diff --git a/BUILD.gn b/BUILD.gn
index 0a9d56c..e9d1908 100644
--- a/BUILD.gn
+++ b/BUILD.gn

@@ -662,7 +662,6 @@
       "//components/filesystem:filesystem_service_unittests",
       "//components/leveldb:leveldb_service_unittests",
       "//components/metrics:serialization",
-      "//components/password_manager/content/renderer:browser_tests",
       "//components/rappor:unit_tests",
       "//components/sessions:unit_tests",
       "//media/blink:media_blink_unittests",

diff --git a/DEPS b/DEPS
index 8655a59f..09e2b72b 100644
--- a/DEPS
+++ b/DEPS

@@ -82,7 +82,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '6696edd63a12f1a49d7d57547a3c9e2960b6c667',
+  'v8_revision': 'f5b1d1d4f29b238ca2f0a13bf3a7b7067854592d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -102,7 +102,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '208eecfa7850ced5c0d776b9e5df5b104428608f',
+  'pdfium_revision': 'ab384ed5a2c6c05a5d55645b7a50c6c42b613165',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -134,7 +134,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': 'a0b20a4892e20dcd620ac6f821411fa62ee3994b',
+  'catapult_revision': '436908b7d264b36cf00478756f59f109e93e31a5',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -197,7 +197,7 @@
   },
 
   'src/ios/third_party/material_components_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '857c3016cdf4f765263af84f41f027f51091bbc8',
+      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '624dd86aef86bc5892fbc8717b1e2c3e5f3843f0',
       'condition': 'checkout_ios',
   },
 
@@ -207,7 +207,7 @@
   },
 
   'src/ios/third_party/material_internationalization_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-foundation/material-internationalization-ios.git' + '@' + 'fa05ea39c50b232917232c0d6e8b5a34caf7f43f',
+      'url': Var('chromium_git') + '/external/github.com/material-foundation/material-internationalization-ios.git' + '@' + '8f28a55c7f35b95a587bba01a8467ea470647873',
       'condition': 'checkout_ios',
   },
 
@@ -222,17 +222,17 @@
   },
 
   'src/ios/third_party/material_text_accessibility_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-foundation/material-text-accessibility-ios.git' + '@' + '7340b22cc589101ba0b11516afe4f3a733041951',
+      'url': Var('chromium_git') + '/external/github.com/material-foundation/material-text-accessibility-ios.git' + '@' + '92c9e56f4e07622084b3d931247db974fec55dde',
       'condition': 'checkout_ios',
   },
 
   'src/ios/third_party/motion_interchange_objc/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-motion/motion-interchange-objc.git' + '@' + '26d91bf724adec6880cbc83a95d4cb4fb94847b6',
+      'url': Var('chromium_git') + '/external/github.com/material-motion/motion-interchange-objc.git' + '@' + '9be1e8572f8debb8dd9033ce9bd6ae56dc7ae1ab',
       'condition': 'checkout_ios',
   },
 
   'src/ios/third_party/motion_animator_objc/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-motion/motion-animator-objc.git' + '@' + '60cf5680f1df8b181299c04ba22c32e388a7f0ba',
+      'url': Var('chromium_git') + '/external/github.com/material-motion/motion-animator-objc.git' + '@' + 'f31562c64954525d21b74bc638bd5b7625a32d20',
       'condition': 'checkout_ios',
   },
 

diff --git a/base/BUILD.gn b/base/BUILD.gn
index 1e09a0bb..0150c15 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn

@@ -1765,8 +1765,6 @@
   sources = [
     "base_switches.cc",
     "base_switches.h",
-    "task_scheduler/switches.cc",
-    "task_scheduler/switches.h",
   ]
 
   if (is_win) {

diff --git a/base/task_scheduler/switches.cc b/base/task_scheduler/switches.cc
deleted file mode 100644
index 4dd3bbc..0000000
--- a/base/task_scheduler/switches.cc
+++ /dev/null

@@ -1,12 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/task_scheduler/switches.h"
-
-namespace switches {
-
-const char kDisableBrowserTaskScheduler[] = "disable-browser-task-scheduler";
-const char kEnableBrowserTaskScheduler[] = "enable-browser-task-scheduler";
-
-}  // namespace switches

diff --git a/base/task_scheduler/switches.h b/base/task_scheduler/switches.h
deleted file mode 100644
index 967c726..0000000
--- a/base/task_scheduler/switches.h
+++ /dev/null

@@ -1,15 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_TASK_SCHEDULER_SWITCHES_H_
-#define BASE_TASK_SCHEDULER_SWITCHES_H_
-
-namespace switches {
-
-extern const char kDisableBrowserTaskScheduler[];
-extern const char kEnableBrowserTaskScheduler[];
-
-}  // namespace switches
-
-#endif  // BASE_TASK_SCHEDULER_SWITCHES_H_

diff --git a/build/android/gyp/create_dist_jar.py b/build/android/gyp/create_dist_jar.py
index 2206cc6..2e06478 100755
--- a/build/android/gyp/create_dist_jar.py
+++ b/build/android/gyp/create_dist_jar.py

@@ -6,24 +6,21 @@
 
 """Merges a list of jars into a single jar."""
 
