractions.tap(resetBanner.$.ok);
+    return browserProxy.whenCalled('onHideResetProfileBanner').then(function() {
+      assertFalse(resetBanner.$.dialog.open);
+    });
   });
 });
diff --git a/chrome/test/data/webui/settings/site_list_tests.js b/chrome/test/data/webui/settings/site_list_tests.js
index b3017cb..5fc88f6 100644
--- a/chrome/test/data/webui/settings/site_list_tests.js
+++ b/chrome/test/data/webui/settings/site_list_tests.js
@@ -59,6 +59,7 @@
           images: [],
           javascript: [],
           mic: [],
+          midiDevices: [],
           notifications: [],
           plugins: [],
           protectedContent: [],
@@ -151,6 +152,7 @@
           mic: [],
           notifications: [],
           plugins: [],
+          midiDevices: [],
           protectedContent: [],
           popups: [],
           unsandboxed_plugins: [],
@@ -185,6 +187,7 @@
           images: [],
           javascript: [],
           mic: [],
+          midiDevices: [],
           notifications: [
             {
               embeddingOrigin: 'https://google.com',
diff --git a/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js b/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js
index 49fae51..dd9abed 100644
--- a/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js
+++ b/chrome/test/data/webui/settings/test_site_settings_prefs_browser_proxy.js
@@ -15,6 +15,7 @@
     geolocation: '',
     javascript: '',
     mic: '',
+    midiDevices: '',
     notifications: '',
     plugins: '',
     popups: '',
@@ -28,6 +29,7 @@
     geolocation: [],
     javascript: [],
     mic: [],
+    midiDevices: [],
     notifications: [],
     plugins: [],
     popups: [],
@@ -165,6 +167,8 @@
       pref = this.prefs_.defaults.javascript;
     } else if (contentType == settings.ContentSettingsTypes.MIC) {
       pref = this.prefs_.defaults.mic;
+    } else if (contentType == settings.ContentSettingsTypes.MIDI_DEVICES) {
+      pref = this.prefs_.defaults.midiDevices;
     } else if (contentType == settings.ContentSettingsTypes.NOTIFICATIONS) {
       pref = this.prefs_.defaults.notifications;
     } else if (contentType == settings.ContentSettingsTypes.PDF_DOCUMENTS) {
@@ -205,6 +209,8 @@
       pref = this.prefs_.exceptions.javascript;
     else if (contentType == settings.ContentSettingsTypes.MIC)
       pref = this.prefs_.exceptions.mic;
+    else if (contentType == settings.ContentSettingsTypes.MIDI_DEVICES)
+      pref = this.prefs_.exceptions.midiDevices;
     else if (contentType == settings.ContentSettingsTypes.NOTIFICATIONS)
       pref = this.prefs_.exceptions.notifications;
     else if (contentType == settings.ContentSettingsTypes.PDF_DOCUMENTS)
diff --git a/chrome_elf/BUILD.gn b/chrome_elf/BUILD.gn
index c2861e0f6..53a29c8 100644
--- a/chrome_elf/BUILD.gn
+++ b/chrome_elf/BUILD.gn
@@ -53,9 +53,6 @@
   configs += [ "//build/config/win:windowed" ]
   configs -= [ "//build/config/win:console" ]
 
-  # Turn on CFG for this project.
-  configs += [ "//build/config/win:win_msvc_cfg" ]
-
   # Delay loads in this list will prevent user32.dll
   # from loading too early.
   ldflags = [
diff --git a/chromecast/media/cma/base/decoder_config_adapter.cc b/chromecast/media/cma/base/decoder_config_adapter.cc
index d9039b29..b86e65b 100644
--- a/chromecast/media/cma/base/decoder_config_adapter.cc
+++ b/chromecast/media/cma/base/decoder_config_adapter.cc
@@ -273,62 +273,5 @@
   return video_config;
 }
 
-// Ensure that Chromecast enum values match enums in gfx::ColorSpace.
-#define STATIC_ASSERT_ENUM(a, b)                                             \
-  static_assert(static_cast<int>(a) == static_cast<int>(gfx::ColorSpace::b), \
-                "mismatching enums: " #a " and " #b)
-
-STATIC_ASSERT_ENUM(PrimaryID::RESERVED0, PrimaryID::RESERVED0);
-STATIC_ASSERT_ENUM(PrimaryID::BT709, PrimaryID::BT709);
-STATIC_ASSERT_ENUM(PrimaryID::UNSPECIFIED, PrimaryID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(PrimaryID::RESERVED, PrimaryID::RESERVED);
-STATIC_ASSERT_ENUM(PrimaryID::BT470M, PrimaryID::BT470M);
-STATIC_ASSERT_ENUM(PrimaryID::BT470BG, PrimaryID::BT470BG);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTE170M, PrimaryID::SMPTE170M);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTE240M, PrimaryID::SMPTE240M);
-STATIC_ASSERT_ENUM(PrimaryID::FILM, PrimaryID::FILM);
-STATIC_ASSERT_ENUM(PrimaryID::BT2020, PrimaryID::BT2020);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTEST428_1, PrimaryID::SMPTEST428_1);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTEST431_2, PrimaryID::SMPTEST431_2);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTEST431_2, PrimaryID::SMPTEST431_2);
-STATIC_ASSERT_ENUM(PrimaryID::SMPTEST432_1, PrimaryID::SMPTEST432_1);
-
-STATIC_ASSERT_ENUM(TransferID::RESERVED0, TransferID::RESERVED0);
-STATIC_ASSERT_ENUM(TransferID::BT709, TransferID::BT709);
-STATIC_ASSERT_ENUM(TransferID::UNSPECIFIED, TransferID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(TransferID::RESERVED, TransferID::RESERVED);
-STATIC_ASSERT_ENUM(TransferID::GAMMA22, TransferID::GAMMA22);
-STATIC_ASSERT_ENUM(TransferID::GAMMA28, TransferID::GAMMA28);
-STATIC_ASSERT_ENUM(TransferID::SMPTE170M, TransferID::SMPTE170M);
-STATIC_ASSERT_ENUM(TransferID::SMPTE240M, TransferID::SMPTE240M);
-STATIC_ASSERT_ENUM(TransferID::LINEAR, TransferID::LINEAR);
-STATIC_ASSERT_ENUM(TransferID::LOG, TransferID::LOG);
-STATIC_ASSERT_ENUM(TransferID::LOG_SQRT, TransferID::LOG_SQRT);
-STATIC_ASSERT_ENUM(TransferID::IEC61966_2_4, TransferID::IEC61966_2_4);
-STATIC_ASSERT_ENUM(TransferID::BT1361_ECG, TransferID::BT1361_ECG);
-STATIC_ASSERT_ENUM(TransferID::IEC61966_2_1, TransferID::IEC61966_2_1);
-STATIC_ASSERT_ENUM(TransferID::BT2020_10, TransferID::BT2020_10);
-STATIC_ASSERT_ENUM(TransferID::BT2020_12, TransferID::BT2020_12);
-STATIC_ASSERT_ENUM(TransferID::SMPTEST2084, TransferID::SMPTEST2084);
-STATIC_ASSERT_ENUM(TransferID::SMPTEST428_1, TransferID::SMPTEST428_1);
-STATIC_ASSERT_ENUM(TransferID::ARIB_STD_B67, TransferID::ARIB_STD_B67);
-
-STATIC_ASSERT_ENUM(MatrixID::RGB, MatrixID::RGB);
-STATIC_ASSERT_ENUM(MatrixID::BT709, MatrixID::BT709);
-STATIC_ASSERT_ENUM(MatrixID::UNSPECIFIED, MatrixID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(MatrixID::RESERVED, MatrixID::RESERVED);
-STATIC_ASSERT_ENUM(MatrixID::FCC, MatrixID::FCC);
-STATIC_ASSERT_ENUM(MatrixID::BT470BG, MatrixID::BT470BG);
-STATIC_ASSERT_ENUM(MatrixID::SMPTE170M, MatrixID::SMPTE170M);
-STATIC_ASSERT_ENUM(MatrixID::SMPTE240M, MatrixID::SMPTE240M);
-STATIC_ASSERT_ENUM(MatrixID::YCOCG, MatrixID::YCOCG);
-STATIC_ASSERT_ENUM(MatrixID::BT2020_NCL, MatrixID::BT2020_NCL);
-STATIC_ASSERT_ENUM(MatrixID::BT2020_CL, MatrixID::BT2020_CL);
-
-STATIC_ASSERT_ENUM(RangeID::UNSPECIFIED, RangeID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(RangeID::LIMITED, RangeID::LIMITED);
-STATIC_ASSERT_ENUM(RangeID::FULL, RangeID::FULL);
-STATIC_ASSERT_ENUM(RangeID::DERIVED, RangeID::DERIVED);
-
 }  // namespace media
 }  // namespace chromecast
diff --git a/chromeos/binder/ipc_thread.cc b/chromeos/binder/ipc_thread.cc
index d67f9aa..6fb9822 100644
--- a/chromeos/binder/ipc_thread.cc
+++ b/chromeos/binder/ipc_thread.cc
@@ -11,7 +11,10 @@
 
 // IpcThreadPoller
 IpcThreadPoller::IpcThreadPoller(ThreadType type, Driver* driver)
-    : type_(type), driver_(driver), command_broker_(driver) {}
+    : type_(type),
+      driver_(driver),
+      command_broker_(driver),
+      watcher_(FROM_HERE) {}
 
 IpcThreadPoller::~IpcThreadPoller() {
   if (!command_broker_.ExitLooper()) {
diff --git a/chromeos/network/managed_state.h b/chromeos/network/managed_state.h
index 04b8799..1fe17c8 100644
--- a/chromeos/network/managed_state.h
+++ b/chromeos/network/managed_state.h
@@ -108,6 +108,7 @@
                       uint32_t* out_value);
 
   void set_name(const std::string& name) { name_ = name; }
+  void set_type(const std::string& type) { type_ = type; }
 
  private:
   friend class NetworkChangeNotifierChromeosUpdateTest;
diff --git a/chromeos/network/network_state_handler.cc b/chromeos/network/network_state_handler.cc
index 0941f86e..eaed6e9c 100644
--- a/chromeos/network/network_state_handler.cc
+++ b/chromeos/network/network_state_handler.cc
@@ -326,14 +326,52 @@
 const NetworkState* NetworkStateHandler::GetNetworkStateFromGuid(
     const std::string& guid) const {
   DCHECK(!guid.empty());
+
   for (auto iter = network_list_.begin(); iter != network_list_.end(); ++iter) {
     const NetworkState* network = (*iter)->AsNetworkState();
     if (network->guid() == guid)
       return network;
   }
+
+  for (auto iter = tether_network_list_.begin();
+       iter != tether_network_list_.end(); ++iter) {
+    const NetworkState* network = (*iter)->AsNetworkState();
+    if (network->guid() == guid)
+      return network;
+  }
+
   return nullptr;
 }
 
+const std::string NetworkStateHandler::CreateTetherNetworkState(
+    const std::string& name) {
+  const std::string& guid = base::GenerateGUID();
+
+  std::unique_ptr<NetworkState> tether_managed_state =
+      base::MakeUnique<NetworkState>(base::GenerateGUID());
+
+  tether_managed_state->set_name(name);
+  tether_managed_state->set_type(kTypeTether);
+  tether_managed_state->SetGuid(guid);
+  tether_managed_state->set_update_received();
+
+  tether_network_list_.push_back(std::move(tether_managed_state));
+  NotifyNetworkListChanged();
+
+  return guid;
+}
+
+void NetworkStateHandler::RemoveTetherNetworkState(const std::string& guid) {
+  for (auto iter = tether_network_list_.begin();
+       iter != tether_network_list_.end(); ++iter) {
+    if (iter->get()->AsNetworkState()->guid() == guid) {
+      tether_network_list_.erase(iter);
+      NotifyNetworkListChanged();
+      return;
+    }
+  }
+}
+
 void NetworkStateHandler::GetDeviceList(DeviceStateList* list) const {
   GetDeviceListByType(NetworkTypePattern::Default(), list);
 }
@@ -712,11 +750,7 @@
   if (type == ManagedState::MANAGED_TYPE_NETWORK) {
     SortNetworkList();
     UpdateNetworkStats();
-    // Notify observers that the list of networks has changed.
-    NET_LOG_EVENT("NOTIFY:NetworkListChanged",
-                  base::StringPrintf("Size:%" PRIuS, network_list_.size()));
-    for (auto& observer : observers_)
-      observer.NetworkListChanged();
+    NotifyNetworkListChanged();
   } else if (type == ManagedState::MANAGED_TYPE_DEVICE) {
     std::string devices;
     for (auto iter = device_list_.begin(); iter != device_list_.end(); ++iter) {
@@ -854,6 +888,13 @@
   network->SetGuid(guid);
 }
 
+void NetworkStateHandler::NotifyNetworkListChanged() {
+  NET_LOG_EVENT("NOTIFY:NetworkListChanged",
+                base::StringPrintf("Size:%" PRIuS, network_list_.size()));
+  for (auto& observer : observers_)
+    observer.NetworkListChanged();
+}
+
 void NetworkStateHandler::NotifyDeviceListChanged() {
   SCOPED_NET_LOG_IF_SLOW();
   NET_LOG_DEBUG("NOTIFY:DeviceListChanged",
diff --git a/chromeos/network/network_state_handler.h b/chromeos/network/network_state_handler.h
index 05042eb..99398bc 100644
--- a/chromeos/network/network_state_handler.h
+++ b/chromeos/network/network_state_handler.h
@@ -192,6 +192,18 @@
   // found. This returns all entries (IsInProfile() may be true or false).
   const NetworkState* GetNetworkStateFromGuid(const std::string& guid) const;
 
+  // Creates a "tether" NetworkState that has no underlying shill type or
+  // service. When initially created, it does not actually represent a real
+  // network. Generates and returns a guid to be used to refer to and fetch this
+  // NetworkState in the future.
+  // NOTE: only GetNetworkStateFromGuid is supported to fetch "tether"
+  // NetworkStates.
+  const std::string CreateTetherNetworkState(const std::string& name);
+
+  // Remove a "tether" NetworkState, using the same guid that was returned by
+  // CreateTetherNetworkState.
+  void RemoveTetherNetworkState(const std::string& guid);
+
   // Sets |list| to contain the list of devices.  The returned list contains
   // a copy of DeviceState pointers which should not be stored or used beyond
   // the scope of the calling function (i.e. they may later become invalid, but
@@ -348,6 +360,9 @@
   // Ensure a valid GUID for NetworkState.
   void UpdateGuid(NetworkState* network);
 
+  // Sends NetworkListChanged() to observers and logs an event.
+  void NotifyNetworkListChanged();
+
   // Sends DeviceListChanged() to observers and logs an event.
   void NotifyDeviceListChanged();
 
@@ -395,6 +410,10 @@
   // List of managed network states
   ManagedStateList network_list_;
 
+  // List of managed "tether" network states, which exist separately from
+  // |network_list_|.
+  ManagedStateList tether_network_list_;
+
   // Set to true when the network list is sorted, cleared when network updates
   // arrive. Used to trigger sorting when needed.
   bool network_list_sorted_ = false;
diff --git a/chromeos/network/network_state_handler_unittest.cc b/chromeos/network/network_state_handler_unittest.cc
index bc41b58..8f48ef2e 100644
--- a/chromeos/network/network_state_handler_unittest.cc
+++ b/chromeos/network/network_state_handler_unittest.cc
@@ -45,6 +45,8 @@
 const char kShillManagerClientStubWifi2[] = "/service/wifi2";
 const char kShillManagerClientStubCellular[] = "/service/cellular1";
 
+const char kTetherName[] = "Device";
+
 using chromeos::DeviceState;
 using chromeos::NetworkState;
 using chromeos::NetworkStateHandler;
@@ -542,6 +544,26 @@
   EXPECT_FALSE(network_state_handler_->GetNetworkState(wifi_path));
 }
 
+TEST_F(NetworkStateHandlerTest, TetherNetworkState) {
+  EXPECT_EQ(0u, test_observer_->network_list_changed_count());
+
+  const std::string& guid =
+      network_state_handler_->CreateTetherNetworkState(kTetherName);
+
+  EXPECT_EQ(1u, test_observer_->network_list_changed_count());
+
+  const NetworkState* tether_network =
+      network_state_handler_->GetNetworkStateFromGuid(guid);
+  ASSERT_TRUE(tether_network);
+  EXPECT_EQ(kTetherName, tether_network->name());
+
+  network_state_handler_->RemoveTetherNetworkState(guid);
+
+  EXPECT_EQ(2u, test_observer_->network_list_changed_count());
+
+  ASSERT_FALSE(network_state_handler_->GetNetworkStateFromGuid(guid));
+}
+
 TEST_F(NetworkStateHandlerTest, NetworkConnectionStateChanged) {
   const std::string eth1 = kShillManagerClientStubDefaultService;
   EXPECT_EQ(0, test_observer_->ConnectionStateChangesForService(eth1));
diff --git a/chromeos/network/network_type_pattern.cc b/chromeos/network/network_type_pattern.cc
index 65537292..9e3c02c 100644
--- a/chromeos/network/network_type_pattern.cc
+++ b/chromeos/network/network_type_pattern.cc
@@ -11,6 +11,8 @@
 
 namespace chromeos {
 
+const char kTypeTether[] = "wifi-tether";
+
 namespace {
 
 const char kPatternDefault[] = "PatternDefault";
@@ -27,21 +29,21 @@
   kNetworkTypeCellular = 1 << 3,
   kNetworkTypeVPN = 1 << 4,
   kNetworkTypeEthernetEap = 1 << 5,
-  kNetworkTypeBluetooth = 1 << 6
+  kNetworkTypeBluetooth = 1 << 6,
+  kNetworkTypeTether = 1 << 7
 };
 
 struct ShillToBitFlagEntry {
   const char* shill_network_type;
   NetworkTypeBitFlag bit_flag;
-} shill_type_to_flag[] = {
-  { shill::kTypeEthernet, kNetworkTypeEthernet },
-  { shill::kTypeEthernetEap, kNetworkTypeEthernetEap },
-  { shill::kTypeWifi, kNetworkTypeWifi },
-  { shill::kTypeWimax, kNetworkTypeWimax },
-  { shill::kTypeCellular, kNetworkTypeCellular },
-  { shill::kTypeVPN, kNetworkTypeVPN },
-  { shill::kTypeBluetooth, kNetworkTypeBluetooth }
-};
+} shill_type_to_flag[] = {{shill::kTypeEthernet, kNetworkTypeEthernet},
+                          {shill::kTypeEthernetEap, kNetworkTypeEthernetEap},
+                          {shill::kTypeWifi, kNetworkTypeWifi},
+                          {shill::kTypeWimax, kNetworkTypeWimax},
+                          {shill::kTypeCellular, kNetworkTypeCellular},
+                          {shill::kTypeVPN, kNetworkTypeVPN},
+                          {shill::kTypeBluetooth, kNetworkTypeBluetooth},
+                          {kTypeTether, kNetworkTypeTether}};
 
 NetworkTypeBitFlag ShillNetworkTypeToFlag(const std::string& shill_type) {
   for (size_t i = 0; i < arraysize(shill_type_to_flag); ++i) {
@@ -72,7 +74,7 @@
 
 // static
 NetworkTypePattern NetworkTypePattern::NonVirtual() {
-  return NetworkTypePattern(~kNetworkTypeVPN);
+  return NetworkTypePattern(~(kNetworkTypeVPN | kNetworkTypeTether));
 }
 
 // static
@@ -101,6 +103,11 @@
 }
 
 // static
+NetworkTypePattern NetworkTypePattern::Tether() {
+  return NetworkTypePattern(kNetworkTypeTether);
+}
+
+// static
 NetworkTypePattern NetworkTypePattern::Primitive(
     const std::string& shill_network_type) {
   return NetworkTypePattern(ShillNetworkTypeToFlag(shill_network_type));
diff --git a/chromeos/network/network_type_pattern.h b/chromeos/network/network_type_pattern.h
index 74e3aa9..702db0f 100644
--- a/chromeos/network/network_type_pattern.h
+++ b/chromeos/network/network_type_pattern.h
@@ -12,6 +12,9 @@
 
 namespace chromeos {
 
+// A special case non-shill type.
+CHROMEOS_EXPORT extern const char kTypeTether[];
+
 class CHROMEOS_EXPORT NetworkTypePattern {
  public:
   // Matches any network.
@@ -34,6 +37,8 @@
   static NetworkTypePattern VPN();
   static NetworkTypePattern Wimax();
 
+  static NetworkTypePattern Tether();
+
   // Matches only networks of exactly the type |shill_network_type|, which must
   // be one of the types defined in service_constants.h (e.g.
   // shill::kTypeWifi).
diff --git a/chromeos/network/network_type_pattern_unittest.cc b/chromeos/network/network_type_pattern_unittest.cc
index b56043c..0003d8a6 100644
--- a/chromeos/network/network_type_pattern_unittest.cc
+++ b/chromeos/network/network_type_pattern_unittest.cc
@@ -20,7 +20,8 @@
         mobile_(NetworkTypePattern::Mobile()),
         non_virtual_(NetworkTypePattern::NonVirtual()),
         wimax_(NetworkTypePattern::Wimax()),
-        wireless_(NetworkTypePattern::Wireless()) {}
+        wireless_(NetworkTypePattern::Wireless()),
+        tether_(NetworkTypePattern::Tether()) {}
 
   bool MatchesPattern(const NetworkTypePattern& a,
                       const NetworkTypePattern& b) {
@@ -37,6 +38,7 @@
   const NetworkTypePattern non_virtual_;
   const NetworkTypePattern wimax_;
   const NetworkTypePattern wireless_;
+  const NetworkTypePattern tether_;
 };
 
 }  // namespace
@@ -50,6 +52,9 @@
   EXPECT_TRUE(wireless_.MatchesType(shill::kTypeCellular));
   EXPECT_TRUE(wireless_.MatchesType(shill::kTypeWimax));
   EXPECT_FALSE(wireless_.MatchesType(shill::kTypeEthernet));
+
+  EXPECT_FALSE(wireless_.MatchesType(kTypeTether));
+  EXPECT_FALSE(wimax_.MatchesType(kTypeTether));
 }
 
 TEST_F(NetworkTypePatternTest, MatchesPattern) {
@@ -69,6 +74,9 @@
   EXPECT_TRUE(MatchesPattern(non_virtual_, ethernet_));
   EXPECT_FALSE(MatchesPattern(cellular_, ethernet_));
 
+  EXPECT_FALSE(MatchesPattern(tether_, wireless_));
+  EXPECT_FALSE(MatchesPattern(tether_, non_virtual_));
+
   // Default matches anything.
   EXPECT_TRUE(MatchesPattern(default_, default_));
   EXPECT_TRUE(MatchesPattern(default_, non_virtual_));
diff --git a/components/crash/content/browser/crash_handler_host_linux.cc b/components/crash/content/browser/crash_handler_host_linux.cc
index 7bb7c80..ce6598f4 100644
--- a/components/crash/content/browser/crash_handler_host_linux.cc
+++ b/components/crash/content/browser/crash_handler_host_linux.cc
@@ -99,6 +99,7 @@
 #if !defined(OS_ANDROID)
       upload_(upload),
 #endif
+      file_descriptor_watcher_(FROM_HERE),
       shutting_down_(false),
       worker_pool_token_(base::SequencedWorkerPool::GetSequenceToken()) {
   write_dump_file_sequence_checker_.DetachFromSequence();
diff --git a/components/display_compositor/OWNERS b/components/display_compositor/OWNERS
index 7e99113..68de279a 100644
--- a/components/display_compositor/OWNERS
+++ b/components/display_compositor/OWNERS
@@ -2,3 +2,5 @@
 danakj@chromium.org
 jbauman@chromium.org
 ccameron@chromium.org
+
+# COMPONENT: Internals>Compositing
diff --git a/components/tracing/OWNERS b/components/tracing/OWNERS
index 1d9100e..8c97000 100644
--- a/components/tracing/OWNERS
+++ b/components/tracing/OWNERS
@@ -1,2 +1,5 @@
 file://base/trace_event/OWNERS
 jbauman@chromium.org
+
+# TEAM: tracing@chromium.org
+# COMPONENT: Speed>Tracing
diff --git a/content/browser/compositor/OWNERS b/content/browser/compositor/OWNERS
index 2817671..008651e 100644
--- a/content/browser/compositor/OWNERS
+++ b/content/browser/compositor/OWNERS
@@ -5,3 +5,5 @@
 per-file *mus*=fsamuel@chromium.org
 per-file *mus*=sadrul@chromium.org
 per-file *mus*=rjkroege@chromium.org
+
+# COMPONENT: Internals>Compositing
diff --git a/content/browser/frame_host/PRESUBMIT.py b/content/browser/frame_host/PRESUBMIT.py
index a6d6fbf..fd53c7ea4 100644
--- a/content/browser/frame_host/PRESUBMIT.py
+++ b/content/browser/frame_host/PRESUBMIT.py
@@ -33,21 +33,9 @@
   This hook adds extra try bots to the CL description in order to run site
   isolation tests in addition to CQ try bots.
   """
-  rietveld_obj = cl.RpcServer()
-  issue = cl.issue
-  description = rietveld_obj.get_description(issue)
-  if re.search(r'^CQ_INCLUDE_TRYBOTS=.*', description, re.M | re.I):
-    return []
-
-  masters = _GetTryMasters(None, change)
-  results = []
-  new_description = description
-  new_description += '\nCQ_INCLUDE_TRYBOTS=%s' % ';'.join(
-      '%s:%s' % (master, ','.join(bots))
-      for master, bots in masters.iteritems())
-  results.append(output_api.PresubmitNotifyResult(
-      'Automatically added site isolation trybots to run tests on CQ.'))
-
-  rietveld_obj.update_description(issue, new_description)
-
-  return results
+  return output_api.EnsureCQIncludeTrybotsAreAdded(
+    cl,
+    [
+      'master.tryserver.chromium.linux:linux_site_isolation'
+    ],
+    'Automatically added site isolation trybots to run tests on CQ.')
diff --git a/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 8ea87f7..19689a70 100644
--- a/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -1335,9 +1335,7 @@
 }
 
 // Verify that reloading a page with url anchor scrolls to correct position.
-// Disabled due to flakiness: https://crbug.com/672545.
-IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       DISABLED_ReloadWithUrlAnchor) {
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, ReloadWithUrlAnchor) {
   GURL url1(embedded_test_server()->GetURL(
       "/navigation_controller/reload-with-url-anchor.html#d2"));
   EXPECT_TRUE(NavigateToURL(shell(), url1));
@@ -1355,6 +1353,41 @@
   EXPECT_EQ(100, value);
 }
 
+// Verify that reloading a page with url anchor and scroll scrolls to correct
+// position.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       ReloadWithUrlAnchorAndScroll) {
+  GURL url1(embedded_test_server()->GetURL(
+      "/navigation_controller/reload-with-url-anchor.html#d2"));
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+
+  std::string script_scroll_down = "window.scroll(0, 10)";
+  EXPECT_TRUE(ExecuteScript(shell(), script_scroll_down));
+
+  std::string get_div_scroll_top =
+      "domAutomationController.send(document.getElementById('div').scrollTop)";
+  std::string get_window_scroll_y =
+      "domAutomationController.send(window.scrollY)";
+  int div_scroll_top = 0;
+  int window_scroll_y = 0;
+  EXPECT_TRUE(
+      ExecuteScriptAndExtractInt(shell(), get_div_scroll_top, &div_scroll_top));
+  EXPECT_TRUE(ExecuteScriptAndExtractInt(shell(), get_window_scroll_y,
+                                         &window_scroll_y));
+  EXPECT_EQ(100, div_scroll_top);
+  EXPECT_EQ(10, window_scroll_y);
+
+  // Reload.
+  ReloadBlockUntilNavigationsComplete(shell(), 1);
+
+  EXPECT_TRUE(
+      ExecuteScriptAndExtractInt(shell(), get_div_scroll_top, &div_scroll_top));
+  EXPECT_TRUE(ExecuteScriptAndExtractInt(shell(), get_window_scroll_y,
+                                         &window_scroll_y));
+  EXPECT_EQ(100, div_scroll_top);
+  EXPECT_EQ(10, window_scroll_y);
+}
+
 // Verify that empty GURL navigations are not classified as SAME_PAGE.
 // See https://crbug.com/534980.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
diff --git a/content/browser/gpu/OWNERS b/content/browser/gpu/OWNERS
index 954a4d9..1e9bbf4 100644
--- a/content/browser/gpu/OWNERS
+++ b/content/browser/gpu/OWNERS
@@ -2,3 +2,5 @@
 kbr@chromium.org
 piman@chromium.org
 zmo@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/content/browser/renderer_host/input/OWNERS b/content/browser/renderer_host/input/OWNERS
index 77d8e4d1..cf2b318 100644
--- a/content/browser/renderer_host/input/OWNERS
+++ b/content/browser/renderer_host/input/OWNERS
@@ -2,3 +2,6 @@
 dtapuska@chromium.org
 tdresser@chromium.org
 
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/content/common/android/OWNERS b/content/common/android/OWNERS
index 21f1e244..acb7d488 100644
--- a/content/common/android/OWNERS
+++ b/content/common/android/OWNERS
@@ -11,3 +11,5 @@
 
 per-file *_param_traits*.*=set noparent
 per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
+
+# COMPONENT: Content>Core
diff --git a/content/common/gpu/OWNERS b/content/common/gpu/OWNERS
index 158c900..2afc34b 100644
--- a/content/common/gpu/OWNERS
+++ b/content/common/gpu/OWNERS
@@ -7,3 +7,5 @@
 
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
+
+# COMPONENT: Internals>GPU
diff --git a/content/common/input/OWNERS b/content/common/input/OWNERS
index 368b47f..d1c97c5 100644
--- a/content/common/input/OWNERS
+++ b/content/common/input/OWNERS
@@ -3,4 +3,7 @@
 tdresser@chromium.org
 
 per-file *_param_traits*.*=set noparent
-per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
\ No newline at end of file
+per-file *_param_traits*.*=file://ipc/SECURITY_OWNERS
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/content/common/page_state_serialization.cc b/content/common/page_state_serialization.cc
index 894ff2b..52ed1a19 100644
--- a/content/common/page_state_serialization.cc
+++ b/content/common/page_state_serialization.cc
@@ -196,12 +196,13 @@
 // 21: Add frame sequence number.
 // 22: Add scroll restoration type.
 // 23: Remove frame sequence number, there are easier ways.
+// 24: Add did save scroll or scale state.
 //
 // NOTE: If the version is -1, then the pickle contains only a URL string.
 // See ReadPageState.
 //
 const int kMinVersion = 11;
-const int kCurrentVersion = 23;
+const int kCurrentVersion = 24;
 
 // A bunch of convenience functions to read/write to SerializeObjects.  The
 // de-serializers assume the input data will be in the correct format and fall
@@ -505,18 +506,28 @@
 
   WriteString(state.url_string, obj);
   WriteString(state.target, obj);
-  WriteInteger(state.scroll_offset.x(), obj);
-  WriteInteger(state.scroll_offset.y(), obj);
+  WriteBoolean(state.did_save_scroll_or_scale_state, obj);
+
+  if (state.did_save_scroll_or_scale_state) {
+    WriteInteger(state.scroll_offset.x(), obj);
+    WriteInteger(state.scroll_offset.y(), obj);
+  }
+
   WriteString(state.referrer, obj);
 
   WriteStringVector(state.document_state, obj);
 
-  WriteReal(state.page_scale_factor, obj);
+  if (state.did_save_scroll_or_scale_state)
+    WriteReal(state.page_scale_factor, obj);
+
   WriteInteger64(state.item_sequence_number, obj);
   WriteInteger64(state.document_sequence_number, obj);
   WriteInteger(static_cast<int>(state.referrer_policy), obj);
-  WriteReal(state.visual_viewport_scroll_offset.x(), obj);
-  WriteReal(state.visual_viewport_scroll_offset.y(), obj);
+
+  if (state.did_save_scroll_or_scale_state) {
+    WriteReal(state.visual_viewport_scroll_offset.x(), obj);
+    WriteReal(state.visual_viewport_scroll_offset.y(), obj);
+  }
 
   WriteInteger(state.scroll_restoration_type, obj);
 
@@ -557,9 +568,17 @@
     ReadReal(obj);    // Skip obsolete visited time field.
   }
 
-  int x = ReadInteger(obj);
-  int y = ReadInteger(obj);
-  state->scroll_offset = gfx::Point(x, y);
+  if (obj->version >= 24) {
+    state->did_save_scroll_or_scale_state = ReadBoolean(obj);
+  } else {
+    state->did_save_scroll_or_scale_state = true;
+  }
+
+  if (state->did_save_scroll_or_scale_state) {
+    int x = ReadInteger(obj);
+    int y = ReadInteger(obj);
+    state->scroll_offset = gfx::Point(x, y);
+  }
 
   if (obj->version < 15) {
     ReadBoolean(obj);  // Skip obsolete target item flag.
@@ -569,7 +588,9 @@
 
   ReadStringVector(obj, &state->document_state);
 
-  state->page_scale_factor = ReadReal(obj);
+  if (state->did_save_scroll_or_scale_state)
+    state->page_scale_factor = ReadReal(obj);
+
   state->item_sequence_number = ReadInteger64(obj);
   state->document_sequence_number = ReadInteger64(obj);
   if (obj->version >= 21 && obj->version < 23)
@@ -583,7 +604,7 @@
         static_cast<blink::WebReferrerPolicy>(ReadInteger(obj));
   }
 
-  if (obj->version >= 20) {
+  if (obj->version >= 20 && state->did_save_scroll_or_scale_state) {
     double x = ReadReal(obj);
     double y = ReadReal(obj);
     state->visual_viewport_scroll_offset = gfx::PointF(x, y);
@@ -689,11 +710,11 @@
 
 ExplodedFrameState::ExplodedFrameState()
     : scroll_restoration_type(blink::WebHistoryScrollRestorationAuto),
+      did_save_scroll_or_scale_state(true),
       item_sequence_number(0),
       document_sequence_number(0),
       page_scale_factor(0.0),
-      referrer_policy(blink::WebReferrerPolicyDefault) {
-}
+      referrer_policy(blink::WebReferrerPolicyDefault) {}
 
 ExplodedFrameState::ExplodedFrameState(const ExplodedFrameState& other) {
   assign(other);
@@ -714,6 +735,7 @@
   state_object = other.state_object;
   document_state = other.document_state;
   scroll_restoration_type = other.scroll_restoration_type;
+  did_save_scroll_or_scale_state = other.did_save_scroll_or_scale_state;
   visual_viewport_scroll_offset = other.visual_viewport_scroll_offset;
   scroll_offset = other.scroll_offset;
   item_sequence_number = other.item_sequence_number;
diff --git a/content/common/page_state_serialization.h b/content/common/page_state_serialization.h
index 51ad47a4..9c1642da 100644
--- a/content/common/page_state_serialization.h
+++ b/content/common/page_state_serialization.h
@@ -39,6 +39,7 @@
   base::NullableString16 state_object;
   std::vector<base::NullableString16> document_state;
   blink::WebHistoryScrollRestorationType scroll_restoration_type;
+  bool did_save_scroll_or_scale_state;
   gfx::PointF visual_viewport_scroll_offset;
   gfx::Point scroll_offset;
   int64_t item_sequence_number;
diff --git a/content/common/page_state_serialization_unittest.cc b/content/common/page_state_serialization_unittest.cc
index 9ed9d33ed..43b801dd 100644
--- a/content/common/page_state_serialization_unittest.cc
+++ b/content/common/page_state_serialization_unittest.cc
@@ -439,5 +439,9 @@
   TestBackwardsCompat(22);
 }
 
+TEST_F(PageStateSerializationTest, BackwardsCompat_v23) {
+  TestBackwardsCompat(23);
+}
+
 }  // namespace
 }  // namespace content
diff --git a/content/gpu/OWNERS b/content/gpu/OWNERS
index 4cd2b20..7dabf197 100644
--- a/content/gpu/OWNERS
+++ b/content/gpu/OWNERS
@@ -1,3 +1,5 @@
 jbauman@chromium.org
 kbr@chromium.org
 piman@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/content/public/android/OWNERS b/content/public/android/OWNERS
index 0c25859..6043cc2 100644
--- a/content/public/android/OWNERS
+++ b/content/public/android/OWNERS
@@ -6,3 +6,5 @@
 
 per-file *.aidl=set noparent
 per-file *.aidl=palmer@chromium.org
+
+# COMPONENT: Content>Core
diff --git a/content/public/android/java/src/org/chromium/content/browser/input/OWNERS b/content/public/android/java/src/org/chromium/content/browser/input/OWNERS
index 41b4ecb..575b818 100644
--- a/content/public/android/java/src/org/chromium/content/browser/input/OWNERS
+++ b/content/public/android/java/src/org/chromium/content/browser/input/OWNERS
@@ -1,2 +1,5 @@
 aelias@chromium.org
 changwan@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: UI>Input>Text>IME
diff --git a/content/public/android/javatests/src/org/chromium/content/browser/input/OWNERS b/content/public/android/javatests/src/org/chromium/content/browser/input/OWNERS
index 41b4ecb..575b818 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/input/OWNERS
+++ b/content/public/android/javatests/src/org/chromium/content/browser/input/OWNERS
@@ -1,2 +1,5 @@
 aelias@chromium.org
 changwan@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: UI>Input>Text>IME
diff --git a/content/public/android/junit/src/org/chromium/content/browser/input/OWNERS b/content/public/android/junit/src/org/chromium/content/browser/input/OWNERS
index a99f2a4..575b818 100644
--- a/content/public/android/junit/src/org/chromium/content/browser/input/OWNERS
+++ b/content/public/android/junit/src/org/chromium/content/browser/input/OWNERS
@@ -1,2 +1,5 @@
 aelias@chromium.org
-changwan@chromium.org
\ No newline at end of file
+changwan@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: UI>Input>Text>IME
diff --git a/content/public/browser/android/OWNERS b/content/public/browser/android/OWNERS
index 5abbf577..db48a41c 100644
--- a/content/public/browser/android/OWNERS
+++ b/content/public/browser/android/OWNERS
@@ -2,3 +2,5 @@
 boliu@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
+
+# COMPONENT: Content>Core
diff --git a/content/public/test/android/OWNERS b/content/public/test/android/OWNERS
index 2f11e49..6fedb4f 100644
--- a/content/public/test/android/OWNERS
+++ b/content/public/test/android/OWNERS
@@ -7,3 +7,5 @@
 skyostil@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
+
+# COMPONENT: Test>Android
diff --git a/content/renderer/android/synchronous_compositor_frame_sink.cc b/content/renderer/android/synchronous_compositor_frame_sink.cc
index 1813620..8edefc70 100644
--- a/content/renderer/android/synchronous_compositor_frame_sink.cc
+++ b/content/renderer/android/synchronous_compositor_frame_sink.cc
@@ -107,6 +107,7 @@
     scoped_refptr<cc::ContextProvider> context_provider,
     scoped_refptr<cc::ContextProvider> worker_context_provider,
     gpu::GpuMemoryBufferManager* gpu_memory_buffer_manager,
+    cc::SharedBitmapManager* shared_bitmap_manager,
     int routing_id,
     uint32_t compositor_frame_sink_id,
     std::unique_ptr<cc::BeginFrameSource> begin_frame_source,
@@ -119,6 +120,7 @@
       routing_id_(routing_id),
       compositor_frame_sink_id_(compositor_frame_sink_id),
       registry_(registry),
+      shared_bitmap_manager_(shared_bitmap_manager),
       sender_(RenderThreadImpl::current()->sync_compositor_message_filter()),
       memory_policy_(0u),
       frame_swap_message_queue_(frame_swap_message_queue),
@@ -185,16 +187,18 @@
       base::MakeUnique<SoftwareDevice>(&current_sw_canvas_));
   software_output_surface_ = output_surface.get();
 
-  // The shared_bitmap_manager and gpu_memory_buffer_manager here are null as
-  // this Display is only used for resourcesless software draws, where no
-  // resources are included in the frame swapped from the compositor. So there
-  // is no need for these.
+  // The gpu_memory_buffer_manager here is null as the Display is only used for
+  // resourcesless software draws, where no resources are included in the frame
+  // swapped from the compositor. So there is no need for it.
+  // The shared_bitmap_manager_ is provided for the Display to allocate
+  // resources.
+  // TODO(crbug.com/692814): The Display never sends its resources out of
+  // process so there is no reason for it to use a SharedBitmapManager.
   display_.reset(new cc::Display(
-      nullptr /* shared_bitmap_manager */,
-      nullptr /* gpu_memory_buffer_manager */, software_renderer_settings,
-      kRootFrameSinkId, nullptr /* begin_frame_source */,
-      std::move(output_surface), nullptr /* scheduler */,
-      nullptr /* texture_mailbox_deleter */));
+      shared_bitmap_manager_, nullptr /* gpu_memory_buffer_manager */,
+      software_renderer_settings, kRootFrameSinkId,
+      nullptr /* begin_frame_source */, std::move(output_surface),
+      nullptr /* scheduler */, nullptr /* texture_mailbox_deleter */));
   display_->Initialize(&display_client_, surface_manager_.get());
   display_->SetVisible(true);
   return true;
diff --git a/content/renderer/android/synchronous_compositor_frame_sink.h b/content/renderer/android/synchronous_compositor_frame_sink.h
index 61906c5..34f373f 100644
--- a/content/renderer/android/synchronous_compositor_frame_sink.h
+++ b/content/renderer/android/synchronous_compositor_frame_sink.h
@@ -71,6 +71,7 @@
       scoped_refptr<cc::ContextProvider> context_provider,
       scoped_refptr<cc::ContextProvider> worker_context_provider,
       gpu::GpuMemoryBufferManager* gpu_memory_buffer_manager,
+      cc::SharedBitmapManager* shared_bitmap_manager,
       int routing_id,
       uint32_t compositor_frame_sink_id,
       std::unique_ptr<cc::BeginFrameSource> begin_frame_source,
@@ -120,6 +121,7 @@
   const int routing_id_;
   const uint32_t compositor_frame_sink_id_;
   SynchronousCompositorRegistry* const registry_;  // Not owned.
+  cc::SharedBitmapManager* const shared_bitmap_manager_;  // Not owned.
   IPC::Sender* const sender_;                      // Not owned.
 