-import optparse
+import argparse
 import sys
 
 from util import build_utils
 
+
 def main(args):
   args = build_utils.ExpandFileArgs(args)
-  parser = optparse.OptionParser()
+  parser = argparse.ArgumentParser()
   build_utils.AddDepfileOption(parser)
-  parser.add_option('--output', help='Path to output jar.')
-  parser.add_option('--inputs', action='append', help='List of jar inputs.')
-  options, _ = parser.parse_args(args)
-  build_utils.CheckOptions(options, parser, ['output', 'inputs'])
+  parser.add_argument('--output', required=True, help='Path to output jar.')
+  parser.add_argument('--jars', required=True, help='GN list of jar inputs.')
+  options = parser.parse_args(args)
 
-  input_jars = []
-  for inputs_arg in options.inputs:
-    input_jars.extend(build_utils.ParseGnList(inputs_arg))
-
+  input_jars = build_utils.ParseGnList(options.jars)
   build_utils.MergeZips(options.output, input_jars)
 
   if options.depfile:
@@ -31,4 +28,4 @@
 
 
 if __name__ == '__main__':
-  sys.exit(main(sys.argv[1:]))
+  main(sys.argv[1:])

diff --git a/build/android/gyp/write_build_config.py b/build/android/gyp/write_build_config.py
index a77532c..5b40ada 100755
--- a/build/android/gyp/write_build_config.py
+++ b/build/android/gyp/write_build_config.py

@@ -697,7 +697,6 @@
         p for p in deps_dex_files if not p in tested_apk_deps_dex_files]
 
   if options.proguard_configs:
-    assert options.type == 'java_library'
     deps_info['proguard_configs'] = (
         build_utils.ParseGnList(options.proguard_configs))
 
@@ -707,14 +706,14 @@
     config['proguard'] = {}
     proguard_config = config['proguard']
     extra_jars = []
-    lib_configs = []
+    all_configs = deps_info.get('proguard_configs', [])
     for c in all_library_deps:
       extra_jars.extend(
           p for p in c.get('extra_classpath_jars', []) if p not in extra_jars)
-      lib_configs.extend(
-          p for p in c.get('proguard_configs', []) if p not in lib_configs)
-    proguard_config['lib_paths'] = extra_jars
-    proguard_config['lib_configs'] = lib_configs
+      all_configs.extend(
+          p for p in c.get('proguard_configs', []) if p not in all_configs)
+    proguard_config['extra_jars'] = extra_jars
+    proguard_config['all_configs'] = all_configs
 
   # Dependencies for the final dex file of an apk.
   if options.type == 'android_apk':

diff --git a/build/config/android/internal_rules.gni b/build/config/android/internal_rules.gni
index cf2f7f1..0084ccc 100644
--- a/build/config/android/internal_rules.gni
+++ b/build/config/android/internal_rules.gni

@@ -52,13 +52,13 @@
 # See build/android/gyp/write_build_config.py and
 # build/android/gyp/util/build_utils.py:ExpandFileArgs
 template("write_build_config") {
-  type = invoker.type
+  _type = invoker.type
 
   # Don't need to enforce naming scheme for these targets since we never
   # consider them in dependency chains.
-  if (type != "android_apk" && type != "java_binary" &&
-      type != "resource_rewriter" && type != "dist_jar" &&
-      type != "java_annotation_processor") {
+  if (_type != "android_apk" && _type != "java_binary" &&
+      _type != "resource_rewriter" && _type != "dist_jar" &&
+      _type != "java_annotation_processor") {
     set_sources_assignment_filter(_java_target_whitelist)
     _parent_invoker = invoker.invoker
     _target_label =
@@ -80,15 +80,6 @@
   }
 
   action(target_name) {
-    set_sources_assignment_filter([])
-    build_config = invoker.build_config
-
-    assert(type == "android_apk" || type == "java_library" ||
-           type == "android_resources" || type == "dist_jar" ||
-           type == "android_assets" || type == "resource_rewriter" ||
-           type == "java_binary" || type == "group" || type == "junit_binary" ||
-           type == "java_annotation_processor")
-
     forward_variables_from(invoker,
                            [
                              "deps",
@@ -104,6 +95,9 @@
     script = "//build/android/gyp/write_build_config.py"
     depfile = "$target_gen_dir/$target_name.d"
     inputs = []
+    outputs = [
+      invoker.build_config,
+    ]
 
     _deps_configs = []
     if (defined(invoker.possible_config_deps)) {
@@ -128,46 +122,18 @@
         }
         sources = []
       }
-      set_sources_assignment_filter([])
     }
     _rebased_deps_configs = rebase_path(_deps_configs, root_build_dir)
 
-    outputs = [
-      build_config,
-    ]
-
     args = [
-      "--type",
-      type,
+      "--type=$_type",
       "--depfile",
       rebase_path(depfile, root_build_dir),
       "--deps-configs=$_rebased_deps_configs",
       "--build-config",
-      rebase_path(build_config, root_build_dir),
+      rebase_path(invoker.build_config, root_build_dir),
     ]
 
-    is_apk = type == "android_apk"
-    is_android_assets = type == "android_assets"
-    is_android_resources = type == "android_resources"
-    is_group = type == "group"
-
-    supports_android = is_android_assets || is_android_resources
-    if (defined(invoker.supports_android)) {
-      supports_android = invoker.supports_android
-    }
-    requires_android = is_android_assets || is_android_resources
-    if (defined(invoker.requires_android)) {
-      requires_android = invoker.requires_android
-    }
-
-    assert(!requires_android || supports_android,
-           "requires_android requires" + " supports_android")
-
-    # Mark these variables as used.
-    assert(is_apk || true)
-    assert(is_android_resources || true)
-    assert(is_group || true)
-
     if (defined(invoker.jar_path)) {
       args += [
         "--jar-path",
@@ -212,10 +178,10 @@
         rebase_path(invoker.dex_path, root_build_dir),
       ]
     }
-    if (supports_android) {
+    if (defined(invoker.supports_android) && invoker.supports_android) {
       args += [ "--supports-android" ]
     }
-    if (requires_android) {
+    if (defined(invoker.requires_android) && invoker.requires_android) {
       args += [ "--requires-android" ]
     }
     if (defined(invoker.is_prebuilt) && invoker.is_prebuilt) {
@@ -239,27 +205,26 @@
       ]
     }
 
-    if (is_android_assets) {
-      if (defined(invoker.asset_sources)) {
-        _rebased_asset_sources =
-            rebase_path(invoker.asset_sources, root_build_dir)
-        args += [ "--asset-sources=$_rebased_asset_sources" ]
-      }
-      if (defined(invoker.asset_renaming_sources)) {
-        _rebased_asset_renaming_sources =
-            rebase_path(invoker.asset_renaming_sources, root_build_dir)
-        args += [ "--asset-renaming-sources=$_rebased_asset_renaming_sources" ]
+    if (defined(invoker.asset_sources)) {
+      _rebased_asset_sources =
+          rebase_path(invoker.asset_sources, root_build_dir)
+      args += [ "--asset-sources=$_rebased_asset_sources" ]
+    }
+    if (defined(invoker.asset_renaming_sources)) {
+      _rebased_asset_renaming_sources =
+          rebase_path(invoker.asset_renaming_sources, root_build_dir)
+      args += [ "--asset-renaming-sources=$_rebased_asset_renaming_sources" ]
 
-        # These are zip paths, so no need to rebase.
-        args += [ "--asset-renaming-destinations=${invoker.asset_renaming_destinations}" ]
-      }
-      if (defined(invoker.disable_compression) && invoker.disable_compression) {
-        args += [ "--disable-asset-compression" ]
-      }
-      if (defined(invoker.treat_as_locale_paks) &&
-          invoker.treat_as_locale_paks) {
-        args += [ "--treat-as-locale-paks" ]
-      }
+      # These are zip paths, so no need to rebase.
+      args += [
+        "--asset-renaming-destinations=${invoker.asset_renaming_destinations}",
+      ]
+    }
+    if (defined(invoker.disable_compression) && invoker.disable_compression) {
+      args += [ "--disable-asset-compression" ]
+    }
+    if (defined(invoker.treat_as_locale_paks) && invoker.treat_as_locale_paks) {
+      args += [ "--treat-as-locale-paks" ]
     }
 
     if (defined(invoker.android_manifest)) {
@@ -269,72 +234,68 @@
         rebase_path(invoker.android_manifest, root_build_dir),
       ]
     }
-    if (is_android_resources || is_apk) {
-      if (defined(invoker.resources_zip)) {
-        args += [
-          "--resources-zip",
-          rebase_path(invoker.resources_zip, root_build_dir),
-        ]
-      }
-      if (defined(invoker.custom_package)) {
-        args += [
-          "--package-name",
-          invoker.custom_package,
-        ]
-      }
-      if (defined(invoker.r_text)) {
-        args += [
-          "--r-text",
-          rebase_path(invoker.r_text, root_build_dir),
-        ]
-      }
+    if (defined(invoker.resources_zip)) {
+      args += [
+        "--resources-zip",
+        rebase_path(invoker.resources_zip, root_build_dir),
+      ]
+    }
+    if (defined(invoker.custom_package)) {
+      args += [
+        "--package-name",
+        invoker.custom_package,
+      ]
+    }
+    if (defined(invoker.r_text)) {
+      args += [
+        "--r-text",
+        rebase_path(invoker.r_text, root_build_dir),
+      ]
     }
 
-    if (is_android_resources && defined(invoker.resource_dirs)) {
+    if (defined(invoker.resource_dirs)) {
       resource_dirs = rebase_path(invoker.resource_dirs, root_build_dir)
       args += [ "--resource-dirs=$resource_dirs" ]
     }
 
-    if (is_apk) {
-      if (defined(invoker.shared_libraries_runtime_deps_file)) {
-        # Don't list shared_libraries_runtime_deps_file as an input in order to
-        # avoid having to depend on the runtime_deps target. See comment in
-        # rules.gni for why we do this.
-        args += [
-          "--shared-libraries-runtime-deps",
-          rebase_path(invoker.shared_libraries_runtime_deps_file,
-                      root_build_dir),
-        ]
-      }
+    if (defined(invoker.shared_libraries_runtime_deps_file)) {
+      # Don't list shared_libraries_runtime_deps_file as an input in order to
+      # avoid having to depend on the runtime_deps target. See comment in
+      # rules.gni for why we do this.
+      args += [
+        "--shared-libraries-runtime-deps",
+        rebase_path(invoker.shared_libraries_runtime_deps_file, root_build_dir),
+      ]
+    }
 
-      if (defined(invoker.secondary_abi_shared_libraries_runtime_deps_file)) {
-        # Don't list secondary_abi_shared_libraries_runtime_deps_file as an
-        # input in order to avoid having to depend on the runtime_deps target.
-        # See comment in rules.gni for why we do this.
-        args += [
-          "--secondary-abi-shared-libraries-runtime-deps",
-          rebase_path(invoker.secondary_abi_shared_libraries_runtime_deps_file,
-                      root_build_dir),
-        ]
-      }
+    if (defined(invoker.secondary_abi_shared_libraries_runtime_deps_file)) {
+      # Don't list secondary_abi_shared_libraries_runtime_deps_file as an
+      # input in order to avoid having to depend on the runtime_deps target.
+      # See comment in rules.gni for why we do this.
+      args += [
+        "--secondary-abi-shared-libraries-runtime-deps",
+        rebase_path(invoker.secondary_abi_shared_libraries_runtime_deps_file,
+                    root_build_dir),
+      ]
+    }
 