   // Not owned.
diff --git a/content/renderer/gpu/OWNERS b/content/renderer/gpu/OWNERS
index 68dda9d..2c952eb 100644
--- a/content/renderer/gpu/OWNERS
+++ b/content/renderer/gpu/OWNERS
@@ -2,3 +2,5 @@
 kbr@chromium.org
 piman@chromium.org
 enne@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/content/renderer/history_serialization.cc b/content/renderer/history_serialization.cc
index b1fae6a7..1ec24ddc 100644
--- a/content/renderer/history_serialization.cc
+++ b/content/renderer/history_serialization.cc
@@ -54,6 +54,7 @@
   state->document_sequence_number =
       item.documentSequenceNumber();
   state->page_scale_factor = item.pageScaleFactor();
+  state->did_save_scroll_or_scale_state = item.didSaveScrollOrScaleState();
   ToNullableString16Vector(item.getDocumentState(), &state->document_state);
 
   state->http_body.http_content_type =
@@ -102,6 +103,7 @@
   item.setVisualViewportScrollOffset(state.visual_viewport_scroll_offset);
   item.setScrollOffset(state.scroll_offset);
   item.setPageScaleFactor(state.page_scale_factor);
+  item.setDidSaveScrollOrScaleState(state.did_save_scroll_or_scale_state);
 
   // These values are generated at WebHistoryItem construction time, and we
   // only want to override those new values with old values if the old values
diff --git a/content/renderer/input/OWNERS b/content/renderer/input/OWNERS
index 82540eb6..90ec5a03 100644
--- a/content/renderer/input/OWNERS
+++ b/content/renderer/input/OWNERS
@@ -1,3 +1,6 @@
 aelias@chromium.org
 dtapuska@chromium.org
 tdresser@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 968f4e0..96c1e721 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -1985,8 +1985,8 @@
   if (sync_compositor_message_filter_) {
     return base::MakeUnique<SynchronousCompositorFrameSink>(
         std::move(context_provider), std::move(worker_context_provider),
-        GetGpuMemoryBufferManager(), routing_id, compositor_frame_sink_id,
-        CreateExternalBeginFrameSource(routing_id),
+        GetGpuMemoryBufferManager(), shared_bitmap_manager(), routing_id,
+        compositor_frame_sink_id, CreateExternalBeginFrameSource(routing_id),
         sync_compositor_message_filter_.get(),
         std::move(frame_swap_message_queue));
   }
diff --git a/content/shell/android/OWNERS b/content/shell/android/OWNERS
index 5abbf577..db48a41c 100644
--- a/content/shell/android/OWNERS
+++ b/content/shell/android/OWNERS
@@ -2,3 +2,5 @@
 boliu@chromium.org
 tedchoc@chromium.org
 yfriedman@chromium.org
+
+# COMPONENT: Content>Core
diff --git a/content/test/data/dom_storage/verify_data.html b/content/test/data/dom_storage/verify_data.html
index cc845bb8..6349b04b 100644
--- a/content/test/data/dom_storage/verify_data.html
+++ b/content/test/data/dom_storage/verify_data.html
@@ -5,7 +5,7 @@
 function test() {
   let val = window.localStorage['foo'];
   if (val !== 'bar')
-    fail('Read incorrect value from localStorage. Excpected "bar", got "' + val + '"');
+    fail('Read incorrect value from localStorage. Expected "bar", got "' + val + '"');
   else
     done();
 }
diff --git a/content/test/data/navigation_controller/reload-with-url-anchor.html b/content/test/data/navigation_controller/reload-with-url-anchor.html
index 7b1ba4d..36bcaec8 100644
--- a/content/test/data/navigation_controller/reload-with-url-anchor.html
+++ b/content/test/data/navigation_controller/reload-with-url-anchor.html
@@ -14,3 +14,5 @@
   <div>d1</div>
   <div id='d2'>d2</div>
 </div>
+
+<p style="position: absolute; top: 2000px">End of page.</p>
diff --git a/content/test/data/page_state/serialized_v23.dat b/content/test/data/page_state/serialized_v23.dat
new file mode 100644
index 0000000..ed726d5
--- /dev/null
+++ b/content/test/data/page_state/serialized_v23.dat
@@ -0,0 +1,17 @@
+tAMAABgAAAABAAAAEAAAAGYAaQBsAGUALgB0AHgAdAAoAAAAaAB0AHQAcAA6AC8ALwBjAGgAcgBv
+AG0AaQB1AG0ALgBvAHIAZwAvAAwAAAB0AGEAcgBnAGUAdAABAAAAKgAAANb///8kAAAAaAB0AHQA
+cAA6AC8ALwBnAG8AbwBnAGwAZQAuAGMAbwBtAC8ACAAAAGAAAAAKAA0APwAlACAAVwBlAGIASwBp
+AHQAIABzAGUAcgBpAGEAbABpAHoAZQBkACAAZgBvAHIAbQAgAHMAdABhAHQAZQAgAHYAZQByAHMA
+aQBvAG4AIAA4ACAACgANAD0AJgAQAAAAZgBvAHIAbQAgAGsAZQB5AAIAAAAxAAAABgAAAGYAbwBv
+AAAACAAAAGYAaQBsAGUAAgAAADIAAAAQAAAAZgBpAGwAZQAuAHQAeAB0ABYAAABkAGkAcwBwAGwA
+YQB5AE4AYQBtAGUAAAAIAAAAAAAAAAAAAEB7AAAAAAAAAMgBAAAAAAAAAQAAAAgAAAAAAAAAAADw
+vwgAAAAAAAAAAADwvwAAAAAAAAAAAQAAAAMAAAAAAAAAEAAAAGZpcnN0IGRhdGEgYmxvY2sBAAAA
+EAAAAGYAaQBsAGUALgB0AHgAdAAAAAAAAAAAAP//////////CAAAAAAAAAAAAAAAAAAAAA8AAABk
+YXRhIHRoZSBzZWNvbmQAFQMAAAAAAAAAAAAADgAAAGYAbwBvAC8AYgBhAHIAAAABAAAAKAAAAGgA
+dAB0AHAAOgAvAC8AYwBoAHIAbwBtAGkAdQBtAC4AbwByAGcALwD/////AQAAACoAAADW////JAAA
+AGgAdAB0AHAAOgAvAC8AZwBvAG8AZwBsAGUALgBjAG8AbQAvAAgAAABgAAAACgANAD8AJQAgAFcA
+ZQBiAEsAaQB0ACAAcwBlAHIAaQBhAGwAaQB6AGUAZAAgAGYAbwByAG0AIABzAHQAYQB0AGUAIAB2
+AGUAcgBzAGkAbwBuACAAOAAgAAoADQA9ACYAEAAAAGYAbwByAG0AIABrAGUAeQACAAAAMQAAAAYA
+AABmAG8AbwAAAAgAAABmAGkAbABlAAIAAAAyAAAAEAAAAGYAaQBsAGUALgB0AHgAdAAWAAAAZABp
+AHMAcABsAGEAeQBOAGEAbQBlAAAACAAAAAAAAAAAAABAewAAAAAAAADIAQAAAAAAAAEAAAAIAAAA
+AAAAAAAA8L8IAAAAAAAAAAAA8L8AAAAAAAAAAAAAAAD/////AAAAAA==
diff --git a/dbus/bus.cc b/dbus/bus.cc
index 186c9380..a869717 100644
--- a/dbus/bus.cc
+++ b/dbus/bus.cc
@@ -45,7 +45,7 @@
 class Watch : public base::MessagePumpLibevent::Watcher {
  public:
   explicit Watch(DBusWatch* watch)
-      : raw_watch_(watch) {
+      : raw_watch_(watch), file_descriptor_watcher_(FROM_HERE) {
     dbus_watch_set_data(raw_watch_, this, NULL);
   }
 
diff --git a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
index 179e68e..c12db754 100644
--- a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
+++ b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
@@ -44,6 +44,8 @@
 const char kAppCacheKey[] = "appcache";
 const char kCacheKey[] = "cache";
 const char kCookiesKey[] = "cookies";
+const char kSessionCookiesKey[] = "sessionCookies";
+const char kPersistentCookiesKey[] = "persistentCookies";
 const char kFileSystemsKey[] = "fileSystems";
 const char kIndexedDBKey[] = "indexedDB";
 const char kLocalStorageKey[] = "localStorage";
@@ -61,6 +63,10 @@
     return webview::WEB_VIEW_REMOVE_DATA_MASK_APPCACHE;
   if (strcmp(key, kCacheKey) == 0)
     return webview::WEB_VIEW_REMOVE_DATA_MASK_CACHE;
+  if (strcmp(key, kSessionCookiesKey) == 0)
+    return webview::WEB_VIEW_REMOVE_DATA_MASK_SESSION_COOKIES;
+  if (strcmp(key, kPersistentCookiesKey) == 0)
+    return webview::WEB_VIEW_REMOVE_DATA_MASK_PERSISTENT_COOKIES;
   if (strcmp(key, kCookiesKey) == 0)
     return webview::WEB_VIEW_REMOVE_DATA_MASK_COOKIES;
   if (strcmp(key, kFileSystemsKey) == 0)
diff --git a/extensions/browser/guest_view/web_view/web_view_constants.cc b/extensions/browser/guest_view/web_view/web_view_constants.cc
index 9ed1ed5..4c2af5b 100644
--- a/extensions/browser/guest_view/web_view/web_view_constants.cc
+++ b/extensions/browser/guest_view/web_view/web_view_constants.cc
@@ -138,6 +138,8 @@
 const uint32_t WEB_VIEW_REMOVE_DATA_MASK_INDEXEDDB = 1 << 4;
 const uint32_t WEB_VIEW_REMOVE_DATA_MASK_LOCAL_STORAGE = 1 << 5;
 const uint32_t WEB_VIEW_REMOVE_DATA_MASK_WEBSQL = 1 << 6;
+const uint32_t WEB_VIEW_REMOVE_DATA_MASK_SESSION_COOKIES = 1 << 7;
+const uint32_t WEB_VIEW_REMOVE_DATA_MASK_PERSISTENT_COOKIES = 1 << 8;
 
 // Other.
 const char kWebViewContentScriptManagerKeyName[] =
diff --git a/extensions/browser/guest_view/web_view/web_view_constants.h b/extensions/browser/guest_view/web_view/web_view_constants.h
index 6b82c19..bfef2e5 100644
--- a/extensions/browser/guest_view/web_view/web_view_constants.h
+++ b/extensions/browser/guest_view/web_view/web_view_constants.h
@@ -148,6 +148,8 @@
 extern const uint32_t WEB_VIEW_REMOVE_DATA_MASK_INDEXEDDB;
 extern const uint32_t WEB_VIEW_REMOVE_DATA_MASK_LOCAL_STORAGE;
 extern const uint32_t WEB_VIEW_REMOVE_DATA_MASK_WEBSQL;
+extern const uint32_t WEB_VIEW_REMOVE_DATA_MASK_SESSION_COOKIES;
+extern const uint32_t WEB_VIEW_REMOVE_DATA_MASK_PERSISTENT_COOKIES;
 
 // Other.
 extern const char kWebViewContentScriptManagerKeyName[];
diff --git a/extensions/browser/guest_view/web_view/web_view_guest.cc b/extensions/browser/guest_view/web_view/web_view_guest.cc
index 57150cd9..6973ebb0 100644
--- a/extensions/browser/guest_view/web_view/web_view_guest.cc
+++ b/extensions/browser/guest_view/web_view/web_view_guest.cc
@@ -62,6 +62,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
+#include "net/cookies/canonical_cookie.h"
 #include "ui/base/models/simple_menu_model.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "url/url_constants.h"
@@ -87,8 +88,12 @@
   uint32_t mask = 0;
   if (web_view_removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_APPCACHE)
     mask |= StoragePartition::REMOVE_DATA_MASK_APPCACHE;
-  if (web_view_removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_COOKIES)
+  if (web_view_removal_mask &
+      (webview::WEB_VIEW_REMOVE_DATA_MASK_COOKIES |
+       webview::WEB_VIEW_REMOVE_DATA_MASK_SESSION_COOKIES |
+       webview::WEB_VIEW_REMOVE_DATA_MASK_PERSISTENT_COOKIES)) {
     mask |= StoragePartition::REMOVE_DATA_MASK_COOKIES;
+  }
   if (web_view_removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_FILE_SYSTEMS)
     mask |= StoragePartition::REMOVE_DATA_MASK_FILE_SYSTEMS;
   if (web_view_removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_INDEXEDDB)
@@ -425,15 +430,41 @@
     callback.Run();
     return;
   }
+
+  content::StoragePartition::CookieMatcherFunction cookie_matcher;
+
+  bool remove_session_cookies =
+      !!(removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_SESSION_COOKIES);
+  bool remove_persistent_cookies =
+      !!(removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_PERSISTENT_COOKIES);
+  bool remove_all_cookies =
+      (!!(removal_mask & webview::WEB_VIEW_REMOVE_DATA_MASK_COOKIES)) ||
+      (remove_session_cookies && remove_persistent_cookies);
+
+  // Leaving the cookie_matcher unset will cause all cookies to be purged.
+  if (!remove_all_cookies) {
+    if (remove_session_cookies) {
+      cookie_matcher =
+          base::Bind([](const net::CanonicalCookie& cookie) -> bool {
+            return !cookie.IsPersistent();
+          });
+    } else if (remove_persistent_cookies) {
+      cookie_matcher =
+          base::Bind([](const net::CanonicalCookie& cookie) -> bool {
+            return cookie.IsPersistent();
+          });
+    }
+  }
+
   content::StoragePartition* partition =
       content::BrowserContext::GetStoragePartition(
           web_contents()->GetBrowserContext(),
           web_contents()->GetSiteInstance());
   partition->ClearData(
       storage_partition_removal_mask,
-      content::StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL, GURL(),
-      content::StoragePartition::OriginMatcherFunction(), remove_since,
-      base::Time::Now(), callback);
+      content::StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL,
+      content::StoragePartition::OriginMatcherFunction(), cookie_matcher,
+      remove_since, base::Time::Now(), callback);
 }
 
 void WebViewGuest::GuestViewDidStopLoading() {
diff --git a/extensions/common/api/web_view_internal.json b/extensions/common/api/web_view_internal.json
index 94a6eb9..2030dfe 100644
--- a/extensions/common/api/web_view_internal.json
+++ b/extensions/common/api/web_view_internal.json
@@ -23,7 +23,17 @@
           "cookies": {
             "type": "boolean",
             "optional": true,
-            "description": "The browser's cookies."
+            "description": "The Websites' cookies. This will remove both session and persistent cookies"
+          },
+          "sessionCookies": {
+            "type": "boolean",
+            "optional": true,
+            "description": "The Websites' session cookies."
+          },
+          "persistentCookies": {
+            "type": "boolean",
+            "optional": true,
+            "description": "The Websites' persistent cookies."
           },
           "fileSystems": {
             "type": "boolean",
diff --git a/gpu/OWNERS b/gpu/OWNERS
index 9b58a03..eccb505 100644
--- a/gpu/OWNERS
+++ b/gpu/OWNERS
@@ -6,3 +6,5 @@
 
 # GPU memory buffer implementations.
 per-file *gpu_memory_buffer*=reveman@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/gpu/config/OWNERS b/gpu/config/OWNERS
index a72f996..4b8dfc90 100644
--- a/gpu/config/OWNERS
+++ b/gpu/config/OWNERS
@@ -2,3 +2,5 @@
 kbr@chromium.org
 piman@chromium.org
 zmo@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/gpu/config/software_rendering_list_json.cc b/gpu/config/software_rendering_list_json.cc
index 293566a..7c8acc3 100644
--- a/gpu/config/software_rendering_list_json.cc
+++ b/gpu/config/software_rendering_list_json.cc
@@ -18,7 +18,7 @@
 {
   "name": "software rendering list",
   // Please update the version number whenever you change this file.
-  "version": "12.13",
+  "version": "12.14",
   "entries": [
     {
       "id": 1,
@@ -1255,7 +1255,7 @@
     },
     {
       "id": 122,
-      "description": "GPU rasterization should only be enabled on NVIDIA Pascal and Maxwell, Intel Broadwell+, and AMD RX-R2 GPUs for now.",
+      "description": "GPU rasterization should only be enabled on NVIDIA Pascal and Maxwell, Intel Haswell+, and AMD RX-R2 GPUs for now.",
       "cr_bugs": [643850],
       "os": {
         "type": "win"
@@ -1296,21 +1296,10 @@
             }
           },
           "vendor_id": "0x8086",
-          "device_id": ["0x1602", "0x1606", "0x160a", "0x160b", "0x160d",
-                        "0x160e", "0x1612", "0x1616", "0x161a", "0x161b",
-                        "0x161d", "0x161e", "0x1622", "0x1626", "0x162a",
-                        "0x162b", "0x162d", "0x162e", "0x22b0", "0x22b1",
-                        "0x22b2", "0x22b3", "0x1902", "0x1906", "0x190a",
-                        "0x190b", "0x190e", "0x1912", "0x1913", "0x1915",
-                        "0x1916", "0x1917", "0x191a", "0x191b", "0x191d",
-                        "0x191e", "0x1921", "0x1923", "0x1926", "0x1927",
-                        "0x192a", "0x192b", "0x192d", "0x1932", "0x193a",
-                        "0x193b", "0x193d", "0x0a84", "0x1a84", "0x1a85",
-                        "0x5a84", "0x5a85", "0x5916", "0x5913", "0x5906",
-                        "0x5926", "0x5921", "0x5915", "0x590e", "0x591e",
-                        "0x5912", "0x5917", "0x5902", "0x591b", "0x593b",
-                        "0x590b", "0x591a", "0x590a", "0x591d", "0x5908",
-                        "0x5923", "0x5927"]
+          "pixel_shader_version": {
+            "op": ">=",
+            "value": "5.0"
+          }
         },
         {
           "os": {
diff --git a/gpu/ipc/service/image_transport_surface_win.cc b/gpu/ipc/service/image_transport_surface_win.cc
index 6213128..7d484e90 100644
--- a/gpu/ipc/service/image_transport_surface_win.cc
+++ b/gpu/ipc/service/image_transport_surface_win.cc
@@ -29,11 +29,6 @@
   scoped_refptr<gl::GLSurface> surface;
   if (gl::GetGLImplementation() == gl::kGLImplementationEGLGLES2 &&
       gl::GLSurfaceEGL::IsDirectCompositionSupported()) {
-    // TODO(stanisc): http://crbug.com/659844:
-    // Force DWM based gl::VSyncProviderWin provider to avoid video playback
-    // smoothness issues. Once that issue is fixed, passing a nullptr
-    // vsync_provider would result in assigning a default VSyncProvider inside
-    // the Initialize call.
     std::unique_ptr<gfx::VSyncProvider> vsync_provider(
         new gl::VSyncProviderWin(surface_handle));
     if (base::FeatureList::IsEnabled(switches::kDirectCompositionOverlays)) {
diff --git a/ipc/ipc_channel.h b/ipc/ipc_channel.h
index 4a201441..527c949 100644
--- a/ipc/ipc_channel.h
+++ b/ipc/ipc_channel.h
@@ -22,7 +22,6 @@
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/associated_group.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/associated_interface_request.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
@@ -92,10 +91,6 @@
 
     virtual ~AssociatedInterfaceSupport() {}
 
-    // Accesses the AssociatedGroup used to associate new interface endpoints
-    // with this Channel. Must be safe to call from any thread.
-    virtual mojo::AssociatedGroup* GetAssociatedGroup() = 0;
-
     // Returns a ThreadSafeForwarded for this channel which can be used to
     // safely send mojom::Channel requests from arbitrary threads.
     virtual std::unique_ptr<mojo::ThreadSafeForwarder<mojom::Channel>>
@@ -128,8 +123,7 @@
     template <typename Interface>
     void GetRemoteAssociatedInterface(
         mojo::AssociatedInterfacePtr<Interface>* proxy) {
-      mojo::AssociatedInterfaceRequest<Interface> request =
-          mojo::MakeRequest(proxy, GetAssociatedGroup());
+      auto request = mojo::MakeRequest(proxy);
       GetGenericRemoteAssociatedInterface(
           Interface::Name_, request.PassHandle());
     }
diff --git a/ipc/ipc_channel_mojo.cc b/ipc/ipc_channel_mojo.cc
index 3b4e5e9c..d0129e3 100644
--- a/ipc/ipc_channel_mojo.cc
+++ b/ipc/ipc_channel_mojo.cc
@@ -468,11 +468,6 @@
   return MOJO_RESULT_OK;
 }
 
-mojo::AssociatedGroup* ChannelMojo::GetAssociatedGroup() {
-  DCHECK(bootstrap_);
-  return bootstrap_->GetAssociatedGroup();
-}
-
 void ChannelMojo::AddGenericAssociatedInterface(
     const std::string& name,
     const GenericAssociatedInterfaceFactory& factory) {
diff --git a/ipc/ipc_channel_mojo.h b/ipc/ipc_channel_mojo.h
index d2d6880f..20135b5 100644
--- a/ipc/ipc_channel_mojo.h
+++ b/ipc/ipc_channel_mojo.h
@@ -106,7 +106,6 @@
       std::unique_ptr<mojo::MessageReceiver> responder);
 
   // Channel::AssociatedInterfaceSupport:
-  mojo::AssociatedGroup* GetAssociatedGroup() override;
   std::unique_ptr<mojo::ThreadSafeForwarder<mojom::Channel>>
   CreateThreadSafeChannel() override;
   void AddGenericAssociatedInterface(
diff --git a/ipc/ipc_channel_mojo_unittest.cc b/ipc/ipc_channel_mojo_unittest.cc
index b2582cf1..4dbf339c 100644
--- a/ipc/ipc_channel_mojo_unittest.cc
+++ b/ipc/ipc_channel_mojo_unittest.cc
@@ -920,8 +920,7 @@
   IPC::mojom::IndirectTestDriverAssociatedPtr driver;
   IPC::mojom::PingReceiverAssociatedPtr ping_receiver;
   proxy()->GetRemoteAssociatedInterface(&driver);
-  driver->GetPingReceiver(
-      mojo::MakeRequest(&ping_receiver, driver.associated_group()));
+  driver->GetPingReceiver(mojo::MakeRequest(&ping_receiver));
 
   base::RunLoop loop;
   ping_receiver->Ping(loop.QuitClosure());
@@ -1275,8 +1274,7 @@
   IPC::mojom::AssociatedInterfaceVendorAssociatedPtr vendor;
   proxy()->GetRemoteAssociatedInterface(&vendor);
   IPC::mojom::SimpleTestDriverAssociatedPtr tester;
-  vendor->GetTestInterface(
-      mojo::MakeRequest(&tester, vendor.associated_group()));
+  vendor->GetTestInterface(mojo::MakeRequest(&tester));
   base::RunLoop run_loop;
   tester.set_connection_error_handler(run_loop.QuitClosure());
   run_loop.Run();
diff --git a/ipc/ipc_channel_proxy.cc b/ipc/ipc_channel_proxy.cc
index 6759c49..ef1c0b2 100644
--- a/ipc/ipc_channel_proxy.cc
+++ b/ipc/ipc_channel_proxy.cc
@@ -67,7 +67,6 @@
   Channel::AssociatedInterfaceSupport* support =
       channel_->GetAssociatedInterfaceSupport();
   if (support) {
-    associated_group_ = *support->GetAssociatedGroup();
     thread_safe_channel_ = support->CreateThreadSafeChannel();
 
     base::AutoLock l(pending_filters_lock_);
@@ -375,7 +374,6 @@
 void ChannelProxy::Context::ClearChannel() {
   base::AutoLock l(channel_lifetime_lock_);
   channel_.reset();
-  associated_group_ = mojo::AssociatedGroup();
 }
 
 void ChannelProxy::Context::AddGenericAssociatedInterfaceForIOThread(
@@ -560,10 +558,6 @@
   context()->AddGenericAssociatedInterfaceForIOThread(name, factory);
 }
 
-mojo::AssociatedGroup* ChannelProxy::GetAssociatedGroup() {
-  return context()->associated_group();
-}
-
 void ChannelProxy::GetGenericRemoteAssociatedInterface(
     const std::string& name,
     mojo::ScopedInterfaceEndpointHandle handle) {
diff --git a/ipc/ipc_channel_proxy.h b/ipc/ipc_channel_proxy.h
index cde6a896..0bb7260c 100644
--- a/ipc/ipc_channel_proxy.h
+++ b/ipc/ipc_channel_proxy.h
@@ -21,7 +21,6 @@
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/associated_group.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/associated_interface_request.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
@@ -187,10 +186,6 @@
                    factory));
   }
 
-  // Gets the AssociatedGroup used to create new associated endpoints on this
-  // ChannelProxy.
-  mojo::AssociatedGroup* GetAssociatedGroup();
-
   // Requests an associated interface from the remote endpoint.
   void GetGenericRemoteAssociatedInterface(
       const std::string& name,
@@ -200,8 +195,7 @@
   template <typename Interface>
   void GetRemoteAssociatedInterface(
       mojo::AssociatedInterfacePtr<Interface>* proxy) {
-    mojo::AssociatedInterfaceRequest<Interface> request =
-        mojo::MakeRequest(proxy, GetAssociatedGroup());
+    auto request = mojo::MakeRequest(proxy);
     GetGenericRemoteAssociatedInterface(Interface::Name_, request.PassHandle());
   }
 
@@ -221,9 +215,7 @@
       scoped_refptr<mojo::ThreadSafeAssociatedInterfacePtr<Interface>>*
           out_ptr) {
     mojo::AssociatedInterfacePtrInfo<Interface> ptr_info;
-    mojo::AssociatedInterfaceRequest<Interface> request;
-    GetAssociatedGroup()->CreateAssociatedInterface(
-        mojo::AssociatedGroup::WILL_PASS_REQUEST, &ptr_info, &request);
+    auto request = mojo::MakeRequest(&ptr_info);
     GetGenericRemoteAssociatedInterface(Interface::Name_, request.PassHandle());
     *out_ptr = mojo::ThreadSafeAssociatedInterfacePtr<Interface>::Create(
         std::move(ptr_info), ipc_task_runner());
@@ -313,7 +305,6 @@
 
     void ClearChannel();
 
-    mojo::AssociatedGroup* associated_group() { return &associated_group_; }
     mojom::Channel& thread_safe_channel() {
       return thread_safe_channel_->proxy();
     }
@@ -355,8 +346,6 @@
     base::ProcessId peer_pid_;
     base::Lock peer_pid_lock_;
 
-    mojo::AssociatedGroup associated_group_;
-
     // A thread-safe mojom::Channel interface we use to make remote interface
     // requests from the proxy thread.
     std::unique_ptr<mojo::ThreadSafeForwarder<mojom::Channel>>
diff --git a/ipc/ipc_sync_message_filter.cc b/ipc/ipc_sync_message_filter.cc
index 77c6a3a..ffccff3 100644
--- a/ipc/ipc_sync_message_filter.cc
+++ b/ipc/ipc_sync_message_filter.cc
@@ -172,10 +172,6 @@
   {
     base::AutoLock auto_lock(lock_);
     channel_ = channel;
-    Channel::AssociatedInterfaceSupport* support =
-        channel_->GetAssociatedInterfaceSupport();
-    if (support)
-      channel_associated_group_ = *support->GetAssociatedGroup();
 
     io_task_runner_ = base::ThreadTaskRunnerHandle::Get();
     shutdown_watcher_.StartWatching(
diff --git a/ipc/ipc_sync_message_filter.h b/ipc/ipc_sync_message_filter.h
index f38fd49..abee662 100644
--- a/ipc/ipc_sync_message_filter.h
+++ b/ipc/ipc_sync_message_filter.h
@@ -17,7 +17,6 @@
 #include "ipc/ipc_sync_message.h"
 #include "ipc/message_filter.h"
 #include "ipc/mojo_event.h"
-#include "mojo/public/cpp/bindings/associated_group.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/associated_interface_request.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
@@ -55,8 +54,7 @@
   template <typename Interface>
   void GetRemoteAssociatedInterface(
       mojo::AssociatedInterfacePtr<Interface>* proxy) {
-    mojo::AssociatedInterfaceRequest<Interface> request =
-        mojo::MakeRequest(proxy, &channel_associated_group_);
+    auto request = mojo::MakeRequest(proxy);
     GetGenericRemoteAssociatedInterface(Interface::Name_, request.PassHandle());
   }
 
@@ -112,10 +110,6 @@
 
   scoped_refptr<IOMessageLoopObserver> io_message_loop_observer_;
 
-  // The AssociatedGroup for the underlying channel, used to construct new
-  // associated interface endpoints.
-  mojo::AssociatedGroup channel_associated_group_;
-
   base::WeakPtrFactory<SyncMessageFilter> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(SyncMessageFilter);
diff --git a/media/ffmpeg/ffmpeg_common.cc b/media/ffmpeg/ffmpeg_common.cc
index ce36e2f..91836b8 100644
--- a/media/ffmpeg/ffmpeg_common.cc
+++ b/media/ffmpeg/ffmpeg_common.cc
@@ -742,62 +742,4 @@
   return hash;
 }
 
-#define TEST_PRIMARY(P)                                                 \
-  static_assert(                                                        \
-      static_cast<int>(gfx::ColorSpace::PrimaryID::P) == AVCOL_PRI_##P, \
-      "gfx::ColorSpace::PrimaryID::" #P " does not match AVCOL_PRI_" #P);
-
-#define TEST_TRANSFER(T)                                                 \
-  static_assert(                                                         \
-      static_cast<int>(gfx::ColorSpace::TransferID::T) == AVCOL_TRC_##T, \
-      "gfx::ColorSpace::TransferID::" #T " does not match AVCOL_TRC_" #T);
-
-#define TEST_COLORSPACE(C)                                             \
-  static_assert(                                                       \
-      static_cast<int>(gfx::ColorSpace::MatrixID::C) == AVCOL_SPC_##C, \
-      "gfx::ColorSpace::MatrixID::" #C " does not match AVCOL_SPC_" #C);
-
-TEST_PRIMARY(RESERVED0);
-TEST_PRIMARY(BT709);
-TEST_PRIMARY(UNSPECIFIED);
-TEST_PRIMARY(RESERVED);
-TEST_PRIMARY(BT470M);
-TEST_PRIMARY(BT470BG);
-TEST_PRIMARY(SMPTE170M);
-TEST_PRIMARY(SMPTE240M);
-TEST_PRIMARY(FILM);
-TEST_PRIMARY(BT2020);
-TEST_PRIMARY(SMPTEST428_1);
-
-TEST_TRANSFER(RESERVED0);
-TEST_TRANSFER(BT709);
-TEST_TRANSFER(UNSPECIFIED);
-TEST_TRANSFER(RESERVED);
-TEST_TRANSFER(GAMMA22);
-TEST_TRANSFER(GAMMA28);
-TEST_TRANSFER(SMPTE170M);
-TEST_TRANSFER(SMPTE240M);
-TEST_TRANSFER(LINEAR);
-TEST_TRANSFER(LOG);
-TEST_TRANSFER(LOG_SQRT);
-TEST_TRANSFER(IEC61966_2_4);
-TEST_TRANSFER(BT1361_ECG);
-TEST_TRANSFER(IEC61966_2_1);
-TEST_TRANSFER(BT2020_10);
-TEST_TRANSFER(BT2020_12);
-TEST_TRANSFER(SMPTEST2084);
-TEST_TRANSFER(SMPTEST428_1);
-
-TEST_COLORSPACE(RGB);
-TEST_COLORSPACE(BT709);
-TEST_COLORSPACE(UNSPECIFIED);
-TEST_COLORSPACE(RESERVED);
-TEST_COLORSPACE(FCC);
-TEST_COLORSPACE(BT470BG);
-TEST_COLORSPACE(SMPTE170M);
-TEST_COLORSPACE(SMPTE240M);
-TEST_COLORSPACE(YCOCG);
-TEST_COLORSPACE(BT2020_NCL);
-TEST_COLORSPACE(BT2020_CL);
-
 }  // namespace media
diff --git a/media/filters/ffmpeg_video_decoder.cc b/media/filters/ffmpeg_video_decoder.cc
index c9b3b30..31a984d 100644
--- a/media/filters/ffmpeg_video_decoder.cc
+++ b/media/filters/ffmpeg_video_decoder.cc
@@ -185,12 +185,12 @@
   if (codec_context->color_primaries != AVCOL_PRI_UNSPECIFIED ||
       codec_context->color_trc != AVCOL_TRC_UNSPECIFIED ||
       codec_context->colorspace != AVCOL_SPC_UNSPECIFIED) {
-    video_frame->set_color_space(
-        gfx::ColorSpace(codec_context->color_primaries,
-                        codec_context->color_trc, codec_context->colorspace,
-                        codec_context->color_range != AVCOL_RANGE_MPEG
-                            ? gfx::ColorSpace::RangeID::FULL
-                            : gfx::ColorSpace::RangeID::LIMITED));
+    video_frame->set_color_space(gfx::ColorSpace::CreateVideo(
+        codec_context->color_primaries, codec_context->color_trc,
+        codec_context->colorspace,
+        codec_context->color_range != AVCOL_RANGE_MPEG
+            ? gfx::ColorSpace::RangeID::FULL
+            : gfx::ColorSpace::RangeID::LIMITED));
   }
 
   for (size_t i = 0; i < VideoFrame::NumPlanes(video_frame->format()); i++) {
diff --git a/media/filters/h264_parser.cc b/media/filters/h264_parser.cc
index 052f441d..9b17808 100644
--- a/media/filters/h264_parser.cc
+++ b/media/filters/h264_parser.cc
@@ -125,17 +125,17 @@
 // available from http://www.itu.int/rec/T-REC-H.264.
 gfx::ColorSpace H264SPS::GetColorSpace() const {
   if (colour_description_present_flag) {
-    return gfx::ColorSpace(
+    return gfx::ColorSpace::CreateVideo(
         colour_primaries, transfer_characteristics, matrix_coefficients,
         video_full_range_flag ? gfx::ColorSpace::RangeID::FULL
                               : gfx::ColorSpace::RangeID::LIMITED);
   } else {
-    return gfx::ColorSpace(gfx::ColorSpace::PrimaryID::UNSPECIFIED,
-                           gfx::ColorSpace::TransferID::UNSPECIFIED,
-                           gfx::ColorSpace::MatrixID::UNSPECIFIED,
-                           video_full_range_flag
-                               ? gfx::ColorSpace::RangeID::FULL
-                               : gfx::ColorSpace::RangeID::LIMITED);
+    // TODO(ccameron/hubbe): Add a uniform way to handle default video frames.
+    return gfx::ColorSpace(
+        gfx::ColorSpace::PrimaryID::BT709, gfx::ColorSpace::TransferID::BT709,
+        gfx::ColorSpace::MatrixID::BT709,
+        video_full_range_flag ? gfx::ColorSpace::RangeID::FULL
+                              : gfx::ColorSpace::RangeID::LIMITED);
   }
 }
 
diff --git a/media/filters/vpx_video_decoder.cc b/media/filters/vpx_video_decoder.cc
index 07b1bed..9ee8eaa5 100644
--- a/media/filters/vpx_video_decoder.cc
+++ b/media/filters/vpx_video_decoder.cc
@@ -604,11 +604,9 @@
     // bitstream data below.
     (*video_frame)->set_color_space(config_.color_space_info());
   } else {
-    gfx::ColorSpace::PrimaryID primaries =
-        gfx::ColorSpace::PrimaryID::UNSPECIFIED;
-    gfx::ColorSpace::TransferID transfer =
-        gfx::ColorSpace::TransferID::UNSPECIFIED;
-    gfx::ColorSpace::MatrixID matrix = gfx::ColorSpace::MatrixID::UNSPECIFIED;
+    gfx::ColorSpace::PrimaryID primaries = gfx::ColorSpace::PrimaryID::INVALID;
+    gfx::ColorSpace::TransferID transfer = gfx::ColorSpace::TransferID::INVALID;
+    gfx::ColorSpace::MatrixID matrix = gfx::ColorSpace::MatrixID::INVALID;
     gfx::ColorSpace::RangeID range = vpx_image->range == VPX_CR_FULL_RANGE
                                          ? gfx::ColorSpace::RangeID::FULL
                                          : gfx::ColorSpace::RangeID::LIMITED;
@@ -651,7 +649,8 @@
         break;
     }
 
-    if (primaries != gfx::ColorSpace::PrimaryID::UNSPECIFIED) {
+    // TODO(ccameron): Set a color space even for unspecified values.
+    if (primaries != gfx::ColorSpace::PrimaryID::INVALID) {
       (*video_frame)
           ->set_color_space(
               gfx::ColorSpace(primaries, transfer, matrix, range));
diff --git a/media/formats/webm/webm_colour_parser.cc b/media/formats/webm/webm_colour_parser.cc
index ddc9b93..5e62ff9 100644
--- a/media/formats/webm/webm_colour_parser.cc
+++ b/media/formats/webm/webm_colour_parser.cc
@@ -254,83 +254,6 @@
 
 // ---- End copy/paste from libwebm/webm_parser/include/webm/dom_types.h ----
 
-// Ensure that libwebm enum values match enums in gfx::ColorSpace.
-#define STATIC_ASSERT_ENUM(a, b)                                             \
-  static_assert(static_cast<int>(a) == static_cast<int>(gfx::ColorSpace::b), \
-                "mismatching enums: " #a " and " #b)
-
-STATIC_ASSERT_ENUM(MatrixCoefficients::kRgb, MatrixID::RGB);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kBt709, MatrixID::BT709);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kUnspecified, MatrixID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kFcc, MatrixID::FCC);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kBt470Bg, MatrixID::BT470BG);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kSmpte170M, MatrixID::SMPTE170M);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kSmpte240M, MatrixID::SMPTE240M);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kYCgCo, MatrixID::YCOCG);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kBt2020NonconstantLuminance,
-                   MatrixID::BT2020_NCL);
-STATIC_ASSERT_ENUM(MatrixCoefficients::kBt2020ConstantLuminance,
-                   MatrixID::BT2020_CL);
-
-gfx::ColorSpace::MatrixID FromWebMMatrixCoefficients(MatrixCoefficients c) {
-  return static_cast<gfx::ColorSpace::MatrixID>(c);
-}
-
-STATIC_ASSERT_ENUM(Range::kUnspecified, RangeID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(Range::kBroadcast, RangeID::LIMITED);
-STATIC_ASSERT_ENUM(Range::kFull, RangeID::FULL);
-STATIC_ASSERT_ENUM(Range::kDerived, RangeID::DERIVED);
-
-gfx::ColorSpace::RangeID FromWebMRange(Range range) {
-  return static_cast<gfx::ColorSpace::RangeID>(range);
-}
-
-STATIC_ASSERT_ENUM(TransferCharacteristics::kBt709, TransferID::BT709);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kUnspecified,
-                   TransferID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kGamma22curve, TransferID::GAMMA22);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kGamma28curve, TransferID::GAMMA28);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kSmpte170M, TransferID::SMPTE170M);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kSmpte240M, TransferID::SMPTE240M);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kLinear, TransferID::LINEAR);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kLog, TransferID::LOG);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kLogSqrt, TransferID::LOG_SQRT);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kIec6196624,
-                   TransferID::IEC61966_2_4);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kBt1361ExtendedColourGamut,
-                   TransferID::BT1361_ECG);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kIec6196621,
-                   TransferID::IEC61966_2_1);
-STATIC_ASSERT_ENUM(TransferCharacteristics::k10BitBt2020,
-                   TransferID::BT2020_10);
-STATIC_ASSERT_ENUM(TransferCharacteristics::k12BitBt2020,
-                   TransferID::BT2020_12);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kSmpteSt2084,
-                   TransferID::SMPTEST2084);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kSmpteSt4281,
-                   TransferID::SMPTEST428_1);
-STATIC_ASSERT_ENUM(TransferCharacteristics::kAribStdB67Hlg,
-                   TransferID::ARIB_STD_B67);
-
-gfx::ColorSpace::TransferID FromWebMTransferCharacteristics(
-    TransferCharacteristics tc) {
-  return static_cast<gfx::ColorSpace::TransferID>(tc);
-}
-
-STATIC_ASSERT_ENUM(Primaries::kBt709, PrimaryID::BT709);
-STATIC_ASSERT_ENUM(Primaries::kUnspecified, PrimaryID::UNSPECIFIED);
-STATIC_ASSERT_ENUM(Primaries::kBt470M, PrimaryID::BT470M);
-STATIC_ASSERT_ENUM(Primaries::kBt470Bg, PrimaryID::BT470BG);
-STATIC_ASSERT_ENUM(Primaries::kSmpte170M, PrimaryID::SMPTE170M);
-STATIC_ASSERT_ENUM(Primaries::kSmpte240M, PrimaryID::SMPTE240M);
-STATIC_ASSERT_ENUM(Primaries::kFilm, PrimaryID::FILM);
-STATIC_ASSERT_ENUM(Primaries::kBt2020, PrimaryID::BT2020);
-STATIC_ASSERT_ENUM(Primaries::kSmpteSt4281, PrimaryID::SMPTEST428_1);
-
-gfx::ColorSpace::PrimaryID FromWebMPrimaries(Primaries primaries) {
-  return static_cast<gfx::ColorSpace::PrimaryID>(primaries);
-}
-
 WebMColorMetadata::WebMColorMetadata() {}
 WebMColorMetadata::WebMColorMetadata(const WebMColorMetadata& rhs) = default;
 
@@ -490,28 +413,23 @@
   if (chroma_siting_vert_ != -1)
     color_metadata.ChromaSitingVert = chroma_siting_vert_;
 
-  gfx::ColorSpace::MatrixID matrix_id = gfx::ColorSpace::MatrixID::UNSPECIFIED;
-  if (matrix_coefficients_ != -1)
-    matrix_id = FromWebMMatrixCoefficients(
-        static_cast<MatrixCoefficients>(matrix_coefficients_));
-
-  gfx::ColorSpace::RangeID range_id = gfx::ColorSpace::RangeID::UNSPECIFIED;
-  if (range_ != -1)
-    range_id = FromWebMRange(static_cast<Range>(range_));
-
-  gfx::ColorSpace::TransferID transfer_id =
-      gfx::ColorSpace::TransferID::UNSPECIFIED;
-  if (transfer_characteristics_ != -1)
-    transfer_id = FromWebMTransferCharacteristics(
-        static_cast<TransferCharacteristics>(transfer_characteristics_));
-
-  gfx::ColorSpace::PrimaryID primary_id =
-      gfx::ColorSpace::PrimaryID::UNSPECIFIED;
-  if (primaries_ != -1)
-    primary_id = FromWebMPrimaries(static_cast<Primaries>(primaries_));
-
-  color_metadata.color_space =
-      gfx::ColorSpace(primary_id, transfer_id, matrix_id, range_id);
+  gfx::ColorSpace::RangeID range_id = gfx::ColorSpace::RangeID::FULL;
+  switch (static_cast<Range>(range_)) {
+    case Range::kUnspecified:
+      range_id = gfx::ColorSpace::RangeID::FULL;
+      break;
+    case Range::kBroadcast:
+      range_id = gfx::ColorSpace::RangeID::LIMITED;
+      break;
+    case Range::kFull:
+      range_id = gfx::ColorSpace::RangeID::FULL;
+      break;
+    case Range::kDerived:
+      range_id = gfx::ColorSpace::RangeID::DERIVED;
+      break;
+  }
+  color_metadata.color_space = gfx::ColorSpace::CreateVideo(
+      primaries_, transfer_characteristics_, matrix_coefficients_, range_id);
 
   if (max_cll_ != -1)
     color_metadata.hdr_metadata.max_cll = max_cll_;
diff --git a/mojo/edk/system/channel_posix.cc b/mojo/edk/system/channel_posix.cc
index f4687562..fb43b85 100644
--- a/mojo/edk/system/channel_posix.cc
+++ b/mojo/edk/system/channel_posix.cc
@@ -210,14 +210,16 @@
   void StartOnIOThread() {
     DCHECK(!read_watcher_);
     DCHECK(!write_watcher_);
-    read_watcher_.reset(new base::MessageLoopForIO::FileDescriptorWatcher);
+    read_watcher_.reset(
+        new base::MessageLoopForIO::FileDescriptorWatcher(FROM_HERE));
     base::MessageLoop::current()->AddDestructionObserver(this);
     if (handle_.get().needs_connection) {
       base::MessageLoopForIO::current()->WatchFileDescriptor(
           handle_.get().handle, false /* persistent */,
           base::MessageLoopForIO::WATCH_READ, read_watcher_.get(), this);
     } else {
-      write_watcher_.reset(new base::MessageLoopForIO::FileDescriptorWatcher);
+      write_watcher_.reset(
+          new base::MessageLoopForIO::FileDescriptorWatcher(FROM_HERE));
       base::MessageLoopForIO::current()->WatchFileDescriptor(
           handle_.get().handle, true /* persistent */,
           base::MessageLoopForIO::WATCH_READ, read_watcher_.get(), this);
diff --git a/net/base/address_tracker_linux.cc b/net/base/address_tracker_linux.cc
index 7ce4687..1cbfec7 100644
--- a/net/base/address_tracker_linux.cc
+++ b/net/base/address_tracker_linux.cc
@@ -116,6 +116,7 @@
       link_callback_(base::Bind(&base::DoNothing)),
       tunnel_callback_(base::Bind(&base::DoNothing)),
       netlink_fd_(-1),
+      watcher_(FROM_HERE),
       ignored_interfaces_(),
       connection_type_initialized_(false),
       connection_type_initialized_cv_(&connection_type_lock_),
@@ -133,6 +134,7 @@
       link_callback_(link_callback),
       tunnel_callback_(tunnel_callback),
       netlink_fd_(-1),
+      watcher_(FROM_HERE),
       ignored_interfaces_(ignored_interfaces),
       connection_type_initialized_(false),
       connection_type_initialized_cv_(&connection_type_lock_),
diff --git a/net/dns/notify_watcher_mac.cc b/net/dns/notify_watcher_mac.cc
index 286f18b..6d22d70 100644
--- a/net/dns/notify_watcher_mac.cc
+++ b/net/dns/notify_watcher_mac.cc
@@ -11,7 +11,8 @@
 
 namespace net {
 
-NotifyWatcherMac::NotifyWatcherMac() : notify_fd_(-1), notify_token_(-1) {}
+NotifyWatcherMac::NotifyWatcherMac()
+    : notify_fd_(-1), notify_token_(-1), watcher_(FROM_HERE) {}
 
 NotifyWatcherMac::~NotifyWatcherMac() {
   Cancel();
diff --git a/net/proxy/proxy_config_service_linux.cc b/net/proxy/proxy_config_service_linux.cc
index f0f03dc4..537eb49f 100644
--- a/net/proxy/proxy_config_service_linux.cc
+++ b/net/proxy/proxy_config_service_linux.cc
@@ -863,6 +863,7 @@
  public:
   explicit SettingGetterImplKDE(base::Environment* env_var_getter)
       : inotify_fd_(-1),
+        inotify_watcher_(FROM_HERE),
         notify_delegate_(nullptr),
         debounce_timer_(new base::OneShotTimer()),
         indirect_manual_(false),
diff --git a/net/socket/socket_posix.cc b/net/socket/socket_posix.cc
index 09d9baec..20cc92b 100644
--- a/net/socket/socket_posix.cc
+++ b/net/socket/socket_posix.cc
@@ -60,7 +60,10 @@
 
 SocketPosix::SocketPosix()
     : socket_fd_(kInvalidSocket),
+      accept_socket_watcher_(FROM_HERE),
+      read_socket_watcher_(FROM_HERE),
       read_buf_len_(0),
+      write_socket_watcher_(FROM_HERE),
       write_buf_len_(0),
       waiting_connect_(false) {}
 
diff --git a/net/socket/udp_socket_posix.cc b/net/socket/udp_socket_posix.cc
index 395541e0..1fee495 100644
--- a/net/socket/udp_socket_posix.cc
+++ b/net/socket/udp_socket_posix.cc
@@ -162,6 +162,8 @@
       multicast_time_to_live_(1),
       bind_type_(bind_type),
       rand_int_cb_(rand_int_cb),
+      read_socket_watcher_(FROM_HERE),
+      write_socket_watcher_(FROM_HERE),
       read_watcher_(this),
       write_watcher_(this),
       read_buf_len_(0),
diff --git a/net/ssl/ssl_client_session_cache_unittest.cc b/net/ssl/ssl_client_session_cache_unittest.cc
index a30a84ef..3f3bb54f 100644
--- a/net/ssl/ssl_client_session_cache_unittest.cc
+++ b/net/ssl/ssl_client_session_cache_unittest.cc
@@ -28,24 +28,37 @@
   return clock;
 }
 
-bssl::UniquePtr<SSL_SESSION> MakeTestSession(base::Time now,
-                                             base::TimeDelta timeout) {
-  bssl::UniquePtr<SSL_SESSION> session(SSL_SESSION_new());
-  SSL_SESSION_set_time(session.get(), now.ToTimeT());
-  SSL_SESSION_set_timeout(session.get(), timeout.InSeconds());
-  return session;
-}
+class SSLClientSessionCacheTest : public testing::Test {
+ public:
+  SSLClientSessionCacheTest() : ssl_ctx_(SSL_CTX_new(TLS_method())) {}
+
+ protected:
+  bssl::UniquePtr<SSL_SESSION> NewSSLSession() {
+    return bssl::UniquePtr<SSL_SESSION>(SSL_SESSION_new(ssl_ctx_.get()));
+  }
+
+  bssl::UniquePtr<SSL_SESSION> MakeTestSession(base::Time now,
+                                               base::TimeDelta timeout) {
+    bssl::UniquePtr<SSL_SESSION> session = NewSSLSession();
+    SSL_SESSION_set_time(session.get(), now.ToTimeT());
+    SSL_SESSION_set_timeout(session.get(), timeout.InSeconds());
+    return session;
+  }
+
+ private:
+  bssl::UniquePtr<SSL_CTX> ssl_ctx_;
+};
 
 }  // namespace
 
 // Test basic insertion and lookup operations.
-TEST(SSLClientSessionCacheTest, Basic) {
+TEST_F(SSLClientSessionCacheTest, Basic) {
   SSLClientSessionCache::Config config;
   SSLClientSessionCache cache(config);
 
-  bssl::UniquePtr<SSL_SESSION> session1(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session2(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session3(SSL_SESSION_new());
+  bssl::UniquePtr<SSL_SESSION> session1 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session2 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session3 = NewSSLSession();
   EXPECT_EQ(1u, session1->references);
   EXPECT_EQ(1u, session2->references);
   EXPECT_EQ(1u, session3->references);
@@ -89,12 +102,12 @@
 
 // Test that pairs of calls to Lookup/ResetLookupCount appropriately log to
 // UMA.
-TEST(SSLClientSessionCacheTest, LookupCountUMA) {
+TEST_F(SSLClientSessionCacheTest, LookupCountUMA) {
   SSLClientSessionCache::Config config;
   SSLClientSessionCache cache(config);
 
-  bssl::UniquePtr<SSL_SESSION> session1(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session2(SSL_SESSION_new());
+  bssl::UniquePtr<SSL_SESSION> session1 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session2 = NewSSLSession();
   cache.Insert("key1", session1.get());
   cache.Insert("key2", session2.get());
 
@@ -128,11 +141,11 @@
 
 // Test that a session may be inserted at two different keys. This should never
 // be necessary, but the API doesn't prohibit it.
-TEST(SSLClientSessionCacheTest, DoubleInsert) {
+TEST_F(SSLClientSessionCacheTest, DoubleInsert) {
   SSLClientSessionCache::Config config;
   SSLClientSessionCache cache(config);
 
-  bssl::UniquePtr<SSL_SESSION> session(SSL_SESSION_new());
+  bssl::UniquePtr<SSL_SESSION> session = NewSSLSession();
   EXPECT_EQ(1u, session->references);
 
   EXPECT_EQ(nullptr, cache.Lookup("key1", nullptr).get());
@@ -162,15 +175,15 @@
 }
 
 // Tests that the session cache's size is correctly bounded.
-TEST(SSLClientSessionCacheTest, MaxEntries) {
+TEST_F(SSLClientSessionCacheTest, MaxEntries) {
   SSLClientSessionCache::Config config;
   config.max_entries = 3;
   SSLClientSessionCache cache(config);
 
-  bssl::UniquePtr<SSL_SESSION> session1(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session2(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session3(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session4(SSL_SESSION_new());
+  bssl::UniquePtr<SSL_SESSION> session1 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session2 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session3 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session4 = NewSSLSession();
 
   // Insert three entries.
   cache.Insert("key1", session1.get());
@@ -200,7 +213,7 @@
 }
 
 // Tests that session expiration works properly.
-TEST(SSLClientSessionCacheTest, Expiration) {
+TEST_F(SSLClientSessionCacheTest, Expiration) {
   const size_t kNumEntries = 20;
   const size_t kExpirationCheckCount = 10;
   const base::TimeDelta kTimeout = base::TimeDelta::FromSeconds(1000);
@@ -248,7 +261,7 @@
 
 // Tests that Lookup performs an expiration check before returning a cached
 // session.
-TEST(SSLClientSessionCacheTest, LookupExpirationCheck) {
+TEST_F(SSLClientSessionCacheTest, LookupExpirationCheck) {
   // kExpirationCheckCount is set to a suitably large number so the automated
   // pruning never triggers.
   const size_t kExpirationCheckCount = 1000;
@@ -296,7 +309,7 @@
 }
 
 // Test that SSL cache is flushed on low memory notifications
-TEST(SSLClientSessionCacheTest, TestFlushOnMemoryNotifications) {
+TEST_F(SSLClientSessionCacheTest, TestFlushOnMemoryNotifications) {
   // kExpirationCheckCount is set to a suitably large number so the automated
   // pruning never triggers.
   const size_t kExpirationCheckCount = 1000;
@@ -342,13 +355,13 @@
 }
 
 // Basic test for dumping memory stats.
-TEST(SSLClientSessionCacheTest, TestDumpMemoryStats) {
+TEST_F(SSLClientSessionCacheTest, TestDumpMemoryStats) {
   SSLClientSessionCache::Config config;
   SSLClientSessionCache cache(config);
 
-  bssl::UniquePtr<SSL_SESSION> session1(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session2(SSL_SESSION_new());
-  bssl::UniquePtr<SSL_SESSION> session3(SSL_SESSION_new());
+  bssl::UniquePtr<SSL_SESSION> session1 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session2 = NewSSLSession();
+  bssl::UniquePtr<SSL_SESSION> session3 = NewSSLSession();
 
   // Insert three entries.
   cache.Insert("key1", session1.get());
diff --git a/sandbox/linux/OWNERS b/sandbox/linux/OWNERS
index 99ef1bd..c05fa11 100644
--- a/sandbox/linux/OWNERS
+++ b/sandbox/linux/OWNERS
@@ -1,4 +1,7 @@
 jln@chromium.org
 jorgelo@chromium.org
+rsesek@chromium.org
+
+# Emeritus
 mdempsky@chromium.org
 rickyz@chromium.org
diff --git a/sandbox/win/BUILD.gn b/sandbox/win/BUILD.gn
index 958996b..1d51220c 100644
--- a/sandbox/win/BUILD.gn
+++ b/sandbox/win/BUILD.gn
@@ -221,9 +221,6 @@
     "//build/config/sanitizers:deps",
     "//build/win:default_exe_manifest",
   ]
-
-  # cfi_unittest.cc tests require this exe is built with CFG enabled.
-  configs += [ "//build/config/win:win_msvc_cfg" ]
 }
 
 loadable_module("sbox_integration_test_hook_dll") {
diff --git a/sandbox/win/tests/integration_tests/cfi_unittest_exe.cc b/sandbox/win/tests/integration_tests/cfi_unittest_exe.cc
index c4c1e40..07e17ea 100644
--- a/sandbox/win/tests/integration_tests/cfi_unittest_exe.cc
+++ b/sandbox/win/tests/integration_tests/cfi_unittest_exe.cc
@@ -220,9 +220,9 @@
 //    The whole purpose of this unittest is to ensure that a failed CFG check in
 //    a Microsoft binary results in an exception.  If CFG is not properly
 //    enabled for a process, no exception will be thrown.
-//    This test EXE is built with
-//    configs += [ "//build/config/win:win_msvc_cfg" ]
-//    which should result in CFG enabled on the process.
+//    All Chromium projects should be linked with "common_linker_setup" config
+//    (build\config\win\BUILD.gn), which should result in CFG enabled on the
+//    process.
 //
 //  - The patches (x86 or x64) were carefully constructed to be valid and not
 //    mess up the executing instructions.  Need to ensure that the CFG check
diff --git a/services/shape_detection/PRESUBMIT.py b/services/shape_detection/PRESUBMIT.py
index ad094f7..93854d4dc 100644
--- a/services/shape_detection/PRESUBMIT.py
+++ b/services/shape_detection/PRESUBMIT.py
@@ -13,24 +13,12 @@
 def PostUploadHook(cl, change, output_api):
   """git cl upload will call this hook after the issue is created/modified.
 