-      if (defined(invoker.apk_path)) {
-        _rebased_apk_path = rebase_path(invoker.apk_path, root_build_dir)
-        _rebased_incremental_apk_path =
-            rebase_path(invoker.incremental_apk_path, root_build_dir)
-        _rebased_incremental_install_json_path =
-            rebase_path(invoker.incremental_install_json_path, root_build_dir)
-        _incremental_allowed =
-            defined(invoker.incremental_allowed) && invoker.incremental_allowed
-        args += [ "--apk-path=$_rebased_apk_path" ]
-        args += [ "--incremental-install-json-path=$_rebased_incremental_install_json_path" ]
+    if (defined(invoker.apk_path)) {
+      _rebased_apk_path = rebase_path(invoker.apk_path, root_build_dir)
+      _rebased_incremental_apk_path =
+          rebase_path(invoker.incremental_apk_path, root_build_dir)
+      _rebased_incremental_install_json_path =
+          rebase_path(invoker.incremental_install_json_path, root_build_dir)
+      _incremental_allowed =
+          defined(invoker.incremental_allowed) && invoker.incremental_allowed
+      args += [ "--apk-path=$_rebased_apk_path" ]
+      args += [ "--incremental-install-json-path=$_rebased_incremental_install_json_path" ]
 
-        assert(_rebased_incremental_apk_path != "")  # Mark as used.
-        if (_incremental_allowed) {
-          args += [ "--incremental-apk-path=$_rebased_incremental_apk_path" ]
-        }
+      assert(_rebased_incremental_apk_path != "")  # Mark as used.
+      if (_incremental_allowed) {
+        args += [ "--incremental-apk-path=$_rebased_incremental_apk_path" ]
       }
     }
+
     if (defined(invoker.non_native_packed_relocations) &&
         invoker.non_native_packed_relocations) {
       args += [ "--non-native-packed-relocations" ]

diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 3b1b50fd..3c85a36 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni

@@ -1309,8 +1309,8 @@
   #     "apk".
   #   use_interface_jars: Use all dependent interface .jars rather than
   #     implementation .jars.
+  #   use_unprocessed_jars: Use unprocessed / undesugared .jars.
   #   direct_deps_only: Do not recurse on deps.
-  #   data, deps, testonly, visibility: Usual meaning.
   #   proguard_enabled: Whether to run ProGuard on resulting jar.
   #   proguard_configs: List of proguard configs.
   #   proguard_jar_path: The path to proguard.jar you wish to use. If undefined,
@@ -1322,6 +1322,11 @@
   #     deps = [ ":my_java_lib" ]
   #     output = "$root_build_dir/MyLibrary.jar"
   #   }
+  #   dist_jar("sideloaded_dex") {
+  #     deps = [ ":my_java_lib" ]
+  #     output = "$root_build_dir/MyLibrary.jar"
+  #     dex_path = "$root_build_dir/MyLibrary.dex"
+  #   }
   template("dist_jar") {
     forward_variables_from(invoker, [ "testonly" ])
     _supports_android =
@@ -1332,14 +1337,16 @@
         defined(invoker.proguard_enabled) && invoker.proguard_enabled
     _use_interface_jars =
         defined(invoker.use_interface_jars) && invoker.use_interface_jars
+    _use_unprocessed_jars =
+        defined(invoker.use_unprocessed_jars) && invoker.use_unprocessed_jars
     _direct_deps_only =
         defined(invoker.direct_deps_only) && invoker.direct_deps_only
-    assert(
-        !(_proguard_enabled && _use_interface_jars),
-        "Cannot set both proguard_enabled and use_interface_jars (target=$target_name)")
-    assert(
-        !(_proguard_enabled && _direct_deps_only),
-        "Cannot set both proguard_enabled and direct_deps_only (target=$target_name)")
+    assert(!(_proguard_enabled && _use_interface_jars),
+           "Cannot set both proguard_enabled and use_interface_jars")
+    assert(!(_proguard_enabled && _direct_deps_only),
+           "Cannot set both proguard_enabled and direct_deps_only")
+    assert(!(_use_unprocessed_jars && _use_interface_jars),
+           "Cannot set both use_interface_jars and use_unprocessed_jars")
 
     _jar_target_name = target_name
     if (defined(invoker.dex_path)) {
@@ -1369,7 +1376,11 @@
 
       write_build_config(_build_config_target_name) {
         type = "dist_jar"
-        forward_variables_from(invoker, [ "proguard_enabled" ])
+        forward_variables_from(invoker,
+                               [
+                                 "proguard_enabled",
+                                 "proguard_configs",
+                               ])
         supports_android = _supports_android
         requires_android = _requires_android
         possible_config_deps = _deps
@@ -1383,7 +1394,6 @@
     }
 
     _rebased_build_config = rebase_path(_build_config, root_build_dir)
-
     if (_proguard_enabled) {
       proguard(_jar_target_name) {
         forward_variables_from(invoker,
@@ -1399,15 +1409,10 @@
 
         output_jar_path = invoker.output
         args = [
-          "--proguard-configs=@FileArg($_rebased_build_config:proguard:lib_configs)",
+          "--proguard-configs=@FileArg($_rebased_build_config:proguard:all_configs)",
           "--input-paths=@FileArg($_rebased_build_config:deps_info:java_runtime_classpath)",
-          "--classpath=@FileArg($_rebased_build_config:proguard:lib_paths)",
+          "--classpath=@FileArg($_rebased_build_config:proguard:extra_jars)",
         ]
-        if (defined(invoker.proguard_configs)) {
-          _rebased_proguard_configs =
-              rebase_path(invoker.proguard_configs, root_build_dir)
-          args += [ "--proguard-configs=$_rebased_proguard_configs" ]
-        }
         if (defined(invoker.proguard_config_exclusions)) {
           _rebased_proguard_config_exclusions =
               rebase_path(invoker.proguard_config_exclusions, root_build_dir)
@@ -1440,16 +1445,22 @@
 