-  This hook adds extra try bots list to the CL description in order to run
+  This hook adds an extra try bot list to the CL description in order to run
   the Mac GPU bots in addition to the usual CQ try bots.
   """
-  rietveld_obj = cl.RpcServer()
-  issue = cl.issue
-  description = rietveld_obj.get_description(issue)
-  if re.search(r'^CQ_INCLUDE_TRYBOTS=.*', description, re.M | re.I):
-    return []
-
-  bots = [ 'master.tryserver.chromium.mac:mac_optional_gpu_tests_rel' ]
-
-  results = []
-  new_description = description
-  new_description += '\nCQ_INCLUDE_TRYBOTS=%s' % ';'.join(bots)
-  results.append(output_api.PresubmitNotifyResult(
-      'Automatically added optional Mac GPU tests to run on CQ.'))
-
-  if new_description != description:
-    rietveld_obj.update_description(issue, new_description)
-
-  return results
+  return output_api.EnsureCQIncludeTrybotsAreAdded(
+    cl,
+    [
+      'master.tryserver.chromium.mac:mac_optional_gpu_tests_rel'
+    ],
+    'Automatically added optional Mac GPU tests to run on CQ.')
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index f928ad5..11f96a60 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -1817,7 +1817,7 @@
             ],
             "experiments": [
                 {
-                    "name": "EnabledCGRUV20",
+                    "name": "EnabledCGRUV20b",
                     "params": {
                         "config_url": "https://www.gstatic.com/chrome/wifiprefetch/precache_config_g20"
                     }
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2 b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
index 36372fb..436ce36 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
@@ -408,7 +408,6 @@
 Bug(none) compositing/scrollbars/custom-composited-different-track-parts.html [ Failure ]
 Bug(none) compositing/scrollbars/nested-overlay-scrollbars.html [ Failure ]
 Bug(none) compositing/self-painting-layers.html [ Failure ]
-Bug(none) compositing/shadows/shadow-drawing.html [ Failure ]
 Bug(none) compositing/squashing/add-remove-squashed-layers.html [ Failure ]
 Bug(none) compositing/squashing/clipping-ancestor.html [ Failure ]
 Bug(none) compositing/squashing/composited-bounds-for-negative-z.html [ Failure ]
@@ -534,12 +533,10 @@
 Bug(none) fast/borders/rtl-border-02.html [ Failure ]
 Bug(none) fast/borders/rtl-border-03.html [ Failure ]
 Bug(none) fast/box-shadow/basic-shadows.html [ Failure ]
-Bug(none) fast/box-shadow/box-shadow-clipped-slices.html [ Failure Timeout ]
 Bug(none) fast/box-shadow/box-shadow-transformed.html [ Failure ]
 Bug(none) fast/box-shadow/box-shadow.html [ Failure ]
 Bug(none) fast/box-shadow/scaled-box-shadow.html [ Failure ]
 Bug(none) fast/box-sizing/box-sizing.html [ Failure ]
-Bug(none) fast/canvas/alpha.html [ Failure ]
 Bug(none) fast/canvas/canvas-composite-video.html [ Failure ]
 Bug(none) fast/canvas/canvas-css-clip-path.html [ Failure ]
 Bug(none) fast/canvas/webgl/pixelated.html [ Failure ]
@@ -627,16 +624,11 @@
 Bug(none) fast/forms/select/listbox-appearance-basic.html [ Failure ]
 Bug(none) fast/forms/select/menulist-appearance-basic.html [ Failure ]
 Bug(none) fast/forms/select/menulist-appearance-rtl.html [ Failure ]
-Bug(none) fast/forms/select/menulist-deselect-update.html [ Crash Failure ]
-Bug(none) fast/forms/select/menulist-width-change.html [ Crash Failure ]
-Bug(none) fast/forms/select/select-change-listbox-to-popup.html [ Crash Failure ]
-Bug(none) fast/forms/select/select-writing-direction-natural.html [ Crash Failure ]
 Bug(none) fast/forms/select-popup/popup-menu-appearance-zoom110.html [ Crash ]
 Bug(none) fast/forms/text/input-appearance-selection.html [ Failure ]
 Bug(none) fast/forms/text/input-readonly-autoscroll.html [ Failure ]
 Bug(none) fast/forms/text/input-table.html [ Failure ]
 Bug(none) fast/forms/text/input-text-scroll-left-on-blur.html [ Failure ]
-Bug(none) fast/forms/text/textfield-overflow.html [ Failure ]
 Bug(none) fast/forms/textarea/basic-textareas-quirks.html [ Failure ]
 Bug(none) fast/forms/textarea/basic-textareas.html [ Failure ]
 Bug(none) fast/forms/textarea/textarea-scrolled-focus-ring.html [ Failure ]
@@ -668,7 +660,6 @@
 Bug(none) html/details_summary/details-remove-summary-4-and-click.html [ Crash Failure ]
 Bug(none) html/details_summary/details-remove-summary-5-and-click.html [ Failure ]
 Bug(none) html/details_summary/details-remove-summary-6-and-click.html [ Failure ]
-Bug(none) images/182.html [ Crash Failure ]
 Bug(none) images/color-profile-border-fade.html [ Failure ]
 Bug(none) images/color-profile-border-radius.html [ Failure ]
 Bug(none) images/color-profile-filter.html [ Failure ]
@@ -921,7 +912,6 @@
 Bug(none) fast/scrolling/scrollbar-tickmarks-styled.html [ Failure ]
 Bug(none) fast/selectors/166.html [ Failure ]
 Bug(none) fast/sub-pixel/column-clipping.html [ Failure ]
-Bug(none) fast/sub-pixel/ellipsis-zoom.html [ Crash Failure ]
 Bug(none) fast/sub-pixel/repaint-subpixel-layer-in-subpixel-composited-layer.html [ Failure ]
 Bug(none) fast/sub-pixel/should-not-repaint-subpixel-composited-layer.html [ Failure ]
 Bug(none) fast/sub-pixel/sub-pixel-composited-layer-with-transform.html [ Failure ]
@@ -982,14 +972,7 @@
 Bug(none) fast/text/capitalize-boundaries.html [ Failure ]
 Bug(none) fast/text/descent-clip-in-scaled-page.html [ Crash Timeout ]
 Bug(none) fast/text/ellipsis-ltr-text-in-ltr-flow-underline-composition.html [ Failure ]
-Bug(none) fast/text/ellipsis-ltr-text-in-rtl-flow-underline-composition.html [ Failure ]
 Bug(none) fast/text/ellipsis-rtl-text-in-ltr-flow-underline-composition.html [ Failure ]
-Bug(none) fast/text/ellipsis-rtl-text-in-ltr-flow-underline.html [ Failure ]
-Bug(none) fast/text/ellipsis-rtl-text-in-ltr-flow.html [ Failure ]
-Bug(none) fast/text/ellipsis-rtl-text-in-rtl-flow-underline-composition.html [ Failure ]
-Bug(none) fast/text/ellipsis-rtl-text-in-rtl-flow-underline.html [ Failure ]
-Bug(none) fast/text/ellipsis-rtl-text-in-rtl-flow.html [ Failure ]
-Bug(none) fast/text/ellipsis-stroked.html [ Failure ]
 Bug(none) fast/text/emphasis.html [ Failure ]
 Bug(none) fast/text/font-stretch-variant.html [ Failure ]
 Bug(none) fast/text/font-weight-variant.html [ Failure ]
@@ -1014,8 +997,6 @@
 # Subpixel differences
 Bug(none) svg/as-image/img-preserveAspectRatio-support-1.html [ Failure ]
 Bug(none) svg/as-image/svgview-references.html [ Failure ]
-Bug(none) svg/as-object/embedded-svg-immediate-offsetWidth-query.html [ Crash Failure ]
-Bug(none) svg/as-object/object-box-sizing-no-width-height.html [ Failure ]
 Bug(none) svg/batik/filters/feTile.svg [ Failure ]
 Bug(none) svg/batik/filters/filterRegions.svg [ Failure ]
 Bug(none) svg/batik/masking/maskRegions.svg [ Failure ]
@@ -1101,7 +1082,6 @@
 Bug(none) svg/custom/non-scaling-stroke.svg [ Failure ]
 Bug(none) svg/custom/object-sizing-no-width-height.xhtml [ Failure ]
 Bug(none) svg/custom/path-bad-data.svg [ Failure ]
-Bug(none) svg/custom/pointer-events-text-css-transform.svg [ Crash Timeout Failure ]
 Bug(none) svg/custom/preserve-aspect-ratio-syntax.svg [ Failure ]
 Bug(none) svg/custom/recursive-clippath.svg [ Failure ]
 Bug(none) svg/custom/recursive-filter.svg [ Failure ]
@@ -1194,12 +1174,10 @@
 Bug(none) svg/stroke/zero-length-arc-linecaps-rendering.svg [ Failure ]
 Bug(none) svg/stroke/zero-length-path-linecap-rendering.svg [ Failure ]
 Bug(none) svg/stroke/zero-length-subpaths-linecap-rendering.svg [ Failure ]
-Bug(none) svg/text/combining-character-queries.html [ Failure ]
 Bug(none) svg/text/foreignObject-text-clipping-bug.xml [ Failure ]
 Bug(none) svg/text/select-textLength-spacingAndGlyphs-squeeze-4.svg [ Failure ]
 Bug(none) svg/text/selection-styles.xhtml [ Failure ]
 Bug(none) svg/text/small-fonts-3.svg [ Failure ]
-Bug(none) svg/text/small-fonts.svg [ Crash Timeout Failure ]
 Bug(none) svg/text/text-fill-opacity.svg [ Failure ]
 Bug(none) svg/text/text-selection-align-01-b.svg [ Failure ]
 Bug(none) svg/text/text-selection-align-02-b.svg [ Failure ]
@@ -1211,7 +1189,6 @@
 Bug(none) svg/text/text-selection-text-04-t.svg [ Failure ]
 Bug(none) svg/text/text-selection-text-08-b.svg [ Failure ]
 Bug(none) svg/text/text-selection-ws-02-t.svg [ Failure ]
-Bug(none) svg/text/text-with-geometric-precision.svg [ Crash Failure ]
 Bug(none) svg/transforms/svg-css-transforms-clip-path.xhtml [ Failure ]
 Bug(none) svg/transforms/svg-css-transforms.xhtml [ Failure ]
 Bug(none) svg/transforms/text-with-mask-with-svg-transform.svg [ Failure ]
@@ -1574,8 +1551,6 @@
 Bug(none) svg/custom/transformedMaskFails.svg [ Failure ]
 Bug(none) svg/filters/feSpecularLight-premultiplied.svg [ Failure ]
 
-Bug(none) fast/forms/select-popup/popup-menu-position.html [ Failure ]
-
 # Text failures due to layerization differences
 Bug(none) compositing/will-change/will-change-contents-suppresses-compositing.html [ Failure ]
 Bug(none) css3/blending/mix-blend-mode-2nd-stacking-context-composited.html [ Failure ]
@@ -1648,14 +1623,6 @@
 Bug(none) compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html [ Failure ]
 Bug(none) fast/table/edge-offsets.html [ Failure ]
 
-# Failing because SPv2 applies extra clips for SVG root clip or control clip.
-crbug.com/680325 fast/forms/button-positioned.html [ Failure ]
-crbug.com/680325 fast/forms/text/input-appearance-preventDefault.html [ Failure ]
-crbug.com/680325 svg/custom/mouse-move-on-svg-container-standalone.svg [ Failure ]
-crbug.com/680325 svg/custom/mouse-move-on-svg-root-standalone.svg [ Failure ]
-crbug.com/680325 svg/custom/pattern-userSpaceOnUse-userToBaseTransform.xhtml [ Failure ]
-crbug.com/680325 svg/custom/viewport-update2.svg [ Failure ]
-
 # Some work remains to fully support composited animation and scrolling.
 crbug.com/674317 virtual/threaded/animations/KeyframeEffectReadOnly-composited-animation.html [ Timeout ]
 crbug.com/674317 virtual/threaded/animations/composited-animations-rotate-zero-degrees.html [ Timeout ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 5c857b2..8c7d7a72 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -2349,8 +2349,6 @@
 
 crbug.com/685951 css2.1/t040304-c64-uri-00-a-g.html [ Failure Pass ]
 
-skbug.com/6203 [ Mac ] fast/forms/text/text-font-height-mismatch.html [ NeedsManualRebaseline ]
-
 # Sheriff failures 2017-02-03
 crbug.com/688515 fast/spatial-navigation/snav-div-overflow-scrol-hidden.html [ Pass Failure ]
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing-expected.txt b/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing-expected.txt
index 0d0c5581..46309d1 100644
--- a/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing-expected.txt
@@ -34,3 +34,8 @@
 Frame: '<!--framePath //<!--frame6-->-->'
 --------
 PASS
+
+--------
+Frame: '<!--framePath //<!--frame7-->-->'
+--------
+PASS
diff --git a/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing.html b/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing.html
index db6bdc0c..dc66316 100644
--- a/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing.html
+++ b/third_party/WebKit/LayoutTests/http/tests/misc/last-modified-parsing.html
@@ -6,6 +6,8 @@
 
 function getExpectedLastModified(lastModified) {
     var date = new Date(lastModified);
+    if (isNaN(date.getTime()))
+      return "illformed-date";
     var month = ('0' + (date.getMonth() + 1)).slice(-2);
     var day = ('0' + date.getDate()).slice(-2);
     var hour = ('0' + date.getHours()).slice(-2);
@@ -27,4 +29,5 @@
 test('Mon, 21-Feb-2008 01:03:33 GMT');
 test('Mon, 03-Feb-2008 01:03:33 GMT');
 test('Mon, 3-Mar-2008 01:03:33 GMT');
+test('Something ill-formed');
 </script>
diff --git a/third_party/WebKit/LayoutTests/http/tests/resources/last-modified.php b/third_party/WebKit/LayoutTests/http/tests/resources/last-modified.php
index 6465f77..8dded1c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/resources/last-modified.php
+++ b/third_party/WebKit/LayoutTests/http/tests/resources/last-modified.php
@@ -6,7 +6,13 @@
 <script>
 var expected = '<?=$expected?>';
 var lastModified = document.lastModified;
-if (expected == lastModified) {
+
+// If expected is 'illformed-date', then the Last-Modified: header
+// is assumed to contain an unparseable date. For which we're supposed
+// to return the current time per spec. Simply verify that by checking
+// that the |lastModified| parses.
+if (expected === lastModified ||
+    (expected === "illformed-date" && !isNaN(Date.parse(lastModified)))) {
     document.write('PASS');
 } else {
     document.write('FAIL: expect ' + expected + ', but got ' + lastModified);
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.png
index 105cd0f..d41eedf 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.txt
index 36474e3c..f53c173 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/text/text-font-height-mismatch-expected.txt
@@ -7,18 +7,18 @@
         LayoutText {#text} at (0,0) size 273x18
           text run at (0,0) width 273: "Editable text should be centered vertically."
       LayoutBlockFlow {DIV} at (0,34) size 784x28
-        LayoutTextControl {INPUT} at (0,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutTextControl {INPUT} at (251,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (0,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (194,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,62) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 274x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,90) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 173x28 [bgcolor=#FFFFFF] [border: (2px inset #EEEEEE)]
-layer at (10,52) size 247x24
-  LayoutBlockFlow {DIV} at (2,2) size 247x24
+layer at (10,52) size 190x24
+  LayoutBlockFlow {DIV} at (2,2) size 190x24
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
-layer at (261,52) size 247x24
-  LayoutBlockFlow {DIV} at (2,2) size 247x24
+layer at (204,52) size 190x24
+  LayoutBlockFlow {DIV} at (2,2) size 190x24
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
 layer at (10,78) size 270x28
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.png
index 0d0dc27..34706d23 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.txt
index abab82c..d16772c0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/forms/text/text-font-height-mismatch-expected.txt
@@ -7,18 +7,18 @@
         LayoutText {#text} at (0,0) size 273x18
           text run at (0,0) width 273: "Editable text should be centered vertically."
       LayoutBlockFlow {DIV} at (0,34) size 784x28
-        LayoutTextControl {INPUT} at (0,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutTextControl {INPUT} at (251,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (0,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (194,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,62) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 260x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,90) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 170x28 [bgcolor=#FFFFFF] [border: (2px inset #EEEEEE)]
-layer at (10,52) size 247x25
-  LayoutBlockFlow {DIV} at (2,1.50) size 247x25
+layer at (10,52) size 190x25
+  LayoutBlockFlow {DIV} at (2,1.50) size 190x25
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
-layer at (261,52) size 247x25
-  LayoutBlockFlow {DIV} at (2,1.50) size 247x25
+layer at (204,52) size 190x25
+  LayoutBlockFlow {DIV} at (2,1.50) size 190x25
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
 layer at (10,78) size 256x28
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.png
index a29cb6d..e618448 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.txt
index 6883e6e..61d3c14 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/text/text-font-height-mismatch-expected.txt
@@ -7,18 +7,18 @@
         LayoutText {#text} at (0,0) size 273x18
           text run at (0,0) width 273: "Editable text should be centered vertically."
       LayoutBlockFlow {DIV} at (0,34) size 784x28
-        LayoutTextControl {INPUT} at (0,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
-        LayoutTextControl {INPUT} at (251,0) size 251x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (0,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
+        LayoutTextControl {INPUT} at (194,0) size 194x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,62) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 255x28 [bgcolor=#FFFFFF] [border: (1px solid #000000)]
       LayoutBlockFlow {DIV} at (0,90) size 784x28
         LayoutTextControl {INPUT} at (0,0) size 173x28 [bgcolor=#FFFFFF] [border: (2px inset #EEEEEE)]
-layer at (10,52) size 247x24
-  LayoutBlockFlow {DIV} at (2,2) size 247x24
+layer at (10,52) size 190x24
+  LayoutBlockFlow {DIV} at (2,2) size 190x24
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
-layer at (261,52) size 247x24
-  LayoutBlockFlow {DIV} at (2,2) size 247x24
+layer at (204,52) size 190x24
+  LayoutBlockFlow {DIV} at (2,2) size 190x24
     LayoutText {#text} at (0,0) size 74x24
       text run at (0,0) width 74: "\x{3075} ABCgjy"
 layer at (10,78) size 251x28
diff --git a/third_party/WebKit/PRESUBMIT.py b/third_party/WebKit/PRESUBMIT.py
index ce54af2..3c4d6689 100644
--- a/third_party/WebKit/PRESUBMIT.py
+++ b/third_party/WebKit/PRESUBMIT.py
@@ -362,25 +362,9 @@
     """
     if not _ArePaintOrCompositingDirectoriesModified(change):
         return []
-
-    rietveld_obj = cl.RpcServer()
-    issue = cl.issue
-    description = rietveld_obj.get_description(issue)
-    if re.search(r'^CQ_INCLUDE_TRYBOTS=.*', description, re.M | re.I):
-        return []
-
-    bots = [
-        'master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2',
-    ]
-
-    results = []
-    new_description = description
-    new_description += '\nCQ_INCLUDE_TRYBOTS=%s' % ';'.join(bots)
-    results.append(output_api.PresubmitNotifyResult(
+    return output_api.EnsureCQIncludeTrybotsAreAdded(
+        cl,
+        ['master.tryserver.chromium.linux:'
+         'linux_layout_tests_slimming_paint_v2'],
         'Automatically added slimming-paint-v2 tests to run on CQ due to '
-        'changes in paint or compositing directories.'))
-
-    if new_description != description:
-        rietveld_obj.update_description(issue, new_description)
-
-    return results
+        'changes in paint or compositing directories.')
diff --git a/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorld.cpp b/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorld.cpp
index 10b5dbee..3a779bf6c 100644
--- a/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorld.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorld.cpp
@@ -306,7 +306,7 @@
 void DOMWrapperWorld::unregisterDOMObjectHolder(
     DOMObjectHolderBase* holderBase) {
   ASSERT(m_domObjectHolders.contains(holderBase));
-  m_domObjectHolders.remove(holderBase);
+  m_domObjectHolders.erase(holderBase);
 }
 
 void DOMWrapperWorld::weakCallbackForDOMObjectHolder(
diff --git a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
index 3fbcae6..8eae8a3 100644
--- a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
@@ -134,7 +134,7 @@
 
   for (Animation* animation : animations) {
     if (!animation->update(reason))
-      m_animationsNeedingUpdate.remove(animation);
+      m_animationsNeedingUpdate.erase(animation);
   }
 
   DCHECK_EQ(m_outdatedAnimationCount, 0U);
diff --git a/third_party/WebKit/Source/core/css/CSSFontSelector.cpp b/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
index a4d11009..0de37e66 100644
--- a/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
+++ b/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
@@ -65,7 +65,7 @@
 
 void CSSFontSelector::unregisterForInvalidationCallbacks(
     CSSFontSelectorClient* client) {
-  m_clients.remove(client);
+  m_clients.erase(client);
 }
 
 void CSSFontSelector::dispatchInvalidationCallbacks() {
diff --git a/third_party/WebKit/Source/core/css/FontFaceSet.cpp b/third_party/WebKit/Source/core/css/FontFaceSet.cpp
index 80433325..11759e3 100644
--- a/third_party/WebKit/Source/core/css/FontFaceSet.cpp
+++ b/third_party/WebKit/Source/core/css/FontFaceSet.cpp
@@ -237,7 +237,7 @@
 }
 
 void FontFaceSet::removeFromLoadingFonts(FontFace* fontFace) {
-  m_loadingFonts.remove(fontFace);
+  m_loadingFonts.erase(fontFace);
   if (m_loadingFonts.isEmpty())
     handlePendingEventsAndPromisesSoon();
 }
diff --git a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
index 0005ba3..f593ed3 100644
--- a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
+++ b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
@@ -579,8 +579,8 @@
 }
 
 void StyleSheetContents::unregisterClient(CSSStyleSheet* sheet) {
-  m_loadingClients.remove(sheet);
-  m_completedClients.remove(sheet);
+  m_loadingClients.erase(sheet);
+  m_completedClients.erase(sheet);
 
   if (!sheet->ownerDocument() || !m_loadingClients.isEmpty() ||
       !m_completedClients.isEmpty())
@@ -591,7 +591,7 @@
 
 void StyleSheetContents::clientLoadCompleted(CSSStyleSheet* sheet) {
   ASSERT(m_loadingClients.contains(sheet) || !sheet->ownerDocument());
-  m_loadingClients.remove(sheet);
+  m_loadingClients.erase(sheet);
   // In m_ownerNode->sheetLoaded, the CSSStyleSheet might be detached.
   // (i.e. clearOwnerNode was invoked.)
   // In this case, we don't need to add the stylesheet to completed clients.
@@ -602,7 +602,7 @@
 
 void StyleSheetContents::clientLoadStarted(CSSStyleSheet* sheet) {
   ASSERT(m_completedClients.contains(sheet));
-  m_completedClients.remove(sheet);
+  m_completedClients.erase(sheet);
   m_loadingClients.insert(sheet);
 }
 
diff --git a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
index 6ccb2d97..3650b57 100644
--- a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
@@ -98,7 +98,7 @@
   bool success =
       resolveTokenRange(variableData.tokens(), disallowAnimationTainted, tokens,
                         isAnimationTainted);
-  m_variablesSeen.remove(name);
+  m_variablesSeen.erase(name);
 
   // The old variable data holds onto the backing string the new resolved
   // CSSVariableData relies on. Ensure it will live beyond us overwriting the
@@ -106,7 +106,7 @@
   ASSERT(variableData.refCount() > 1);
 
   if (!success || !m_cycleStartPoints.isEmpty()) {
-    m_cycleStartPoints.remove(name);
+    m_cycleStartPoints.erase(name);
     return nullptr;
   }
   return CSSVariableData::createResolved(tokens, variableData,
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 376a393..d983c96 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2342,7 +2342,7 @@
 }
 
 void Document::unscheduleUseShadowTreeUpdate(SVGUseElement& element) {
-  m_useElementsNeedingUpdate.remove(&element);
+  m_useElementsNeedingUpdate.erase(&element);
 }
 
 void Document::updateUseShadowTreesIfNeeded() {
@@ -4178,10 +4178,10 @@
 
 void Document::unregisterNodeList(const LiveNodeListBase* list) {
   DCHECK(m_nodeLists[list->invalidationType()].contains(list));
-  m_nodeLists[list->invalidationType()].remove(list);
+  m_nodeLists[list->invalidationType()].erase(list);
   if (list->isRootedAtTreeScope()) {
     DCHECK(m_listsInvalidatedAtDocument.contains(list));
-    m_listsInvalidatedAtDocument.remove(list);
+    m_listsInvalidatedAtDocument.erase(list);
   }
 }
 
@@ -4193,7 +4193,7 @@
 
 void Document::unregisterNodeListWithIdNameCache(const LiveNodeListBase* list) {
   DCHECK(m_nodeLists[InvalidateOnIdNameAttrChange].contains(list));
-  m_nodeLists[InvalidateOnIdNameAttrChange].remove(list);
+  m_nodeLists[InvalidateOnIdNameAttrChange].erase(list);
 }
 
 void Document::attachNodeIterator(NodeIterator* ni) {
@@ -4203,7 +4203,7 @@
 void Document::detachNodeIterator(NodeIterator* ni) {
   // The node iterator can be detached without having been attached if its root
   // node didn't have a document when the iterator was created, but has it now.
-  m_nodeIterators.remove(ni);
+  m_nodeIterators.erase(ni);
 }
 
 void Document::moveNodeIteratorsToNewDocument(Node& node,
@@ -4673,9 +4673,12 @@
       const AtomicString& httpLastModified =
           documentLoader->response().httpHeaderField(HTTPNames::Last_Modified);
       if (!httpLastModified.isEmpty()) {
-        date.setMillisecondsSinceEpochForDateTime(
-            convertToLocalTime(parseDate(httpLastModified)));
-        foundDate = true;
+        double dateValue = parseDate(httpLastModified);
+        if (!std::isnan(dateValue)) {
+          date.setMillisecondsSinceEpochForDateTime(
+              convertToLocalTime(dateValue));
+          foundDate = true;
+        }
       }
     }
   }
@@ -5679,7 +5682,7 @@
 void Document::detachRange(Range* range) {
   // We don't ASSERT m_ranges.contains(range) to allow us to call this
   // unconditionally to fix: https://bugs.webkit.org/show_bug.cgi?id=26044
-  m_ranges.remove(range);
+  m_ranges.erase(range);
 }
 
 void Document::initDNSPrefetch() {
diff --git a/third_party/WebKit/Source/core/dom/DocumentParser.cpp b/third_party/WebKit/Source/core/dom/DocumentParser.cpp
index 0c985d2..c4059325 100644
--- a/third_party/WebKit/Source/core/dom/DocumentParser.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentParser.cpp
@@ -89,7 +89,7 @@
 }
 
 void DocumentParser::removeClient(DocumentParserClient* client) {
-  m_clients.remove(client);
+  m_clients.erase(client);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp
index f326dbd4..4d667c4 100644
--- a/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp
+++ b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp
@@ -28,7 +28,7 @@
 
 void ElementIntersectionObserverData::removeObserver(
     IntersectionObserver& observer) {
-  m_intersectionObservers.remove(&observer);
+  m_intersectionObservers.erase(&observer);
 }
 
 void ElementIntersectionObserverData::addObservation(
diff --git a/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp b/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
index dbcdfd9..fedf7a7 100644
--- a/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
@@ -58,7 +58,7 @@
   IdToObserverSetMap::iterator iter = m_registry.find(id.impl());
 
   ObserverSet* set = iter->value.get();
-  set->remove(observer);
+  set->erase(observer);
   if (set->isEmpty() && set != m_notifyingObserversInSet)
     m_registry.remove(iter);
 }
diff --git a/third_party/WebKit/Source/core/dom/MutationObserver.cpp b/third_party/WebKit/Source/core/dom/MutationObserver.cpp
index 8b00d14..85f6eba 100644
--- a/third_party/WebKit/Source/core/dom/MutationObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/MutationObserver.cpp
@@ -163,7 +163,7 @@
 void MutationObserver::observationEnded(
     MutationObserverRegistration* registration) {
   DCHECK(m_registrations.contains(registration));
-  m_registrations.remove(registration);
+  m_registrations.erase(registration);
 }
 
 static MutationObserverSet& activeMutationObservers() {
@@ -280,7 +280,7 @@
   copyToVector(suspendedMutationObservers(), suspended);
   for (const auto& observer : suspended) {
     if (!observer->shouldBeSuspended()) {
-      suspendedMutationObservers().remove(observer);
+      suspendedMutationObservers().erase(observer);
       activateObserver(observer);
     }
   }
diff --git a/third_party/WebKit/Source/core/dom/NodeRareData.h b/third_party/WebKit/Source/core/dom/NodeRareData.h
index 014be41..7df8d9d 100644
--- a/third_party/WebKit/Source/core/dom/NodeRareData.h
+++ b/third_party/WebKit/Source/core/dom/NodeRareData.h
@@ -56,7 +56,7 @@
 
   void removeTransientRegistration(MutationObserverRegistration* registration) {
     DCHECK(m_transientRegistry.contains(registration));
-    m_transientRegistry.remove(registration);
+    m_transientRegistry.erase(registration);
   }
 
   void addRegistration(MutationObserverRegistration* registration) {
diff --git a/third_party/WebKit/Source/core/dom/QualifiedName.cpp b/third_party/WebKit/Source/core/dom/QualifiedName.cpp
index 28e2584..28ac626 100644
--- a/third_party/WebKit/Source/core/dom/QualifiedName.cpp
+++ b/third_party/WebKit/Source/core/dom/QualifiedName.cpp
@@ -98,7 +98,7 @@
 QualifiedName::~QualifiedName() {}
 
 QualifiedName::QualifiedNameImpl::~QualifiedNameImpl() {
-  qualifiedNameCache().remove(this);
+  qualifiedNameCache().erase(this);
 }
 
 String QualifiedName::toString() const {
diff --git a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
index 6b7e8009..92df0ed7 100644
--- a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
@@ -115,7 +115,7 @@
       // to detach).
       SECURITY_CHECK(m_pendingAsyncScripts.contains(scriptLoader));
 
-      m_pendingAsyncScripts.remove(scriptLoader);
+      m_pendingAsyncScripts.erase(scriptLoader);
       m_asyncScriptsToExecuteSoon.append(scriptLoader);
 
       postTask(BLINK_FROM_HERE);
@@ -157,7 +157,7 @@
       // (otherwise we'd cause a use-after-free in ~ScriptRunner when it tries
       // to detach).
       SECURITY_CHECK(m_pendingAsyncScripts.contains(scriptLoader));
-      m_pendingAsyncScripts.remove(scriptLoader);
+      m_pendingAsyncScripts.erase(scriptLoader);
       break;
     }
     case InOrder:
@@ -203,7 +203,7 @@
                                      ScriptLoader* scriptLoader) {
   if (m_pendingAsyncScripts.contains(scriptLoader)) {
     newRunner->queueScriptForExecution(scriptLoader, Async);
-    m_pendingAsyncScripts.remove(scriptLoader);
+    m_pendingAsyncScripts.erase(scriptLoader);
     m_document->decrementLoadEventDelayCount();
     return;
   }
diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.cpp b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
index 6a5d1ce..19826f4 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
@@ -337,7 +337,7 @@
         updateActiveStyleSheetsInShadow(treeScope, treeScopesRemoved);
     }
     for (TreeScope* treeScope : treeScopesRemoved)
-      m_activeTreeScopes.remove(treeScope);
+      m_activeTreeScopes.erase(treeScope);
   }
 
   InspectorInstrumentation::activeStyleSheetsUpdated(m_document);
@@ -389,8 +389,8 @@
 
 void StyleEngine::shadowRootRemovedFromDocument(ShadowRoot* shadowRoot) {
   m_styleSheetCollectionMap.erase(shadowRoot);
-  m_activeTreeScopes.remove(shadowRoot);
-  m_dirtyTreeScopes.remove(shadowRoot);
+  m_activeTreeScopes.erase(shadowRoot);
+  m_dirtyTreeScopes.erase(shadowRoot);
   resetAuthorStyle(*shadowRoot);
 }
 
diff --git a/third_party/WebKit/Source/core/events/EventDispatcher.cpp b/third_party/WebKit/Source/core/events/EventDispatcher.cpp
index 6b6592a..2214239 100644
--- a/third_party/WebKit/Source/core/events/EventDispatcher.cpp
+++ b/third_party/WebKit/Source/core/events/EventDispatcher.cpp
@@ -123,7 +123,7 @@
                                            underlyingEvent, creationScope))
       .dispatch();
 
-  nodesDispatchingSimulatedClicks.remove(&node);
+  nodesDispatchingSimulatedClicks.erase(&node);
 }
 
 DispatchEventResult EventDispatcher::dispatch() {
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 9ff63af..5c587b2 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -1448,7 +1448,7 @@
 }
 
 void FrameView::removePart(LayoutPart* object) {
-  m_parts.remove(object);
+  m_parts.erase(object);
 }
 
 void FrameView::updateWidgetGeometries() {
@@ -1561,7 +1561,7 @@
 void FrameView::removeBackgroundAttachmentFixedObject(LayoutObject* object) {
   ASSERT(m_backgroundAttachmentFixedObjects.contains(object));
 
-  m_backgroundAttachmentFixedObjects.remove(object);
+  m_backgroundAttachmentFixedObjects.erase(object);
   if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
     scrollingCoordinator->frameViewHasBackgroundAttachmentFixedObjectsDidChange(
         this);
@@ -1592,7 +1592,7 @@
 void FrameView::removeViewportConstrainedObject(LayoutObject* object) {
   if (m_viewportConstrainedObjects &&
       m_viewportConstrainedObjects->contains(object)) {
-    m_viewportConstrainedObjects->remove(object);
+    m_viewportConstrainedObjects->erase(object);
 
     if (ScrollingCoordinator* scrollingCoordinator =
             this->scrollingCoordinator())
@@ -2422,7 +2422,7 @@
 
     // Prevent plugins from causing infinite updates of themselves.
     // FIXME: Do we really need to prevent this?
-    m_partUpdateSet.remove(&object);
+    m_partUpdateSet.erase(&object);
   }
 
   return m_partUpdateSet.isEmpty();
@@ -3706,7 +3706,7 @@
 void FrameView::removeScrollableArea(ScrollableArea* scrollableArea) {
   if (!m_scrollableAreas)
     return;
-  m_scrollableAreas->remove(scrollableArea);
+  m_scrollableAreas->erase(scrollableArea);
 
   if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
     scrollingCoordinator->scrollableAreasDidChange();
@@ -3722,7 +3722,7 @@
 void FrameView::removeAnimatingScrollableArea(ScrollableArea* scrollableArea) {
   if (!m_animatingScrollableAreas)
     return;
-  m_animatingScrollableAreas->remove(scrollableArea);
+  m_animatingScrollableAreas->erase(scrollableArea);
 }
 
 void FrameView::setParent(Widget* parentView) {
@@ -3746,7 +3746,7 @@
     removeScrollableArea(toFrameView(child));
 
   child->setParent(0);
-  m_children.remove(child);
+  m_children.erase(child);
 }
 
 bool FrameView::visualViewportSuppliesScrollbars() {
diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
index eb7c407..4fda1a2 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
@@ -644,7 +644,7 @@
 }
 
 void LocalDOMWindow::removePostMessageTimer(PostMessageTimer* timer) {
-  m_postMessageTimers.remove(timer);
+  m_postMessageTimers.erase(timer);
 }
 
 void LocalDOMWindow::dispatchMessageEventWithOriginCheck(
diff --git a/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp b/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
index f3536cd4..6d7e861 100644
--- a/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
+++ b/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
@@ -32,7 +32,7 @@
     PlatformEventController* controller) {
   ASSERT(m_controllers.contains(controller));
 
-  m_controllers.remove(controller);
+  m_controllers.erase(controller);
   if (!m_isDispatching && m_controllers.isEmpty()) {
     stopListening();
     m_isListening = false;
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 5e84495..9332683 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -781,7 +781,7 @@
 }
 
 void HTMLCanvasElement::removeListener(CanvasDrawListener* listener) {
-  m_listeners.remove(listener);
+  m_listeners.erase(listener);
 }
 
 SecurityOrigin* HTMLCanvasElement::getSecurityOrigin() const {
diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index a577e6b..dbbcdb2a 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
@@ -173,7 +173,7 @@
   auto it = map.find(document);
   DCHECK(it != map.end());
   WeakMediaElementSet* set = it->value;
-  set->remove(element);
+  set->erase(element);
   if (set->isEmpty())
     map.remove(it);
 }
diff --git a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
index 6dda048..11d9b6d4 100644
--- a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
+++ b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
@@ -204,7 +204,7 @@
 
 void ImageBitmapFactories::didFinishLoading(ImageBitmapLoader* loader) {
   ASSERT(m_pendingLoaders.contains(loader));
-  m_pendingLoaders.remove(loader);
+  m_pendingLoaders.erase(loader);
 }
 
 ImageBitmapFactories::ImageBitmapLoader::ImageBitmapLoader(
diff --git a/third_party/WebKit/Source/core/inspector/CodeGeneratorInstrumentation.py b/third_party/WebKit/Source/core/inspector/CodeGeneratorInstrumentation.py
index 44febb60..7b676e6 100755
--- a/third_party/WebKit/Source/core/inspector/CodeGeneratorInstrumentation.py
+++ b/third_party/WebKit/Source/core/inspector/CodeGeneratorInstrumentation.py
@@ -128,7 +128,7 @@
 
 void InstrumentingAgents::remove${class_name}(${class_name}* agent)
 {
-    ${member_name}.remove(agent);
+    ${member_name}.erase(agent);
     ${has_member_name} = !${member_name}.isEmpty();
 }
 """)
diff --git a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
index 6570bcf..7f7d6db 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
@@ -796,7 +796,7 @@
   HeapVector<Member<CSSStyleSheet>> addedSheets;
   for (CSSStyleSheet* cssStyleSheet : allSheetsVector) {
     if (removedSheets.contains(cssStyleSheet)) {
-      removedSheets.remove(cssStyleSheet);
+      removedSheets.erase(cssStyleSheet);
     } else {
       addedSheets.push_back(cssStyleSheet);
     }
@@ -807,7 +807,7 @@
         m_cssStyleSheetToInspectorStyleSheet.get(cssStyleSheet);
     ASSERT(inspectorStyleSheet);
 
-    documentCSSStyleSheets->remove(cssStyleSheet);
+    documentCSSStyleSheets->erase(cssStyleSheet);
     if (m_idToInspectorStyleSheet.contains(inspectorStyleSheet->id())) {
       String id = unbindStyleSheet(inspectorStyleSheet);
       if (frontend())
@@ -829,7 +829,7 @@
 }
 
 void InspectorCSSAgent::documentDetached(Document* document) {
-  m_invalidatedDocuments.remove(document);
+  m_invalidatedDocuments.erase(document);
   setActiveStyleSheets(document, HeapVector<Member<CSSStyleSheet>>());
 }
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
index b11d023..a63a604 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
@@ -341,7 +341,7 @@
   bool childrenRequested = m_childrenRequested.contains(id);
   if (childrenRequested) {
     // Unbind subtree known to client recursively.
-    m_childrenRequested.remove(id);
+    m_childrenRequested.erase(id);
     Node* child = innerFirstChild(node);
     while (child) {
       unbind(child, nodesMap);
diff --git a/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
index 0283eac..d0d9559b 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
@@ -922,7 +922,7 @@
   if (!m_replayXHRs.contains(xhr))
     return;
   m_replayXHRsToBeDeleted.insert(xhr);
-  m_replayXHRs.remove(xhr);
+  m_replayXHRs.erase(xhr);
   m_removeFinishedReplayXHRTimer.startOneShot(0, BLINK_FROM_HERE);
 }
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp b/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
index 28d6566..4d7ac22 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
@@ -227,7 +227,7 @@
 }
 
 void InspectorResourceContentLoader::resourceFinished(ResourceClient* client) {
-  m_pendingResourceClients.remove(client);
+  m_pendingResourceClients.erase(client);
   checkDone();
 }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index 98e2213..dac2e3f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -1414,7 +1414,7 @@
       FloatingObjectSetIterator end = floatingObjectSet.end();
       for (FloatingObjectSetIterator it = floatingObjectSet.begin();
            it != end && !oldIntrudingFloatSet.isEmpty(); ++it)
-        oldIntrudingFloatSet.remove((*it)->layoutObject());
+        oldIntrudingFloatSet.erase((*it)->layoutObject());
       if (!oldIntrudingFloatSet.isEmpty())
         markAllDescendantsWithFloatsForLayout();
     }
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 7bfe241..66e9a1fe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -5698,7 +5698,7 @@
 
 void LayoutBox::removeSnapArea(const LayoutBox& snapArea) {
   if (m_rareData && m_rareData->m_snapAreas) {
-    m_rareData->m_snapAreas->remove(&snapArea);
+    m_rareData->m_snapAreas->erase(&snapArea);
   }
 }
 
diff --git a/third_party/WebKit/Source/core/layout/TextAutosizer.cpp b/third_party/WebKit/Source/core/layout/TextAutosizer.cpp
index e693e683..170f3dad 100644
--- a/third_party/WebKit/Source/core/layout/TextAutosizer.cpp
+++ b/third_party/WebKit/Source/core/layout/TextAutosizer.cpp
@@ -1317,7 +1317,7 @@
     return false;
 
   BlockSet& blocks = *blocksIter->value;
-  blocks.remove(toLayoutBlock(layoutObject));
+  blocks.erase(toLayoutBlock(layoutObject));
   if (blocks.isEmpty()) {
     m_blocksForFingerprint.remove(blocksIter);
 
@@ -1326,7 +1326,7 @@
 
     if (superclusterIter != m_superclusters.end()) {
       Supercluster* supercluster = superclusterIter->value.get();
-      m_potentiallyInconsistentSuperclusters.remove(supercluster);
+      m_potentiallyInconsistentSuperclusters.erase(supercluster);
       m_superclusters.remove(superclusterIter);
     }
   }
diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.cpp
index fe3dd926..f7056fd 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceContainer.cpp
@@ -193,7 +193,7 @@
 void LayoutSVGResourceContainer::removeClient(LayoutObject* client) {
   ASSERT(client);
   removeClientFromCache(client, false);
-  m_clients.remove(client);
+  m_clients.erase(client);
 }
 
 void LayoutSVGResourceContainer::invalidateCacheAndMarkForLayout(
@@ -275,7 +275,7 @@
 
       LayoutSVGResourceContainer::markForLayoutAndParentResourceInvalidation(
           layoutObject, needsLayout);
-      invalidatingDependencies.remove(element);
+      invalidatingDependencies.erase(element);
     }
   }
 }
diff --git a/third_party/WebKit/Source/core/layout/svg/SVGResourcesCycleSolver.cpp b/third_party/WebKit/Source/core/layout/svg/SVGResourcesCycleSolver.cpp
index 8ee065e..a6c13c5 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGResourcesCycleSolver.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/SVGResourcesCycleSolver.cpp
@@ -48,7 +48,7 @@
       : m_activeSet(activeSet), m_resource(resource) {
     m_activeSet.insert(m_resource);
   }
-  ~ActiveFrame() { m_activeSet.remove(m_resource); }
+  ~ActiveFrame() { m_activeSet.erase(m_resource); }
 
   ResourceSet& m_activeSet;
   LayoutSVGResourceContainer* m_resource;
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 26bd2f95..3f62008 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -36,6 +36,7 @@
 
 #include "core/loader/FrameLoader.h"
 
+#include <memory>
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/SerializedScriptValue.h"
@@ -102,7 +103,6 @@
 #include "wtf/AutoReset.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/WTFString.h"
-#include <memory>
 
 using blink::WebURLRequest;
 
@@ -421,6 +421,8 @@
     return;
   m_currentItem->setDocumentSequenceNumber(oldItem->documentSequenceNumber());
   m_currentItem->setScrollOffset(oldItem->getScrollOffset());
+  m_currentItem->setDidSaveScrollOrScaleState(
+      oldItem->didSaveScrollOrScaleState());
   m_currentItem->setVisualViewportScrollOffset(
       oldItem->visualViewportScrollOffset());
   m_currentItem->setPageScaleFactor(oldItem->pageScaleFactor());
@@ -1414,6 +1416,8 @@
   }
   if (!needsHistoryItemRestore(loadType))
     return;
+  if (!m_currentItem->didSaveScrollOrScaleState())
+    return;
 
   bool shouldRestoreScroll =
       m_currentItem->scrollRestorationType() != ScrollRestorationManual;
diff --git a/third_party/WebKit/Source/core/loader/HistoryItem.cpp b/third_party/WebKit/Source/core/loader/HistoryItem.cpp
index 28340e4..2978583d 100644
--- a/third_party/WebKit/Source/core/loader/HistoryItem.cpp
+++ b/third_party/WebKit/Source/core/loader/HistoryItem.cpp
@@ -43,7 +43,8 @@
 }
 
 HistoryItem::HistoryItem()
-    : m_pageScaleFactor(0),
+    : m_didSaveScrollOrScaleState(false),
+      m_pageScaleFactor(0),
       m_itemSequenceNumber(generateSequenceNumber()),
       m_documentSequenceNumber(generateSequenceNumber()),
       m_scrollRestorationType(ScrollRestorationAuto) {}
@@ -91,6 +92,7 @@
 
 void HistoryItem::setVisualViewportScrollOffset(const ScrollOffset& offset) {
   m_visualViewportScrollOffset = offset;
+  setDidSaveScrollOrScaleState(true);
 }
 
 const ScrollOffset& HistoryItem::getScrollOffset() const {
@@ -99,6 +101,7 @@
 
 void HistoryItem::setScrollOffset(const ScrollOffset& offset) {
   m_scrollOffset = offset;
+  setDidSaveScrollOrScaleState(true);
 }
 
 float HistoryItem::pageScaleFactor() const {
@@ -107,6 +110,7 @@
 
 void HistoryItem::setPageScaleFactor(float scaleFactor) {
   m_pageScaleFactor = scaleFactor;
+  setDidSaveScrollOrScaleState(true);
 }
 
 void HistoryItem::setDocumentState(const Vector<String>& state) {
diff --git a/third_party/WebKit/Source/core/loader/HistoryItem.h b/third_party/WebKit/Source/core/loader/HistoryItem.h
index 35ca7fa..e8e2f402 100644
--- a/third_party/WebKit/Source/core/loader/HistoryItem.h
+++ b/third_party/WebKit/Source/core/loader/HistoryItem.h
@@ -60,6 +60,12 @@
   EncodedFormData* formData();
   const AtomicString& formContentType() const;
 
+  void setDidSaveScrollOrScaleState(bool didSaveScrollOrScaleState) {
+    m_didSaveScrollOrScaleState = didSaveScrollOrScaleState;
+  }
+
+  bool didSaveScrollOrScaleState() const { return m_didSaveScrollOrScaleState; }
+
   const ScrollOffset& visualViewportScrollOffset() const;
   void setVisualViewportScrollOffset(const ScrollOffset&);
   const ScrollOffset& getScrollOffset() const;
@@ -114,6 +120,7 @@
   Referrer m_referrer;
   String m_target;
 
+  bool m_didSaveScrollOrScaleState;
   ScrollOffset m_visualViewportScrollOffset;
   ScrollOffset m_scrollOffset;
   float m_pageScaleFactor;
@@ -141,7 +148,6 @@
   // info used to repost form data
   RefPtr<EncodedFormData> m_formData;
   AtomicString m_formContentType;
-
 };  // class HistoryItem
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/page/ContextMenuController.cpp b/third_party/WebKit/Source/core/page/ContextMenuController.cpp
index 7f9177c69..c2c1131 100644
--- a/third_party/WebKit/Source/core/page/ContextMenuController.cpp
+++ b/third_party/WebKit/Source/core/page/ContextMenuController.cpp
@@ -113,20 +113,6 @@
   showContextMenu(event);
 }
 
-void ContextMenuController::showContextMenu(Event* event,
-                                            ContextMenuProvider* menuProvider) {
-  m_menuProvider = menuProvider;
-
-  m_contextMenu = createContextMenu(event);
-  if (!m_contextMenu) {
-    clearContextMenu();
-    return;
-  }
-
-  m_menuProvider->populateContextMenu(m_contextMenu.get());
-  showContextMenu(event);
-}
-
 void ContextMenuController::showContextMenuAtPoint(
     LocalFrame* frame,
     float x,
diff --git a/third_party/WebKit/Source/core/page/ContextMenuController.h b/third_party/WebKit/Source/core/page/ContextMenuController.h
index 65c95da..6ac0ac9 100644
--- a/third_party/WebKit/Source/core/page/ContextMenuController.h
+++ b/third_party/WebKit/Source/core/page/ContextMenuController.h
@@ -60,7 +60,6 @@
   void documentDetached(Document*);
 
   void handleContextMenuEvent(Event*);
-  void showContextMenu(Event*, ContextMenuProvider*);
   void showContextMenuAtPoint(LocalFrame*,
                               float x,
                               float y,
diff --git a/third_party/WebKit/Source/core/page/Page.cpp b/third_party/WebKit/Source/core/page/Page.cpp
index 23f5e99..d5771fbc 100644
--- a/third_party/WebKit/Source/core/page/Page.cpp
+++ b/third_party/WebKit/Source/core/page/Page.cpp
@@ -524,8 +524,8 @@
   mainFrame->detach(FrameDetachType::Remove);
 
   ASSERT(allPages().contains(this));
-  allPages().remove(this);
-  ordinaryPages().remove(this);
+  allPages().erase(this);
+  ordinaryPages().erase(this);
 
   if (m_scrollingCoordinator)
     m_scrollingCoordinator->willBeDestroyed();
diff --git a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
index 181bc55..1df1c1f 100644
--- a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
+++ b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
@@ -824,7 +824,7 @@
 }
 
 void ScrollingCoordinator::willDestroyLayer(PaintLayer* layer) {
-  m_layersWithTouchRects.remove(layer);
+  m_layersWithTouchRects.erase(layer);
 }
 
 void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(
diff --git a/third_party/WebKit/Source/core/page/scrolling/SnapCoordinator.cpp b/third_party/WebKit/Source/core/page/scrolling/SnapCoordinator.cpp
index 9f96c0b..53335cf 100644
--- a/third_party/WebKit/Source/core/page/scrolling/SnapCoordinator.cpp
+++ b/third_party/WebKit/Source/core/page/scrolling/SnapCoordinator.cpp
@@ -65,7 +65,7 @@
   if (scrollSnapType == ScrollSnapTypeNone) {
     // TODO(majidvp): Track and report these removals to CompositorWorker
     // instance responsible for snapping
-    m_snapContainers.remove(&snapContainer);
+    m_snapContainers.erase(&snapContainer);
     snapContainer.clearSnapAreas();
   } else {
     m_snapContainers.insert(&snapContainer);
diff --git a/third_party/WebKit/Source/core/paint/ClipRect.h b/third_party/WebKit/Source/core/paint/ClipRect.h
index 4a12cdb..5999fbc 100644
--- a/third_party/WebKit/Source/core/paint/ClipRect.h
+++ b/third_party/WebKit/Source/core/paint/ClipRect.h
@@ -37,10 +37,9 @@
   USING_FAST_MALLOC(ClipRect);
 
  public:
-  ClipRect() : m_hasRadius(false), m_isClippedByClipCss(false) {}
+  ClipRect() : m_hasRadius(false) {}
 
-  ClipRect(const LayoutRect& rect)
-      : m_rect(rect), m_hasRadius(false), m_isClippedByClipCss(false) {}
+  ClipRect(const LayoutRect& rect) : m_rect(rect), m_hasRadius(false) {}
 
   const LayoutRect& rect() const { return m_rect; }
 
@@ -70,19 +69,11 @@
   bool isEmpty() const { return m_rect.isEmpty(); }
   bool intersects(const HitTestLocation&) const;
 
-  // These have no semantic use. They are used for use-counting.
-  bool isClippedByClipCss() const { return m_isClippedByClipCss; }
-  ClipRect& setIsClippedByClipCss() {
-    m_isClippedByClipCss = true;
-    return *this;
-  }
-
   String toString() const { return m_rect.toString(); }
 
  private:
   LayoutRect m_rect;
   bool m_hasRadius;
-  bool m_isClippedByClipCss;
 };
 
 inline ClipRect intersection(const ClipRect& a, const ClipRect& b) {
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
index aca00804..7572412 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
@@ -103,13 +103,11 @@
   }
   if (box.hasClip()) {
     LayoutRect newClip = box.clipRect(offset);
-    clipRects.setPosClipRect(
-        intersection(newClip, clipRects.posClipRect()).setIsClippedByClipCss());
+    clipRects.setPosClipRect(intersection(newClip, clipRects.posClipRect()));
     clipRects.setOverflowClipRect(
-        intersection(newClip, clipRects.overflowClipRect())
-            .setIsClippedByClipCss());
-    clipRects.setFixedClipRect(intersection(newClip, clipRects.fixedClipRect())
-                                   .setIsClippedByClipCss());
+        intersection(newClip, clipRects.overflowClipRect()));
+    clipRects.setFixedClipRect(
+        intersection(newClip, clipRects.fixedClipRect()));
   }
 }
 
@@ -384,9 +382,7 @@
     // Clip applies to *us* as well, so go ahead and update the damageRect.
     LayoutRect newPosClip = toLayoutBox(layoutObject).clipRect(offset);
     backgroundRect.intersect(newPosClip);
-    backgroundRect.setIsClippedByClipCss();
     foregroundRect.intersect(newPosClip);
-    foregroundRect.setIsClippedByClipCss();
   }
 }
 
diff --git a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
index e90e1f06..6a2e8505 100644
--- a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
@@ -41,7 +41,7 @@
 }
 
 void SVGDocumentExtensions::removeTimeContainer(SVGSVGElement* element) {
-  m_timeContainers.remove(element);
+  m_timeContainers.erase(element);
 }
 
 void SVGDocumentExtensions::addWebAnimationsPendingSVGElement(
@@ -128,7 +128,7 @@
 void SVGDocumentExtensions::removeSVGRootWithRelativeLengthDescendents(
     SVGSVGElement* svgRoot) {
   ASSERT(!m_inRelativeLengthSVGRootsInvalidation);
-  m_relativeLengthSVGRoots.remove(svgRoot);
+  m_relativeLengthSVGRoots.erase(svgRoot);
 }
 
 bool SVGDocumentExtensions::isSVGRootWithRelativeLengthDescendents(
diff --git a/third_party/WebKit/Source/core/svg/SVGElement.cpp b/third_party/WebKit/Source/core/svg/SVGElement.cpp
index 2167da9..53baaab8 100644
--- a/third_party/WebKit/Source/core/svg/SVGElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGElement.cpp
@@ -532,7 +532,7 @@
     if (clientHasRelativeLengths)
       currentElement.m_elementsWithRelativeLengths.insert(clientElement);
     else
-      currentElement.m_elementsWithRelativeLengths.remove(clientElement);
+      currentElement.m_elementsWithRelativeLengths.erase(clientElement);
 
     // If the relative length state hasn't changed, we can stop propagating the
     // notification.
@@ -629,7 +629,7 @@
   HeapHashSet<WeakMember<SVGElement>>& instances =
       svgRareData()->elementInstances();
 
-  instances.remove(instance);
+  instances.erase(instance);
 }
 
 static HeapHashSet<WeakMember<SVGElement>>& emptyInstances() {
@@ -1278,7 +1278,7 @@
   SVGElementSet& incomingReferences = svgRareData()->incomingReferences();
   for (SVGElement* sourceElement : incomingReferences) {
     ASSERT(sourceElement->hasSVGRareData());
-    sourceElement->ensureSVGRareData()->outgoingReferences().remove(this);
+    sourceElement->ensureSVGRareData()->outgoingReferences().erase(this);
   }
   incomingReferences.clear();
 }
@@ -1290,7 +1290,7 @@
   SVGElementSet& outgoingReferences = svgRareData()->outgoingReferences();
   for (SVGElement* targetElement : outgoingReferences) {
     ASSERT(targetElement->hasSVGRareData());
-    targetElement->ensureSVGRareData()->incomingReferences().remove(this);
+    targetElement->ensureSVGRareData()->incomingReferences().erase(this);
   }
   outgoingReferences.clear();
 }
diff --git a/third_party/WebKit/Source/core/svg/SVGTreeScopeResources.cpp b/third_party/WebKit/Source/core/svg/SVGTreeScopeResources.cpp
index eacac72..2e94301 100644
--- a/third_party/WebKit/Source/core/svg/SVGTreeScopeResources.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGTreeScopeResources.cpp
@@ -109,7 +109,7 @@
       DCHECK(elements);
       DCHECK(!elements->isEmpty());
 
-      elements->remove(element);
+      elements->erase(element);
       if (elements->isEmpty())
         toBeRemoved.push_back(entry.key);
     }
diff --git a/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp b/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
index c9787a8..8d8ba57 100644
--- a/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
+++ b/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
@@ -1184,7 +1184,7 @@
   for (SVGSMILElement* element : m_syncBaseDependents)
     element->createInstanceTimesFromSyncbase(this);
 
-  loopBreaker.remove(this);
+  loopBreaker.erase(this);
 }
 
 void SVGSMILElement::createInstanceTimesFromSyncbase(SVGSMILElement* syncBase) {
@@ -1222,7 +1222,7 @@
 }
 
 void SVGSMILElement::removeSyncBaseDependent(SVGSMILElement* animation) {
-  m_syncBaseDependents.remove(animation);
+  m_syncBaseDependents.erase(animation);
 }
 
 void SVGSMILElement::handleConditionEvent(Event* event, Condition* condition) {
diff --git a/third_party/WebKit/Source/core/workers/WorkerBackingThread.cpp b/third_party/WebKit/Source/core/workers/WorkerBackingThread.cpp
index 6664105..624747e 100644
--- a/third_party/WebKit/Source/core/workers/WorkerBackingThread.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerBackingThread.cpp
@@ -41,7 +41,7 @@
 
 static void removeWorkerIsolate(v8::Isolate* isolate) {
   MutexLocker lock(isolatesMutex());
-  isolates().remove(isolate);
+  isolates().erase(isolate);
 }
 
 WorkerBackingThread::WorkerBackingThread(const char* name,
diff --git a/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp b/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp
index ae82cd6..22a18f0 100644
--- a/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp
@@ -73,7 +73,7 @@
 void WorkerInspectorProxy::workerThreadTerminated() {
   if (m_workerThread) {
     DCHECK(inspectorProxies().contains(this));
-    inspectorProxies().remove(this);
+    inspectorProxies().erase(this);
     InspectorInstrumentation::workerTerminated(m_document, this);
   }
 
diff --git a/third_party/WebKit/Source/core/workers/WorkerThread.cpp b/third_party/WebKit/Source/core/workers/WorkerThread.cpp
index cd48725..ca8983f 100644
--- a/third_party/WebKit/Source/core/workers/WorkerThread.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerThread.cpp
@@ -94,7 +94,7 @@
   DCHECK(isMainThread());
   MutexLocker lock(threadSetMutex());
   DCHECK(workerThreads().contains(this));
-  workerThreads().remove(this);
+  workerThreads().erase(this);
 
   DCHECK_NE(ExitCode::NotTerminated, m_exitCode);
   DEFINE_THREAD_SAFE_STATIC_LOCAL(
diff --git a/third_party/WebKit/Source/core/xml/XPathNodeSet.cpp b/third_party/WebKit/Source/core/xml/XPathNodeSet.cpp
index f2f56c0e..9d3ad86 100644
--- a/third_party/WebKit/Source/core/xml/XPathNodeSet.cpp
+++ b/third_party/WebKit/Source/core/xml/XPathNodeSet.cpp
@@ -148,7 +148,7 @@
       DCHECK_NE(previousGroupEnd, groupEnd);
       previousGroupEnd = groupEnd;
 #if DCHECK_IS_ON()
-      parentNodes.remove(n);
+      parentNodes.erase(n);
 #endif
     }
   }
diff --git a/third_party/WebKit/Source/core/xml/XPathParser.cpp b/third_party/WebKit/Source/core/xml/XPathParser.cpp
index 0b65bd02..0d8f070 100644
--- a/third_party/WebKit/Source/core/xml/XPathParser.cpp
+++ b/third_party/WebKit/Source/core/xml/XPathParser.cpp
@@ -516,7 +516,7 @@
     return;
 
   DCHECK(m_strings.contains(s));
-  m_strings.remove(s);
+  m_strings.erase(s);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
index d7e69c7..82fa8a6 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
@@ -370,7 +370,7 @@
    * @return {boolean}
    */
   supportsCaseSensitiveSearch() {
-    return false;
+    return true;
   }
 
   /**
@@ -378,7 +378,7 @@
    * @return {boolean}
    */
   supportsRegexSearch() {
-    return false;
+    return true;
   }
 
   /**
@@ -469,8 +469,7 @@
    * @param {boolean=} jumpBackwards
    */
   performSearch(searchConfig, shouldJump, jumpBackwards) {
-    var query = searchConfig.query;
-    this._searchRegex = createPlainTextSearchRegex(query, 'i');
+    this._searchRegex = searchConfig.toSearchRegex();
     delete this._searchResults;
     this._updateSearchHighlight(true, shouldJump, jumpBackwards);
   }
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
index 50b719f..9e2245e 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
@@ -383,7 +383,7 @@
     this._currentResult = 0;
     if (!this._root)
       return;
-    var searchRegex = createPlainTextSearchRegex(searchConfig.query, 'i');
+    var searchRegex = searchConfig.toSearchRegex();
     this._searchResults =
         this._root.searchTree(event => Timeline.TimelineUIUtils.testContentMatching(event, searchRegex));
     this._searchableView.updateSearchMatchesCount(this._searchResults.length);
@@ -414,7 +414,7 @@
    * @return {boolean}
    */
   supportsCaseSensitiveSearch() {
-    return false;
+    return true;
   }
 
   /**
@@ -422,7 +422,7 @@
    * @return {boolean}
    */
   supportsRegexSearch() {
-    return false;
+    return true;
   }
 };
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index 24472e91..7959f89 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
@@ -558,7 +558,7 @@
   ASSERT(!HashTraits<AXID>::isDeletedValue(objID));
   ASSERT(m_idsInUse.contains(objID));
   object->setAXObjectID(0);
-  m_idsInUse.remove(objID);
+  m_idsInUse.erase(objID);
 
   if (m_ariaOwnerToChildrenMapping.contains(objID)) {
     Vector<AXID> childAXIDs = m_ariaOwnerToChildrenMapping.get(objID);
@@ -724,7 +724,7 @@
       idsChanged = true;
       HashSet<AXID>* owners = m_idToAriaOwnersMapping.get(id);
       if (owners) {
-        owners->remove(owner->axObjectID());
+        owners->erase(owner->axObjectID());
         if (owners->isEmpty())
           m_idToAriaOwnersMapping.erase(id);
       }
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
index 384c5ced..8f52294 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
@@ -46,7 +46,7 @@
   if (!m_activeAlgorithms.contains(resolver)) {
     return false;
   }
-  m_activeAlgorithms.remove(resolver);
+  m_activeAlgorithms.erase(resolver);
   return true;
 }
 
diff --git a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
index bfa49fdf..12b47f44 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
@@ -930,7 +930,7 @@
 }
 
 void FetchManager::onLoaderFinished(Loader* loader) {
-  m_loaders.remove(loader);
+  m_loaders.erase(loader);
   loader->dispose();
 }
 
diff --git a/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp b/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
index 85e00588..ba10471d 100644
--- a/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
+++ b/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
@@ -246,7 +246,7 @@
 
 void Geolocation::fatalErrorOccurred(GeoNotifier* notifier) {
   // This request has failed fatally. Remove it from our lists.
-  m_oneShots.remove(notifier);
+  m_oneShots.erase(notifier);
   m_watchers.remove(notifier);
 
   if (!hasListeners())
@@ -261,7 +261,7 @@
   // If this is a one-shot request, stop it. Otherwise, if the watch still
   // exists, start the service to get updates.
   if (m_oneShots.contains(notifier)) {
-    m_oneShots.remove(notifier);
+    m_oneShots.erase(notifier);
   } else if (m_watchers.contains(notifier)) {
     if (notifier->options().timeout())
       startUpdating(notifier);
@@ -274,7 +274,7 @@
 
 void Geolocation::requestTimedOut(GeoNotifier* notifier) {
   // If this is a one-shot request, stop it.
-  m_oneShots.remove(notifier);
+  m_oneShots.erase(notifier);
 
   if (!hasListeners())
     stopUpdating();
@@ -295,7 +295,7 @@
     return;
 
   if (GeoNotifier* notifier = m_watchers.find(watchID))
-    m_pendingForPermissionNotifiers.remove(notifier);
+    m_pendingForPermissionNotifiers.erase(notifier);
   m_watchers.remove(watchID);
 
   if (!hasListeners())
diff --git a/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp b/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp
index 974de92..c33cefd 100644
--- a/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp
+++ b/third_party/WebKit/Source/modules/imagecapture/ImageCapture.cpp
@@ -341,7 +341,7 @@
     caps->setSharpness(sharpness);
     resolver->resolve(caps);
   }
-  m_serviceRequests.remove(resolver);
+  m_serviceRequests.erase(resolver);
 }
 
 void ImageCapture::onSetOptions(ScriptPromiseResolver* resolver, bool result) {
@@ -352,7 +352,7 @@
     resolver->resolve();
   else
     resolver->reject(DOMException::create(UnknownError, "setOptions failed"));
-  m_serviceRequests.remove(resolver);
+  m_serviceRequests.erase(resolver);
 }
 
 void ImageCapture::onTakePhoto(ScriptPromiseResolver* resolver,
@@ -366,7 +366,7 @@
   else
     resolver->resolve(
         Blob::create(blob->data.data(), blob->data.size(), blob->mime_type));
-  m_serviceRequests.remove(resolver);
+  m_serviceRequests.erase(resolver);
 }
 
 void ImageCapture::onServiceConnectionError() {
diff --git a/third_party/WebKit/Source/modules/nfc/NFC.cpp b/third_party/WebKit/Source/modules/nfc/NFC.cpp
index 4e00b63..3c8ead0 100644
--- a/third_party/WebKit/Source/modules/nfc/NFC.cpp
+++ b/third_party/WebKit/Source/modules/nfc/NFC.cpp
@@ -738,7 +738,7 @@
   if (!m_requests.contains(resolver))
     return;
 
-  m_requests.remove(resolver);
+  m_requests.erase(resolver);
   if (error.is_null())
     resolver->resolve();
   else
@@ -803,7 +803,7 @@
                             ScriptPromiseResolver* resolver,
                             uint32_t id,
                             device::nfc::mojom::blink::NFCErrorPtr error) {
-  m_requests.remove(resolver);
+  m_requests.erase(resolver);
 
   // Invalid id was returned.
   // https://w3c.github.io/web-nfc/#dom-nfc-watch
diff --git a/third_party/WebKit/Source/modules/notifications/ServiceWorkerRegistrationNotifications.cpp b/third_party/WebKit/Source/modules/notifications/ServiceWorkerRegistrationNotifications.cpp
index a868e620c..781def3f 100644
--- a/third_party/WebKit/Source/modules/notifications/ServiceWorkerRegistrationNotifications.cpp
+++ b/third_party/WebKit/Source/modules/notifications/ServiceWorkerRegistrationNotifications.cpp
@@ -194,7 +194,7 @@
   notificationManager->showPersistent(
       WebSecurityOrigin(origin.get()), data, loader->getResources(),
       m_registration->webRegistration(), std::move(callbacks));
-  m_loaders.remove(loader);
+  m_loaders.erase(loader);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp b/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp
index fcd98ff..6caf643 100644
--- a/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp
+++ b/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp
@@ -46,7 +46,7 @@
 }
 
 void SensorProxy::removeObserver(Observer* observer) {
-  m_observers.remove(observer);
+  m_observers.erase(observer);
 }
 
 void SensorProxy::initialize() {
diff --git a/third_party/WebKit/Source/modules/shapedetection/BarcodeDetector.cpp b/third_party/WebKit/Source/modules/shapedetection/BarcodeDetector.cpp
index 9f8beca..a78d39b 100644
--- a/third_party/WebKit/Source/modules/shapedetection/BarcodeDetector.cpp
+++ b/third_party/WebKit/Source/modules/shapedetection/BarcodeDetector.cpp
@@ -51,7 +51,7 @@
     Vector<shape_detection::mojom::blink::BarcodeDetectionResultPtr>
         barcodeDetectionResults) {
   DCHECK(m_barcodeServiceRequests.contains(resolver));
-  m_barcodeServiceRequests.remove(resolver);
+  m_barcodeServiceRequests.erase(resolver);
 
   HeapVector<Member<DetectedBarcode>> detectedBarcodes;
   for (const auto& barcode : barcodeDetectionResults) {
diff --git a/third_party/WebKit/Source/modules/shapedetection/FaceDetector.cpp b/third_party/WebKit/Source/modules/shapedetection/FaceDetector.cpp
index ccda92a..8593617 100644
--- a/third_party/WebKit/Source/modules/shapedetection/FaceDetector.cpp
+++ b/third_party/WebKit/Source/modules/shapedetection/FaceDetector.cpp
@@ -58,7 +58,7 @@
     ScriptPromiseResolver* resolver,
     shape_detection::mojom::blink::FaceDetectionResultPtr faceDetectionResult) {
   DCHECK(m_faceServiceRequests.contains(resolver));
-  m_faceServiceRequests.remove(resolver);
+  m_faceServiceRequests.erase(resolver);
 
   HeapVector<Member<DetectedFace>> detectedFaces;
   for (const auto& boundingBox : faceDetectionResult->bounding_boxes) {
diff --git a/third_party/WebKit/Source/modules/shapedetection/TextDetector.cpp b/third_party/WebKit/Source/modules/shapedetection/TextDetector.cpp
index d887f9db..1b365ac 100644
--- a/third_party/WebKit/Source/modules/shapedetection/TextDetector.cpp
+++ b/third_party/WebKit/Source/modules/shapedetection/TextDetector.cpp
@@ -48,7 +48,7 @@
     Vector<shape_detection::mojom::blink::TextDetectionResultPtr>
         textDetectionResults) {
   DCHECK(m_textServiceRequests.contains(resolver));
-  m_textServiceRequests.remove(resolver);
+  m_textServiceRequests.erase(resolver);
 
   HeapVector<Member<DetectedText>> detectedText;
   for (const auto& text : textDetectionResults) {
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp b/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp
index 7475302..ff89d8fe 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp
@@ -92,7 +92,7 @@
 void AudioListener::removePanner(PannerHandler& panner) {
   DCHECK(isMainThread());
   DCHECK(m_panners.contains(&panner));
-  m_panners.remove(&panner);
+  m_panners.erase(&panner);
 }
 
 bool AudioListener::hasSampleAccurateValues() const {
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioNode.cpp b/third_party/WebKit/Source/modules/webaudio/AudioNode.cpp
index 078da44..3d082a6e 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioNode.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioNode.cpp
@@ -710,7 +710,7 @@
   if (!output.isConnectedToInput(input))
     return false;
   output.disconnectInput(input);
-  m_connectedNodes[outputIndex]->remove(&destination);
+  m_connectedNodes[outputIndex]->erase(&destination);
   return true;
 }
 
@@ -720,7 +720,7 @@
   if (!output.isConnectedToAudioParam(param.handler()))
     return false;
   output.disconnectAudioParam(param.handler());
-  m_connectedParams[outputIndex]->remove(&param);
+  m_connectedParams[outputIndex]->erase(&param);
   return true;
 }
 
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioNodeInput.cpp b/third_party/WebKit/Source/modules/webaudio/AudioNodeInput.cpp
index d6ee8a8c..6ecb2bb 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioNodeInput.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioNodeInput.cpp
@@ -60,7 +60,7 @@
 
   // First try to disconnect from "active" connections.
   if (m_outputs.contains(&output)) {
-    m_outputs.remove(&output);
+    m_outputs.erase(&output);
     changedOutputs();
     output.removeInput(*this);
     // Note: it's important to return immediately after removeInput() calls
@@ -70,7 +70,7 @@
 
   // Otherwise, try to disconnect from disabled connections.
   if (m_disabledOutputs.contains(&output)) {
-    m_disabledOutputs.remove(&output);
+    m_disabledOutputs.erase(&output);
     output.removeInput(*this);
     // Note: it's important to return immediately after all removeInput() calls
     // since the node may be deleted.
@@ -85,7 +85,7 @@
   DCHECK(m_outputs.contains(&output));
 
   m_disabledOutputs.insert(&output);
-  m_outputs.remove(&output);
+  m_outputs.erase(&output);
   changedOutputs();
 
   // Propagate disabled state to outputs.
@@ -99,7 +99,7 @@
   m_outputs.insert(&output);
   if (m_disabledOutputs.size() > 0) {
     DCHECK(m_disabledOutputs.contains(&output));
-    m_disabledOutputs.remove(&output);
+    m_disabledOutputs.erase(&output);
   }
   changedOutputs();
 
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioNodeOutput.cpp b/third_party/WebKit/Source/modules/webaudio/AudioNodeOutput.cpp
index c008f6c..f6412da 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioNodeOutput.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioNodeOutput.cpp
@@ -168,7 +168,7 @@
 void AudioNodeOutput::removeInput(AudioNodeInput& input) {
   ASSERT(deferredTaskHandler().isGraphOwner());
   input.handler().breakConnection();
-  m_inputs.remove(&input);
+  m_inputs.erase(&input);
 }
 
 void AudioNodeOutput::disconnectAllInputs() {
@@ -198,7 +198,7 @@
 
 void AudioNodeOutput::removeParam(AudioParamHandler& param) {
   ASSERT(deferredTaskHandler().isGraphOwner());
-  m_params.remove(&param);
+  m_params.erase(&param);
 }
 
 void AudioNodeOutput::disconnectAllParams() {
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp b/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
index e96eed5..e1eb9be 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioParam.cpp
@@ -302,7 +302,7 @@
   ASSERT(deferredTaskHandler().isGraphOwner());
 
   if (m_outputs.contains(&output)) {
-    m_outputs.remove(&output);
+    m_outputs.erase(&output);
     changedOutputs();
     output.removeParam(*this);
   }
diff --git a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
index d48fff09..8a9dcd0c 100644
--- a/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp
@@ -315,7 +315,7 @@
 
   // We've resolved the promise.  Remove it now.
   DCHECK(m_decodeAudioResolvers.contains(resolver));
-  m_decodeAudioResolvers.remove(resolver);
+  m_decodeAudioResolvers.erase(resolver);
 }
 
 AudioBufferSourceNode* BaseAudioContext::createBufferSource(
diff --git a/third_party/WebKit/Source/modules/webaudio/DeferredTaskHandler.cpp b/third_party/WebKit/Source/modules/webaudio/DeferredTaskHandler.cpp
index f4ecbda4..f03fd8605 100644
--- a/third_party/WebKit/Source/modules/webaudio/DeferredTaskHandler.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/DeferredTaskHandler.cpp
@@ -95,7 +95,7 @@
     AudioSummingJunction* summingJunction) {
   DCHECK(isMainThread());
   AutoLocker locker(*this);
-  m_dirtySummingJunctions.remove(summingJunction);
+  m_dirtySummingJunctions.erase(summingJunction);
 }
 
 void DeferredTaskHandler::markAudioNodeOutputDirty(AudioNodeOutput* output) {
@@ -107,7 +107,7 @@
 void DeferredTaskHandler::removeMarkedAudioNodeOutput(AudioNodeOutput* output) {
   ASSERT(isGraphOwner());
   DCHECK(isMainThread());
-  m_dirtyAudioNodeOutputs.remove(output);
+  m_dirtyAudioNodeOutputs.erase(output);
 }
 
 void DeferredTaskHandler::handleDirtyAudioSummingJunctions() {
@@ -144,7 +144,7 @@
   ASSERT(isGraphOwner());
 
   if (m_automaticPullNodes.contains(node)) {
-    m_automaticPullNodes.remove(node);
+    m_automaticPullNodes.erase(node);
     m_automaticPullNodesNeedUpdating = true;
   }
 }
@@ -174,7 +174,7 @@
 void DeferredTaskHandler::removeChangedChannelCountMode(AudioHandler* node) {
   ASSERT(isGraphOwner());
 
-  m_deferredCountModeChange.remove(node);
+  m_deferredCountModeChange.erase(node);
 }
 
 void DeferredTaskHandler::addChangedChannelInterpretation(AudioHandler* node) {
@@ -187,7 +187,7 @@
     AudioHandler* node) {
   ASSERT(isGraphOwner());
 
-  m_deferredChannelInterpretationChange.remove(node);
+  m_deferredChannelInterpretationChange.erase(node);
 }
 
 void DeferredTaskHandler::updateChangedChannelCountMode() {
diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseThread.cpp b/third_party/WebKit/Source/modules/webdatabase/DatabaseThread.cpp
index 19f8b088..4cc549f 100644
--- a/third_party/WebKit/Source/modules/webdatabase/DatabaseThread.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseThread.cpp
@@ -144,7 +144,7 @@
     ASSERT(m_terminationRequested || m_openDatabaseSet.contains(database));
   }
 #endif
-  m_openDatabaseSet.remove(database);
+  m_openDatabaseSet.erase(database);
 }
 
 bool DatabaseThread::isDatabaseOpen(Database* database) {
diff --git a/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.cpp b/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.cpp
index a184a97..6f7dfa2 100644
--- a/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/SQLTransactionCoordinator.cpp
@@ -104,7 +104,7 @@
 
   if (transaction->isReadOnly()) {
     ASSERT(info.activeReadTransactions.contains(transaction));
-    info.activeReadTransactions.remove(transaction);
+    info.activeReadTransactions.erase(transaction);
   } else {
     ASSERT(info.activeWriteTransaction == transaction);
     info.activeWriteTransaction = nullptr;
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index f77eba72..c2a12ea7 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -406,7 +406,7 @@
 
 void WebGL2RenderingContextBase::unregisterGetBufferSubDataAsyncCallback(
     WebGLGetBufferSubDataAsyncCallback* callback) {
-  m_getBufferSubDataAsyncCallbacks.remove(callback);
+  m_getBufferSubDataAsyncCallbacks.erase(callback);
 }
 
 void WebGL2RenderingContextBase::blitFramebuffer(GLint srcX0,
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 751fc5eb2..be351bc 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -229,7 +229,7 @@
 
 void WebGLRenderingContextBase::deactivateContext(
     WebGLRenderingContextBase* context) {
-  activeContexts().remove(context);
+  activeContexts().erase(context);
 }
 
 void WebGLRenderingContextBase::addToEvictedList(
diff --git a/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp b/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
index 5d3182257..382e6b49 100644
--- a/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
+++ b/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
@@ -43,7 +43,7 @@
 
 void NavigatorShare::ShareClientImpl::callback(const String& error) {
   if (m_navigator)
-    m_navigator->m_clients.remove(this);
+    m_navigator->m_clients.erase(this);
 
   if (error.isNull()) {
     m_resolver->resolve();
diff --git a/third_party/WebKit/Source/modules/webusb/USB.cpp b/third_party/WebKit/Source/modules/webusb/USB.cpp
index e497d4b..df7ea7f 100644
--- a/third_party/WebKit/Source/modules/webusb/USB.cpp
+++ b/third_party/WebKit/Source/modules/webusb/USB.cpp
@@ -178,7 +178,7 @@
   for (auto& deviceInfo : deviceInfos)
     devices.push_back(getOrCreateDevice(std::move(deviceInfo)));
   resolver->resolve(devices);
-  m_deviceManagerRequests.remove(resolver);
+  m_deviceManagerRequests.erase(resolver);
 }
 
 void USB::onGetPermission(ScriptPromiseResolver* resolver,
diff --git a/third_party/WebKit/Source/platform/LifecycleNotifier.h b/third_party/WebKit/Source/platform/LifecycleNotifier.h
index cf1480e..b6eed1af 100644
--- a/third_party/WebKit/Source/platform/LifecycleNotifier.h
+++ b/third_party/WebKit/Source/platform/LifecycleNotifier.h
@@ -157,7 +157,7 @@
     return;
   }
   RELEASE_ASSERT(m_iterationState & AllowingRemoval);
-  m_observers.remove(observer);
+  m_observers.erase(observer);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/platform/MemoryCoordinator.cpp b/third_party/WebKit/Source/platform/MemoryCoordinator.cpp
index c011a96..b8d6b7a 100644
--- a/third_party/WebKit/Source/platform/MemoryCoordinator.cpp
+++ b/third_party/WebKit/Source/platform/MemoryCoordinator.cpp
@@ -50,7 +50,7 @@
 
 void MemoryCoordinator::unregisterClient(MemoryCoordinatorClient* client) {
   DCHECK(isMainThread());
-  m_clients.remove(client);
+  m_clients.erase(client);
 }
 
 void MemoryCoordinator::onMemoryPressure(WebMemoryPressureLevel level) {
diff --git a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
index 81e0072..a5f5623 100644
--- a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
+++ b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
@@ -91,6 +91,10 @@
 }
 
 AudioDestination::~AudioDestination() {
+#if OS(ANDROID)
+  // Log when AudioDestination is destructed. (crbug.com/692423)
+  LOG(WARNING) << "[WebAudio/AudioDestination] going away...";
+#endif
   stop();
 }
 
diff --git a/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp b/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp
index f464e9d..1c137020 100644
--- a/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp
+++ b/third_party/WebKit/Source/platform/audio/PushPullFIFO.cpp
@@ -29,7 +29,12 @@
   m_fifoBus = AudioBus::create(numberOfChannels, m_fifoLength);
 }
 
-PushPullFIFO::~PushPullFIFO() {}
+PushPullFIFO::~PushPullFIFO() {
+#if OS(ANDROID)
+  // Log when PushPullFIFO is destructed. (crbug.com/692423)
+  LOG(WARNING) << "[WebAudio/PushPullFIFO] going away...";
+#endif
+}
 
 // Push the data from |inputBus| to FIFO. The size of push is determined by
 // the length of |inputBus|.
@@ -83,6 +88,13 @@
 // Pull the data out of FIFO to |outputBus|. If remaining frame in the FIFO
 // is less than the frames to pull, provides remaining frame plus the silence.
 void PushPullFIFO::pull(AudioBus* outputBus, size_t framesRequested) {
+#if OS(ANDROID)
+  if (!outputBus) {
+    // Log when outputBus is invalid. (crbug.com/692423)
+    LOG(WARNING) << "[WebAudio/PushPullFIFO::pull] outputBus = " << outputBus;
+  }
+#endif
+
   CHECK(outputBus);
   SECURITY_CHECK(framesRequested <= outputBus->length());
   SECURITY_CHECK(framesRequested <= m_fifoLength);
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
index d49d688..d2e2512 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
@@ -417,7 +417,7 @@
   DCHECK(s_registeredLayerSet);
   if (!s_registeredLayerSet->contains(layer->id()))
     CRASH();
-  s_registeredLayerSet->remove(layer->id());
+  s_registeredLayerSet->erase(layer->id());
 }
 
 void GraphicsLayer::setContentsTo(WebLayer* layer) {
diff --git a/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp b/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp
index 9b325db9..369b15b22 100644
--- a/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp
+++ b/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp
@@ -247,7 +247,7 @@
   // Remove entry from identifier map.
   typename V::iterator iter = identifierMap->find(cacheEntry->generator());
   ASSERT(iter != identifierMap->end());
-  iter->value.remove(cacheEntry->cacheKey());
+  iter->value.erase(cacheEntry->cacheKey());
   if (!iter->value.size())
     identifierMap->remove(iter);
 