         if (_direct_deps_only) {
           if (_use_interface_jars) {
-            args += [ "--inputs=@FileArg($_rebased_build_config:javac:interface_classpath)" ]
-          } else {
+            args += [ "--jars=@FileArg($_rebased_build_config:javac:interface_classpath)" ]
+          } else if (_use_unprocessed_jars) {
             args +=
-                [ "--inputs=@FileArg($_rebased_build_config:javac:classpath)" ]
+                [ "--jars=@FileArg($_rebased_build_config:javac:classpath)" ]
+          } else {
+            assert(
+                false,
+                "direct_deps_only does not work without use_interface_jars or use_unprocessed_jars")
           }
         } else {
           if (_use_interface_jars) {
-            args += [ "--inputs=@FileArg($_rebased_build_config:dist_jar:all_interface_jars)" ]
+            args += [ "--jars=@FileArg($_rebased_build_config:dist_jar:all_interface_jars)" ]
+          } else if (_use_unprocessed_jars) {
+            args += [ "--jars=@FileArg($_rebased_build_config:deps_info:javac_full_classpath)" ]
           } else {
-            args += [ "--inputs=@FileArg($_rebased_build_config:deps_info:java_runtime_classpath)" ]
+            args += [ "--jars=@FileArg($_rebased_build_config:deps_info:java_runtime_classpath)" ]
           }
         }
       }
@@ -2080,6 +2091,13 @@
       proguard_enabled = _proguard_enabled
       if (_proguard_enabled) {
         proguard_info = "$_proguard_output_jar_path.info"
+        proguard_configs = [ _generated_proguard_config ]
+        if (defined(invoker.proguard_configs)) {
+          proguard_configs += invoker.proguard_configs
+        }
+        if (_enable_multidex) {
+          proguard_configs += [ "//build/android/multidex.flags" ]
+        }
       }
       non_native_packed_relocations = _pack_relocations
 
@@ -2116,14 +2134,6 @@
     }
 
     if (_proguard_enabled) {
-      _proguard_configs = [ _generated_proguard_config ]
-      if (defined(invoker.proguard_configs)) {
-        _proguard_configs += invoker.proguard_configs
-      }
-      if (_enable_multidex) {
-        _proguard_configs += [ "//build/android/multidex.flags" ]
-      }
-      assert(_proguard_configs != [])  # Mark as used.
       _proguard_target = "${_template_name}__proguard"
       proguard(_proguard_target) {
         forward_variables_from(invoker,
@@ -2137,18 +2147,15 @@
                  ":$_java_target",
                ]
         inputs = [
-                   _build_config,
-                   _jar_path,
-                 ] + _proguard_configs
+          _build_config,
+          _jar_path,
+        ]
 
         output_jar_path = _proguard_output_jar_path
-        _rebased_proguard_configs =
-            rebase_path(_proguard_configs, root_build_dir)
         args = [
-          "--proguard-configs=$_rebased_proguard_configs",
-          "--proguard-configs=@FileArg($_rebased_build_config:proguard:lib_configs)",
+          "--proguard-configs=@FileArg($_rebased_build_config:proguard:all_configs)",
           "--input-paths=@FileArg($_rebased_build_config:deps_info:java_runtime_classpath)",
-          "--classpath=@FileArg($_rebased_build_config:proguard:lib_paths)",
+          "--classpath=@FileArg($_rebased_build_config:proguard:extra_jars)",
         ]
         if (defined(invoker.proguard_config_exclusions)) {
           _rebased_proguard_config_exclusions =

diff --git a/cc/resources/video_resource_updater.cc b/cc/resources/video_resource_updater.cc
index 34fb091..79b555e 100644
--- a/cc/resources/video_resource_updater.cc
+++ b/cc/resources/video_resource_updater.cc

@@ -82,7 +82,7 @@
     case media::PIXEL_FORMAT_YV12:
     case media::PIXEL_FORMAT_I422:
     case media::PIXEL_FORMAT_I444:
-    case media::PIXEL_FORMAT_YV12A:
+    case media::PIXEL_FORMAT_I420A:
     case media::PIXEL_FORMAT_NV21:
     case media::PIXEL_FORMAT_YUY2:
     case media::PIXEL_FORMAT_RGB24:

diff --git a/cc/scheduler/scheduler.cc b/cc/scheduler/scheduler.cc
index 9dc7584..7438c11 100644
--- a/cc/scheduler/scheduler.cc
+++ b/cc/scheduler/scheduler.cc

@@ -213,6 +213,9 @@
 void Scheduler::BeginMainFrameNotExpectedUntil(base::TimeTicks time) {
   TRACE_EVENT1("cc", "Scheduler::BeginMainFrameNotExpectedUntil",
                "remaining_time", (time - Now()).InMillisecondsF());
+
+  DCHECK(!inside_scheduled_action_);
+  base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
   client_->ScheduledActionBeginMainFrameNotExpectedUntil(time);
 }
 
@@ -223,6 +226,8 @@
   // false negatives, but we want to avoid running long idle tasks when
   // we are actually active.
   if (state_machine_.wants_begin_main_frame_not_expected_messages()) {
+    DCHECK(!inside_scheduled_action_);
+    base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
     client_->SendBeginMainFrameNotExpectedSoon();
   }
 }
@@ -501,7 +506,11 @@
   state_machine_.OnBeginImplFrameIdle();
   ProcessScheduledActions();
 