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
index a180f8d..3660f788 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasFrameDispatcherImpl.cpp
@@ -422,7 +422,7 @@
   // resource lock being lifted, and the second will delete
   // the resource for real.
   if (m_spareResourceLocks.contains(resourceId)) {
-    m_spareResourceLocks.remove(resourceId);
+    m_spareResourceLocks.erase(resourceId);
     return;
   }
   m_cachedImages.erase(resourceId);
diff --git a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
index eb65a98..009cce51 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.cpp
@@ -39,7 +39,7 @@
           << ". See crbug.com/609218.";
     }
   }
-  liveDisplayItemClients->remove(this);
+  liveDisplayItemClients->erase(this);
   // In case this object is a subsequence owner.
   endShouldKeepAliveAllClients(this);
 }
diff --git a/third_party/WebKit/Source/platform/heap/Heap.cpp b/third_party/WebKit/Source/platform/heap/Heap.cpp
index 2d986a1..b5665c5 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.cpp
+++ b/third_party/WebKit/Source/platform/heap/Heap.cpp
@@ -179,7 +179,7 @@
     MutexLocker locker(m_threadAttachMutex);
     thread->runTerminationGC();
     ASSERT(m_threads.contains(thread));
-    m_threads.remove(thread);
+    m_threads.erase(thread);
     isLastThread = m_threads.isEmpty();
   }
   if (thread->isMainThread())
diff --git a/third_party/WebKit/Source/platform/heap/HeapTest.cpp b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
index 04b6e409..c741cfed 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTest.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
@@ -3498,7 +3498,7 @@
           } else if (collectionNumber == weakSetIndex && firstAlive) {
             ASSERT_TRUE(weakSet->contains(keepNumbersAlive[i]));
             if (deleteAfterwards)
-              weakSet->remove(keepNumbersAlive[i]);
+              weakSet->erase(keepNumbersAlive[i]);
             else
               count++;
           } else if (collectionNumber == weakOrderedSetIndex && firstAlive) {
diff --git a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
index ea45ca8..42e0614 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
@@ -283,7 +283,7 @@
 }
 
 void Resource::ResourceCallback::cancel(Resource* resource) {
-  m_resourcesWithPendingClients.remove(resource);
+  m_resourcesWithPendingClients.erase(resource);
   if (m_taskHandle.isActive() && m_resourcesWithPendingClients.isEmpty())
     m_taskHandle.cancel();
 }
diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
index 386b8070..9fdf8cce 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
@@ -428,7 +428,7 @@
       resource->isLoadEventBlockingResourceType() &&
       resource->isLinkPreload() && !request.isLinkPreload() &&
       m_nonBlockingLoaders.contains(resource->loader())) {
-    m_nonBlockingLoaders.remove(resource->loader());
+    m_nonBlockingLoaders.erase(resource->loader());
     m_loaders.insert(resource->loader());
   }
 }
@@ -1222,7 +1222,7 @@
   // TODO(yoav): Convert CHECK to DCHECK if no crash reports come in.
   CHECK(m_loaders.contains(loader));
   m_nonBlockingLoaders.insert(loader);
-  m_loaders.remove(loader);
+  m_loaders.erase(loader);
 }
 
 bool ResourceFetcher::startLoad(Resource* resource) {
@@ -1268,9 +1268,9 @@
 void ResourceFetcher::removeResourceLoader(ResourceLoader* loader) {
   DCHECK(loader);
   if (m_loaders.contains(loader))
-    m_loaders.remove(loader);
+    m_loaders.erase(loader);
   else if (m_nonBlockingLoaders.contains(loader))
-    m_nonBlockingLoaders.remove(loader);
+    m_nonBlockingLoaders.erase(loader);
   else
     NOTREACHED();
 }
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollbarThemeMac.mm b/third_party/WebKit/Source/platform/scroll/ScrollbarThemeMac.mm
index 991c650..7a5fe195d 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollbarThemeMac.mm
+++ b/third_party/WebKit/Source/platform/scroll/ScrollbarThemeMac.mm
@@ -225,7 +225,7 @@
 
 void ScrollbarThemeMac::unregisterScrollbar(ScrollbarThemeClient& scrollbar) {
   scrollbarPainterMap().remove(&scrollbar);
-  scrollbarSet().remove(&scrollbar);
+  scrollbarSet().erase(&scrollbar);
 }
 
 void ScrollbarThemeMac::setNewPainterForScrollbar(
diff --git a/third_party/WebKit/Source/platform/weborigin/SchemeRegistry.cpp b/third_party/WebKit/Source/platform/weborigin/SchemeRegistry.cpp
index 5fc77fc2..78b8384 100644
--- a/third_party/WebKit/Source/platform/weborigin/SchemeRegistry.cpp
+++ b/third_party/WebKit/Source/platform/weborigin/SchemeRegistry.cpp
@@ -184,7 +184,7 @@
     getMutableURLSchemesRegistry().schemesForbiddenFromDomainRelaxation.insert(
         scheme);
   } else {
-    getMutableURLSchemesRegistry().schemesForbiddenFromDomainRelaxation.remove(
+    getMutableURLSchemesRegistry().schemesForbiddenFromDomainRelaxation.erase(
         scheme);
   }
 }
@@ -298,7 +298,7 @@
 void SchemeRegistry::removeURLSchemeAsFirstPartyWhenTopLevel(
     const String& scheme) {
   DCHECK_EQ(scheme, scheme.lower());
-  getMutableURLSchemesRegistry().firstPartyWhenTopLevelSchemes.remove(scheme);
+  getMutableURLSchemesRegistry().firstPartyWhenTopLevelSchemes.erase(scheme);
 }
 
 bool SchemeRegistry::shouldTreatURLSchemeAsFirstPartyWhenTopLevel(
@@ -316,7 +316,7 @@
 }
 
 void SchemeRegistry::removeURLSchemeAsAllowedForReferrer(const String& scheme) {
-  getMutableURLSchemesRegistry().allowedInReferrerSchemes.remove(scheme);
+  getMutableURLSchemesRegistry().allowedInReferrerSchemes.erase(scheme);
 }
 
 bool SchemeRegistry::shouldTreatURLSchemeAsAllowedForReferrer(
diff --git a/third_party/WebKit/Source/web/AnimationWorkletProxyClientImpl.cpp b/third_party/WebKit/Source/web/AnimationWorkletProxyClientImpl.cpp
index 0cef84cc..c44def5 100644
--- a/third_party/WebKit/Source/web/AnimationWorkletProxyClientImpl.cpp
+++ b/third_party/WebKit/Source/web/AnimationWorkletProxyClientImpl.cpp
@@ -41,7 +41,7 @@
 void AnimationWorkletProxyClientImpl::unregisterCompositorProxy(
     CompositorProxy* proxy) {
   DCHECK(!isMainThread());
-  m_proxies.remove(proxy);
+  m_proxies.erase(proxy);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp b/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp
index 45e4ae5..a7d8352 100644
--- a/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp
+++ b/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp
@@ -86,7 +86,7 @@
 void CompositorMutatorImpl::unregisterCompositorAnimator(
     CompositorAnimator* animator) {
   DCHECK(m_animators.contains(animator));
-  m_animators.remove(animator);
+  m_animators.erase(animator);
 }
 
 void CompositorMutatorImpl::setNeedsMutate() {
diff --git a/third_party/WebKit/Source/web/CompositorWorkerProxyClientImpl.cpp b/third_party/WebKit/Source/web/CompositorWorkerProxyClientImpl.cpp
index 1e7f149..c564b861 100644
--- a/third_party/WebKit/Source/web/CompositorWorkerProxyClientImpl.cpp
+++ b/third_party/WebKit/Source/web/CompositorWorkerProxyClientImpl.cpp
@@ -117,7 +117,7 @@
 
 void CompositorWorkerProxyClientImpl::unregisterCompositorProxy(
     CompositorProxy* proxy) {
-  m_proxies.remove(proxy);
+  m_proxies.erase(proxy);
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/web/OpenedFrameTracker.cpp b/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
index 12e4e1a8..cc96b64 100644
--- a/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
+++ b/third_party/WebKit/Source/web/OpenedFrameTracker.cpp
@@ -22,7 +22,7 @@
 }
 
 void OpenedFrameTracker::remove(WebFrame* frame) {
-  m_openedFrames.remove(frame);
+  m_openedFrames.erase(frame);
 }
 
 void OpenedFrameTracker::transferTo(WebFrame* opener) {
diff --git a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
index 1b57d60..64265f1 100644
--- a/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
+++ b/third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp
@@ -112,7 +112,7 @@
     m_workerThread->terminateAndWait();
 
   DCHECK(runningWorkerInstances().contains(this));
-  runningWorkerInstances().remove(this);
+  runningWorkerInstances().erase(this);
   DCHECK(m_webView);
 
   // Detach the client before closing the view to avoid getting called back.
diff --git a/third_party/WebKit/Source/web/WebFrameWidgetBase.cpp b/third_party/WebKit/Source/web/WebFrameWidgetBase.cpp
index 7a8caaf..98339a4 100644
--- a/third_party/WebKit/Source/web/WebFrameWidgetBase.cpp
+++ b/third_party/WebKit/Source/web/WebFrameWidgetBase.cpp
@@ -182,7 +182,12 @@
     DragAction dragAction,
     int modifiers) {
   DCHECK(m_currentDragData);
-  if (ignoreInputEvents()) {
+  // TODO(paulmeyer): It shouldn't be possible for |m_currentDragData| to be
+  // null here, but this is somehow happening (rarely). This suggests that in
+  // some cases drag-over is happening before drag-enter, which should be
+  // impossible. This needs to be investigated further. Once fixed, the extra
+  // check for |!m_currentDragData| should be removed. (crbug.com/671504)
+  if (ignoreInputEvents() || !m_currentDragData) {
     cancelDrag();
     return WebDragOperationNone;
   }
diff --git a/third_party/WebKit/Source/web/WebHistoryItem.cpp b/third_party/WebKit/Source/web/WebHistoryItem.cpp
index bdd4bf7..7dafe65 100644
--- a/third_party/WebKit/Source/web/WebHistoryItem.cpp
+++ b/third_party/WebKit/Source/web/WebHistoryItem.cpp
@@ -198,6 +198,15 @@
   return results;
 }
 
+bool WebHistoryItem::didSaveScrollOrScaleState() const {
+  return m_private->didSaveScrollOrScaleState();
+}
+
+void WebHistoryItem::setDidSaveScrollOrScaleState(
+    bool hasSaveScrollOrScaleState) {
+  m_private->setDidSaveScrollOrScaleState(hasSaveScrollOrScaleState);
+}
+
 WebHistoryItem::WebHistoryItem(HistoryItem* item) : m_private(item) {}
 
 WebHistoryItem& WebHistoryItem::operator=(HistoryItem* item) {
diff --git a/third_party/WebKit/Source/web/WebViewImpl.cpp b/third_party/WebKit/Source/web/WebViewImpl.cpp
index 6dc0e37..43d2e28a 100644
--- a/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/web/WebViewImpl.cpp
@@ -1749,7 +1749,7 @@
 
 void WebViewImpl::close() {
   DCHECK(allInstances().contains(this));
-  allInstances().remove(this);
+  allInstances().erase(this);
 
   if (m_page) {
     // Initiate shutdown for the entire frameset.  This will cause a lot of
diff --git a/third_party/WebKit/Source/wtf/DequeTest.cpp b/third_party/WebKit/Source/wtf/DequeTest.cpp
index 791a5a1..ddc4ebe9 100644
--- a/third_party/WebKit/Source/wtf/DequeTest.cpp
+++ b/third_party/WebKit/Source/wtf/DequeTest.cpp
@@ -304,7 +304,7 @@
   ~WrappedInt() {
     EXPECT_EQ(m_originalThisPtr, this);
     EXPECT_TRUE(constructedWrappedInts.contains(this));
-    constructedWrappedInts.remove(this);
+    constructedWrappedInts.erase(this);
   }
 
   int get() const { return m_i; }
diff --git a/third_party/WebKit/Source/wtf/HashSet.h b/third_party/WebKit/Source/wtf/HashSet.h
index f1af65b..b69f645 100644
--- a/third_party/WebKit/Source/wtf/HashSet.h
+++ b/third_party/WebKit/Source/wtf/HashSet.h
@@ -122,7 +122,7 @@
   template <typename HashTranslator, typename T>
   AddResult addWithTranslator(T&&);
 
-  void remove(ValuePeekInType);
+  void erase(ValuePeekInType);
   void remove(iterator);
   void clear();
   template <typename Collection>
@@ -280,7 +280,7 @@
 }
 
 template <typename T, typename U, typename V, typename W>
-inline void HashSet<T, U, V, W>::remove(ValuePeekInType value) {
+inline void HashSet<T, U, V, W>::erase(ValuePeekInType value) {
   remove(find(value));
 }
 
diff --git a/third_party/WebKit/Source/wtf/HashSetTest.cpp b/third_party/WebKit/Source/wtf/HashSetTest.cpp
index a8049ed..4d6e77c 100644
--- a/third_party/WebKit/Source/wtf/HashSetTest.cpp
+++ b/third_party/WebKit/Source/wtf/HashSetTest.cpp
@@ -119,7 +119,7 @@
   EXPECT_NE(set.end(), it2);
   EXPECT_EQ(ptr2, (*it2).get());
 
-  set.remove(ptr1);
+  set.erase(ptr1);
   EXPECT_TRUE(deleted1);
 
   set.clear();
@@ -197,7 +197,7 @@
   ptr.clear();
   EXPECT_FALSE(isDeleted);
 
-  set.remove(rawPtr);
+  set.erase(rawPtr);
   EXPECT_TRUE(isDeleted);
   EXPECT_TRUE(set.isEmpty());
   EXPECT_EQ(1, DummyRefCounted::s_refInvokesCount);
@@ -388,7 +388,7 @@
     EXPECT_EQ(7, addResult.storedValue->id());
   }
 
-  set.remove(MoveOnly(11));
+  set.erase(MoveOnly(11));
   iter = set.find(MoveOnly(11));
   EXPECT_TRUE(iter == set.end());
 
diff --git a/third_party/WebKit/Source/wtf/HashTable.h b/third_party/WebKit/Source/wtf/HashTable.h
index 069c16a..dc707ef 100644
--- a/third_party/WebKit/Source/wtf/HashTable.h
+++ b/third_party/WebKit/Source/wtf/HashTable.h
@@ -2269,7 +2269,7 @@
   typedef typename Collection2::const_iterator CollectionIterator;
   CollectionIterator end(toBeRemoved.end());
   for (CollectionIterator it(toBeRemoved.begin()); it != end; ++it)
-    collection.remove(*it);
+    collection.erase(*it);
 }
 
 }  // namespace WTF
diff --git a/third_party/WebKit/Source/wtf/VectorTest.cpp b/third_party/WebKit/Source/wtf/VectorTest.cpp
index 1b3f2b5..1e66770c 100644
--- a/third_party/WebKit/Source/wtf/VectorTest.cpp
+++ b/third_party/WebKit/Source/wtf/VectorTest.cpp
@@ -300,7 +300,7 @@
   ~WrappedInt() {
     EXPECT_EQ(m_originalThisPtr, this);
     EXPECT_TRUE(constructedWrappedInts.contains(this));
-    constructedWrappedInts.remove(this);
+    constructedWrappedInts.erase(this);
   }
 
   int get() const { return m_i; }
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py
index 4522f249..a47a9381 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py
@@ -69,10 +69,6 @@
             self._host.filesystem.remove(results_path)
         return json.loads(contents)
 
-    def is_closed(self):
-        out = self.run(['status' '--field', 'status'])
-        return out.strip() == 'closed'
-
     @staticmethod
     def all_jobs_finished(try_results):
         return all(r.get('status') == 'COMPLETED' for r in try_results)
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py
index b747083b..7c47ebc 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py
@@ -47,18 +47,6 @@
         git_cl = GitCL(host)
         self.assertEqual(git_cl.get_issue_number(), 'None')
 
-    def test_is_closed_true(self):
-        host = MockHost()
-        host.executive = MockExecutive(output='closed ')
-        git_cl = GitCL(host)
-        self.assertTrue(git_cl.is_closed())
-
-    def test_is_closed_false(self):
-        host = MockHost()
-        host.executive = MockExecutive(output='waiting')
-        git_cl = GitCL(host)
-        self.assertFalse(git_cl.is_closed())
-
     def test_all_jobs_finished_empty(self):
         self.assertTrue(GitCL.all_jobs_finished([]))
 
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/network_transaction.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/network_transaction.py
index 136bdf7..654d3dc7a 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/network_transaction.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/network_transaction.py
@@ -41,9 +41,6 @@
 
 class NetworkTransaction(object):
 
-    # TODO(qyearsley): Rename return_none_on_404
-    # pylint: disable=invalid-name
-
     def __init__(self, initial_backoff_seconds=10, grown_factor=1.5, timeout_seconds=(10 * 60), return_none_on_404=False):
         self._initial_backoff_seconds = initial_backoff_seconds
         self._grown_factor = grown_factor
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/system/executive_mock.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/system/executive_mock.py
index 0fdc2c8..d32c505 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/system/executive_mock.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/system/executive_mock.py
@@ -194,3 +194,13 @@
 
     def process_dump(self):
         return []
+
+
+def mock_git_commands(vals, strict=False):
+    def run_fn(args):
+        sub_command = args[1]
+        if strict and sub_command not in vals:
+            raise AssertionError('{} not found in sub-command list {}'.format(
+                sub_command, vals))
+        return vals.get(sub_command, '')
+    return MockExecutive(run_command_fn=run_fn)
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/chromium_commit_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/chromium_commit_unittest.py
index 30afa5a..a67b4d39 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/chromium_commit_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/chromium_commit_unittest.py
@@ -5,9 +5,8 @@
 import unittest
 
 from webkitpy.common.host_mock import MockHost
-from webkitpy.common.system.executive_mock import MockExecutive
+from webkitpy.common.system.executive_mock import MockExecutive, mock_git_commands
 from webkitpy.w3c.chromium_commit import ChromiumCommit
-from webkitpy.w3c.common_unittest import mock_command_exec
 
 CHROMIUM_WPT_DIR = 'third_party/WebKit/LayoutTests/external/wpt/'
 
@@ -35,7 +34,7 @@
         fake_files = ['file1', 'MANIFEST.json', 'file3']
         qualified_fake_files = [CHROMIUM_WPT_DIR + f for f in fake_files]
 
-        host.executive = mock_command_exec({
+        host.executive = mock_git_commands({
             'diff-tree': '\n'.join(qualified_fake_files),
             'crrev-parse': 'c881563d734a86f7d9cd57ac509653a61c45c240',
         })
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/common_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/common_unittest.py
index 10746018d..7ec206e 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/common_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/common_unittest.py
@@ -5,26 +5,11 @@
 import unittest
 
 from webkitpy.common.host_mock import MockHost
-from webkitpy.common.system.executive_mock import MockExecutive
+from webkitpy.common.system.executive_mock import mock_git_commands
 from webkitpy.w3c.chromium_commit import ChromiumCommit
 from webkitpy.w3c.common import exportable_commits_since
 
 
-# TODO(qyearsley): Move this to executive_mock.
-def mock_command_exec(vals):
-    def run_fn(args):
-        sub_command = args[1]
-        return vals.get(sub_command, '')
-    return MockExecutive(run_command_fn=run_fn)
-
-
-def mock_command_exec_strict(vals):
-    def run_fn(args):
-        sub_command = args[1]
-        return vals[sub_command]
-    return MockExecutive(run_command_fn=run_fn)
-
-
 class MockLocalWPT(object):
 
     def test_patch(self, patch, chromium_commit):  # pylint: disable=unused-argument
@@ -35,7 +20,7 @@
 
     def test_exportable_commits_since(self):
         host = MockHost()
-        host.executive = mock_command_exec({
+        host.executive = mock_git_commands({
             'show': 'fake message',
             'rev-list': 'add087a97844f4b9e307d9a216940582d96db306',
             'rev-parse': 'add087a97844f4b9e307d9a216940582d96db306',
@@ -62,7 +47,7 @@
 
     def test_ignores_commits_with_noexport_true(self):
         host = MockHost()
-        host.executive = mock_command_exec({
+        host.executive = mock_git_commands({
             'show': 'Commit message\nNOEXPORT=true',
             'rev-list': 'add087a97844f4b9e307d9a216940582d96db306',
             'rev-parse': 'add087a97844f4b9e307d9a216940582d96db306',
@@ -82,13 +67,13 @@
 
     def test_ignores_reverted_commits_with_noexport_true(self):
         host = MockHost()
-        host.executive = mock_command_exec_strict({
+        host.executive = mock_git_commands({
             'show': 'Commit message\n> NOEXPORT=true',
             'rev-list': 'add087a97844f4b9e307d9a216940582d96db306',
             'rev-parse': 'add087a97844f4b9e307d9a216940582d96db306',
             'footers': 'cr-rev-position',
             'diff-tree': '',
-        })
+        }, strict=True)
 
         commits = exportable_commits_since('add087a97844f4b9e307d9a216940582d96db306', host, MockLocalWPT())
         self.assertEqual(len(commits), 0)
@@ -103,7 +88,7 @@
 
     def test_ignores_commits_that_start_with_import(self):
         host = MockHost()
-        host.executive = mock_command_exec({
+        host.executive = mock_git_commands({
             'show': 'Import rutabaga@deadbeef',
             'rev-list': 'add087a97844f4b9e307d9a216940582d96db306',
             'rev-parse': 'add087a97844f4b9e307d9a216940582d96db306',
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/local_wpt_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/local_wpt_unittest.py
index 58e3e9ae..e8c8fd2 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/local_wpt_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/local_wpt_unittest.py
@@ -5,10 +5,9 @@
 import unittest
 
 from webkitpy.common.host_mock import MockHost
-from webkitpy.common.system.executive_mock import MockExecutive
+from webkitpy.common.system.executive_mock import MockExecutive, mock_git_commands
 from webkitpy.common.system.filesystem_mock import MockFileSystem
 from webkitpy.w3c.local_wpt import LocalWPT
-from webkitpy.w3c.common_unittest import mock_command_exec_strict
 
 
 class LocalWPTTest(unittest.TestCase):
@@ -53,11 +52,11 @@
 
     def test_last_wpt_exported_commit(self):
         host = MockHost()
-        host.executive = mock_command_exec_strict({
+        host.executive = mock_git_commands({
             'rev-list': '9ea4fc353a4b1c11c6e524270b11baa4d1ddfde8',
             'footers': 'Cr-Commit-Position: 123',
             'crrev-parse': 'add087a97844f4b9e307d9a216940582d96db306',
-        })
+        }, strict=True)
         host.filesystem = MockFileSystem()
         local_wpt = LocalWPT(host)
 
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py
index 3127b45..d7d88950 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py
@@ -354,7 +354,9 @@
             return False
 
         # If the CQ passes, then the issue will be closed.
-        if not self.git_cl.is_closed():
+        status = self.git_cl.run(['status' '--field', 'status']).strip()
+        _log.info('CL status: "%s"', status)
+        if status not in ('lgtm', 'closed'):
             _log.error('CQ appears to have failed; aborting.')
             self.git_cl.run(['set-close'])
             return False
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater.py
index 3622121a..9d1c26a 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater.py
@@ -46,7 +46,7 @@
             return 1
 
         rietveld = Rietveld(self.host.web)
-        builds = rietveld.latest_try_jobs(issue_number, self.get_try_bots())
+        builds = rietveld.latest_try_jobs(issue_number, self._get_try_bots())
         _log.debug('Latest try jobs: %r', builds)
         if not builds:
             _log.error('No try job information was collected.')
@@ -72,12 +72,6 @@
         """Returns current CL number. Can be replaced in unit tests."""
         return GitCL(self.host).get_issue_number()
 
-    def get_try_bots(self):
-        """Returns try bot names. Can be replaced in unit tests."""
-        # TODO(qyearsley): This method is unnecessary; unit tests can set up
-        # a BuilderList with try builder names, instead of overriding this.
-        return self.host.builders.all_try_builder_names()
-
     def get_failing_results_dict(self, build):
         """Returns a nested dict of failing test results.
 
@@ -310,7 +304,7 @@
     @memoized
     def all_try_builder_ports(self):
         """Returns a list of Port objects for all try builders."""
-        return [self.host.port_factory.get_from_builder_name(name) for name in self.get_try_bots()]
+        return [self.host.port_factory.get_from_builder_name(name) for name in self._get_try_bots()]
 
     @staticmethod
     def simplify_specifiers(specifiers, configuration_specifier_macros):  # pylint: disable=unused-argument
@@ -446,3 +440,6 @@
         if not test_parser.test_doc:
             return False
         return test_parser.is_jstest()
+
+    def _get_try_bots(self):
+        return self.host.builders.all_try_builder_names()
diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater_unittest.py
index 02b754e..b859ae1 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/wpt_expectations_updater_unittest.py
@@ -433,7 +433,6 @@
         })
         updater = WPTExpectationsUpdater(host)
         updater.get_issue_number = lambda: '11112222'
-        updater.get_try_bots = lambda: ['test-builder-name']
         self.assertEqual(1, updater.run(args=[]))
         self.assertEqual(
             host.web.urls_fetched,
diff --git a/third_party/WebKit/public/web/WebHistoryItem.h b/third_party/WebKit/public/web/WebHistoryItem.h
index 2b91f34..39e5340 100644
--- a/third_party/WebKit/public/web/WebHistoryItem.h
+++ b/third_party/WebKit/public/web/WebHistoryItem.h
@@ -116,6 +116,9 @@
 
   BLINK_EXPORT WebVector<WebString> getReferencedFilePaths() const;
 
+  BLINK_EXPORT bool didSaveScrollOrScaleState() const;
+  BLINK_EXPORT void setDidSaveScrollOrScaleState(bool);
+
 #if BLINK_IMPLEMENTATION
   BLINK_EXPORT WebHistoryItem(HistoryItem*);
   BLINK_EXPORT WebHistoryItem& operator=(HistoryItem*);
diff --git a/third_party/boringssl/BUILD.generated.gni b/third_party/boringssl/BUILD.generated.gni
index 761a3cf..ea584b6 100644
--- a/third_party/boringssl/BUILD.generated.gni
+++ b/third_party/boringssl/BUILD.generated.gni
@@ -392,7 +392,6 @@
   "src/ssl/handshake_server.c",
   "src/ssl/internal.h",
   "src/ssl/s3_both.c",
-  "src/ssl/s3_enc.c",
   "src/ssl/s3_lib.c",
   "src/ssl/s3_pkt.c",
   "src/ssl/ssl_aead_ctx.c",
@@ -403,10 +402,11 @@
   "src/ssl/ssl_ecdh.c",
   "src/ssl/ssl_file.c",
   "src/ssl/ssl_lib.c",
-  "src/ssl/ssl_rsa.c",
-  "src/ssl/ssl_rsa_cc.cc",
+  "src/ssl/ssl_privkey.c",
+  "src/ssl/ssl_privkey_cc.cc",
   "src/ssl/ssl_session.c",
   "src/ssl/ssl_stat.c",
+  "src/ssl/ssl_transcript.c",
   "src/ssl/ssl_x509.c",
   "src/ssl/t1_enc.c",
   "src/ssl/t1_lib.c",
diff --git a/third_party/boringssl/BUILD.generated_tests.gni b/third_party/boringssl/BUILD.generated_tests.gni
index c249ca8..5169b8e 100644
--- a/third_party/boringssl/BUILD.generated_tests.gni
+++ b/third_party/boringssl/BUILD.generated_tests.gni
@@ -16,8 +16,10 @@
 ]
 
 crypto_test_sources = [
+  "src/crypto/chacha/chacha_test.cc",
   "src/crypto/dh/dh_test.cc",
   "src/crypto/dsa/dsa_test.cc",
+  "src/crypto/err/err_test.cc",
   "src/crypto/test/gtest_main.cc",
 ]
 
@@ -99,18 +101,6 @@
     deps = invoker.deps
   }
 
-  executable("boringssl_chacha_test") {
-    sources = [
-      "src/crypto/chacha/chacha_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
   executable("boringssl_aead_test") {
     sources = [
       "src/crypto/cipher/aead_test.cc",
@@ -291,18 +281,6 @@
     deps = invoker.deps
   }
 
-  executable("boringssl_err_test") {
-    sources = [
-      "src/crypto/err/err_test.cc",
-    ]
-    sources += test_support_sources
-    if (defined(invoker.configs_exclude)) {
-      configs -= invoker.configs_exclude
-    }
-    configs += invoker.configs
-    deps = invoker.deps
-  }
-
   executable("boringssl_evp_extra_test") {
     sources = [
       "src/crypto/evp/evp_extra_test.cc",
@@ -540,7 +518,6 @@
       ":boringssl_bio_test",
       ":boringssl_bn_test",
       ":boringssl_bytestring_test",
-      ":boringssl_chacha_test",
       ":boringssl_cipher_test",
       ":boringssl_cmac_test",
       ":boringssl_constant_time_test",
@@ -551,7 +528,6 @@
       ":boringssl_ecdsa_test",
       ":boringssl_ecdsa_verify_test",
       ":boringssl_ed25519_test",
-      ":boringssl_err_test",
       ":boringssl_evp_extra_test",
       ":boringssl_evp_test",
       ":boringssl_example_mul",
diff --git a/third_party/boringssl/linux-arm/crypto/chacha/chacha-armv4.S b/third_party/boringssl/linux-arm/crypto/chacha/chacha-armv4.S
index 19a4d2c..0784fc7 100644
--- a/third_party/boringssl/linux-arm/crypto/chacha/chacha-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/chacha/chacha-armv4.S
@@ -1457,7 +1457,7 @@
 	ldrb	r9,[r12],#1		@ read input
 	subs	r11,r11,#1
 	eor	r8,r8,r9
-	strb	r8,[r14],#1		@ store ouput
+	strb	r8,[r14],#1		@ store output
 	bne	.Loop_tail_neon
 
 .Ldone_neon:
diff --git a/third_party/boringssl/linux-x86/crypto/bn/x86-mont.S b/third_party/boringssl/linux-x86/crypto/bn/x86-mont.S
index 1569b2c..e291a88 100644
--- a/third_party/boringssl/linux-x86/crypto/bn/x86-mont.S
+++ b/third_party/boringssl/linux-x86/crypto/bn/x86-mont.S
@@ -17,39 +17,54 @@
 	jl	.L000just_leave
 	leal	20(%esp),%esi
 	leal	24(%esp),%edx
-	movl	%esp,%ebp
 	addl	$2,%edi
 	negl	%edi
-	leal	-32(%esp,%edi,4),%esp
+	leal	-32(%esp,%edi,4),%ebp
 	negl	%edi
-	movl	%esp,%eax
+	movl	%ebp,%eax
 	subl	%edx,%eax
 	andl	$2047,%eax
-	subl	%eax,%esp
-	xorl	%esp,%edx
+	subl	%eax,%ebp
+	xorl	%ebp,%edx
 	andl	$2048,%edx
 	xorl	$2048,%edx
-	subl	%edx,%esp
-	andl	$-64,%esp
+	subl	%edx,%ebp
+	andl	$-64,%ebp
+	movl	%esp,%eax
+	subl	%ebp,%eax
+	andl	$-4096,%eax
+	movl	%esp,%edx
+	leal	(%ebp,%eax,1),%esp
+	movl	(%esp),%eax
+	cmpl	%ebp,%esp
+	ja	.L001page_walk
+	jmp	.L002page_walk_done
+.align	16
+.L001page_walk:
+	leal	-4096(%esp),%esp
+	movl	(%esp),%eax
+	cmpl	%ebp,%esp
+	ja	.L001page_walk
+.L002page_walk_done:
 	movl	(%esi),%eax
 	movl	4(%esi),%ebx
 	movl	8(%esi),%ecx
-	movl	12(%esi),%edx
+	movl	12(%esi),%ebp
 	movl	16(%esi),%esi
 	movl	(%esi),%esi
 	movl	%eax,4(%esp)
 	movl	%ebx,8(%esp)
 	movl	%ecx,12(%esp)
-	movl	%edx,16(%esp)
+	movl	%ebp,16(%esp)
 	movl	%esi,20(%esp)
 	leal	-3(%edi),%ebx
-	movl	%ebp,24(%esp)
-	call	.L001PIC_me_up
-.L001PIC_me_up:
+	movl	%edx,24(%esp)
+	call	.L003PIC_me_up
+.L003PIC_me_up:
 	popl	%eax
-	leal	OPENSSL_ia32cap_P-.L001PIC_me_up(%eax),%eax
+	leal	OPENSSL_ia32cap_P-.L003PIC_me_up(%eax),%eax
 	btl	$26,(%eax)
-	jnc	.L002non_sse2
+	jnc	.L004non_sse2
 	movl	$-1,%eax
 	movd	%eax,%mm7
 	movl	8(%esp),%esi
@@ -73,7 +88,7 @@
 	psrlq	$32,%mm3
 	incl	%ecx
 .align	16
-.L0031st:
+.L0051st:
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -88,7 +103,7 @@
 	psrlq	$32,%mm3
 	leal	1(%ecx),%ecx
 	cmpl	%ebx,%ecx
-	jl	.L0031st
+	jl	.L0051st
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -102,7 +117,7 @@
 	paddq	%mm2,%mm3
 	movq	%mm3,32(%esp,%ebx,4)
 	incl	%edx
-.L004outer:
+.L006outer:
 	xorl	%ecx,%ecx
 	movd	(%edi,%edx,4),%mm4
 	movd	(%esi),%mm5
@@ -124,7 +139,7 @@
 	paddq	%mm6,%mm2
 	incl	%ecx
 	decl	%ebx
-.L005inner:
+.L007inner:
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -141,7 +156,7 @@
 	paddq	%mm6,%mm2
 	decl	%ebx
 	leal	1(%ecx),%ecx
-	jnz	.L005inner
+	jnz	.L007inner
 	movl	%ecx,%ebx
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
@@ -159,11 +174,11 @@
 	movq	%mm3,32(%esp,%ebx,4)
 	leal	1(%edx),%edx
 	cmpl	%ebx,%edx
-	jle	.L004outer
+	jle	.L006outer
 	emms
-	jmp	.L006common_tail
+	jmp	.L008common_tail
 .align	16
-.L002non_sse2:
+.L004non_sse2:
 	movl	8(%esp),%esi
 	leal	1(%ebx),%ebp
 	movl	12(%esp),%edi
@@ -174,12 +189,12 @@
 	leal	4(%edi,%ebx,4),%eax
 	orl	%edx,%ebp
 	movl	(%edi),%edi
-	jz	.L007bn_sqr_mont
+	jz	.L009bn_sqr_mont
 	movl	%eax,28(%esp)
 	movl	(%esi),%eax
 	xorl	%edx,%edx
 .align	16
-.L008mull:
+.L010mull:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	%eax,%ebp
@@ -188,7 +203,7 @@
 	movl	(%esi,%ecx,4),%eax
 	cmpl	%ebx,%ecx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	.L008mull
+	jl	.L010mull
 	movl	%edx,%ebp
 	mull	%edi
 	movl	20(%esp),%edi
@@ -206,9 +221,9 @@
 	movl	4(%esi),%eax
 	adcl	$0,%edx
 	incl	%ecx
-	jmp	.L0092ndmadd
+	jmp	.L0112ndmadd
 .align	16
-.L0101stmadd:
+.L0121stmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -219,7 +234,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	.L0101stmadd
+	jl	.L0121stmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%eax
@@ -242,7 +257,7 @@
 	adcl	$0,%edx
 	movl	$1,%ecx
 .align	16
-.L0092ndmadd:
+.L0112ndmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -253,7 +268,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,24(%esp,%ecx,4)
-	jl	.L0092ndmadd
+	jl	.L0112ndmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%ebp
@@ -269,16 +284,16 @@
 	movl	%edx,32(%esp,%ebx,4)
 	cmpl	28(%esp),%ecx
 	movl	%eax,36(%esp,%ebx,4)
-	je	.L006common_tail
+	je	.L008common_tail
 	movl	(%ecx),%edi
 	movl	8(%esp),%esi
 	movl	%ecx,12(%esp)
 	xorl	%ecx,%ecx
 	xorl	%edx,%edx
 	movl	(%esi),%eax
-	jmp	.L0101stmadd
+	jmp	.L0121stmadd
 .align	16
-.L007bn_sqr_mont:
+.L009bn_sqr_mont:
 	movl	%ebx,(%esp)
 	movl	%ecx,12(%esp)
 	movl	%edi,%eax
@@ -289,7 +304,7 @@
 	andl	$1,%ebx
 	incl	%ecx
 .align	16
-.L011sqr:
+.L013sqr:
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -301,7 +316,7 @@
 	cmpl	(%esp),%ecx
 	movl	%eax,%ebx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	.L011sqr
+	jl	.L013sqr
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -325,7 +340,7 @@
 	movl	4(%esi),%eax
 	movl	$1,%ecx
 .align	16
-.L0123rdmadd:
+.L0143rdmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -344,7 +359,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,24(%esp,%ecx,4)
-	jl	.L0123rdmadd
+	jl	.L0143rdmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%ebp
@@ -360,7 +375,7 @@
 	movl	%edx,32(%esp,%ebx,4)
 	cmpl	%ebx,%ecx
 	movl	%eax,36(%esp,%ebx,4)
-	je	.L006common_tail
+	je	.L008common_tail
 	movl	4(%esi,%ecx,4),%edi
 	leal	1(%ecx),%ecx
 	movl	%edi,%eax
@@ -372,12 +387,12 @@
 	xorl	%ebp,%ebp
 	cmpl	%ebx,%ecx
 	leal	1(%ecx),%ecx
-	je	.L013sqrlast
+	je	.L015sqrlast
 	movl	%edx,%ebx
 	shrl	$1,%edx
 	andl	$1,%ebx
 .align	16
-.L014sqradd:
+.L016sqradd:
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -393,13 +408,13 @@
 	cmpl	(%esp),%ecx
 	movl	%ebp,28(%esp,%ecx,4)
 	movl	%eax,%ebx
-	jle	.L014sqradd
+	jle	.L016sqradd
 	movl	%edx,%ebp
 	addl	%edx,%edx
 	shrl	$31,%ebp
 	addl	%ebx,%edx
 	adcl	$0,%ebp
-.L013sqrlast:
+.L015sqrlast:
 	movl	20(%esp),%edi
 	movl	16(%esp),%esi
 	imull	32(%esp),%edi
@@ -414,9 +429,9 @@
 	adcl	$0,%edx
 	movl	$1,%ecx
 	movl	4(%esi),%eax
-	jmp	.L0123rdmadd
+	jmp	.L0143rdmadd
 .align	16
-.L006common_tail:
+.L008common_tail:
 	movl	16(%esp),%ebp
 	movl	4(%esp),%edi
 	leal	32(%esp),%esi
@@ -424,25 +439,26 @@
 	movl	%ebx,%ecx
 	xorl	%edx,%edx
 .align	16
-.L015sub:
+.L017sub:
 	sbbl	(%ebp,%edx,4),%eax
 	movl	%eax,(%edi,%edx,4)
 	decl	%ecx
 	movl	4(%esi,%edx,4),%eax
 	leal	1(%edx),%edx
-	jge	.L015sub
+	jge	.L017sub
 	sbbl	$0,%eax
+	andl	%eax,%esi
+	notl	%eax
+	movl	%edi,%ebp
+	andl	%eax,%ebp
+	orl	%ebp,%esi
 .align	16
-.L016copy:
-	movl	(%esi,%ebx,4),%edx
-	movl	(%edi,%ebx,4),%ebp
-	xorl	%ebp,%edx
-	andl	%eax,%edx
-	xorl	%ebp,%edx
-	movl	%ecx,(%esi,%ebx,4)
-	movl	%edx,(%edi,%ebx,4)
+.L018copy:
+	movl	(%esi,%ebx,4),%eax
+	movl	%eax,(%edi,%ebx,4)
+	movl	%ecx,32(%esp,%ebx,4)
 	decl	%ebx
-	jge	.L016copy
+	jge	.L018copy
 	movl	24(%esp),%esp
 	movl	$1,%eax
 .L000just_leave:
diff --git a/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont.S b/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont.S
index 83926ad..5152de5d 100644
--- a/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont.S
+++ b/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont.S
@@ -9,6 +9,8 @@
 .type	bn_mul_mont,@function
 .align	16
 bn_mul_mont:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 	testl	$3,%r9d
 	jnz	.Lmul_enter
 	cmpl	$8,%r9d
@@ -28,14 +30,37 @@
 	pushq	%r14
 	pushq	%r15
 
-	movl	%r9d,%r9d
-	leaq	2(%r9),%r10
+	negq	%r9
 	movq	%rsp,%r11
-	negq	%r10
-	leaq	(%rsp,%r10,8),%rsp
-	andq	$-1024,%rsp
+	leaq	-16(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
-	movq	%r11,8(%rsp,%r9,8)
+
+
+
+
+
+
+
+
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul_page_walk
+	jmp	.Lmul_page_walk_done
+
+.align	16
+.Lmul_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul_page_walk
+.Lmul_page_walk_done:
+
+	movq	%rax,8(%rsp,%r9,8)
 .Lmul_body:
 	movq	%rdx,%r12
 	movq	(%r8),%r8
@@ -187,35 +212,38 @@
 
 	sbbq	$0,%rax
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
 	movq	%r9,%r15
+	orq	%rcx,%rsi
 .align	16
 .Lcopy:
-	movq	(%rsp,%r14,8),%rsi
-	movq	(%rdi,%r14,8),%rcx
-	xorq	%rcx,%rsi
-	andq	%rax,%rsi
-	xorq	%rcx,%rsi
+	movq	(%rsi,%r14,8),%rax
 	movq	%r14,(%rsp,%r14,8)
-	movq	%rsi,(%rdi,%r14,8)
+	movq	%rax,(%rdi,%r14,8)
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	.Lcopy
 
 	movq	8(%rsp,%r9,8),%rsi
 	movq	$1,%rax
-	movq	(%rsi),%r15
-	movq	8(%rsi),%r14
-	movq	16(%rsi),%r13
-	movq	24(%rsi),%r12
-	movq	32(%rsi),%rbp
-	movq	40(%rsi),%rbx
-	leaq	48(%rsi),%rsp
+	movq	-48(%rsi),%r15
+	movq	-40(%rsi),%r14
+	movq	-32(%rsi),%r13
+	movq	-24(%rsi),%r12
+	movq	-16(%rsi),%rbp
+	movq	-8(%rsi),%rbx
+	leaq	(%rsi),%rsp
 .Lmul_epilogue:
 	.byte	0xf3,0xc3
 .size	bn_mul_mont,.-bn_mul_mont
 .type	bn_mul4x_mont,@function
 .align	16
 bn_mul4x_mont:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 .Lmul4x_enter:
 	pushq	%rbx
 	pushq	%rbp
@@ -224,14 +252,28 @@
 	pushq	%r14
 	pushq	%r15
 
-	movl	%r9d,%r9d
-	leaq	4(%r9),%r10
+	negq	%r9
 	movq	%rsp,%r11
-	negq	%r10
-	leaq	(%rsp,%r10,8),%rsp
-	andq	$-1024,%rsp
+	leaq	-32(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
-	movq	%r11,8(%rsp,%r9,8)
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul4x_page_walk
+	jmp	.Lmul4x_page_walk_done
+
+.Lmul4x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul4x_page_walk
+.Lmul4x_page_walk_done:
+
+	movq	%rax,8(%rsp,%r9,8)
 .Lmul4x_body:
 	movq	%rdi,16(%rsp,%r9,8)
 	movq	%rdx,%r12
@@ -532,6 +574,7 @@
 	jb	.Louter4x
 	movq	16(%rsp,%r9,8),%rdi
 	movq	0(%rsp),%rax
+	pxor	%xmm0,%xmm0
 	movq	8(%rsp),%rdx
 	shrq	$2,%r9
 	leaq	(%rsp),%rsi
@@ -569,45 +612,44 @@
 	movq	%rbx,16(%rdi,%r14,8)
 
 	sbbq	$0,%rax
-	movq	%rax,%xmm0
-	punpcklqdq	%xmm0,%xmm0
 	movq	%rbp,24(%rdi,%r14,8)
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
+	leaq	-1(%r9),%r15
+	orq	%rcx,%rsi
 
-	movq	%r9,%r15
-	pxor	%xmm5,%xmm5
+	movdqu	(%rsi),%xmm1
+	movdqa	%xmm0,(%rsp)
+	movdqu	%xmm1,(%rdi)
 	jmp	.Lcopy4x
 .align	16
 .Lcopy4x:
-	movdqu	(%rsp,%r14,1),%xmm2
-	movdqu	16(%rsp,%r14,1),%xmm4
-	movdqu	(%rdi,%r14,1),%xmm1
-	movdqu	16(%rdi,%r14,1),%xmm3
-	pxor	%xmm1,%xmm2
-	pxor	%xmm3,%xmm4
-	pand	%xmm0,%xmm2
-	pand	%xmm0,%xmm4
-	pxor	%xmm1,%xmm2
-	pxor	%xmm3,%xmm4
-	movdqu	%xmm2,(%rdi,%r14,1)
-	movdqu	%xmm4,16(%rdi,%r14,1)
-	movdqa	%xmm5,(%rsp,%r14,1)
-	movdqa	%xmm5,16(%rsp,%r14,1)
-
+	movdqu	16(%rsi,%r14,1),%xmm2
+	movdqu	32(%rsi,%r14,1),%xmm1
+	movdqa	%xmm0,16(%rsp,%r14,1)
+	movdqu	%xmm2,16(%rdi,%r14,1)
+	movdqa	%xmm0,32(%rsp,%r14,1)
+	movdqu	%xmm1,32(%rdi,%r14,1)
 	leaq	32(%r14),%r14
 	decq	%r15
 	jnz	.Lcopy4x
 
 	shlq	$2,%r9
+	movdqu	16(%rsi,%r14,1),%xmm2
+	movdqa	%xmm0,16(%rsp,%r14,1)
+	movdqu	%xmm2,16(%rdi,%r14,1)
 	movq	8(%rsp,%r9,8),%rsi
 	movq	$1,%rax
-	movq	(%rsi),%r15
-	movq	8(%rsi),%r14
-	movq	16(%rsi),%r13
-	movq	24(%rsi),%r12
-	movq	32(%rsi),%rbp
-	movq	40(%rsi),%rbx
-	leaq	48(%rsi),%rsp
+	movq	-48(%rsi),%r15
+	movq	-40(%rsi),%r14
+	movq	-32(%rsi),%r13
+	movq	-24(%rsi),%r12
+	movq	-16(%rsi),%rbp
+	movq	-8(%rsi),%rbx
+	leaq	(%rsi),%rsp
 .Lmul4x_epilogue:
 	.byte	0xf3,0xc3
 .size	bn_mul4x_mont,.-bn_mul4x_mont
@@ -617,14 +659,15 @@
 .type	bn_sqr8x_mont,@function
 .align	32
 bn_sqr8x_mont:
-.Lsqr8x_enter:
 	movq	%rsp,%rax
+.Lsqr8x_enter:
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+.Lsqr8x_prologue:
 
 	movl	%r9d,%r10d
 	shll	$3,%r9d
@@ -637,25 +680,43 @@
 
 
 	leaq	-64(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	movq	(%r8),%r8
 	subq	%rsi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lsqr8x_sp_alt
-	subq	%r11,%rsp
-	leaq	-64(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-64(%rbp,%r9,2),%rbp
 	jmp	.Lsqr8x_sp_done
 
 .align	32
 .Lsqr8x_sp_alt:
 	leaq	4096-64(,%r9,2),%r10
-	leaq	-64(%rsp,%r9,2),%rsp
+	leaq	-64(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 .Lsqr8x_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lsqr8x_page_walk
+	jmp	.Lsqr8x_page_walk_done
+
+.align	16
+.Lsqr8x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lsqr8x_page_walk
+.Lsqr8x_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
diff --git a/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont5.S b/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont5.S
index 5d7502c..b891f353 100644
--- a/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont5.S
+++ b/third_party/boringssl/linux-x86_64/crypto/bn/x86_64-mont5.S
@@ -9,16 +9,15 @@
 .type	bn_mul_mont_gather5,@function
 .align	64
 bn_mul_mont_gather5:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 	testl	$7,%r9d
 	jnz	.Lmul_enter
 	jmp	.Lmul4x_enter
 
 .align	16
 .Lmul_enter:
-	movl	%r9d,%r9d
-	movq	%rsp,%rax
 	movd	8(%rsp),%xmm5
-	leaq	.Linc(%rip),%r10
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
@@ -26,13 +25,39 @@
 	pushq	%r14
 	pushq	%r15
 
-	leaq	2(%r9),%r11
-	negq	%r11
-	leaq	-264(%rsp,%r11,8),%rsp
-	andq	$-1024,%rsp
+	negq	%r9
+	movq	%rsp,%r11
+	leaq	-280(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
+
+
+
+
+
+
+
+
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul_page_walk
+	jmp	.Lmul_page_walk_done
+
+.Lmul_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	.Lmul_page_walk
+.Lmul_page_walk_done:
+
+	leaq	.Linc(%rip),%r10
 	movq	%rax,8(%rsp,%r9,8)
 .Lmul_body:
+
 	leaq	128(%rdx),%r12
 	movdqa	0(%r10),%xmm0
 	movdqa	16(%r10),%xmm1
@@ -371,16 +396,17 @@
 
 	sbbq	$0,%rax
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
 	movq	%r9,%r15
+	orq	%rcx,%rsi
 .align	16
 .Lcopy:
-	movq	(%rsp,%r14,8),%rsi
-	movq	(%rdi,%r14,8),%rcx
-	xorq	%rcx,%rsi
-	andq	%rax,%rsi
-	xorq	%rcx,%rsi
+	movq	(%rsi,%r14,8),%rax
 	movq	%r14,(%rsp,%r14,8)
-	movq	%rsi,(%rdi,%r14,8)
+	movq	%rax,(%rdi,%r14,8)
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	.Lcopy
@@ -401,15 +427,16 @@
 .type	bn_mul4x_mont_gather5,@function
 .align	32
 bn_mul4x_mont_gather5:
-.Lmul4x_enter:
 .byte	0x67
 	movq	%rsp,%rax
+.Lmul4x_enter:
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+.Lmul4x_prologue:
 
 .byte	0x67
 	shll	$3,%r9d
@@ -426,24 +453,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lmul4xsp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	.Lmul4xsp_done
 
 .align	32
 .Lmul4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 .Lmul4xsp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lmul4x_page_walk
+	jmp	.Lmul4x_page_walk_done
+
+.Lmul4x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lmul4x_page_walk
+.Lmul4x_page_walk_done:
+
 	negq	%r9
 
 	movq	%rax,40(%rsp)
@@ -1002,6 +1046,7 @@
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+.Lpower5_prologue:
 
 	shll	$3,%r9d
 	leal	(%r9,%r9,2),%r10d
@@ -1016,24 +1061,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lpwr_sp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	.Lpwr_sp_done
 
 .align	32
 .Lpwr_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 .Lpwr_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lpwr_page_walk
+	jmp	.Lpwr_page_walk_done
+
+.Lpwr_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lpwr_page_walk
+.Lpwr_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
@@ -1944,6 +2006,7 @@
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+.Lfrom_prologue:
 
 	shll	$3,%r9d
 	leaq	(%r9,%r9,2),%r10
@@ -1958,24 +2021,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	.Lfrom_sp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	.Lfrom_sp_done
 
 .align	32
 .Lfrom_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 .Lfrom_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lfrom_page_walk
+	jmp	.Lfrom_page_walk_done
+
+.Lfrom_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	.Lfrom_page_walk
+.Lfrom_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
diff --git a/third_party/boringssl/linux-x86_64/crypto/chacha/chacha-x86_64.S b/third_party/boringssl/linux-x86_64/crypto/chacha/chacha-x86_64.S
index e994940..76969da0 100644
--- a/third_party/boringssl/linux-x86_64/crypto/chacha/chacha-x86_64.S
+++ b/third_party/boringssl/linux-x86_64/crypto/chacha/chacha-x86_64.S
@@ -23,6 +23,15 @@
 .byte	0x3,0x0,0x1,0x2, 0x7,0x4,0x5,0x6, 0xb,0x8,0x9,0xa, 0xf,0xc,0xd,0xe
 .Lsigma:
 .byte	101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107,0
+.align	64
+.Lzeroz:
+.long	0,0,0,0, 1,0,0,0, 2,0,0,0, 3,0,0,0
+.Lfourz:
+.long	4,0,0,0, 4,0,0,0, 4,0,0,0, 4,0,0,0
+.Lincz:
+.long	0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
+.Lsixteen:
+.long	16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16
 .byte	67,104,97,67,104,97,50,48,32,102,111,114,32,120,56,54,95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .globl	ChaCha20_ctr32
 .hidden ChaCha20_ctr32
@@ -316,7 +325,7 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	movl	$10,%ebp
+	movq	$10,%r8
 	jmp	.Loop_ssse3
 
 .align	32
@@ -326,7 +335,7 @@
 	movdqa	16(%rsp),%xmm1
 	movdqa	32(%rsp),%xmm2
 	paddd	48(%rsp),%xmm3
-	movl	$10,%ebp
+	movq	$10,%r8
 	movdqa	%xmm3,48(%rsp)
 	jmp	.Loop_ssse3
 
@@ -375,7 +384,7 @@
 	pshufd	$78,%xmm2,%xmm2
 	pshufd	$147,%xmm1,%xmm1
 	pshufd	$57,%xmm3,%xmm3
-	decl	%ebp
+	decq	%r8
 	jnz	.Loop_ssse3
 	paddd	0(%rsp),%xmm0
 	paddd	16(%rsp),%xmm1
@@ -412,25 +421,19 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	xorq	%rbx,%rbx
+	xorq	%r8,%r8
 
 .Loop_tail_ssse3:
-	movzbl	(%rsi,%rbx,1),%eax
-	movzbl	(%rsp,%rbx,1),%ecx
-	leaq	1(%rbx),%rbx
+	movzbl	(%rsi,%r8,1),%eax
+	movzbl	(%rsp,%r8,1),%ecx
+	leaq	1(%r8),%r8
 	xorl	%ecx,%eax
-	movb	%al,-1(%rdi,%rbx,1)
+	movb	%al,-1(%rdi,%r8,1)
 	decq	%rdx
 	jnz	.Loop_tail_ssse3
 
 .Ldone_ssse3:
-	addq	$64+24,%rsp
-	popq	%r15
-	popq	%r14
-	popq	%r13
-	popq	%r12
-	popq	%rbp
-	popq	%rbx
+	addq	$64+24+48,%rsp
 	.byte	0xf3,0xc3
 .size	ChaCha20_ssse3,.-ChaCha20_ssse3
 .type	ChaCha20_4x,@function
diff --git a/third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S b/third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
index 241d7d0..c7e673f 100644
--- a/third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
+++ b/third_party/boringssl/linux-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
@@ -2,6 +2,9 @@
 .text	
 .extern	OPENSSL_ia32cap_P
 .hidden OPENSSL_ia32cap_P
+
+chacha20_poly1305_constants:
+
 .align	64
 .chacha20_consts:
 .byte	'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
diff --git a/third_party/boringssl/mac-x86/crypto/bn/x86-mont.S b/third_party/boringssl/mac-x86/crypto/bn/x86-mont.S
index 234034b..5c13ca4d 100644
--- a/third_party/boringssl/mac-x86/crypto/bn/x86-mont.S
+++ b/third_party/boringssl/mac-x86/crypto/bn/x86-mont.S
@@ -16,39 +16,54 @@
 	jl	L000just_leave
 	leal	20(%esp),%esi
 	leal	24(%esp),%edx
-	movl	%esp,%ebp
 	addl	$2,%edi
 	negl	%edi
-	leal	-32(%esp,%edi,4),%esp
+	leal	-32(%esp,%edi,4),%ebp
 	negl	%edi
-	movl	%esp,%eax
+	movl	%ebp,%eax
 	subl	%edx,%eax
 	andl	$2047,%eax
-	subl	%eax,%esp
-	xorl	%esp,%edx
+	subl	%eax,%ebp
+	xorl	%ebp,%edx
 	andl	$2048,%edx
 	xorl	$2048,%edx
-	subl	%edx,%esp
-	andl	$-64,%esp
+	subl	%edx,%ebp
+	andl	$-64,%ebp
+	movl	%esp,%eax
+	subl	%ebp,%eax
+	andl	$-4096,%eax
+	movl	%esp,%edx
+	leal	(%ebp,%eax,1),%esp
+	movl	(%esp),%eax
+	cmpl	%ebp,%esp
+	ja	L001page_walk
+	jmp	L002page_walk_done
+.align	4,0x90
+L001page_walk:
+	leal	-4096(%esp),%esp
+	movl	(%esp),%eax
+	cmpl	%ebp,%esp
+	ja	L001page_walk
+L002page_walk_done:
 	movl	(%esi),%eax
 	movl	4(%esi),%ebx
 	movl	8(%esi),%ecx
-	movl	12(%esi),%edx
+	movl	12(%esi),%ebp
 	movl	16(%esi),%esi
 	movl	(%esi),%esi
 	movl	%eax,4(%esp)
 	movl	%ebx,8(%esp)
 	movl	%ecx,12(%esp)
-	movl	%edx,16(%esp)
+	movl	%ebp,16(%esp)
 	movl	%esi,20(%esp)
 	leal	-3(%edi),%ebx
-	movl	%ebp,24(%esp)
-	call	L001PIC_me_up
-L001PIC_me_up:
+	movl	%edx,24(%esp)
+	call	L003PIC_me_up
+L003PIC_me_up:
 	popl	%eax
-	movl	L_OPENSSL_ia32cap_P$non_lazy_ptr-L001PIC_me_up(%eax),%eax
+	movl	L_OPENSSL_ia32cap_P$non_lazy_ptr-L003PIC_me_up(%eax),%eax
 	btl	$26,(%eax)
-	jnc	L002non_sse2
+	jnc	L004non_sse2
 	movl	$-1,%eax
 	movd	%eax,%mm7
 	movl	8(%esp),%esi
@@ -72,7 +87,7 @@
 	psrlq	$32,%mm3
 	incl	%ecx
 .align	4,0x90
-L0031st:
+L0051st:
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -87,7 +102,7 @@
 	psrlq	$32,%mm3
 	leal	1(%ecx),%ecx
 	cmpl	%ebx,%ecx
-	jl	L0031st
+	jl	L0051st
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -101,7 +116,7 @@
 	paddq	%mm2,%mm3
 	movq	%mm3,32(%esp,%ebx,4)
 	incl	%edx
-L004outer:
+L006outer:
 	xorl	%ecx,%ecx
 	movd	(%edi,%edx,4),%mm4
 	movd	(%esi),%mm5
@@ -123,7 +138,7 @@
 	paddq	%mm6,%mm2
 	incl	%ecx
 	decl	%ebx
-L005inner:
+L007inner:
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
 	paddq	%mm0,%mm2
@@ -140,7 +155,7 @@
 	paddq	%mm6,%mm2
 	decl	%ebx
 	leal	1(%ecx),%ecx
-	jnz	L005inner
+	jnz	L007inner
 	movl	%ecx,%ebx
 	pmuludq	%mm4,%mm0
 	pmuludq	%mm5,%mm1
@@ -158,11 +173,11 @@
 	movq	%mm3,32(%esp,%ebx,4)
 	leal	1(%edx),%edx
 	cmpl	%ebx,%edx
-	jle	L004outer
+	jle	L006outer
 	emms
-	jmp	L006common_tail
+	jmp	L008common_tail
 .align	4,0x90
-L002non_sse2:
+L004non_sse2:
 	movl	8(%esp),%esi
 	leal	1(%ebx),%ebp
 	movl	12(%esp),%edi
@@ -173,12 +188,12 @@
 	leal	4(%edi,%ebx,4),%eax
 	orl	%edx,%ebp
 	movl	(%edi),%edi
-	jz	L007bn_sqr_mont
+	jz	L009bn_sqr_mont
 	movl	%eax,28(%esp)
 	movl	(%esi),%eax
 	xorl	%edx,%edx
 .align	4,0x90
-L008mull:
+L010mull:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	%eax,%ebp
@@ -187,7 +202,7 @@
 	movl	(%esi,%ecx,4),%eax
 	cmpl	%ebx,%ecx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	L008mull
+	jl	L010mull
 	movl	%edx,%ebp
 	mull	%edi
 	movl	20(%esp),%edi
@@ -205,9 +220,9 @@
 	movl	4(%esi),%eax
 	adcl	$0,%edx
 	incl	%ecx
-	jmp	L0092ndmadd
+	jmp	L0112ndmadd
 .align	4,0x90
-L0101stmadd:
+L0121stmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -218,7 +233,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	L0101stmadd
+	jl	L0121stmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%eax
@@ -241,7 +256,7 @@
 	adcl	$0,%edx
 	movl	$1,%ecx
 .align	4,0x90
-L0092ndmadd:
+L0112ndmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -252,7 +267,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,24(%esp,%ecx,4)
-	jl	L0092ndmadd
+	jl	L0112ndmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%ebp
@@ -268,16 +283,16 @@
 	movl	%edx,32(%esp,%ebx,4)
 	cmpl	28(%esp),%ecx
 	movl	%eax,36(%esp,%ebx,4)
-	je	L006common_tail
+	je	L008common_tail
 	movl	(%ecx),%edi
 	movl	8(%esp),%esi
 	movl	%ecx,12(%esp)
 	xorl	%ecx,%ecx
 	xorl	%edx,%edx
 	movl	(%esi),%eax
-	jmp	L0101stmadd
+	jmp	L0121stmadd
 .align	4,0x90
-L007bn_sqr_mont:
+L009bn_sqr_mont:
 	movl	%ebx,(%esp)
 	movl	%ecx,12(%esp)
 	movl	%edi,%eax
@@ -288,7 +303,7 @@
 	andl	$1,%ebx
 	incl	%ecx
 .align	4,0x90
-L011sqr:
+L013sqr:
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -300,7 +315,7 @@
 	cmpl	(%esp),%ecx
 	movl	%eax,%ebx
 	movl	%ebp,28(%esp,%ecx,4)
-	jl	L011sqr
+	jl	L013sqr
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -324,7 +339,7 @@
 	movl	4(%esi),%eax
 	movl	$1,%ecx
 .align	4,0x90
-L0123rdmadd:
+L0143rdmadd:
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ecx,4),%ebp
@@ -343,7 +358,7 @@
 	adcl	$0,%edx
 	cmpl	%ebx,%ecx
 	movl	%ebp,24(%esp,%ecx,4)
-	jl	L0123rdmadd
+	jl	L0143rdmadd
 	movl	%edx,%ebp
 	mull	%edi
 	addl	32(%esp,%ebx,4),%ebp
@@ -359,7 +374,7 @@
 	movl	%edx,32(%esp,%ebx,4)
 	cmpl	%ebx,%ecx
 	movl	%eax,36(%esp,%ebx,4)
-	je	L006common_tail
+	je	L008common_tail
 	movl	4(%esi,%ecx,4),%edi
 	leal	1(%ecx),%ecx
 	movl	%edi,%eax
@@ -371,12 +386,12 @@
 	xorl	%ebp,%ebp
 	cmpl	%ebx,%ecx
 	leal	1(%ecx),%ecx
-	je	L013sqrlast
+	je	L015sqrlast
 	movl	%edx,%ebx
 	shrl	$1,%edx
 	andl	$1,%ebx
 .align	4,0x90
-L014sqradd:
+L016sqradd:
 	movl	(%esi,%ecx,4),%eax
 	movl	%edx,%ebp
 	mull	%edi
@@ -392,13 +407,13 @@
 	cmpl	(%esp),%ecx
 	movl	%ebp,28(%esp,%ecx,4)
 	movl	%eax,%ebx
-	jle	L014sqradd
+	jle	L016sqradd
 	movl	%edx,%ebp
 	addl	%edx,%edx
 	shrl	$31,%ebp
 	addl	%ebx,%edx
 	adcl	$0,%ebp
-L013sqrlast:
+L015sqrlast:
 	movl	20(%esp),%edi
 	movl	16(%esp),%esi
 	imull	32(%esp),%edi
@@ -413,9 +428,9 @@
 	adcl	$0,%edx
 	movl	$1,%ecx
 	movl	4(%esi),%eax
-	jmp	L0123rdmadd
+	jmp	L0143rdmadd
 .align	4,0x90
-L006common_tail:
+L008common_tail:
 	movl	16(%esp),%ebp
 	movl	4(%esp),%edi
 	leal	32(%esp),%esi
@@ -423,25 +438,26 @@
 	movl	%ebx,%ecx
 	xorl	%edx,%edx
 .align	4,0x90
-L015sub:
+L017sub:
 	sbbl	(%ebp,%edx,4),%eax
 	movl	%eax,(%edi,%edx,4)
 	decl	%ecx
 	movl	4(%esi,%edx,4),%eax
 	leal	1(%edx),%edx
-	jge	L015sub
+	jge	L017sub
 	sbbl	$0,%eax
+	andl	%eax,%esi
+	notl	%eax
+	movl	%edi,%ebp
+	andl	%eax,%ebp
+	orl	%ebp,%esi
 .align	4,0x90
-L016copy:
-	movl	(%esi,%ebx,4),%edx
-	movl	(%edi,%ebx,4),%ebp
-	xorl	%ebp,%edx
-	andl	%eax,%edx
-	xorl	%ebp,%edx
-	movl	%ecx,(%esi,%ebx,4)
-	movl	%edx,(%edi,%ebx,4)
+L018copy:
+	movl	(%esi,%ebx,4),%eax
+	movl	%eax,(%edi,%ebx,4)
+	movl	%ecx,32(%esp,%ebx,4)
 	decl	%ebx
-	jge	L016copy
+	jge	L018copy
 	movl	24(%esp),%esp
 	movl	$1,%eax
 L000just_leave:
diff --git a/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont.S b/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont.S
index 51e5d199..8d3c840 100644
--- a/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont.S
+++ b/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont.S
@@ -8,6 +8,8 @@
 
 .p2align	4
 _bn_mul_mont:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 	testl	$3,%r9d
 	jnz	L$mul_enter
 	cmpl	$8,%r9d
@@ -27,14 +29,37 @@
 	pushq	%r14
 	pushq	%r15
 
-	movl	%r9d,%r9d
-	leaq	2(%r9),%r10
+	negq	%r9
 	movq	%rsp,%r11
-	negq	%r10
-	leaq	(%rsp,%r10,8),%rsp
-	andq	$-1024,%rsp
+	leaq	-16(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
-	movq	%r11,8(%rsp,%r9,8)
+
+
+
+
+
+
+
+
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul_page_walk
+	jmp	L$mul_page_walk_done
+
+.p2align	4
+L$mul_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul_page_walk
+L$mul_page_walk_done:
+
+	movq	%rax,8(%rsp,%r9,8)
 L$mul_body:
 	movq	%rdx,%r12
 	movq	(%r8),%r8
@@ -186,35 +211,38 @@
 
 	sbbq	$0,%rax
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
 	movq	%r9,%r15
+	orq	%rcx,%rsi
 .p2align	4
 L$copy:
-	movq	(%rsp,%r14,8),%rsi
-	movq	(%rdi,%r14,8),%rcx
-	xorq	%rcx,%rsi
-	andq	%rax,%rsi
-	xorq	%rcx,%rsi
+	movq	(%rsi,%r14,8),%rax
 	movq	%r14,(%rsp,%r14,8)
-	movq	%rsi,(%rdi,%r14,8)
+	movq	%rax,(%rdi,%r14,8)
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	L$copy
 
 	movq	8(%rsp,%r9,8),%rsi
 	movq	$1,%rax
-	movq	(%rsi),%r15
-	movq	8(%rsi),%r14
-	movq	16(%rsi),%r13
-	movq	24(%rsi),%r12
-	movq	32(%rsi),%rbp
-	movq	40(%rsi),%rbx
-	leaq	48(%rsi),%rsp
+	movq	-48(%rsi),%r15
+	movq	-40(%rsi),%r14
+	movq	-32(%rsi),%r13
+	movq	-24(%rsi),%r12
+	movq	-16(%rsi),%rbp
+	movq	-8(%rsi),%rbx
+	leaq	(%rsi),%rsp
 L$mul_epilogue:
 	.byte	0xf3,0xc3
 
 
 .p2align	4
 bn_mul4x_mont:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 L$mul4x_enter:
 	pushq	%rbx
 	pushq	%rbp
@@ -223,14 +251,28 @@
 	pushq	%r14
 	pushq	%r15
 
-	movl	%r9d,%r9d
-	leaq	4(%r9),%r10
+	negq	%r9
 	movq	%rsp,%r11
-	negq	%r10
-	leaq	(%rsp,%r10,8),%rsp
-	andq	$-1024,%rsp
+	leaq	-32(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
-	movq	%r11,8(%rsp,%r9,8)
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul4x_page_walk
+	jmp	L$mul4x_page_walk_done
+
+L$mul4x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul4x_page_walk
+L$mul4x_page_walk_done:
+
+	movq	%rax,8(%rsp,%r9,8)
 L$mul4x_body:
 	movq	%rdi,16(%rsp,%r9,8)
 	movq	%rdx,%r12
@@ -531,6 +573,7 @@
 	jb	L$outer4x
 	movq	16(%rsp,%r9,8),%rdi
 	movq	0(%rsp),%rax
+	pxor	%xmm0,%xmm0
 	movq	8(%rsp),%rdx
 	shrq	$2,%r9
 	leaq	(%rsp),%rsi
@@ -568,45 +611,44 @@
 	movq	%rbx,16(%rdi,%r14,8)
 
 	sbbq	$0,%rax
-	movq	%rax,%xmm0
-	punpcklqdq	%xmm0,%xmm0
 	movq	%rbp,24(%rdi,%r14,8)
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
+	leaq	-1(%r9),%r15
+	orq	%rcx,%rsi
 
-	movq	%r9,%r15
-	pxor	%xmm5,%xmm5
+	movdqu	(%rsi),%xmm1
+	movdqa	%xmm0,(%rsp)
+	movdqu	%xmm1,(%rdi)
 	jmp	L$copy4x
 .p2align	4
 L$copy4x:
-	movdqu	(%rsp,%r14,1),%xmm2
-	movdqu	16(%rsp,%r14,1),%xmm4
-	movdqu	(%rdi,%r14,1),%xmm1
-	movdqu	16(%rdi,%r14,1),%xmm3
-	pxor	%xmm1,%xmm2
-	pxor	%xmm3,%xmm4
-	pand	%xmm0,%xmm2
-	pand	%xmm0,%xmm4
-	pxor	%xmm1,%xmm2
-	pxor	%xmm3,%xmm4
-	movdqu	%xmm2,(%rdi,%r14,1)
-	movdqu	%xmm4,16(%rdi,%r14,1)
-	movdqa	%xmm5,(%rsp,%r14,1)
-	movdqa	%xmm5,16(%rsp,%r14,1)
-
+	movdqu	16(%rsi,%r14,1),%xmm2
+	movdqu	32(%rsi,%r14,1),%xmm1
+	movdqa	%xmm0,16(%rsp,%r14,1)
+	movdqu	%xmm2,16(%rdi,%r14,1)
+	movdqa	%xmm0,32(%rsp,%r14,1)
+	movdqu	%xmm1,32(%rdi,%r14,1)
 	leaq	32(%r14),%r14
 	decq	%r15
 	jnz	L$copy4x
 
 	shlq	$2,%r9
+	movdqu	16(%rsi,%r14,1),%xmm2
+	movdqa	%xmm0,16(%rsp,%r14,1)
+	movdqu	%xmm2,16(%rdi,%r14,1)
 	movq	8(%rsp,%r9,8),%rsi
 	movq	$1,%rax
-	movq	(%rsi),%r15
-	movq	8(%rsi),%r14
-	movq	16(%rsi),%r13
-	movq	24(%rsi),%r12
-	movq	32(%rsi),%rbp
-	movq	40(%rsi),%rbx
-	leaq	48(%rsi),%rsp
+	movq	-48(%rsi),%r15
+	movq	-40(%rsi),%r14
+	movq	-32(%rsi),%r13
+	movq	-24(%rsi),%r12
+	movq	-16(%rsi),%rbp
+	movq	-8(%rsi),%rbx
+	leaq	(%rsi),%rsp
 L$mul4x_epilogue:
 	.byte	0xf3,0xc3
 
@@ -615,14 +657,15 @@
 
 .p2align	5
 bn_sqr8x_mont:
-L$sqr8x_enter:
 	movq	%rsp,%rax
+L$sqr8x_enter:
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+L$sqr8x_prologue:
 
 	movl	%r9d,%r10d
 	shll	$3,%r9d
@@ -635,25 +678,43 @@
 
 
 	leaq	-64(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	movq	(%r8),%r8
 	subq	%rsi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$sqr8x_sp_alt
-	subq	%r11,%rsp
-	leaq	-64(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-64(%rbp,%r9,2),%rbp
 	jmp	L$sqr8x_sp_done
 
 .p2align	5
 L$sqr8x_sp_alt:
 	leaq	4096-64(,%r9,2),%r10
-	leaq	-64(%rsp,%r9,2),%rsp
+	leaq	-64(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 L$sqr8x_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$sqr8x_page_walk
+	jmp	L$sqr8x_page_walk_done
+
+.p2align	4
+L$sqr8x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$sqr8x_page_walk
+L$sqr8x_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
diff --git a/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont5.S b/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont5.S
index a154cc8..4646c3d 100644
--- a/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont5.S
+++ b/third_party/boringssl/mac-x86_64/crypto/bn/x86_64-mont5.S
@@ -8,16 +8,15 @@
 
 .p2align	6
 _bn_mul_mont_gather5:
+	movl	%r9d,%r9d
+	movq	%rsp,%rax
 	testl	$7,%r9d
 	jnz	L$mul_enter
 	jmp	L$mul4x_enter
 
 .p2align	4
 L$mul_enter:
-	movl	%r9d,%r9d
-	movq	%rsp,%rax
 	movd	8(%rsp),%xmm5
-	leaq	L$inc(%rip),%r10
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
@@ -25,13 +24,39 @@
 	pushq	%r14
 	pushq	%r15
 
-	leaq	2(%r9),%r11
-	negq	%r11
-	leaq	-264(%rsp,%r11,8),%rsp
-	andq	$-1024,%rsp
+	negq	%r9
+	movq	%rsp,%r11
+	leaq	-280(%rsp,%r9,8),%r10
+	negq	%r9
+	andq	$-1024,%r10
 
+
+
+
+
+
+
+
+
+	subq	%r10,%r11
+	andq	$-4096,%r11
+	leaq	(%r10,%r11,1),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul_page_walk
+	jmp	L$mul_page_walk_done
+
+L$mul_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r11
+	cmpq	%r10,%rsp
+	ja	L$mul_page_walk
+L$mul_page_walk_done:
+
+	leaq	L$inc(%rip),%r10
 	movq	%rax,8(%rsp,%r9,8)
 L$mul_body:
+
 	leaq	128(%rdx),%r12
 	movdqa	0(%r10),%xmm0
 	movdqa	16(%r10),%xmm1
@@ -370,16 +395,17 @@
 
 	sbbq	$0,%rax
 	xorq	%r14,%r14
+	andq	%rax,%rsi
+	notq	%rax
+	movq	%rdi,%rcx
+	andq	%rax,%rcx
 	movq	%r9,%r15
+	orq	%rcx,%rsi
 .p2align	4
 L$copy:
-	movq	(%rsp,%r14,8),%rsi
-	movq	(%rdi,%r14,8),%rcx
-	xorq	%rcx,%rsi
-	andq	%rax,%rsi
-	xorq	%rcx,%rsi
+	movq	(%rsi,%r14,8),%rax
 	movq	%r14,(%rsp,%r14,8)
-	movq	%rsi,(%rdi,%r14,8)
+	movq	%rax,(%rdi,%r14,8)
 	leaq	1(%r14),%r14
 	subq	$1,%r15
 	jnz	L$copy
@@ -400,15 +426,16 @@
 
 .p2align	5
 bn_mul4x_mont_gather5:
-L$mul4x_enter:
 .byte	0x67
 	movq	%rsp,%rax
+L$mul4x_enter:
 	pushq	%rbx
 	pushq	%rbp
 	pushq	%r12
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+L$mul4x_prologue:
 
 .byte	0x67
 	shll	$3,%r9d
@@ -425,24 +452,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$mul4xsp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	L$mul4xsp_done
 
 .p2align	5
 L$mul4xsp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 L$mul4xsp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$mul4x_page_walk
+	jmp	L$mul4x_page_walk_done
+
+L$mul4x_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$mul4x_page_walk
+L$mul4x_page_walk_done:
+
 	negq	%r9
 
 	movq	%rax,40(%rsp)
@@ -1001,6 +1045,7 @@
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+L$power5_prologue:
 
 	shll	$3,%r9d
 	leal	(%r9,%r9,2),%r10d
@@ -1015,24 +1060,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$pwr_sp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	L$pwr_sp_done
 
 .p2align	5
 L$pwr_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 L$pwr_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$pwr_page_walk
+	jmp	L$pwr_page_walk_done
+
+L$pwr_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$pwr_page_walk
+L$pwr_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
@@ -1943,6 +2005,7 @@
 	pushq	%r13
 	pushq	%r14
 	pushq	%r15
+L$from_prologue:
 
 	shll	$3,%r9d
 	leaq	(%r9,%r9,2),%r10
@@ -1957,24 +2020,41 @@
 
 
 	leaq	-320(%rsp,%r9,2),%r11
+	movq	%rsp,%rbp
 	subq	%rdi,%r11
 	andq	$4095,%r11
 	cmpq	%r11,%r10
 	jb	L$from_sp_alt
-	subq	%r11,%rsp
-	leaq	-320(%rsp,%r9,2),%rsp
+	subq	%r11,%rbp
+	leaq	-320(%rbp,%r9,2),%rbp
 	jmp	L$from_sp_done
 
 .p2align	5
 L$from_sp_alt:
 	leaq	4096-320(,%r9,2),%r10
-	leaq	-320(%rsp,%r9,2),%rsp
+	leaq	-320(%rbp,%r9,2),%rbp
 	subq	%r10,%r11
 	movq	$0,%r10
 	cmovcq	%r10,%r11
-	subq	%r11,%rsp
+	subq	%r11,%rbp
 L$from_sp_done:
-	andq	$-64,%rsp
+	andq	$-64,%rbp
+	movq	%rsp,%r11
+	subq	%rbp,%r11
+	andq	$-4096,%r11
+	leaq	(%r11,%rbp,1),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$from_page_walk
+	jmp	L$from_page_walk_done
+
+L$from_page_walk:
+	leaq	-4096(%rsp),%rsp
+	movq	(%rsp),%r10
+	cmpq	%rbp,%rsp
+	ja	L$from_page_walk
+L$from_page_walk_done:
+
 	movq	%r9,%r10
 	negq	%r9
 
diff --git a/third_party/boringssl/mac-x86_64/crypto/chacha/chacha-x86_64.S b/third_party/boringssl/mac-x86_64/crypto/chacha/chacha-x86_64.S
index c3554c8d..256a4663 100644
--- a/third_party/boringssl/mac-x86_64/crypto/chacha/chacha-x86_64.S
+++ b/third_party/boringssl/mac-x86_64/crypto/chacha/chacha-x86_64.S
@@ -22,6 +22,15 @@
 .byte	0x3,0x0,0x1,0x2, 0x7,0x4,0x5,0x6, 0xb,0x8,0x9,0xa, 0xf,0xc,0xd,0xe
 L$sigma:
 .byte	101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107,0
+.p2align	6
+L$zeroz:
+.long	0,0,0,0, 1,0,0,0, 2,0,0,0, 3,0,0,0
+L$fourz:
+.long	4,0,0,0, 4,0,0,0, 4,0,0,0, 4,0,0,0
+L$incz:
+.long	0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
+L$sixteen:
+.long	16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16
 .byte	67,104,97,67,104,97,50,48,32,102,111,114,32,120,56,54,95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .globl	_ChaCha20_ctr32
 .private_extern _ChaCha20_ctr32
@@ -315,7 +324,7 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	movl	$10,%ebp
+	movq	$10,%r8
 	jmp	L$oop_ssse3
 
 .p2align	5
@@ -325,7 +334,7 @@
 	movdqa	16(%rsp),%xmm1
 	movdqa	32(%rsp),%xmm2
 	paddd	48(%rsp),%xmm3
-	movl	$10,%ebp
+	movq	$10,%r8
 	movdqa	%xmm3,48(%rsp)
 	jmp	L$oop_ssse3
 
@@ -374,7 +383,7 @@
 	pshufd	$78,%xmm2,%xmm2
 	pshufd	$147,%xmm1,%xmm1
 	pshufd	$57,%xmm3,%xmm3
-	decl	%ebp
+	decq	%r8
 	jnz	L$oop_ssse3
 	paddd	0(%rsp),%xmm0
 	paddd	16(%rsp),%xmm1
@@ -411,25 +420,19 @@
 	movdqa	%xmm1,16(%rsp)
 	movdqa	%xmm2,32(%rsp)
 	movdqa	%xmm3,48(%rsp)
-	xorq	%rbx,%rbx
+	xorq	%r8,%r8
 
 L$oop_tail_ssse3:
-	movzbl	(%rsi,%rbx,1),%eax
-	movzbl	(%rsp,%rbx,1),%ecx
-	leaq	1(%rbx),%rbx
+	movzbl	(%rsi,%r8,1),%eax
+	movzbl	(%rsp,%r8,1),%ecx
+	leaq	1(%r8),%r8
 	xorl	%ecx,%eax
-	movb	%al,-1(%rdi,%rbx,1)
+	movb	%al,-1(%rdi,%r8,1)
 	decq	%rdx
 	jnz	L$oop_tail_ssse3
 
 L$done_ssse3:
-	addq	$64+24,%rsp
-	popq	%r15
-	popq	%r14
-	popq	%r13
-	popq	%r12
-	popq	%rbp
-	popq	%rbx
+	addq	$64+24+48,%rsp
 	.byte	0xf3,0xc3
 
 
diff --git a/third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S b/third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
index 4e5c0f3..1c17ee7 100644
--- a/third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
+++ b/third_party/boringssl/mac-x86_64/crypto/cipher/chacha20_poly1305_x86_64.S
@@ -1,6 +1,9 @@
 #if defined(__x86_64__)
 .text	
 
+
+chacha20_poly1305_constants:
+
 .p2align	6
 .chacha20_consts:
 .byte	'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
@@ -214,29 +217,29 @@
 _chacha20_poly1305_open:
 .cfi_startproc	
 	pushq	%rbp
-.cfi_adjust_cfa_offset	8
+
 	pushq	%rbx
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r12
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r13
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r14
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r15
-.cfi_adjust_cfa_offset	8
+
 
 
 	pushq	%r9
-.cfi_adjust_cfa_offset	8
+
 	subq	$288 + 32,%rsp
-.cfi_adjust_cfa_offset	288 + 32
-.cfi_offset	rbp, -16
-.cfi_offset	rbx, -24
-.cfi_offset	r12, -32
-.cfi_offset	r13, -40
-.cfi_offset	r14, -48
-.cfi_offset	r15, -56
+
+
+
+
+
+
+
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 	movq	%rdx,8+32(%rbp)
@@ -1831,26 +1834,26 @@
 	adcq	8+16(%rbp),%r11
 
 	addq	$288 + 32,%rsp
-.cfi_adjust_cfa_offset	-(288 + 32)
+
 	popq	%r9
-.cfi_adjust_cfa_offset	-8
+
 	movq	%r10,(%r9)
 	movq	%r11,8(%r9)
 
 	popq	%r15
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r14
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r13
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r12
-.cfi_adjust_cfa_offset	-8
+
 	popq	%rbx
-.cfi_adjust_cfa_offset	-8
+
 	popq	%rbp
-.cfi_adjust_cfa_offset	-8
+
 	.byte	0xf3,0xc3
-.cfi_adjust_cfa_offset	(8 * 6) + 288 + 32
+
 
 open_sse_128:
 	movdqu	.chacha20_consts(%rip),%xmm0
@@ -2095,29 +2098,29 @@
 _chacha20_poly1305_seal:
 .cfi_startproc	
 	pushq	%rbp
-.cfi_adjust_cfa_offset	8
+
 	pushq	%rbx
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r12
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r13
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r14
-.cfi_adjust_cfa_offset	8
+
 	pushq	%r15
-.cfi_adjust_cfa_offset	8
+
 
 
 	pushq	%r9
-.cfi_adjust_cfa_offset	8
+
 	subq	$288 + 32,%rsp
-.cfi_adjust_cfa_offset	288 + 32
-.cfi_offset	rbp, -16
-.cfi_offset	rbx, -24
-.cfi_offset	r12, -32
-.cfi_offset	r13, -40
-.cfi_offset	r14, -48
-.cfi_offset	r15, -56
+
+
+
+
+
+
+
 	leaq	32(%rsp),%rbp
 	andq	$-32,%rbp
 	movq	%rdx,8+32(%rbp)
@@ -3714,26 +3717,26 @@
 	adcq	8+16(%rbp),%r11
 
 	addq	$288 + 32,%rsp
-.cfi_adjust_cfa_offset	-(288 + 32)
+
 	popq	%r9
-.cfi_adjust_cfa_offset	-8
+
 	movq	%r10,0(%r9)
 	movq	%r11,8(%r9)
 
 	popq	%r15
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r14
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r13
-.cfi_adjust_cfa_offset	-8
+
 	popq	%r12
-.cfi_adjust_cfa_offset	-8
+
 	popq	%rbx
-.cfi_adjust_cfa_offset	-8
+
 	popq	%rbp
-.cfi_adjust_cfa_offset	-8
+
 	.byte	0xf3,0xc3
-.cfi_adjust_cfa_offset	(8 * 6) + 288 + 32
+
 
 seal_sse_128:
 	movdqu	.chacha20_consts(%rip),%xmm0
diff --git a/third_party/boringssl/win-x86/crypto/bn/x86-mont.asm b/third_party/boringssl/win-x86/crypto/bn/x86-mont.asm
index de7b949..b1a4d594 100644
--- a/third_party/boringssl/win-x86/crypto/bn/x86-mont.asm
+++ b/third_party/boringssl/win-x86/crypto/bn/x86-mont.asm
@@ -29,36 +29,51 @@
 	jl	NEAR L$000just_leave
 	lea	esi,[20+esp]
 	lea	edx,[24+esp]
-	mov	ebp,esp
 	add	edi,2
 	neg	edi
-	lea	esp,[edi*4+esp-32]
+	lea	ebp,[edi*4+esp-32]
 	neg	edi
-	mov	eax,esp
+	mov	eax,ebp
 	sub	eax,edx
 	and	eax,2047
-	sub	esp,eax
-	xor	edx,esp
+	sub	ebp,eax
+	xor	edx,ebp
 	and	edx,2048
 	xor	edx,2048
-	sub	esp,edx
-	and	esp,-64
+	sub	ebp,edx
+	and	ebp,-64
+	mov	eax,esp
+	sub	eax,ebp
+	and	eax,-4096
+	mov	edx,esp
+	lea	esp,[eax*1+ebp]
+	mov	eax,DWORD [esp]
+	cmp	esp,ebp
+	ja	NEAR L$001page_walk
+	jmp	NEAR L$002page_walk_done
+align	16
+L$001page_walk:
+	lea	esp,[esp-4096]
+	mov	eax,DWORD [esp]
+	cmp	esp,ebp
+	ja	NEAR L$001page_walk
+L$002page_walk_done:
 	mov	eax,DWORD [esi]
 	mov	ebx,DWORD [4+esi]
 	mov	ecx,DWORD [8+esi]
-	mov	edx,DWORD [12+esi]
+	mov	ebp,DWORD [12+esi]
 	mov	esi,DWORD [16+esi]
 	mov	esi,DWORD [esi]
 	mov	DWORD [4+esp],eax
 	mov	DWORD [8+esp],ebx
 	mov	DWORD [12+esp],ecx
-	mov	DWORD [16+esp],edx
+	mov	DWORD [16+esp],ebp
 	mov	DWORD [20+esp],esi
 	lea	ebx,[edi-3]
-	mov	DWORD [24+esp],ebp
+	mov	DWORD [24+esp],edx
 	lea	eax,[_OPENSSL_ia32cap_P]
 	bt	DWORD [eax],26
-	jnc	NEAR L$001non_sse2
+	jnc	NEAR L$003non_sse2
 	mov	eax,-1
 	movd	mm7,eax
 	mov	esi,DWORD [8+esp]
@@ -82,7 +97,7 @@
 	psrlq	mm3,32
 	inc	ecx
 align	16
-L$0021st:
+L$0041st:
 	pmuludq	mm0,mm4
 	pmuludq	mm1,mm5
 	paddq	mm2,mm0
@@ -97,7 +112,7 @@
 	psrlq	mm3,32
 	lea	ecx,[1+ecx]
 	cmp	ecx,ebx
-	jl	NEAR L$0021st
+	jl	NEAR L$0041st
 	pmuludq	mm0,mm4
 	pmuludq	mm1,mm5
 	paddq	mm2,mm0
@@ -111,7 +126,7 @@
 	paddq	mm3,mm2
 	movq	[32+ebx*4+esp],mm3
 	inc	edx
-L$003outer:
+L$005outer:
 	xor	ecx,ecx
 	movd	mm4,DWORD [edx*4+edi]
 	movd	mm5,DWORD [esi]
@@ -133,7 +148,7 @@
 	paddq	mm2,mm6
 	inc	ecx
 	dec	ebx
-L$004inner:
+L$006inner:
 	pmuludq	mm0,mm4
 	pmuludq	mm1,mm5
 	paddq	mm2,mm0
@@ -150,7 +165,7 @@
 	paddq	mm2,mm6
 	dec	ebx
 	lea	ecx,[1+ecx]
-	jnz	NEAR L$004inner
+	jnz	NEAR L$006inner
 	mov	ebx,ecx
 	pmuludq	mm0,mm4
 	pmuludq	mm1,mm5
@@ -168,11 +183,11 @@
 	movq	[32+ebx*4+esp],mm3
 	lea	edx,[1+edx]
 	cmp	edx,ebx
-	jle	NEAR L$003outer
+	jle	NEAR L$005outer
 	emms
-	jmp	NEAR L$005common_tail
+	jmp	NEAR L$007common_tail
 align	16
-L$001non_sse2:
+L$003non_sse2:
 	mov	esi,DWORD [8+esp]
 	lea	ebp,[1+ebx]
 	mov	edi,DWORD [12+esp]
@@ -183,12 +198,12 @@
 	lea	eax,[4+ebx*4+edi]
 	or	ebp,edx
 	mov	edi,DWORD [edi]
-	jz	NEAR L$006bn_sqr_mont
+	jz	NEAR L$008bn_sqr_mont
 	mov	DWORD [28+esp],eax
 	mov	eax,DWORD [esi]
 	xor	edx,edx
 align	16
-L$007mull:
+L$009mull:
 	mov	ebp,edx
 	mul	edi
 	add	ebp,eax
@@ -197,7 +212,7 @@
 	mov	eax,DWORD [ecx*4+esi]
 	cmp	ecx,ebx
 	mov	DWORD [28+ecx*4+esp],ebp
-	jl	NEAR L$007mull
+	jl	NEAR L$009mull
 	mov	ebp,edx
 	mul	edi
 	mov	edi,DWORD [20+esp]
@@ -215,9 +230,9 @@
 	mov	eax,DWORD [4+esi]
 	adc	edx,0
 	inc	ecx
-	jmp	NEAR L$0082ndmadd
+	jmp	NEAR L$0102ndmadd
 align	16
-L$0091stmadd:
+L$0111stmadd:
 	mov	ebp,edx
 	mul	edi
 	add	ebp,DWORD [32+ecx*4+esp]
@@ -228,7 +243,7 @@
 	adc	edx,0
 	cmp	ecx,ebx
 	mov	DWORD [28+ecx*4+esp],ebp
-	jl	NEAR L$0091stmadd
+	jl	NEAR L$0111stmadd
 	mov	ebp,edx
 	mul	edi
 	add	eax,DWORD [32+ebx*4+esp]
@@ -251,7 +266,7 @@
 	adc	edx,0
 	mov	ecx,1
 align	16
-L$0082ndmadd:
+L$0102ndmadd:
 	mov	ebp,edx
 	mul	edi
 	add	ebp,DWORD [32+ecx*4+esp]
@@ -262,7 +277,7 @@
 	adc	edx,0
 	cmp	ecx,ebx
 	mov	DWORD [24+ecx*4+esp],ebp
-	jl	NEAR L$0082ndmadd
+	jl	NEAR L$0102ndmadd
 	mov	ebp,edx
 	mul	edi
 	add	ebp,DWORD [32+ebx*4+esp]
@@ -278,16 +293,16 @@
 	mov	DWORD [32+ebx*4+esp],edx
 	cmp	ecx,DWORD [28+esp]
 	mov	DWORD [36+ebx*4+esp],eax
-	je	NEAR L$005common_tail
+	je	NEAR L$007common_tail
 	mov	edi,DWORD [ecx]
 	mov	esi,DWORD [8+esp]
 	mov	DWORD [12+esp],ecx
 	xor	ecx,ecx
 	xor	edx,edx
 	mov	eax,DWORD [esi]
-	jmp	NEAR L$0091stmadd
+	jmp	NEAR L$0111stmadd
 align	16
-L$006bn_sqr_mont:
+L$008bn_sqr_mont:
 	mov	DWORD [esp],ebx
 	mov	DWORD [12+esp],ecx
 	mov	eax,edi
@@ -298,7 +313,7 @@
 	and	ebx,1
 	inc	ecx
 align	16
-L$010sqr:
+L$012sqr:
 	mov	eax,DWORD [ecx*4+esi]
 	mov	ebp,edx
 	mul	edi
@@ -310,7 +325,7 @@
 	cmp	ecx,DWORD [esp]
 	mov	ebx,eax
 	mov	DWORD [28+ecx*4+esp],ebp
-	jl	NEAR L$010sqr
+	jl	NEAR L$012sqr
 	mov	eax,DWORD [ecx*4+esi]
 	mov	ebp,edx
 	mul	edi
@@ -334,7 +349,7 @@
 	mov	eax,DWORD [4+esi]
 	mov	ecx,1
 align	16
-L$0113rdmadd:
+L$0133rdmadd:
 	mov	ebp,edx
 	mul	edi
 	add	ebp,DWORD [32+ecx*4+esp]
@@ -353,7 +368,7 @@
 	adc	edx,0
 	cmp	ecx,ebx
 	mov	DWORD [24+ecx*4+esp],ebp
-	jl	NEAR L$0113rdmadd
+	jl	NEAR L$0133rdmadd
 	mov	ebp,edx
 	mul	edi
 	add	ebp,DWORD [32+ebx*4+esp]
@@ -369,7 +384,7 @@
 	mov	DWORD [32+ebx*4+esp],edx
 	cmp	ecx,ebx
 	mov	DWORD [36+ebx*4+esp],eax
-	je	NEAR L$005common_tail
+	je	NEAR L$007common_tail
 	mov	edi,DWORD [4+ecx*4+esi]
 	lea	ecx,[1+ecx]
 	mov	eax,edi
@@ -381,12 +396,12 @@
 	xor	ebp,ebp
 	cmp	ecx,ebx
 	lea	ecx,[1+ecx]
-	je	NEAR L$012sqrlast
+	je	NEAR L$014sqrlast
 	mov	ebx,edx
 	shr	edx,1
 	and	ebx,1
 align	16
-L$013sqradd:
+L$015sqradd:
 	mov	eax,DWORD [ecx*4+esi]
 	mov	ebp,edx
 	mul	edi
@@ -402,13 +417,13 @@
 	cmp	ecx,DWORD [esp]
 	mov	DWORD [28+ecx*4+esp],ebp
 	mov	ebx,eax
-	jle	NEAR L$013sqradd
+	jle	NEAR L$015sqradd
 	mov	ebp,edx
 	add	edx,edx
 	shr	ebp,31
 	add	edx,ebx
 	adc	ebp,0
-L$012sqrlast:
+L$014sqrlast:
 	mov	edi,DWORD [20+esp]
 	mov	esi,DWORD [16+esp]
 	imul	edi,DWORD [32+esp]
@@ -423,9 +438,9 @@
 	adc	edx,0
 	mov	ecx,1
 	mov	eax,DWORD [4+esi]
-	jmp	NEAR L$0113rdmadd
+	jmp	NEAR L$0133rdmadd
 align	16
-L$005common_tail:
+L$007common_tail:
 	mov	ebp,DWORD [16+esp]
 	mov	edi,DWORD [4+esp]
 	lea	esi,[32+esp]
@@ -433,25 +448,26 @@
 	mov	ecx,ebx
 	xor	edx,edx
 align	16
-L$014sub:
+L$016sub:
 	sbb	eax,DWORD [edx*4+ebp]
 	mov	DWORD [edx*4+edi],eax
 	dec	ecx
 	mov	eax,DWORD [4+edx*4+esi]
 	lea	edx,[1+edx]
-	jge	NEAR L$014sub
+	jge	NEAR L$016sub
 	sbb	eax,0
+	and	esi,eax
+	not	eax
+	mov	ebp,edi
+	and	ebp,eax
+	or	esi,ebp
 align	16
-L$015copy:
-	mov	edx,DWORD [ebx*4+esi]
-	mov	ebp,DWORD [ebx*4+edi]
-	xor	edx,ebp
-	and	edx,eax
-	xor	edx,ebp
-	mov	DWORD [ebx*4+esi],ecx
-	mov	DWORD [ebx*4+edi],edx
+L$017copy:
+	mov	eax,DWORD [ebx*4+esi]
+	mov	DWORD [ebx*4+edi],eax
+	mov	DWORD [32+ebx*4+esp],ecx
 	dec	ebx
-	jge	NEAR L$015copy
+	jge	NEAR L$017copy
 	mov	esp,DWORD [24+esp]
 	mov	eax,1
 L$000just_leave:
diff --git a/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont.asm b/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont.asm
index 4d8e1cb..9bfdaec 100644
--- a/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont.asm
+++ b/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont.asm
@@ -23,6 +23,8 @@
 	mov	r9,QWORD[48+rsp]
 