-  client_->DidFinishImplFrame();
+  DCHECK(!inside_scheduled_action_);
+  {
+    base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
+    client_->DidFinishImplFrame();
+  }
   SendBeginFrameAck(begin_main_frame_args_, kBeginFrameFinished);
   begin_impl_frame_tracker_.Finish();
 }
@@ -513,6 +522,8 @@
     did_submit = state_machine_.did_submit_in_last_frame();
 
   if (!did_submit) {
+    DCHECK(!inside_scheduled_action_);
+    base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
     client_->DidNotProduceFrame(
         viz::BeginFrameAck(args.source_id, args.sequence_number, did_submit));
   }
@@ -531,12 +542,17 @@
   DCHECK(begin_impl_frame_deadline_task_.IsCancelled());
   DCHECK(state_machine_.HasInitializedLayerTreeFrameSink());
 
-  begin_impl_frame_tracker_.Start(args);
-  state_machine_.OnBeginImplFrame(args.source_id, args.sequence_number);
-  devtools_instrumentation::DidBeginFrame(layer_tree_host_id_);
-  compositor_timing_history_->WillBeginImplFrame(
-      state_machine_.NewActiveTreeLikely(), args.frame_time, args.type, now);
-  client_->WillBeginImplFrame(begin_impl_frame_tracker_.Current());
+  {
+    DCHECK(!inside_scheduled_action_);
+    base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
+
+    begin_impl_frame_tracker_.Start(args);
+    state_machine_.OnBeginImplFrame(args.source_id, args.sequence_number);
+    devtools_instrumentation::DidBeginFrame(layer_tree_host_id_);
+    compositor_timing_history_->WillBeginImplFrame(
+        state_machine_.NewActiveTreeLikely(), args.frame_time, args.type, now);
+    client_->WillBeginImplFrame(begin_impl_frame_tracker_.Current());
+  }
 
   ProcessScheduledActions();
 }
@@ -625,6 +641,8 @@
 }
 
 void Scheduler::DrawIfPossible() {
+  DCHECK(!inside_scheduled_action_);
+  base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
   bool drawing_with_new_active_tree =
       state_machine_.active_tree_needs_first_draw() &&
       !state_machine_.previous_pending_tree_was_impl_side();
@@ -641,6 +659,8 @@
 }
 
 void Scheduler::DrawForced() {
+  DCHECK(!inside_scheduled_action_);
+  base::AutoReset<bool> mark_inside(&inside_scheduled_action_, true);
   bool drawing_with_new_active_tree =
       state_machine_.active_tree_needs_first_draw() &&
       !state_machine_.previous_pending_tree_was_impl_side();
@@ -675,7 +695,7 @@
 
   // We do not allow ProcessScheduledActions to be recursive.
   // The top-level call will iteratively execute the next action for us anyway.
-  if (inside_process_scheduled_actions_)
+  if (inside_process_scheduled_actions_ || inside_scheduled_action_)
     return;
 
   base::AutoReset<bool> mark_inside(&inside_process_scheduled_actions_, true);

diff --git a/cc/scheduler/scheduler.h b/cc/scheduler/scheduler.h
index 5e2dcb9..f5f4471e 100644
--- a/cc/scheduler/scheduler.h
+++ b/cc/scheduler/scheduler.h

@@ -202,6 +202,7 @@
 
   SchedulerStateMachine state_machine_;
   bool inside_process_scheduled_actions_ = false;
+  bool inside_scheduled_action_ = false;
   SchedulerStateMachine::Action inside_action_ =
       SchedulerStateMachine::Action::NONE;
 

diff --git a/cc/scheduler/scheduler_unittest.cc b/cc/scheduler/scheduler_unittest.cc
index 67d8b89..695751a 100644
--- a/cc/scheduler/scheduler_unittest.cc
+++ b/cc/scheduler/scheduler_unittest.cc

@@ -9,6 +9,7 @@
 #include <string>
 #include <vector>
 
+#include "base/auto_reset.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
@@ -46,7 +47,8 @@
                             public viz::FakeExternalBeginFrameSource::Client {
  public:
   FakeSchedulerClient()
-      : inside_begin_impl_frame_(false),
+      : inside_action_(false),
+        inside_begin_impl_frame_(false),
         automatic_ack_(true),
         scheduler_(nullptr) {
     Reset();
@@ -103,6 +105,8 @@
   // SchedulerClient implementation.
   void WillBeginImplFrame(const viz::BeginFrameArgs& args) override {
     EXPECT_FALSE(inside_begin_impl_frame_);
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     inside_begin_impl_frame_ = true;
     PushAction("WillBeginImplFrame");
     if (will_begin_impl_frame_requests_one_begin_impl_frame_)
@@ -112,14 +116,20 @@
   }
   void DidFinishImplFrame() override {
     EXPECT_TRUE(inside_begin_impl_frame_);
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     inside_begin_impl_frame_ = false;
   }
   void DidNotProduceFrame(const viz::BeginFrameAck& ack) override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     last_begin_frame_ack_ = ack;
   }
 
   void ScheduledActionSendBeginMainFrame(
       const viz::BeginFrameArgs& args) override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionSendBeginMainFrame");
     last_begin_main_frame_args_ = args;
   }
@@ -133,6 +143,8 @@
   }
 