 
+	mov	r9d,r9d
+	mov	rax,rsp
 	test	r9d,3
 	jnz	NEAR $L$mul_enter
 	cmp	r9d,8
@@ -42,14 +44,37 @@
 	push	r14
 	push	r15
 
-	mov	r9d,r9d
-	lea	r10,[2+r9]
+	neg	r9
 	mov	r11,rsp
-	neg	r10
-	lea	rsp,[r10*8+rsp]
-	and	rsp,-1024
+	lea	r10,[((-16))+r9*8+rsp]
+	neg	r9
+	and	r10,-1024
 
-	mov	QWORD[8+r9*8+rsp],r11
+
+
+
+
+
+
+
+
+	sub	r11,r10
+	and	r11,-4096
+	lea	rsp,[r11*1+r10]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul_page_walk
+	jmp	NEAR $L$mul_page_walk_done
+
+ALIGN	16
+$L$mul_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul_page_walk
+$L$mul_page_walk_done:
+
+	mov	QWORD[8+r9*8+rsp],rax
 $L$mul_body:
 	mov	r12,rdx
 	mov	r8,QWORD[r8]
@@ -201,29 +226,30 @@
 
 	sbb	rax,0
 	xor	r14,r14
+	and	rsi,rax
+	not	rax
+	mov	rcx,rdi
+	and	rcx,rax
 	mov	r15,r9
+	or	rsi,rcx
 ALIGN	16
 $L$copy:
-	mov	rsi,QWORD[r14*8+rsp]
-	mov	rcx,QWORD[r14*8+rdi]
-	xor	rsi,rcx
-	and	rsi,rax
-	xor	rsi,rcx
+	mov	rax,QWORD[r14*8+rsi]
 	mov	QWORD[r14*8+rsp],r14
-	mov	QWORD[r14*8+rdi],rsi
+	mov	QWORD[r14*8+rdi],rax
 	lea	r14,[1+r14]
 	sub	r15,1
 	jnz	NEAR $L$copy
 
 	mov	rsi,QWORD[8+r9*8+rsp]
 	mov	rax,1
-	mov	r15,QWORD[rsi]
-	mov	r14,QWORD[8+rsi]
-	mov	r13,QWORD[16+rsi]
-	mov	r12,QWORD[24+rsi]
-	mov	rbp,QWORD[32+rsi]
-	mov	rbx,QWORD[40+rsi]
-	lea	rsp,[48+rsi]
+	mov	r15,QWORD[((-48))+rsi]
+	mov	r14,QWORD[((-40))+rsi]
+	mov	r13,QWORD[((-32))+rsi]
+	mov	r12,QWORD[((-24))+rsi]
+	mov	rbp,QWORD[((-16))+rsi]
+	mov	rbx,QWORD[((-8))+rsi]
+	lea	rsp,[rsi]
 $L$mul_epilogue:
 	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
 	mov	rsi,QWORD[16+rsp]
@@ -244,6 +270,8 @@
 	mov	r9,QWORD[48+rsp]
 
 
+	mov	r9d,r9d
+	mov	rax,rsp
 $L$mul4x_enter:
 	push	rbx
 	push	rbp
@@ -252,14 +280,28 @@
 	push	r14
 	push	r15
 
-	mov	r9d,r9d
-	lea	r10,[4+r9]
+	neg	r9
 	mov	r11,rsp
-	neg	r10
-	lea	rsp,[r10*8+rsp]
-	and	rsp,-1024
+	lea	r10,[((-32))+r9*8+rsp]
+	neg	r9
+	and	r10,-1024
 
-	mov	QWORD[8+r9*8+rsp],r11
+	sub	r11,r10
+	and	r11,-4096
+	lea	rsp,[r11*1+r10]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul4x_page_walk
+	jmp	NEAR $L$mul4x_page_walk_done
+
+$L$mul4x_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul4x_page_walk
+$L$mul4x_page_walk_done:
+
+	mov	QWORD[8+r9*8+rsp],rax
 $L$mul4x_body:
 	mov	QWORD[16+r9*8+rsp],rdi
 	mov	r12,rdx
@@ -560,6 +602,7 @@
 	jb	NEAR $L$outer4x
 	mov	rdi,QWORD[16+r9*8+rsp]
 	mov	rax,QWORD[rsp]
+	pxor	xmm0,xmm0
 	mov	rdx,QWORD[8+rsp]
 	shr	r9,2
 	lea	rsi,[rsp]
@@ -597,45 +640,44 @@
 	mov	QWORD[16+r14*8+rdi],rbx
 
 	sbb	rax,0
-DB 66h, 48h, 0fh, 6eh, 0c0h
-	punpcklqdq	xmm0,xmm0
 	mov	QWORD[24+r14*8+rdi],rbp
 	xor	r14,r14
+	and	rsi,rax
+	not	rax
+	mov	rcx,rdi
+	and	rcx,rax
+	lea	r15,[((-1))+r9]
+	or	rsi,rcx
 
-	mov	r15,r9
-	pxor	xmm5,xmm5
+	movdqu	xmm1,XMMWORD[rsi]
+	movdqa	XMMWORD[rsp],xmm0
+	movdqu	XMMWORD[rdi],xmm1
 	jmp	NEAR $L$copy4x
 ALIGN	16
 $L$copy4x:
-	movdqu	xmm2,XMMWORD[r14*1+rsp]
-	movdqu	xmm4,XMMWORD[16+r14*1+rsp]
-	movdqu	xmm1,XMMWORD[r14*1+rdi]
-	movdqu	xmm3,XMMWORD[16+r14*1+rdi]
-	pxor	xmm2,xmm1
-	pxor	xmm4,xmm3
-	pand	xmm2,xmm0
-	pand	xmm4,xmm0
-	pxor	xmm2,xmm1
-	pxor	xmm4,xmm3
-	movdqu	XMMWORD[r14*1+rdi],xmm2
-	movdqu	XMMWORD[16+r14*1+rdi],xmm4
-	movdqa	XMMWORD[r14*1+rsp],xmm5
-	movdqa	XMMWORD[16+r14*1+rsp],xmm5
-
+	movdqu	xmm2,XMMWORD[16+r14*1+rsi]
+	movdqu	xmm1,XMMWORD[32+r14*1+rsi]
+	movdqa	XMMWORD[16+r14*1+rsp],xmm0
+	movdqu	XMMWORD[16+r14*1+rdi],xmm2
+	movdqa	XMMWORD[32+r14*1+rsp],xmm0
+	movdqu	XMMWORD[32+r14*1+rdi],xmm1
 	lea	r14,[32+r14]
 	dec	r15
 	jnz	NEAR $L$copy4x
 
 	shl	r9,2
+	movdqu	xmm2,XMMWORD[16+r14*1+rsi]
+	movdqa	XMMWORD[16+r14*1+rsp],xmm0
+	movdqu	XMMWORD[16+r14*1+rdi],xmm2
 	mov	rsi,QWORD[8+r9*8+rsp]
 	mov	rax,1
-	mov	r15,QWORD[rsi]
-	mov	r14,QWORD[8+rsi]
-	mov	r13,QWORD[16+rsi]
-	mov	r12,QWORD[24+rsi]
-	mov	rbp,QWORD[32+rsi]
-	mov	rbx,QWORD[40+rsi]
-	lea	rsp,[48+rsi]
+	mov	r15,QWORD[((-48))+rsi]
+	mov	r14,QWORD[((-40))+rsi]
+	mov	r13,QWORD[((-32))+rsi]
+	mov	r12,QWORD[((-24))+rsi]
+	mov	rbp,QWORD[((-16))+rsi]
+	mov	rbx,QWORD[((-8))+rsi]
+	lea	rsp,[rsi]
 $L$mul4x_epilogue:
 	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
 	mov	rsi,QWORD[16+rsp]
@@ -658,14 +700,15 @@
 	mov	r9,QWORD[48+rsp]
 
 
-$L$sqr8x_enter:
 	mov	rax,rsp
+$L$sqr8x_enter:
 	push	rbx
 	push	rbp
 	push	r12
 	push	r13
 	push	r14
 	push	r15
+$L$sqr8x_prologue:
 
 	mov	r10d,r9d
 	shl	r9d,3
@@ -678,25 +721,43 @@
 
 
 	lea	r11,[((-64))+r9*2+rsp]
+	mov	rbp,rsp
 	mov	r8,QWORD[r8]
 	sub	r11,rsi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$sqr8x_sp_alt
-	sub	rsp,r11
-	lea	rsp,[((-64))+r9*2+rsp]
+	sub	rbp,r11
+	lea	rbp,[((-64))+r9*2+rbp]
 	jmp	NEAR $L$sqr8x_sp_done
 
 ALIGN	32
 $L$sqr8x_sp_alt:
 	lea	r10,[((4096-64))+r9*2]
-	lea	rsp,[((-64))+r9*2+rsp]
+	lea	rbp,[((-64))+r9*2+rbp]
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
-	sub	rsp,r11
+	sub	rbp,r11
 $L$sqr8x_sp_done:
-	and	rsp,-64
+	and	rbp,-64
+	mov	r11,rsp
+	sub	r11,rbp
+	and	r11,-4096
+	lea	rsp,[rbp*1+r11]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$sqr8x_page_walk
+	jmp	NEAR $L$sqr8x_page_walk_done
+
+ALIGN	16
+$L$sqr8x_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$sqr8x_page_walk
+$L$sqr8x_page_walk_done:
+
 	mov	r10,r9
 	neg	r9
 
@@ -829,22 +890,8 @@
 
 	mov	r10,QWORD[192+r8]
 	mov	rax,QWORD[8+r10*8+rax]
-	lea	rax,[48+rax]
 
-	mov	rbx,QWORD[((-8))+rax]
-	mov	rbp,QWORD[((-16))+rax]
-	mov	r12,QWORD[((-24))+rax]
-	mov	r13,QWORD[((-32))+rax]
-	mov	r14,QWORD[((-40))+rax]
-	mov	r15,QWORD[((-48))+rax]
-	mov	QWORD[144+r8],rbx
-	mov	QWORD[160+r8],rbp
-	mov	QWORD[216+r8],r12
-	mov	QWORD[224+r8],r13
-	mov	QWORD[232+r8],r14
-	mov	QWORD[240+r8],r15
-
-	jmp	NEAR $L$common_seh_tail
+	jmp	NEAR $L$common_pop_regs
 
 
 
@@ -872,15 +919,21 @@
 	cmp	rbx,r10
 	jb	NEAR $L$common_seh_tail
 
+	mov	r10d,DWORD[4+r11]
+	lea	r10,[r10*1+rsi]
+	cmp	rbx,r10
+	jb	NEAR $L$common_pop_regs
+
 	mov	rax,QWORD[152+r8]
 
-	mov	r10d,DWORD[4+r11]
+	mov	r10d,DWORD[8+r11]
 	lea	r10,[r10*1+rsi]
 	cmp	rbx,r10
 	jae	NEAR $L$common_seh_tail
 
 	mov	rax,QWORD[40+rax]
 
+$L$common_pop_regs:
 	mov	rbx,QWORD[((-8))+rax]
 	mov	rbp,QWORD[((-16))+rax]
 	mov	r12,QWORD[((-24))+rax]
@@ -960,4 +1013,5 @@
 $L$SEH_info_bn_sqr8x_mont:
 DB	9,0,0,0
 	DD	sqr_handler wrt ..imagebase
-	DD	$L$sqr8x_body wrt ..imagebase,$L$sqr8x_epilogue wrt ..imagebase
+	DD	$L$sqr8x_prologue wrt ..imagebase,$L$sqr8x_body wrt ..imagebase,$L$sqr8x_epilogue wrt ..imagebase
+ALIGN	8
diff --git a/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont5.asm b/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont5.asm
index 58f19ac2..5033f02 100644
--- a/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont5.asm
+++ b/third_party/boringssl/win-x86_64/crypto/bn/x86_64-mont5.asm
@@ -23,16 +23,15 @@
 	mov	r9,QWORD[48+rsp]
 
 
+	mov	r9d,r9d
+	mov	rax,rsp
 	test	r9d,7
 	jnz	NEAR $L$mul_enter
 	jmp	NEAR $L$mul4x_enter
 
 ALIGN	16
 $L$mul_enter:
-	mov	r9d,r9d
-	mov	rax,rsp
 	movd	xmm5,DWORD[56+rsp]
-	lea	r10,[$L$inc]
 	push	rbx
 	push	rbp
 	push	r12
@@ -40,13 +39,39 @@
 	push	r14
 	push	r15
 
-	lea	r11,[2+r9]
-	neg	r11
-	lea	rsp,[((-264))+r11*8+rsp]
-	and	rsp,-1024
+	neg	r9
+	mov	r11,rsp
+	lea	r10,[((-280))+r9*8+rsp]
+	neg	r9
+	and	r10,-1024
 
+
+
+
+
+
+
+
+
+	sub	r11,r10
+	and	r11,-4096
+	lea	rsp,[r11*1+r10]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul_page_walk
+	jmp	NEAR $L$mul_page_walk_done
+
+$L$mul_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r11,QWORD[rsp]
+	cmp	rsp,r10
+	ja	NEAR $L$mul_page_walk
+$L$mul_page_walk_done:
+
+	lea	r10,[$L$inc]
 	mov	QWORD[8+r9*8+rsp],rax
 $L$mul_body:
+
 	lea	r12,[128+rdx]
 	movdqa	xmm0,XMMWORD[r10]
 	movdqa	xmm1,XMMWORD[16+r10]
@@ -385,16 +410,17 @@
 
 	sbb	rax,0
 	xor	r14,r14
+	and	rsi,rax
+	not	rax
+	mov	rcx,rdi
+	and	rcx,rax
 	mov	r15,r9
+	or	rsi,rcx
 ALIGN	16
 $L$copy:
-	mov	rsi,QWORD[r14*8+rsp]
-	mov	rcx,QWORD[r14*8+rdi]
-	xor	rsi,rcx
-	and	rsi,rax
-	xor	rsi,rcx
+	mov	rax,QWORD[r14*8+rsi]
 	mov	QWORD[r14*8+rsp],r14
-	mov	QWORD[r14*8+rdi],rsi
+	mov	QWORD[r14*8+rdi],rax
 	lea	r14,[1+r14]
 	sub	r15,1
 	jnz	NEAR $L$copy
@@ -429,15 +455,16 @@
 	mov	r9,QWORD[48+rsp]
 
 
-$L$mul4x_enter:
 DB	0x67
 	mov	rax,rsp
+$L$mul4x_enter:
 	push	rbx
 	push	rbp
 	push	r12
 	push	r13
 	push	r14
 	push	r15
+$L$mul4x_prologue:
 
 DB	0x67
 	shl	r9d,3
@@ -454,24 +481,41 @@
 
 
 	lea	r11,[((-320))+r9*2+rsp]
+	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$mul4xsp_alt
-	sub	rsp,r11
-	lea	rsp,[((-320))+r9*2+rsp]
+	sub	rbp,r11
+	lea	rbp,[((-320))+r9*2+rbp]
 	jmp	NEAR $L$mul4xsp_done
 
 ALIGN	32
 $L$mul4xsp_alt:
 	lea	r10,[((4096-320))+r9*2]
-	lea	rsp,[((-320))+r9*2+rsp]
+	lea	rbp,[((-320))+r9*2+rbp]
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
-	sub	rsp,r11
+	sub	rbp,r11
 $L$mul4xsp_done:
-	and	rsp,-64
+	and	rbp,-64
+	mov	r11,rsp
+	sub	r11,rbp
+	and	r11,-4096
+	lea	rsp,[rbp*1+r11]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$mul4x_page_walk
+	jmp	NEAR $L$mul4x_page_walk_done
+
+$L$mul4x_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$mul4x_page_walk
+$L$mul4x_page_walk_done:
+
 	neg	r9
 
 	mov	QWORD[40+rsp],rax
@@ -1043,6 +1087,7 @@
 	push	r13
 	push	r14
 	push	r15
+$L$power5_prologue:
 
 	shl	r9d,3
 	lea	r10d,[r9*2+r9]
@@ -1057,24 +1102,41 @@
 
 
 	lea	r11,[((-320))+r9*2+rsp]
+	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$pwr_sp_alt
-	sub	rsp,r11
-	lea	rsp,[((-320))+r9*2+rsp]
+	sub	rbp,r11
+	lea	rbp,[((-320))+r9*2+rbp]
 	jmp	NEAR $L$pwr_sp_done
 
 ALIGN	32
 $L$pwr_sp_alt:
 	lea	r10,[((4096-320))+r9*2]
-	lea	rsp,[((-320))+r9*2+rsp]
+	lea	rbp,[((-320))+r9*2+rbp]
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
-	sub	rsp,r11
+	sub	rbp,r11
 $L$pwr_sp_done:
-	and	rsp,-64
+	and	rbp,-64
+	mov	r11,rsp
+	sub	r11,rbp
+	and	r11,-4096
+	lea	rsp,[rbp*1+r11]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$pwr_page_walk
+	jmp	NEAR $L$pwr_page_walk_done
+
+$L$pwr_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$pwr_page_walk
+$L$pwr_page_walk_done:
+
 	mov	r10,r9
 	neg	r9
 
@@ -1997,6 +2059,7 @@
 	push	r13
 	push	r14
 	push	r15
+$L$from_prologue:
 
 	shl	r9d,3
 	lea	r10,[r9*2+r9]
@@ -2011,24 +2074,41 @@
 
 
 	lea	r11,[((-320))+r9*2+rsp]
+	mov	rbp,rsp
 	sub	r11,rdi
 	and	r11,4095
 	cmp	r10,r11
 	jb	NEAR $L$from_sp_alt
-	sub	rsp,r11
-	lea	rsp,[((-320))+r9*2+rsp]
+	sub	rbp,r11
+	lea	rbp,[((-320))+r9*2+rbp]
 	jmp	NEAR $L$from_sp_done
 
 ALIGN	32
 $L$from_sp_alt:
 	lea	r10,[((4096-320))+r9*2]
-	lea	rsp,[((-320))+r9*2+rsp]
+	lea	rbp,[((-320))+r9*2+rbp]
 	sub	r11,r10
 	mov	r10,0
 	cmovc	r11,r10
-	sub	rsp,r11
+	sub	rbp,r11
 $L$from_sp_done:
-	and	rsp,-64
+	and	rbp,-64
+	mov	r11,rsp
+	sub	r11,rbp
+	and	r11,-4096
+	lea	rsp,[rbp*1+r11]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$from_page_walk
+	jmp	NEAR $L$from_page_walk_done
+
+$L$from_page_walk:
+	lea	rsp,[((-4096))+rsp]
+	mov	r10,QWORD[rsp]
+	cmp	rsp,rbp
+	ja	NEAR $L$from_page_walk
+$L$from_page_walk_done:
+
 	mov	r10,r9
 	neg	r9
 
@@ -2321,9 +2401,14 @@
 	cmp	rbx,r10
 	jb	NEAR $L$common_seh_tail
 
+	mov	r10d,DWORD[4+r11]
+	lea	r10,[r10*1+rsi]
+	cmp	rbx,r10
+	jb	NEAR $L$common_pop_regs
+
 	mov	rax,QWORD[152+r8]
 
-	mov	r10d,DWORD[4+r11]
+	mov	r10d,DWORD[8+r11]
 	lea	r10,[r10*1+rsi]
 	cmp	rbx,r10
 	jae	NEAR $L$common_seh_tail
@@ -2335,11 +2420,11 @@
 	mov	r10,QWORD[192+r8]
 	mov	rax,QWORD[8+r10*8+rax]
 
-	jmp	NEAR $L$body_proceed
+	jmp	NEAR $L$common_pop_regs
 
 $L$body_40:
 	mov	rax,QWORD[40+rax]
-$L$body_proceed:
+$L$common_pop_regs:
 	mov	rbx,QWORD[((-8))+rax]
 	mov	rbp,QWORD[((-16))+rax]
 	mov	r12,QWORD[((-24))+rax]
@@ -2419,22 +2504,22 @@
 $L$SEH_info_bn_mul_mont_gather5:
 DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase
+	DD	$L$mul_body wrt ..imagebase,$L$mul_body wrt ..imagebase,$L$mul_epilogue wrt ..imagebase
 ALIGN	8
 $L$SEH_info_bn_mul4x_mont_gather5:
 DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase
+	DD	$L$mul4x_prologue wrt ..imagebase,$L$mul4x_body wrt ..imagebase,$L$mul4x_epilogue wrt ..imagebase
 ALIGN	8
 $L$SEH_info_bn_power5:
 DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$power5_body wrt ..imagebase,$L$power5_epilogue wrt ..imagebase
+	DD	$L$power5_prologue wrt ..imagebase,$L$power5_body wrt ..imagebase,$L$power5_epilogue wrt ..imagebase
 ALIGN	8
 $L$SEH_info_bn_from_mont8x:
 DB	9,0,0,0
 	DD	mul_handler wrt ..imagebase
-	DD	$L$from_body wrt ..imagebase,$L$from_epilogue wrt ..imagebase
+	DD	$L$from_prologue wrt ..imagebase,$L$from_body wrt ..imagebase,$L$from_epilogue wrt ..imagebase
 ALIGN	8
 $L$SEH_info_bn_gather5:
 DB	0x01,0x0b,0x03,0x0a
diff --git a/third_party/boringssl/win-x86_64/crypto/chacha/chacha-x86_64.asm b/third_party/boringssl/win-x86_64/crypto/chacha/chacha-x86_64.asm
index afebd2e..ce6fdb9 100644
--- a/third_party/boringssl/win-x86_64/crypto/chacha/chacha-x86_64.asm
+++ b/third_party/boringssl/win-x86_64/crypto/chacha/chacha-x86_64.asm
@@ -27,6 +27,15 @@
 $L$sigma:
 DB	101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107
 DB	0
+ALIGN	64
+$L$zeroz:
+	DD	0,0,0,0,1,0,0,0,2,0,0,0,3,0,0,0
+$L$fourz:
+	DD	4,0,0,0,4,0,0,0,4,0,0,0,4,0,0,0
+$L$incz:
+	DD	0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
+$L$sixteen:
+	DD	16,16,16,16,16,16,16,16,16,16,16,16,16,16,16,16
 DB	67,104,97,67,104,97,50,48,32,102,111,114,32,120,56,54
 DB	95,54,52,44,32,67,82,89,80,84,79,71,65,77,83,32
 DB	98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115
@@ -348,7 +357,7 @@
 	movdqa	XMMWORD[16+rsp],xmm1
 	movdqa	XMMWORD[32+rsp],xmm2
 	movdqa	XMMWORD[48+rsp],xmm3
-	mov	ebp,10
+	mov	r8,10
 	jmp	NEAR $L$oop_ssse3
 
 ALIGN	32
@@ -358,7 +367,7 @@
 	movdqa	xmm1,XMMWORD[16+rsp]
 	movdqa	xmm2,XMMWORD[32+rsp]
 	paddd	xmm3,XMMWORD[48+rsp]
-	mov	ebp,10
+	mov	r8,10
 	movdqa	XMMWORD[48+rsp],xmm3
 	jmp	NEAR $L$oop_ssse3
 
@@ -407,7 +416,7 @@
 	pshufd	xmm2,xmm2,78
 	pshufd	xmm1,xmm1,147
 	pshufd	xmm3,xmm3,57
-	dec	ebp
+	dec	r8
 	jnz	NEAR $L$oop_ssse3
 	paddd	xmm0,XMMWORD[rsp]
 	paddd	xmm1,XMMWORD[16+rsp]
@@ -444,27 +453,21 @@
 	movdqa	XMMWORD[16+rsp],xmm1
 	movdqa	XMMWORD[32+rsp],xmm2
 	movdqa	XMMWORD[48+rsp],xmm3
-	xor	rbx,rbx
+	xor	r8,r8
 
 $L$oop_tail_ssse3:
-	movzx	eax,BYTE[rbx*1+rsi]
-	movzx	ecx,BYTE[rbx*1+rsp]
-	lea	rbx,[1+rbx]
+	movzx	eax,BYTE[r8*1+rsi]
+	movzx	ecx,BYTE[r8*1+rsp]
+	lea	r8,[1+r8]
 	xor	eax,ecx
-	mov	BYTE[((-1))+rbx*1+rdi],al
+	mov	BYTE[((-1))+r8*1+rdi],al
 	dec	rdx
 	jnz	NEAR $L$oop_tail_ssse3
 
 $L$done_ssse3:
 	movaps	xmm6,XMMWORD[((64+32))+rsp]
 	movaps	xmm7,XMMWORD[((64+48))+rsp]
-	add	rsp,64+72
-	pop	r15
-	pop	r14
-	pop	r13
-	pop	r12
-	pop	rbp
-	pop	rbx
+	add	rsp,64+72+48
 	mov	rdi,QWORD[8+rsp]	;WIN64 epilogue
 	mov	rsi,QWORD[16+rsp]
 	DB	0F3h,0C3h		;repret
diff --git a/ui/accessibility/platform/ax_platform_node_mac.mm b/ui/accessibility/platform/ax_platform_node_mac.mm
index 3cf4db2..9edb013 100644
--- a/ui/accessibility/platform/ax_platform_node_mac.mm
+++ b/ui/accessibility/platform/ax_platform_node_mac.mm
@@ -392,14 +392,15 @@
 }
 
 - (BOOL)accessibilityIsAttributeSettable:(NSString*)attributeName {
+  if (node_->GetData().HasStateFlag(ui::AX_STATE_DISABLED))
+    return NO;
+
   // Allow certain attributes to be written via an accessibility client. A
   // writable attribute will only appear as such if the accessibility element
   // has a value set for that attribute.
   if ([attributeName
           isEqualToString:NSAccessibilitySelectedChildrenAttribute] ||
       [attributeName
-          isEqualToString:NSAccessibilitySelectedTextRangeAttribute] ||
-      [attributeName
           isEqualToString:NSAccessibilityVisibleCharacterRangeAttribute]) {
     return NO;
   }
@@ -412,7 +413,9 @@
   }
 
   if ([attributeName isEqualToString:NSAccessibilityValueAttribute] ||
-      [attributeName isEqualToString:NSAccessibilitySelectedTextAttribute]) {
+      [attributeName isEqualToString:NSAccessibilitySelectedTextAttribute] ||
+      [attributeName
+          isEqualToString:NSAccessibilitySelectedTextRangeAttribute]) {
     return !ui::AXNodeData::IsFlagSet(node_->GetData().state,
                                       ui::AX_STATE_READ_ONLY);
   }
@@ -438,6 +441,9 @@
                       : ui::AX_ACTION_SET_VALUE;
   } else if ([attribute isEqualToString:NSAccessibilitySelectedTextAttribute]) {
     data.action = ui::AX_ACTION_REPLACE_SELECTED_TEXT;
+  } else if ([attribute
+                 isEqualToString:NSAccessibilitySelectedTextRangeAttribute]) {
+    data.action = ui::AX_ACTION_SET_SELECTION;
   } else if ([attribute isEqualToString:NSAccessibilityFocusedAttribute]) {
     if ([value isKindOfClass:[NSNumber class]]) {
       data.action =
@@ -446,8 +452,14 @@
   }
 
   // Set type-specific information as necessary for actions set above.
-  if ([value isKindOfClass:[NSString class]])
+  if ([value isKindOfClass:[NSString class]]) {
     data.value = base::SysNSStringToUTF16(value);
+  } else if (data.action == ui::AX_ACTION_SET_SELECTION &&
+             [value isKindOfClass:[NSValue class]]) {
+    NSRange range = [value rangeValue];
+    data.anchor_offset = range.location;
+    data.focus_offset = NSMaxRange(range);
+  }
 
   if (data.action != ui::AX_ACTION_NONE)
     node_->GetDelegate()->AccessibilityPerformAction(data);
@@ -510,17 +522,16 @@
 }
 
 - (NSNumber*)AXEnabled {
-  return [NSNumber
-      numberWithBool:!ui::AXNodeData::IsFlagSet(node_->GetData().state,
-                                                ui::AX_STATE_DISABLED)];
+  return @(!ui::AXNodeData::IsFlagSet(node_->GetData().state,
+                                      ui::AX_STATE_DISABLED));
 }
 
 - (NSNumber*)AXFocused {
   if (ui::AXNodeData::IsFlagSet(node_->GetData().state,
                                 ui::AX_STATE_FOCUSABLE))
-    return [NSNumber numberWithBool:(node_->GetDelegate()->GetFocus() ==
-                                     node_->GetNativeViewAccessible())];
-  return [NSNumber numberWithBool:NO];
+    return
+        @(node_->GetDelegate()->GetFocus() == node_->GetNativeViewAccessible());
+  return @NO;
 }
 
 - (id)AXParent {
@@ -562,8 +573,7 @@
 // Misc attributes.
 
 - (NSNumber*)AXSelected {
-  return [NSNumber
-      numberWithBool:node_->GetData().HasStateFlag(ui::AX_STATE_SELECTED)];
+  return @(node_->GetData().HasStateFlag(ui::AX_STATE_SELECTED));
 }
 
 - (NSString*)AXPlaceholderValue {
@@ -589,22 +599,20 @@
   bool isReversed = (textDir == ui::AX_TEXT_DIRECTION_RTL) ||
                     (textDir == ui::AX_TEXT_DIRECTION_BTT);
   int beginSelectionIndex = (end > start && !isReversed) ? start : end;
-  return [NSValue
-      valueWithRange:NSMakeRange(beginSelectionIndex, abs(end - start))];
+  return [NSValue valueWithRange:{beginSelectionIndex, abs(end - start)}];
 }
 
 - (NSNumber*)AXNumberOfCharacters {
-  return [NSNumber numberWithInteger:[[self AXValue] length]];
+  return @([[self AXValue] length]);
 }
 
 - (NSValue*)AXVisibleCharacterRange {
-  return [NSValue
-      valueWithRange:NSMakeRange(0, [[self AXNumberOfCharacters] intValue])];
+  return [NSValue valueWithRange:{0, [[self AXNumberOfCharacters] intValue]}];
 }
 
 - (NSNumber*)AXInsertionPointLineNumber {
   // Multiline is not supported on views.
-  return [NSNumber numberWithInteger:0];
+  return @0;
 }
 
 @end
diff --git a/ui/android/java/src/org/chromium/ui/gfx/OWNERS b/ui/android/java/src/org/chromium/ui/gfx/OWNERS
index 1849050..0fc82371 100644
--- a/ui/android/java/src/org/chromium/ui/gfx/OWNERS
+++ b/ui/android/java/src/org/chromium/ui/gfx/OWNERS
@@ -1,2 +1,4 @@
 aelias@chromium.org
 skyostil@chromium.org
+
+# COMPONENT: UI>GFX
diff --git a/ui/aura/mus/input_method_mus.cc b/ui/aura/mus/input_method_mus.cc
index d629df2..df3ef422 100644
--- a/ui/aura/mus/input_method_mus.cc
+++ b/ui/aura/mus/input_method_mus.cc
@@ -54,7 +54,7 @@
 
   // If no text input client, do nothing.
   if (!GetTextInputClient()) {
-    ignore_result(DispatchKeyEventPostIME(event));
+    DispatchKeyEventPostIME(event);
     if (ack_callback) {
       ack_callback->Run(event->handled() ? EventResult::HANDLED
                                          : EventResult::UNHANDLED);
@@ -122,6 +122,13 @@
 void InputMethodMus::SendKeyEventToInputMethod(
     const ui::KeyEvent& event,
     std::unique_ptr<EventResultCallback> ack_callback) {
+  if (!input_method_) {
+    // This code path is hit in tests that don't connect to the server.
+    DCHECK(!ack_callback);
+    std::unique_ptr<ui::Event> event_clone = ui::Event::Clone(event);
+    DispatchKeyEventPostIME(event_clone->AsKeyEvent());
+    return;
+  }
   // IME driver will notify us whether it handled the event or not by calling
   // ProcessKeyEventCallback(), in which we will run the |ack_callback| to tell
   // the window server if client handled the event or not.
@@ -180,7 +187,7 @@
     // any client-side post-ime processing needs to be done. This includes cases
     // like backspace, return key, etc.
     std::unique_ptr<ui::Event> event_clone = ui::Event::Clone(event);
-    ignore_result(DispatchKeyEventPostIME(event_clone->AsKeyEvent()));
+    DispatchKeyEventPostIME(event_clone->AsKeyEvent());
     event_result =
         event_clone->handled() ? EventResult::HANDLED : EventResult::UNHANDLED;
   } else {
diff --git a/ui/events/android/OWNERS b/ui/events/android/OWNERS
index 2328e39d..2ef1a4241 100644
--- a/ui/events/android/OWNERS
+++ b/ui/events/android/OWNERS
@@ -1,2 +1,5 @@
 aelias@chromium.org
-tdresser@chromium.org
\ No newline at end of file
+tdresser@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/ui/events/blink/OWNERS b/ui/events/blink/OWNERS
index d8afba1..90ec5a03 100644
--- a/ui/events/blink/OWNERS
+++ b/ui/events/blink/OWNERS
@@ -1,3 +1,6 @@
 aelias@chromium.org
 dtapuska@chromium.org
-tdresser@chromium.org
\ No newline at end of file
+tdresser@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/ui/events/gesture_detection/OWNERS b/ui/events/gesture_detection/OWNERS
index 6039fc4..2ef1a4241 100644
--- a/ui/events/gesture_detection/OWNERS
+++ b/ui/events/gesture_detection/OWNERS
@@ -1,2 +1,5 @@
 aelias@chromium.org
 tdresser@chromium.org
+
+# TEAM: input-dev@chromium.org
+# COMPONENT: Blink>Input
diff --git a/ui/events/ozone/device/udev/device_manager_udev.cc b/ui/events/ozone/device/udev/device_manager_udev.cc
index 2f8ee26..bc89145 100644
--- a/ui/events/ozone/device/udev/device_manager_udev.cc
+++ b/ui/events/ozone/device/udev/device_manager_udev.cc
@@ -82,8 +82,8 @@
 
 }  // namespace
 
-DeviceManagerUdev::DeviceManagerUdev() : udev_(UdevCreate()) {
-}
+DeviceManagerUdev::DeviceManagerUdev()
+    : udev_(UdevCreate()), controller_(FROM_HERE) {}
 
 DeviceManagerUdev::~DeviceManagerUdev() {
 }
diff --git a/ui/events/ozone/evdev/event_converter_evdev.cc b/ui/events/ozone/evdev/event_converter_evdev.cc
index e9da819..9ce8d60 100644
--- a/ui/events/ozone/evdev/event_converter_evdev.cc
+++ b/ui/events/ozone/evdev/event_converter_evdev.cc
@@ -28,8 +28,13 @@
                                          uint16_t product_id)
     : fd_(fd),
       path_(path),
-      input_device_(id, type, name, GetInputPathInSys(path), vendor_id,
-                    product_id) {}
+      input_device_(id,
+                    type,
+                    name,
+                    GetInputPathInSys(path),
+                    vendor_id,
+                    product_id),
+      controller_(FROM_HERE) {}
 
 EventConverterEvdev::~EventConverterEvdev() {
   DCHECK(!enabled_);
diff --git a/ui/events/ozone/evdev/event_converter_evdev_impl.cc b/ui/events/ozone/evdev/event_converter_evdev_impl.cc
index ca6fda5..12df16e1 100644
--- a/ui/events/ozone/evdev/event_converter_evdev_impl.cc
+++ b/ui/events/ozone/evdev/event_converter_evdev_impl.cc
@@ -48,6 +48,7 @@
       has_keyboard_(devinfo.HasKeyboard()),
       has_touchpad_(devinfo.HasTouchpad()),
       has_caps_lock_led_(devinfo.HasLedEvent(LED_CAPSL)),
+      controller_(FROM_HERE),
       cursor_(cursor),
       dispatcher_(dispatcher) {}
 
diff --git a/ui/events/ozone/evdev/tablet_event_converter_evdev.cc b/ui/events/ozone/evdev/tablet_event_converter_evdev.cc
index ef021d3..8b0aa2b9 100644
--- a/ui/events/ozone/evdev/tablet_event_converter_evdev.cc
+++ b/ui/events/ozone/evdev/tablet_event_converter_evdev.cc
@@ -45,6 +45,7 @@
                           info.vendor_id(),
                           info.product_id()),
       input_device_fd_(std::move(fd)),
+      controller_(FROM_HERE),
       cursor_(cursor),
       dispatcher_(dispatcher) {
   x_abs_min_ = info.GetAbsMinimum(ABS_X);
diff --git a/ui/events/platform/x11/x11_event_source_libevent.cc b/ui/events/platform/x11/x11_event_source_libevent.cc
index c4beb1e4..662ee48 100644
--- a/ui/events/platform/x11/x11_event_source_libevent.cc
+++ b/ui/events/platform/x11/x11_event_source_libevent.cc
@@ -133,7 +133,7 @@
 }  // namespace
 
 X11EventSourceLibevent::X11EventSourceLibevent(XDisplay* display)
-    : event_source_(this, display) {
+    : event_source_(this, display), watcher_controller_(FROM_HERE) {
   AddEventWatcher();
 }
 
diff --git a/ui/gfx/color_space.cc b/ui/gfx/color_space.cc
index 0f5a42b..7483663 100644
--- a/ui/gfx/color_space.cc
+++ b/ui/gfx/color_space.cc
@@ -15,31 +15,140 @@
 
 namespace gfx {
 
-ColorSpace::PrimaryID ColorSpace::PrimaryIDFromInt(int primary_id) {
-  if (primary_id < 0 || primary_id > static_cast<int>(PrimaryID::LAST))
-    return PrimaryID::UNKNOWN;
-  if (primary_id > static_cast<int>(PrimaryID::LAST_STANDARD_VALUE) &&
-      primary_id < 1000)
-    return PrimaryID::UNKNOWN;
-  return static_cast<PrimaryID>(primary_id);
-}
-
-ColorSpace::TransferID ColorSpace::TransferIDFromInt(int transfer_id) {
-  if (transfer_id < 0 || transfer_id > static_cast<int>(TransferID::LAST))
-    return TransferID::UNKNOWN;
-  if (transfer_id > static_cast<int>(TransferID::LAST_STANDARD_VALUE) &&
-      transfer_id < 1000)
-    return TransferID::UNKNOWN;
-  return static_cast<TransferID>(transfer_id);
-}
-
-ColorSpace::MatrixID ColorSpace::MatrixIDFromInt(int matrix_id) {
-  if (matrix_id < 0 || matrix_id > static_cast<int>(MatrixID::LAST))
-    return MatrixID::UNKNOWN;
-  if (matrix_id > static_cast<int>(MatrixID::LAST_STANDARD_VALUE) &&
-      matrix_id < 1000)
-    return MatrixID::UNKNOWN;
-  return static_cast<MatrixID>(matrix_id);
+// static
+ColorSpace ColorSpace::CreateVideo(int video_primary,
+                                   int video_transfer,
+                                   int video_matrix,
+                                   RangeID range_id) {
+  // TODO(hubbe): Use more context to decide how to handle UNSPECIFIED values.
+  ColorSpace result;
+  switch (video_primary) {
+    default:
+    case 0:  // RESERVED0
+    case 1:  // BT709
+    case 2:  // UNSPECIFIED
+    case 3:  // RESERVED
+      result.primaries_ = PrimaryID::BT709;
+      break;
+    case 4:  // BT470M
+      result.primaries_ = PrimaryID::BT470M;
+      break;
+    case 5:  // BT470BG
+      result.primaries_ = PrimaryID::BT470BG;
+      break;
+    case 6:  // SMPTE170M
+      result.primaries_ = PrimaryID::SMPTE170M;
+      break;
+    case 7:  // SMPTE240M
+      result.primaries_ = PrimaryID::SMPTE240M;
+      break;
+    case 8:  // FILM
+      result.primaries_ = PrimaryID::FILM;
+      break;
+    case 9:  // BT2020
+      result.primaries_ = PrimaryID::BT2020;
+      break;
+    case 10:  // SMPTEST428_1
+      result.primaries_ = PrimaryID::SMPTEST428_1;
+      break;
+    case 11:  // SMPTEST431_2
+      result.primaries_ = PrimaryID::SMPTEST431_2;
+      break;
+    case 12:  // SMPTEST432_1
+      result.primaries_ = PrimaryID::SMPTEST432_1;
+      break;
+  }
+  switch (video_transfer) {
+    default:
+    case 0:  // RESERVED0
+    case 1:  // BT709
+    case 2:  // UNSPECIFIED
+    case 3:  // RESERVED
+      result.transfer_ = TransferID::BT709;
+      break;
+    case 4:  // GAMMA22
+      result.transfer_ = TransferID::GAMMA22;
+      break;
+    case 5:  // GAMMA28
+      result.transfer_ = TransferID::GAMMA28;
+      break;
+    case 6:  // SMPTE170M
+      result.transfer_ = TransferID::SMPTE170M;
+      break;
+    case 7:  // SMPTE240M
+      result.transfer_ = TransferID::SMPTE240M;
+      break;
+    case 8:  // LINEAR
+      result.transfer_ = TransferID::LINEAR;
+      break;
+    case 9:  // LOG
+      result.transfer_ = TransferID::LOG;
+      break;
+    case 10:  // LOG_SQRT
+      result.transfer_ = TransferID::LOG_SQRT;
+      break;
+    case 11:  // IEC61966_2_4
+      result.transfer_ = TransferID::IEC61966_2_4;
+      break;
+    case 12:  // BT1361_ECG
+      result.transfer_ = TransferID::BT1361_ECG;
+      break;
+    case 13:  // IEC61966_2_1
+      result.transfer_ = TransferID::IEC61966_2_1;
+      break;
+    case 14:  // BT2020_10
+      result.transfer_ = TransferID::BT2020_10;
+      break;
+    case 15:  // BT2020_12
+      result.transfer_ = TransferID::BT2020_12;
+      break;
+    case 16:  // SMPTEST2084
+      result.transfer_ = TransferID::SMPTEST2084;
+      break;
+    case 17:  // SMPTEST428_1
+      result.transfer_ = TransferID::SMPTEST428_1;
+      break;
+    case 18:  // ARIB_STD_B67
+      result.transfer_ = TransferID::ARIB_STD_B67;
+      break;
+  }
+  switch (video_matrix) {
+    case 0:  // RGB
+      result.matrix_ = MatrixID::RGB;
+      break;
+    default:
+    case 1:  // BT709
+    case 2:  // UNSPECIFIED
+    case 3:  // RESERVED
+      result.matrix_ = MatrixID::BT709;
+      break;
+    case 4:  // FCC
+      result.matrix_ = MatrixID::FCC;
+      break;
+    case 5:  // BT470BG
+      result.matrix_ = MatrixID::BT470BG;
+      break;
+    case 6:  // SMPTE170M
+      result.matrix_ = MatrixID::SMPTE170M;
+      break;
+    case 7:  // SMPTE240M
+      result.matrix_ = MatrixID::SMPTE240M;
+      break;
+    case 8:  // YCOCG
+      result.matrix_ = MatrixID::YCOCG;
+      break;
+    case 9:  // BT2020_NCL
+      result.matrix_ = MatrixID::BT2020_NCL;
+      break;
+    case 10:  // BT2020_CL
+      result.matrix_ = MatrixID::BT2020_CL;
+      break;
+    case 11:  // YDZDX
+      result.matrix_ = MatrixID::YDZDX;
+      break;
+  }
+  result.range_ = range_id;
+  return result;
 }
 
 ColorSpace::ColorSpace() {}
@@ -60,12 +169,6 @@
       matrix_(matrix),
       range_(range) {}
 
-ColorSpace::ColorSpace(int primaries, int transfer, int matrix, RangeID range)
-    : primaries_(PrimaryIDFromInt(primaries)),
-      transfer_(TransferIDFromInt(transfer)),
-      matrix_(MatrixIDFromInt(matrix)),
-      range_(range) {}
-
 ColorSpace::ColorSpace(const ColorSpace& other)
     : primaries_(other.primaries_),
       transfer_(other.transfer_),
@@ -82,11 +185,11 @@
            sizeof(custom_primary_matrix_));
   }
 }
-
 ColorSpace::~ColorSpace() = default;
 
 bool ColorSpace::IsValid() const {
-  return *this != gfx::ColorSpace();
+  return primaries_ != PrimaryID::INVALID && transfer_ != TransferID::INVALID &&
+         matrix_ != MatrixID::INVALID && range_ != RangeID::INVALID;
 }
 
 // static
@@ -197,10 +300,8 @@
     return icc_profile_sk_color_space_;
 
   // Unspecified color spaces correspond to the null SkColorSpace.
-  if (primaries_ == PrimaryID::UNSPECIFIED ||
-      transfer_ == TransferID::UNSPECIFIED) {
+  if (!IsValid())
     return nullptr;
-  }
 
   // Handle only full-range RGB spaces.
   if (matrix_ != MatrixID::RGB) {
@@ -249,10 +350,10 @@
       to_XYZD50->set3x3RowMajorf(custom_primary_matrix_);
       return;
 
-    case ColorSpace::PrimaryID::RESERVED0:
-    case ColorSpace::PrimaryID::RESERVED:
-    case ColorSpace::PrimaryID::UNSPECIFIED:
-    case ColorSpace::PrimaryID::UNKNOWN:
+    case ColorSpace::PrimaryID::INVALID:
+      to_XYZD50->setIdentity();
+      return;
+
     case ColorSpace::PrimaryID::BT709:
       // BT709 is our default case. Put it after the switch just
       // in case we somehow get an id which is not listed in the switch.
@@ -414,11 +515,6 @@
     case ColorSpace::TransferID::GAMMA28:
       fn->fG = 2.8f;
       return true;
-    case ColorSpace::TransferID::RESERVED0:
-    case ColorSpace::TransferID::RESERVED:
-    case ColorSpace::TransferID::UNSPECIFIED:
-    case ColorSpace::TransferID::UNKNOWN:
-    // All unknown values default to BT709
     case ColorSpace::TransferID::BT709:
     case ColorSpace::TransferID::SMPTE170M:
     case ColorSpace::TransferID::BT2020_10:
@@ -458,6 +554,7 @@
     case ColorSpace::TransferID::LOG_SQRT:
     case ColorSpace::TransferID::SMPTEST2084:
     case ColorSpace::TransferID::SMPTEST2084_NON_HDR:
+    case ColorSpace::TransferID::INVALID:
       break;
   }
 
@@ -476,13 +573,11 @@
   float Kb = 0;
   switch (matrix_) {
     case ColorSpace::MatrixID::RGB:
+    case ColorSpace::MatrixID::INVALID:
       matrix->setIdentity();
       return;
 
     case ColorSpace::MatrixID::BT709:
-    case ColorSpace::MatrixID::UNSPECIFIED:
-    case ColorSpace::MatrixID::RESERVED:
-    case ColorSpace::MatrixID::UNKNOWN:
       Kr = 0.2126f;
       Kb = 0.0722f;
       break;
@@ -562,7 +657,7 @@
 void ColorSpace::GetRangeAdjustMatrix(SkMatrix44* matrix) const {
   switch (range_) {
     case RangeID::FULL:
-    case RangeID::UNSPECIFIED:
+    case RangeID::INVALID:
       matrix->setIdentity();
       return;
 
@@ -572,14 +667,13 @@
   }
   switch (matrix_) {
     case MatrixID::RGB:
+    case MatrixID::INVALID:
     case MatrixID::YCOCG:
       matrix->setScale(255.0f/219.0f, 255.0f/219.0f, 255.0f/219.0f);
       matrix->postTranslate(-16.0f/219.0f, -16.0f/219.0f, -16.0f/219.0f);
       break;
 
     case MatrixID::BT709:
-    case MatrixID::UNSPECIFIED:
-    case MatrixID::RESERVED:
     case MatrixID::FCC:
     case MatrixID::BT470BG:
     case MatrixID::SMPTE170M:
@@ -587,7 +681,6 @@
     case MatrixID::BT2020_NCL:
     case MatrixID::BT2020_CL:
     case MatrixID::YDZDX:
-    case MatrixID::UNKNOWN:
       matrix->setScale(255.0f/219.0f, 255.0f/224.0f, 255.0f/224.0f);
       matrix->postTranslate(-16.0f/219.0f, -15.5f/224.0f, -15.5f/224.0f);
       break;
diff --git a/ui/gfx/color_space.h b/ui/gfx/color_space.h
index 798b9305a..6e424f7 100644
--- a/ui/gfx/color_space.h
+++ b/ui/gfx/color_space.h
@@ -28,26 +28,17 @@
 class GFX_EXPORT ColorSpace {
  public:
   enum class PrimaryID : uint16_t {
-    // The first 0-255 values should match the H264 specification (see Table E-3
-    // Colour Primaries in https://www.itu.int/rec/T-REC-H.264/en).
-    RESERVED0 = 0,
-    BT709 = 1,
-    UNSPECIFIED = 2,
-    RESERVED = 3,
-    BT470M = 4,
-    BT470BG = 5,
-    SMPTE170M = 6,
-    SMPTE240M = 7,
-    FILM = 8,
-    BT2020 = 9,
-    SMPTEST428_1 = 10,
-    SMPTEST431_2 = 11,
-    SMPTEST432_1 = 12,
-
-    LAST_STANDARD_VALUE = SMPTEST432_1,
-
-    // Chrome-specific values start at 1000.
-    UNKNOWN = 1000,
+    INVALID,
+    BT709,
+    BT470M,
+    BT470BG,
+    SMPTE170M,
+    SMPTE240M,
+    FILM,
+    BT2020,
+    SMPTEST428_1,
+    SMPTEST431_2,
+    SMPTEST432_1,
     XYZ_D50,
     ADOBE_RGB,
     CUSTOM,
@@ -55,87 +46,58 @@
   };
 
   enum class TransferID : uint16_t {
-    // The first 0-255 values should match the H264 specification (see Table E-4
-    // Transfer Characteristics in https://www.itu.int/rec/T-REC-H.264/en).
-    RESERVED0 = 0,
-    BT709 = 1,
-    UNSPECIFIED = 2,
-    RESERVED = 3,
-    GAMMA22 = 4,
-    GAMMA28 = 5,
-    SMPTE170M = 6,
-    SMPTE240M = 7,
-    LINEAR = 8,
-    LOG = 9,
-    LOG_SQRT = 10,
-    IEC61966_2_4 = 11,
-    BT1361_ECG = 12,
-    IEC61966_2_1 = 13,
-    BT2020_10 = 14,
-    BT2020_12 = 15,
-    SMPTEST2084 = 16,
-    SMPTEST428_1 = 17,
-    ARIB_STD_B67 = 18,  // AKA hybrid-log gamma, HLG.
-
-    LAST_STANDARD_VALUE = SMPTEST428_1,
-
-    // Chrome-specific values start at 1000.
-    UNKNOWN = 1000,
+    INVALID,
+    BT709,
+    GAMMA22,
     GAMMA24,
-
+    GAMMA28,
+    SMPTE170M,
+    SMPTE240M,
+    LINEAR,
+    LOG,
+    LOG_SQRT,
+    IEC61966_2_4,
+    BT1361_ECG,
+    IEC61966_2_1,
+    BT2020_10,
+    BT2020_12,
+    SMPTEST2084,
+    SMPTEST428_1,
+    ARIB_STD_B67,  // // AKA hybrid-log gamma, HLG.
     // This is an ad-hoc transfer function that decodes SMPTE 2084 content
     // into a 0-1 range more or less suitable for viewing on a non-hdr
     // display.
     SMPTEST2084_NON_HDR,
-
     // Like LINEAR, but intended for HDR. (can go outside of 0-1)
     LINEAR_HDR,
-    // TODO(hubbe): Need to store an approximation of the gamma function(s).
     CUSTOM,
     LAST = CUSTOM,
   };
 
   enum class MatrixID : int16_t {
-    // The first 0-255 values should match the H264 specification (see Table E-5
-    // Matrix Coefficients in https://www.itu.int/rec/T-REC-H.264/en).
-    RGB = 0,
-    BT709 = 1,
-    UNSPECIFIED = 2,
-    RESERVED = 3,
-    FCC = 4,
-    BT470BG = 5,
-    SMPTE170M = 6,
-    SMPTE240M = 7,
-    YCOCG = 8,
-    BT2020_NCL = 9,
-    BT2020_CL = 10,
-    YDZDX = 11,
-
-    LAST_STANDARD_VALUE = YDZDX,
-
-    // Chrome-specific values start at 1000
-    UNKNOWN = 1000,
-    LAST = UNKNOWN,
+    INVALID,
+    RGB,
+    BT709,
+    FCC,
+    BT470BG,
+    SMPTE170M,
+    SMPTE240M,
+    YCOCG,
+    BT2020_NCL,
+    BT2020_CL,
+    YDZDX,
+    LAST = YDZDX,
   };
 
-  // This corresponds to the WebM Range enum which is part of WebM color data
-  // (see http://www.webmproject.org/docs/container/#Range).
-  // H.264 only uses a bool, which corresponds to the LIMITED/FULL values.
-  // Chrome-specific values start at 1000.
   enum class RangeID : int8_t {
-    // Range is not explicitly specified / unknown.
-    UNSPECIFIED = 0,
-
+    INVALID,
     // Limited Rec. 709 color range with RGB values ranging from 16 to 235.
-    LIMITED = 1,
-
+    LIMITED,
     // Full RGB color range with RGB valees from 0 to 255.
-    FULL = 2,
-
+    FULL,
     // Range is defined by TransferID/MatrixID.
-    DERIVED = 3,
-
-    LAST = DERIVED
+    DERIVED,
+    LAST = DERIVED,
   };
 
   ColorSpace();
@@ -145,12 +107,16 @@
              MatrixID matrix,
              RangeID full_range);
   ColorSpace(const ColorSpace& other);
-  ColorSpace(int primaries, int transfer, int matrix, RangeID full_range);
   ~ColorSpace();
 
-  static PrimaryID PrimaryIDFromInt(int primary_id);
-  static TransferID TransferIDFromInt(int transfer_id);
-  static MatrixID MatrixIDFromInt(int matrix_id);
+  // Create a color space with primary, transfer and matrix values from the
+  // H264 specification (Table E-3 Colour Primaries, E-4 Transfer
+  // Characteristics, and E-5 Matrix Coefficients in
+  // https://www.itu.int/rec/T-REC-H.264/en).
+  static ColorSpace CreateVideo(int h264_primary,
+                                int h264_transfer,
+                                int h264_matrix,
+                                RangeID range_id);
 
   // Returns true if this is not the default-constructor object.
   bool IsValid() const;
@@ -187,10 +153,10 @@
   void GetRangeAdjustMatrix(SkMatrix44* matrix) const;
 
  private:
-  PrimaryID primaries_ = PrimaryID::UNSPECIFIED;
-  TransferID transfer_ = TransferID::UNSPECIFIED;
-  MatrixID matrix_ = MatrixID::UNSPECIFIED;
-  RangeID range_ = RangeID::LIMITED;
+  PrimaryID primaries_ = PrimaryID::INVALID;
+  TransferID transfer_ = TransferID::INVALID;
+  MatrixID matrix_ = MatrixID::INVALID;
+  RangeID range_ = RangeID::INVALID;
 
   // Only used if primaries_ is PrimaryID::CUSTOM.
   float custom_primary_matrix_[9] = {0, 0, 0, 0, 0, 0, 0, 0};
diff --git a/ui/gfx/color_space_win.cc b/ui/gfx/color_space_win.cc
index d3ab7009..e1a814b 100644
--- a/ui/gfx/color_space_win.cc
+++ b/ui/gfx/color_space_win.cc
@@ -25,8 +25,8 @@
       format.NominalRange = DXVA2_NominalRange_0_255;
       break;
 
-    case gfx::ColorSpace::RangeID::UNSPECIFIED:
     case gfx::ColorSpace::RangeID::DERIVED:
+    case gfx::ColorSpace::RangeID::INVALID:
       // Not handled
       break;
   }
@@ -44,14 +44,12 @@
       break;
 
     case gfx::ColorSpace::MatrixID::RGB:
-    case gfx::ColorSpace::MatrixID::UNSPECIFIED:
-    case gfx::ColorSpace::MatrixID::RESERVED:
     case gfx::ColorSpace::MatrixID::FCC:
     case gfx::ColorSpace::MatrixID::YCOCG:
     case gfx::ColorSpace::MatrixID::BT2020_NCL:
     case gfx::ColorSpace::MatrixID::BT2020_CL:
     case gfx::ColorSpace::MatrixID::YDZDX:
-    case gfx::ColorSpace::MatrixID::UNKNOWN:
+    case gfx::ColorSpace::MatrixID::INVALID:
       // Not handled
       break;
   }
@@ -73,18 +71,15 @@
       format.VideoPrimaries = DXVA2_VideoPrimaries_SMPTE240M;
       break;
 
-    case gfx::ColorSpace::PrimaryID::RESERVED0:
-    case gfx::ColorSpace::PrimaryID::UNSPECIFIED:
-    case gfx::ColorSpace::PrimaryID::RESERVED:
     case gfx::ColorSpace::PrimaryID::FILM:
     case gfx::ColorSpace::PrimaryID::BT2020:
     case gfx::ColorSpace::PrimaryID::SMPTEST428_1:
     case gfx::ColorSpace::PrimaryID::SMPTEST431_2:
     case gfx::ColorSpace::PrimaryID::SMPTEST432_1:
-    case gfx::ColorSpace::PrimaryID::UNKNOWN:
     case gfx::ColorSpace::PrimaryID::XYZ_D50:
     case gfx::ColorSpace::PrimaryID::ADOBE_RGB:
     case gfx::ColorSpace::PrimaryID::CUSTOM:
+    case gfx::ColorSpace::PrimaryID::INVALID:
       // Not handled
       break;
   }
@@ -111,9 +106,6 @@
       format.VideoTransferFunction = DXVA2_VideoTransFunc_sRGB;
       break;
 
-    case gfx::ColorSpace::TransferID::RESERVED0:
-    case gfx::ColorSpace::TransferID::UNSPECIFIED:
-    case gfx::ColorSpace::TransferID::RESERVED:
     case gfx::ColorSpace::TransferID::LOG:
     case gfx::ColorSpace::TransferID::LOG_SQRT:
     case gfx::ColorSpace::TransferID::IEC61966_2_4:
@@ -123,10 +115,10 @@
     case gfx::ColorSpace::TransferID::SMPTEST2084:
     case gfx::ColorSpace::TransferID::SMPTEST428_1:
     case gfx::ColorSpace::TransferID::ARIB_STD_B67:
-    case gfx::ColorSpace::TransferID::UNKNOWN:
     case gfx::ColorSpace::TransferID::GAMMA24:
     case gfx::ColorSpace::TransferID::SMPTEST2084_NON_HDR:
     case gfx::ColorSpace::TransferID::CUSTOM:
+    case gfx::ColorSpace::TransferID::INVALID:
       // Not handled
       break;
   }
diff --git a/ui/gfx/color_transform.cc b/ui/gfx/color_transform.cc
index 49a3026..e88f3a5 100644
--- a/ui/gfx/color_transform.cc
+++ b/ui/gfx/color_transform.cc
@@ -542,7 +542,6 @@
     ColorTransform::Intent intent) {
   if (intent == ColorTransform::Intent::INTENT_PERCEPTUAL) {
     switch (from.transfer_) {
-      case ColorSpace::TransferID::UNSPECIFIED:
       case ColorSpace::TransferID::BT709:
       case ColorSpace::TransferID::SMPTE170M:
         // SMPTE 1886 suggests that we should be using gamma 2.4 for BT709
@@ -686,6 +685,11 @@
 ColorTransformInternal::ColorTransformInternal(const ColorSpace& from,
                                                const ColorSpace& to,
                                                Intent intent) {
+  // If no source color space is specified, do no transformation.
+  // TODO(ccameron): We may want to assume sRGB at some point in the future.
+  if (!from.IsValid())
+    return;
+
   ScopedQcmsProfile from_profile = GetQCMSProfileIfAvailable(from);
   ScopedQcmsProfile to_profile = GetQCMSProfileIfAvailable(to);
   bool has_from_profile = !!from_profile;
diff --git a/ui/gfx/color_transform_unittest.cc b/ui/gfx/color_transform_unittest.cc
index 5a888267..e566ff9 100644
--- a/ui/gfx/color_transform_unittest.cc
+++ b/ui/gfx/color_transform_unittest.cc
@@ -39,7 +39,6 @@
 
 ColorSpace::MatrixID all_matrices[] = {
     ColorSpace::MatrixID::RGB, ColorSpace::MatrixID::BT709,
-    ColorSpace::MatrixID::UNSPECIFIED, ColorSpace::MatrixID::RESERVED,
     ColorSpace::MatrixID::FCC, ColorSpace::MatrixID::BT470BG,
     ColorSpace::MatrixID::SMPTE170M, ColorSpace::MatrixID::SMPTE240M,
 
@@ -51,8 +50,7 @@
     ColorSpace::MatrixID::YDZDX,
 };
 
-ColorSpace::RangeID all_ranges[] = {ColorSpace::RangeID::UNSPECIFIED,
-                                    ColorSpace::RangeID::FULL,
+ColorSpace::RangeID all_ranges[] = {ColorSpace::RangeID::FULL,
                                     ColorSpace::RangeID::LIMITED,
                                     ColorSpace::RangeID::DERIVED};
 
@@ -194,8 +192,10 @@
   EXPECT_NEAR(tmp.z(), 1.0f, kEpsilon);
 }
 
-TEST(SimpleColorSpace, UnknownToSRGB) {
-  ColorSpace unknown;
+TEST(SimpleColorSpace, UnknownVideoToSRGB) {
+  // Invalid video spaces should be BT709.
+  ColorSpace unknown = gfx::ColorSpace::CreateVideo(
+      -1, -1, -1, gfx::ColorSpace::RangeID::LIMITED);
   ColorSpace sRGB = ColorSpace::CreateSRGB();
   std::unique_ptr<ColorTransform> t(ColorTransform::NewColorTransform(
       unknown, sRGB, ColorTransform::Intent::INTENT_PERCEPTUAL));
@@ -219,6 +219,19 @@
   EXPECT_GT(tmp.z(), tmp.y());
 }
 
+TEST(SimpleColorSpace, DefaultToSRGB) {
+  // The default value should do no transformation, regardless of destination.
+  ColorSpace unknown;
+  std::unique_ptr<ColorTransform> t1(ColorTransform::NewColorTransform(
+      unknown, ColorSpace::CreateSRGB(),
+      ColorTransform::Intent::INTENT_PERCEPTUAL));
+  EXPECT_EQ(t1->NumberOfStepsForTesting(), 0u);
+  std::unique_ptr<ColorTransform> t2(ColorTransform::NewColorTransform(
+      unknown, ColorSpace::CreateXYZD50(),
+      ColorTransform::Intent::INTENT_PERCEPTUAL));
+  EXPECT_EQ(t2->NumberOfStepsForTesting(), 0u);
+}
+
 class TransferTest : public testing::TestWithParam<ColorSpace::TransferID> {};
 
 TEST_P(TransferTest, basicTest) {
diff --git a/ui/gl/OWNERS b/ui/gl/OWNERS
index 476d779..ff0f6be 100644
--- a/ui/gl/OWNERS
+++ b/ui/gl/OWNERS
@@ -5,3 +5,5 @@
 per-file *_ozone*=alexst@chromium.org
 per-file *_ozone*=dnicoara@chromium.org
 per-file *_ozone*=spang@chromium.org
+
+# COMPONENT: Internals>GPU
diff --git a/ui/gl/gl_surface_egl.cc b/ui/gl/gl_surface_egl.cc
index c17892f..444ae10 100644
--- a/ui/gl/gl_surface_egl.cc
+++ b/ui/gl/gl_surface_egl.cc
@@ -31,6 +31,7 @@
 #include "ui/gl/gl_surface_stub.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/gl/scoped_make_current.h"
+#include "ui/gl/sync_control_vsync_provider.h"
 
 #if defined(USE_X11) && !defined(OS_CHROMEOS)
 extern "C" {
@@ -136,6 +137,41 @@
 bool g_egl_surface_orientation_supported = false;
 bool g_use_direct_composition = false;
 
+class EGLSyncControlVSyncProvider : public SyncControlVSyncProvider {
+ public:
+  explicit EGLSyncControlVSyncProvider(EGLSurface surface)
+      : SyncControlVSyncProvider(),
+        surface_(surface) {
+  }
+
+  ~EGLSyncControlVSyncProvider() override {}
+
+ protected:
+  bool GetSyncValues(int64_t* system_time,
+                     int64_t* media_stream_counter,
+                     int64_t* swap_buffer_counter) override {
+    uint64_t u_system_time, u_media_stream_counter, u_swap_buffer_counter;
+    bool result = eglGetSyncValuesCHROMIUM(
+        g_display, surface_, &u_system_time,
+        &u_media_stream_counter, &u_swap_buffer_counter) == EGL_TRUE;
+    if (result) {
+      *system_time = static_cast<int64_t>(u_system_time);
+      *media_stream_counter = static_cast<int64_t>(u_media_stream_counter);
+      *swap_buffer_counter = static_cast<int64_t>(u_swap_buffer_counter);
+    }
+    return result;
+  }
+
+  bool GetMscRate(int32_t* numerator, int32_t* denominator) override {
+    return false;
+  }
+
+ private:
+  EGLSurface surface_;
+
+  DISALLOW_COPY_AND_ASSIGN(EGLSyncControlVSyncProvider);
+};
+
 EGLDisplay GetPlatformANGLEDisplay(EGLNativeDisplayType native_display,
                                    EGLenum platform_type,
                                    bool warpDevice) {
@@ -431,31 +467,6 @@
   }
 }
 
-EGLSyncControlVSyncProvider::EGLSyncControlVSyncProvider(EGLSurface surface)
-    : SyncControlVSyncProvider(), surface_(surface) {}
-
-EGLSyncControlVSyncProvider::~EGLSyncControlVSyncProvider() {}
-
-bool EGLSyncControlVSyncProvider::GetSyncValues(int64_t* system_time,
-                                                int64_t* media_stream_counter,
-                                                int64_t* swap_buffer_counter) {
-  uint64_t u_system_time, u_media_stream_counter, u_swap_buffer_counter;
-  bool result = eglGetSyncValuesCHROMIUM(g_display, surface_, &u_system_time,
-                                         &u_media_stream_counter,
-                                         &u_swap_buffer_counter) == EGL_TRUE;
-  if (result) {
-    *system_time = static_cast<int64_t>(u_system_time);
-    *media_stream_counter = static_cast<int64_t>(u_media_stream_counter);
-    *swap_buffer_counter = static_cast<int64_t>(u_swap_buffer_counter);
-  }
-  return result;
-}
-
-bool EGLSyncControlVSyncProvider::GetMscRate(int32_t* numerator,
-                                             int32_t* denominator) {
-  return false;
-}
-
 GLSurfaceEGL::GLSurfaceEGL() {}
 
 GLSurfaceFormat GLSurfaceEGL::GetFormat() {
@@ -654,8 +665,10 @@
     }
 
     // Init ANGLE platform now that we have the global display.
-    if (!InitializeANGLEPlatform(display)) {
-      LOG(ERROR) << "ANGLE Platform initialization failed.";
+    if (supports_angle_d3d || supports_angle_opengl || supports_angle_null) {
+      if (!InitializeANGLEPlatform(display)) {
+        LOG(ERROR) << "ANGLE Platform initialization failed.";
+      }
     }
 
     if (!eglInitialize(display, nullptr, nullptr)) {
diff --git a/ui/gl/gl_surface_egl.h b/ui/gl/gl_surface_egl.h
index cf10a1c..d9caa8fe 100644
--- a/ui/gl/gl_surface_egl.h
+++ b/ui/gl/gl_surface_egl.h
@@ -24,7 +24,6 @@
 #include "ui/gl/gl_export.h"
 #include "ui/gl/gl_surface.h"
 #include "ui/gl/gl_surface_overlay.h"
-#include "ui/gl/sync_control_vsync_provider.h"
 
 namespace gl {
 
@@ -48,25 +47,6 @@
                                   const base::CommandLine* command_line,
                                   std::vector<DisplayType>* init_displays);
 
-// VSync provider for EGL surface;
-class GL_EXPORT EGLSyncControlVSyncProvider : public SyncControlVSyncProvider {
- public:
-  explicit EGLSyncControlVSyncProvider(EGLSurface surface);
-  ~EGLSyncControlVSyncProvider() override;
-
- protected:
-  bool GetSyncValues(int64_t* system_time,
-                     int64_t* media_stream_counter,
-                     int64_t* swap_buffer_counter) override;
-
-  bool GetMscRate(int32_t* numerator, int32_t* denominator) override;
-
- private:
-  EGLSurface surface_;
-
-  DISALLOW_COPY_AND_ASSIGN(EGLSyncControlVSyncProvider);
-};
-
 // Interface for EGL surface.
 class GL_EXPORT GLSurfaceEGL : public GLSurface {
  public:
diff --git a/ui/gl/sync_control_vsync_provider.cc b/ui/gl/sync_control_vsync_provider.cc
index e181d70e..f9dc5c5 100644
--- a/ui/gl/sync_control_vsync_provider.cc
+++ b/ui/gl/sync_control_vsync_provider.cc
@@ -11,7 +11,7 @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 
-#if defined(OS_LINUX) || defined(OS_WIN)
+#if defined(OS_LINUX)
 // These constants define a reasonable range for a calculated refresh interval.
 // Calculating refreshes out of this range will be considered a fatal error.
 const int64_t kMinVsyncIntervalUs = base::Time::kMicrosecondsPerSecond / 400;
@@ -21,17 +21,17 @@
 // we think the latest computed interval is invalid (noisey due to
 // monitor configuration change, moving a window between monitors, etc.).
 const double kRelativeIntervalDifferenceThreshold = 0.05;
-#endif  // defined(OS_LINUX) || defined(OS_WIN)
+#endif
 
 namespace gl {
 
 SyncControlVSyncProvider::SyncControlVSyncProvider() : gfx::VSyncProvider() {
-#if defined(OS_LINUX) || defined(OS_WIN)
+#if defined(OS_LINUX)
   // On platforms where we can't get an accurate reading on the refresh
   // rate we fall back to the assumption that we're displaying 60 frames
   // per second.
   last_good_interval_ = base::TimeDelta::FromSeconds(1) / 60;
-#endif  // defined(OS_LINUX) || defined(OS_WIN)
+#endif
 }
 
 SyncControlVSyncProvider::~SyncControlVSyncProvider() {}
@@ -39,113 +39,8 @@
 void SyncControlVSyncProvider::GetVSyncParameters(
     const UpdateVSyncCallback& callback) {
   TRACE_EVENT0("gpu", "SyncControlVSyncProvider::GetVSyncParameters");
-#if defined(OS_LINUX) || defined(OS_WIN)
-  base::TimeTicks timebase;
-
-  int64_t system_time;
-  int64_t media_stream_counter;
-  int64_t swap_buffer_counter;
-  if (!GetSyncValues(&system_time, &media_stream_counter, &swap_buffer_counter))
-    return;
-
-  if (media_stream_counter == last_media_stream_counter_) {
-    // SyncValues haven't updated, there is no reason to invoke the callback.
-    return;
-  }
-
-  // Perform platform specific adjustment of |system_time| and
-  // |media_stream_counter|.
-  if (!AdjustSyncValues(&system_time, &media_stream_counter))
-    return;
-
-  timebase = base::TimeTicks::FromInternalValue(system_time);
-
-  // Only need the previous calculated interval for our filtering.
-  while (last_computed_intervals_.size() > 1)
-    last_computed_intervals_.pop();
-
-  base::TimeDelta timebase_diff;
-  int64_t counter_diff = 0;
-
-  int32_t numerator, denominator;
-  if (GetMscRate(&numerator, &denominator) && numerator) {
-    timebase_diff = base::TimeDelta::FromSeconds(denominator);
-    counter_diff = numerator;
-  } else if (!last_timebase_.is_null()) {
-    timebase_diff = timebase - last_timebase_;
-    counter_diff = media_stream_counter - last_media_stream_counter_;
-  }
-
-  if (counter_diff > 0 && timebase_diff > base::TimeDelta()) {
-    last_computed_intervals_.push(timebase_diff / counter_diff);
-
-    if (last_computed_intervals_.size() == 2) {
-      const base::TimeDelta& old_interval = last_computed_intervals_.front();
-      const base::TimeDelta& new_interval = last_computed_intervals_.back();
-
-      double relative_change = fabs(old_interval.InMillisecondsF() -
-                                    new_interval.InMillisecondsF()) /
-                               new_interval.InMillisecondsF();
-      if (relative_change < kRelativeIntervalDifferenceThreshold) {
-        if (new_interval.InMicroseconds() < kMinVsyncIntervalUs ||
-            new_interval.InMicroseconds() > kMaxVsyncIntervalUs) {
-#if defined(OS_WIN) || defined(USE_ASH)
-          // On ash platforms (ChromeOS essentially), the real refresh interval
-          // is queried from XRandR, regardless of the value calculated here,
-          // and this value is overriden by ui::CompositorVSyncManager.  The log
-          // should not be fatal in this case. Reconsider all this when XRandR
-          // support is added to non-ash platforms.
-          // http://crbug.com/340851
-          // On Windows |system_time| is based on QPC and it seems it may
-          // produce invalid value after a suspend/resume cycle.
-          // http://crbug.com/656469
-          LOG(ERROR)
-#else
-          LOG(FATAL)
-#endif  // OS_WIN || USE_ASH
-              << "Calculated bogus refresh interval="
-              << new_interval.InMicroseconds()
-              << " us, old_interval=" << old_interval.InMicroseconds()
-              << " us, last_timebase_=" << last_timebase_.ToInternalValue()
-              << " us, timebase=" << timebase.ToInternalValue()
-              << " us, timebase_diff=" << timebase_diff.ToInternalValue()
-              << " us, last_timebase_diff_="
-              << last_timebase_diff_.ToInternalValue()
-              << " us, last_media_stream_counter_="
-              << last_media_stream_counter_
-              << ", media_stream_counter=" << media_stream_counter
-              << ", counter_diff=" << counter_diff
-              << ", last_counter_diff_=" << last_counter_diff_;
-        } else {
-          last_good_interval_ = new_interval;
-        }
-      }
-    }
-
-    last_timebase_diff_ = timebase_diff;
-    last_counter_diff_ = counter_diff;
-  }
-
-  last_timebase_ = timebase;
-  last_media_stream_counter_ = media_stream_counter;
-  callback.Run(timebase, last_good_interval_);
-#endif  // defined(OS_LINUX) || defined(OS_WIN)
-}
-
 #if defined(OS_LINUX)
-bool SyncControlVSyncProvider::AdjustSyncValues(int64_t* system_time,
-                                                int64_t* media_stream_counter) {
-  // Both Intel and Mali drivers will return TRUE for GetSyncValues
-  // but a value of 0 for MSC if they cannot access the CRTC data structure
-  // associated with the surface. crbug.com/231945
-  bool prev_invalid_msc = invalid_msc_;
-  invalid_msc_ = (*media_stream_counter == 0);
-  if (invalid_msc_) {
-    LOG_IF(ERROR, !prev_invalid_msc)
-        << "glXGetSyncValuesOML "
-           "should not return TRUE with a media stream counter of 0.";
-    return false;
-  }
+  base::TimeTicks timebase;
 
   // The actual clock used for the system time returned by glXGetSyncValuesOML
   // is unspecified. In practice, the clock used is likely to be either
@@ -154,6 +49,23 @@
   // was produced by the clock whose current time is closest to it, subject
   // to the restriction that the returned time must not be in the future
   // (since it is the time of a vblank that has already occurred).
+  int64_t system_time;
+  int64_t media_stream_counter;
+  int64_t swap_buffer_counter;
+  if (!GetSyncValues(&system_time, &media_stream_counter, &swap_buffer_counter))
+    return;
+
+  // Both Intel and Mali drivers will return TRUE for GetSyncValues
+  // but a value of 0 for MSC if they cannot access the CRTC data structure
+  // associated with the surface. crbug.com/231945
+  bool prev_invalid_msc = invalid_msc_;
+  invalid_msc_ = (media_stream_counter == 0);
+  if (invalid_msc_) {
+    LOG_IF(ERROR, !prev_invalid_msc) << "glXGetSyncValuesOML "
+        "should not return TRUE with a media stream counter of 0.";
+    return;
+  }
+
   struct timespec real_time;
   struct timespec monotonic_time;
   clock_gettime(CLOCK_REALTIME, &real_time);
@@ -169,62 +81,81 @@
   // We need the time according to CLOCK_MONOTONIC, so if we've been given
   // a time from CLOCK_REALTIME, we need to convert.
   bool time_conversion_needed =
-      llabs(*system_time - real_time_in_microseconds) <
-      llabs(*system_time - monotonic_time_in_microseconds);
+      llabs(system_time - real_time_in_microseconds) <
+      llabs(system_time - monotonic_time_in_microseconds);
 
   if (time_conversion_needed)
-    *system_time += monotonic_time_in_microseconds - real_time_in_microseconds;
-
-  // Return if |*system_time| is more than 1 frames in the future.
-  int64_t interval_in_microseconds = last_good_interval_.InMicroseconds();
-  if (*system_time > monotonic_time_in_microseconds + interval_in_microseconds)
-    return false;
-
-  // If |system_time| is slightly in the future, adjust it to the previous
-  // frame and use the last frame counter to prevent issues in the callback.
-  if (*system_time > monotonic_time_in_microseconds) {
-    *system_time -= interval_in_microseconds;
-    (*media_stream_counter)--;
-  }
-  if (monotonic_time_in_microseconds - *system_time >
-      base::Time::kMicrosecondsPerSecond)
-    return false;
-
-  return true;
-}
-#endif  // defined(OS_LINUX)
-
-#if defined(OS_WIN)
-bool SyncControlVSyncProvider::AdjustSyncValues(int64_t* system_time,
-                                                int64_t* media_stream_counter) {
-  // Zero MSC is returned once when switching between windowed and full screen
-  // modes.
-  if (*media_stream_counter == 0)
-    return false;
-
-  // The actual clock used for the system time returned by glXGetSyncValuesEGL
-  // is unspecified. In practice, the clock comes from QueryPerformanceCounter.
-  LARGE_INTEGER perf_counter_now = {};
-  ::QueryPerformanceCounter(&perf_counter_now);
-  int64_t qpc_now =
-      base::TimeDelta::FromQPCValue(perf_counter_now.QuadPart).InMicroseconds();
+    system_time += monotonic_time_in_microseconds - real_time_in_microseconds;
 
   // Return if |system_time| is more than 1 frames in the future.
   int64_t interval_in_microseconds = last_good_interval_.InMicroseconds();
-  if (*system_time > qpc_now + interval_in_microseconds)
-    return false;
+  if (system_time > monotonic_time_in_microseconds + interval_in_microseconds)
+    return;
 
   // If |system_time| is slightly in the future, adjust it to the previous
   // frame and use the last frame counter to prevent issues in the callback.
-  if (*system_time > qpc_now) {
-    *system_time -= interval_in_microseconds;
-    (*media_stream_counter)--;
+  if (system_time > monotonic_time_in_microseconds) {
+    system_time -= interval_in_microseconds;
+    media_stream_counter--;
   }
-  if (qpc_now - *system_time > base::Time::kMicrosecondsPerSecond)
-    return false;
+  if (monotonic_time_in_microseconds - system_time >
+      base::Time::kMicrosecondsPerSecond)
+    return;
 
-  return true;
+  timebase = base::TimeTicks::FromInternalValue(system_time);
+
+  // Only need the previous calculated interval for our filtering.
+  while (last_computed_intervals_.size() > 1)
+    last_computed_intervals_.pop();
+
+  int32_t numerator, denominator;
+  if (GetMscRate(&numerator, &denominator) && numerator) {
+    last_computed_intervals_.push(base::TimeDelta::FromSeconds(denominator) /
+                                  numerator);
+  } else if (!last_timebase_.is_null()) {
+    base::TimeDelta timebase_diff = timebase - last_timebase_;
+    int64_t counter_diff = media_stream_counter - last_media_stream_counter_;
+    if (counter_diff > 0 && timebase > last_timebase_)
+      last_computed_intervals_.push(timebase_diff / counter_diff);
+  }
+
+  if (last_computed_intervals_.size() == 2) {
+    const base::TimeDelta& old_interval = last_computed_intervals_.front();
+    const base::TimeDelta& new_interval = last_computed_intervals_.back();
+
+    double relative_change =
+        fabs(old_interval.InMillisecondsF() - new_interval.InMillisecondsF()) /
+        new_interval.InMillisecondsF();
+    if (relative_change < kRelativeIntervalDifferenceThreshold) {
+      if (new_interval.InMicroseconds() < kMinVsyncIntervalUs ||
+          new_interval.InMicroseconds() > kMaxVsyncIntervalUs) {
+#if defined(USE_ASH)
+        // On ash platforms (ChromeOS essentially), the real refresh interval is
+        // queried from XRandR, regardless of the value calculated here, and
+        // this value is overriden by ui::CompositorVSyncManager.  The log
+        // should not be fatal in this case. Reconsider all this when XRandR
+        // support is added to non-ash platforms.
+        // http://crbug.com/340851
+        LOG(ERROR)
+#else
+        LOG(FATAL)
+#endif  // USE_ASH
+            << "Calculated bogus refresh interval="
+            << new_interval.InMicroseconds()
+            << " us., last_timebase_=" << last_timebase_.ToInternalValue()
+            << " us., timebase=" << timebase.ToInternalValue()
+            << " us., last_media_stream_counter_=" << last_media_stream_counter_
+            << ", media_stream_counter=" << media_stream_counter;
+      } else {
+        last_good_interval_ = new_interval;
+      }
+    }
+  }
+
+  last_timebase_ = timebase;
+  last_media_stream_counter_ = media_stream_counter;
+  callback.Run(timebase, last_good_interval_);
+#endif  // defined(OS_LINUX)
 }
-#endif  // defined(OS_WIN)
 
 }  // namespace gl
diff --git a/ui/gl/sync_control_vsync_provider.h b/ui/gl/sync_control_vsync_provider.h
index 19d4a33..9e19653 100644
--- a/ui/gl/sync_control_vsync_provider.h
+++ b/ui/gl/sync_control_vsync_provider.h
@@ -11,13 +11,12 @@
 
 #include "base/macros.h"
 #include "ui/gfx/vsync_provider.h"
-#include "ui/gl/gl_export.h"
 
 namespace gl {
 
 // Base class for providers based on extensions like GLX_OML_sync_control and
 // EGL_CHROMIUM_sync_control.
-class GL_EXPORT SyncControlVSyncProvider : public gfx::VSyncProvider {
+class SyncControlVSyncProvider : public gfx::VSyncProvider {
  public:
   SyncControlVSyncProvider();
   ~SyncControlVSyncProvider() override;
@@ -32,24 +31,17 @@
   virtual bool GetMscRate(int32_t* numerator, int32_t* denominator) = 0;
 
  private:
-#if defined(OS_LINUX) || defined(OS_WIN)
-  bool AdjustSyncValues(int64_t* system_time, int64_t* media_stream_counter);
-
+#if defined(OS_LINUX)
   base::TimeTicks last_timebase_;
-  base::TimeDelta last_timebase_diff_;
-  int64_t last_media_stream_counter_ = 0;
-  int64_t last_counter_diff_ = 0;
+  uint64_t last_media_stream_counter_ = 0;
   base::TimeDelta last_good_interval_;
+  bool invalid_msc_ = false;
 
   // A short history of the last few computed intervals.
   // We use this to filter out the noise in the computation resulting
   // from configuration change (monitor reconfiguration, moving windows
   // between monitors, suspend and resume, etc.).
   std::queue<base::TimeDelta> last_computed_intervals_;
-#endif  //  defined(OS_LINUX) || defined(OS_WIN)
-
-#if defined(OS_LINUX)
-  bool invalid_msc_ = false;
 #endif  // defined(OS_LINUX)
 
   DISALLOW_COPY_AND_ASSIGN(SyncControlVSyncProvider);
diff --git a/ui/ozone/platform/drm/gpu/drm_device.cc b/ui/ozone/platform/drm/gpu/drm_device.cc
index 438edaf..fc2d556 100644
--- a/ui/ozone/platform/drm/gpu/drm_device.cc
+++ b/ui/ozone/platform/drm/gpu/drm_device.cc
@@ -352,7 +352,7 @@
 class DrmDevice::IOWatcher : public base::MessagePumpLibevent::Watcher {
  public:
   IOWatcher(int fd, DrmDevice::PageFlipManager* page_flip_manager)
-      : page_flip_manager_(page_flip_manager), fd_(fd) {
+      : page_flip_manager_(page_flip_manager), controller_(FROM_HERE), fd_(fd) {
     Register();
   }
 
diff --git a/ui/ozone/platform/wayland/fake_server.cc b/ui/ozone/platform/wayland/fake_server.cc
index 2b84d05..916e7c2d 100644
--- a/ui/ozone/platform/wayland/fake_server.cc
+++ b/ui/ozone/platform/wayland/fake_server.cc
@@ -355,7 +355,8 @@
       pause_event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
                    base::WaitableEvent::InitialState::NOT_SIGNALED),
       resume_event_(base::WaitableEvent::ResetPolicy::AUTOMATIC,
-                    base::WaitableEvent::InitialState::NOT_SIGNALED) {}
+                    base::WaitableEvent::InitialState::NOT_SIGNALED),
+      controller_(FROM_HERE) {}
 
 FakeServer::~FakeServer() {
   Resume();
diff --git a/ui/ozone/platform/wayland/wayland_connection.cc b/ui/ozone/platform/wayland/wayland_connection.cc
index 6db7a8f6..78ba2026 100644
--- a/ui/ozone/platform/wayland/wayland_connection.cc
+++ b/ui/ozone/platform/wayland/wayland_connection.cc
@@ -25,7 +25,7 @@
 const uint32_t kMaxXdgShellVersion = 1;
 }  // namespace
 
-WaylandConnection::WaylandConnection() {}
+WaylandConnection::WaylandConnection() : controller_(FROM_HERE) {}
 
 WaylandConnection::~WaylandConnection() {}
 
diff --git a/ui/surface/OWNERS b/ui/surface/OWNERS
index 8e808054..edfe7e6 100644
--- a/ui/surface/OWNERS
+++ b/ui/surface/OWNERS
@@ -2,3 +2,5 @@
 kbr@chromium.org
 piman@chromium.org
 pinkerton@chromium.org
+
+# COMPONENT: UI
diff --git a/ui/views/widget/native_widget_mac_accessibility_unittest.mm b/ui/views/widget/native_widget_mac_accessibility_unittest.mm
index f7d373665..7d26ab83 100644
--- a/ui/views/widget/native_widget_mac_accessibility_unittest.mm
+++ b/ui/views/widget/native_widget_mac_accessibility_unittest.mm
@@ -418,6 +418,31 @@
   // Make sure the cursor is at the end of the replacement.
   EXPECT_EQ(gfx::Range(front.length() + replacement.length()),
             textfield->GetSelectedRange());
+
+  // Check it's not possible to change the selection range when read-only. Note
+  // that this behavior is inconsistent with Cocoa - selections can be set via
+  // a11y in selectable NSTextfields (unless they are password fields).
+  // https://crbug.com/692362
+  textfield->SetReadOnly(true);
+  EXPECT_FALSE([ax_node accessibilityIsAttributeSettable:
+                            NSAccessibilitySelectedTextRangeAttribute]);
+  textfield->SetReadOnly(false);
+  EXPECT_TRUE([ax_node accessibilityIsAttributeSettable:
+                           NSAccessibilitySelectedTextRangeAttribute]);
+
+  // Change the selection to a valid range within the text.
+  [ax_node accessibilitySetValue:[NSValue valueWithRange:NSMakeRange(2, 5)]
+                    forAttribute:NSAccessibilitySelectedTextRangeAttribute];
+  EXPECT_EQ(gfx::Range(2, 7), textfield->GetSelectedRange());
+  // If the length is longer than the value length, default to the max possible.
+  [ax_node accessibilitySetValue:[NSValue valueWithRange:NSMakeRange(0, 1000)]
+                    forAttribute:NSAccessibilitySelectedTextRangeAttribute];
+  EXPECT_EQ(gfx::Range(0, textfield->text().length()),
+            textfield->GetSelectedRange());
+  // Check just moving the cursor works, too.
+  [ax_node accessibilitySetValue:[NSValue valueWithRange:NSMakeRange(5, 0)]
+                    forAttribute:NSAccessibilitySelectedTextRangeAttribute];
+  EXPECT_EQ(gfx::Range(5, 5), textfield->GetSelectedRange());
 }
 
 // Test performing a 'click' on Views with clickable roles work.