   DrawResult ScheduledActionDrawIfPossible() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionDrawIfPossible");
     num_draws_++;
     DrawResult result =
@@ -149,39 +161,57 @@
     return result;
   }
   DrawResult ScheduledActionDrawForced() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionDrawForced");
     last_begin_frame_ack_ = scheduler_->CurrentBeginFrameAckForActiveTree();
     return DRAW_SUCCESS;
   }
   void ScheduledActionCommit() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionCommit");
     scheduler_->DidCommit();
   }
   void ScheduledActionActivateSyncTree() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionActivateSyncTree");
   }
   void ScheduledActionBeginLayerTreeFrameSinkCreation() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionBeginLayerTreeFrameSinkCreation");
   }
   void ScheduledActionPrepareTiles() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionPrepareTiles");
     scheduler_->WillPrepareTiles();
     scheduler_->DidPrepareTiles();
   }
   void ScheduledActionInvalidateLayerTreeFrameSink() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     actions_.push_back("ScheduledActionInvalidateLayerTreeFrameSink");
     states_.push_back(scheduler_->AsValue());
   }
   void ScheduledActionPerformImplSideInvalidation() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionPerformImplSideInvalidation");
   }
 
   void SendBeginMainFrameNotExpectedSoon() override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("SendBeginMainFrameNotExpectedSoon");
   }
 
   void ScheduledActionBeginMainFrameNotExpectedUntil(
       base::TimeTicks time) override {
+    EXPECT_FALSE(inside_action_);
+    base::AutoReset<bool> mark_inside(&inside_action_, true);
     PushAction("ScheduledActionBeginMainFrameNotExpectedUntil");
   }
 
@@ -224,6 +254,7 @@
     return inside_begin_impl_frame_ == state;
   }
 
+  bool inside_action_;
   bool inside_begin_impl_frame_;
   bool will_begin_impl_frame_causes_redraw_;
   bool will_begin_impl_frame_requests_one_begin_impl_frame_;
@@ -3070,6 +3101,27 @@
   client_->Reset();
 }
 
+TEST_F(SchedulerTest, SetNeedsRedrawFromWillBeginImplFrame) {
+  client_ = std::make_unique<FakeSchedulerClient>();
+  CreateScheduler(EXTERNAL_BFS);
+
+  scheduler_->SetVisible(true);
+  scheduler_->SetCanDraw(true);
+  client_->SetWillBeginImplFrameCausesRedraw(true);
+
+  scheduler_->DidCreateAndInitializeLayerTreeFrameSink();
+  scheduler_->SetNeedsBeginMainFrame();
+
+  AdvanceFrame();
+  EXPECT_ACTIONS("ScheduledActionBeginLayerTreeFrameSinkCreation",
+                 "AddObserver(this)", "WillBeginImplFrame",
+                 "ScheduledActionSendBeginMainFrame");
+  EXPECT_TRUE(scheduler_->RedrawPending());
+  // WillBeginFrame calls Scheduler::SetNeedsRedraw, which could try to run
+  // another action. If none of the EXPECT_FALSE(inside_action_)s in
+  // FakeSchedulerClient fail, we know we didn't re-enter the scheduler.
+}
+
 TEST_F(SchedulerTest, SynchronousCompositorSendBeginMainFrameWhileIdle) {
   scheduler_settings_.using_synchronous_renderer_compositor = true;
   SetUpScheduler(EXTERNAL_BFS);

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 826114b..a5da827 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -7498,9 +7498,18 @@
       <message name="IDS_PROFILES_DICE_SIGNIN_BUTTON" desc="Button in the profile user menu to sign in and turn on Sync.">
         Sign in
       </message>
+      <message name="IDS_PROFILES_DICE_SIGNIN_FIRST_ACCOUNT_BUTTON" desc="Button to sign in and turn on Sync for a specific web account.">
+        Sync to <ph name="ACCOUNT_FULL_NAME">$1<ex>John Doe</ex></ph>
+      </message>
+      <message name="IDS_PROFILES_DICE_SIGNIN_FIRST_ACCOUNT_BUTTON_NO_NAME" desc="Button to sign in and turn on Sync for a web account when the name is empty.">
+        Sync to your account
+      </message>
       <message name="IDS_PROFILES_DICE_SIGNIN_PROMO" desc="Text describing the benefits of signing in and turning on Sync.">
         Sign in for a personalized browsing experience, synced across your devices
       </message>
+      <message name="IDS_PROFILES_DICE_SIGNIN_WITH_ANOTHER_ACCOUNT_BUTTON" desc="Button to sign in and turn on Sync with another web account.">
+        Sync to another account
+      </message>
       <message name="IDS_PROFILES_ACCOUNT_REMOVAL_BUTTON" desc="Text of the ok button on the account removal view in the avatar menu bubble.">
         Remove account
       </message>
@@ -11028,8 +11037,8 @@
         Exit
       </message>
       <!-- TODO(https://crbug.com/774199): Make this <if expr="is_android"> -->
-      <message name="IDS_VR_POWERED_BY_CHROME_MESSAGE" desc="A message indicating that the current page is running in Chrome.">
-        Powered by Chrome
+      <message name="IDS_VR_RUNNING_IN_CHROME_MESSAGE" desc="A message indicating that the current page is running in Chrome.">
+        Running in Chrome
       </message>
       <message name="IDS_VR_NO_SPEECH_RECOGNITION_RESULT" desc="Text to be shown if speech recognition failed to recognize a speech due to either no sound or noise.">
         Sorry, didn't catch that.

diff --git a/chrome/app/vector_icons/BUILD.gn b/chrome/app/vector_icons/BUILD.gn
index d9ef4cb..e9a38b5 100644
--- a/chrome/app/vector_icons/BUILD.gn
+++ b/chrome/app/vector_icons/BUILD.gn

@@ -77,6 +77,7 @@
     "sync_circle.icon",
     "sync_error_circle.icon",
     "sync_problem.icon",
+    "sync_switch_account.icon",
     "tab.icon",
     "tab_audio.1x.icon",
     "tab_audio.icon",

diff --git a/chrome/app/vector_icons/sync_switch_account.icon b/chrome/app/vector_icons/sync_switch_account.icon
new file mode 100644
index 0000000..71e863a
--- /dev/null
+++ b/chrome/app/vector_icons/sync_switch_account.icon

@@ -0,0 +1,24 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+CANVAS_DIMENSIONS, 16,
+MOVE_TO, 4.59f, 7.84f,
+LINE_TO, 2, 10.42f,
+LINE_TO, 4.59f, 13,
+R_V_LINE_TO, -1.93f,
+R_H_LINE_TO, 4.55f,
+R_V_LINE_TO, -1.29f,
+H_LINE_TO, 4.59f,
+V_LINE_TO, 7.84f,
+CLOSE,
+MOVE_TO, 14, 5.58f,
+LINE_TO, 11.41f, 3,
+R_V_LINE_TO, 1.94f,
+H_LINE_TO, 6.87f,
+R_V_LINE_TO, 1.29f,
+R_H_LINE_TO, 4.55f,
+R_V_LINE_TO, 1.94f,
+LINE_TO, 14, 5.58f,
+CLOSE,
+END

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index a7ce7dd..f0f3a85 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -23,7 +23,6 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/task_scheduler/switches.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "cc/base/switches.h"
@@ -2783,10 +2782,6 @@
      flag_descriptions::kQuickUnlockFingerprintDescription, kOsCrOS,
      FEATURE_VALUE_TYPE(features::kQuickUnlockFingerprint)},
 #endif  // OS_CHROMEOS
-    {"browser-task-scheduler", flag_descriptions::kBrowserTaskSchedulerName,
-     flag_descriptions::kBrowserTaskSchedulerDescription, kOsAll,
-     ENABLE_DISABLE_VALUE_TYPE(switches::kEnableBrowserTaskScheduler,
-                               switches::kDisableBrowserTaskScheduler)},
 #if defined(OS_ANDROID)
     {"no-credit-card-abort", flag_descriptions::kNoCreditCardAbort,
      flag_descriptions::kNoCreditCardAbortDescription, kOsAndroid,

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 82a99656..1055395b 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc

@@ -3126,22 +3126,6 @@
   }
 }
 
-bool ChromeContentBrowserClient::BindAssociatedInterfaceRequestFromFrame(
-    content::RenderFrameHost* render_frame_host,
-    const std::string& interface_name,
-    mojo::ScopedInterfaceEndpointHandle* handle) {
-  // TODO(https://crbug.com/736357): Factor AssociatedInterfaceRegistryImpl out
-  // into content/public/ so it can be used here instead of this abomination.
-  if (interface_name == password_manager::mojom::CredentialManager::Name_) {
-    ChromePasswordManagerClient::BindCredentialManager(
-        password_manager::mojom::CredentialManagerAssociatedRequest(
-            std::move(*handle)),
-        render_frame_host);
-    return true;
-  }
-  return false;
-}
-
 void ChromeContentBrowserClient::BindInterfaceRequestFromWorker(
     content::RenderProcessHost* render_process_host,
     const url::Origin& origin,
@@ -3616,7 +3600,8 @@
   frame_interfaces_parameterized_->AddInterface(
       base::Bind(&password_manager::ContentPasswordManagerDriverFactory::
                      BindPasswordManagerDriver));
-
+  frame_interfaces_parameterized_->AddInterface(
+      base::BindRepeating(&ChromePasswordManagerClient::BindCredentialManager));
   frame_interfaces_parameterized_->AddInterface(
       base::Bind(&InsecureSensitiveInputDriverFactory::BindDriver));
 

diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index f624e8ee..5f1e3be 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h

@@ -322,10 +322,6 @@
       content::RenderFrameHost* render_frame_host,
       const std::string& interface_name,
       mojo::ScopedMessagePipeHandle interface_pipe) override;
-  bool BindAssociatedInterfaceRequestFromFrame(
-      content::RenderFrameHost* render_frame_host,
-      const std::string& interface_name,
-      mojo::ScopedInterfaceEndpointHandle* handle) override;
   void BindInterfaceRequestFromWorker(
       content::RenderProcessHost* render_process_host,
       const url::Origin& origin,

diff --git a/chrome/browser/extensions/api/cast_streaming/cast_streaming_apitest.cc b/chrome/browser/extensions/api/cast_streaming/cast_streaming_apitest.cc
index 31e0aa8..9c15fa49 100644
--- a/chrome/browser/extensions/api/cast_streaming/cast_streaming_apitest.cc
+++ b/chrome/browser/extensions/api/cast_streaming/cast_streaming_apitest.cc

@@ -204,7 +204,7 @@
 
     CHECK(video_frame->format() == media::PIXEL_FORMAT_YV12 ||
           video_frame->format() == media::PIXEL_FORMAT_I420 ||
-          video_frame->format() == media::PIXEL_FORMAT_YV12A);
+          video_frame->format() == media::PIXEL_FORMAT_I420A);
 
     if (done_callback_.is_null() || expected_yuv_colors_.empty())
       return;  // No need to waste CPU doing analysis on the frame.

diff --git a/chrome/browser/extensions/chrome_app_icon_unittest.cc b/chrome/browser/extensions/chrome_app_icon_unittest.cc
index 2f2f0a6..381857e 100644
--- a/chrome/browser/extensions/chrome_app_icon_unittest.cc
+++ b/chrome/browser/extensions/chrome_app_icon_unittest.cc

@@ -266,7 +266,7 @@
 
  protected:
   void CreateBuilder() {
-    model_updater_ = std::make_unique<app_list::FakeAppListModelUpdater>();
+    model_updater_ = std::make_unique<FakeAppListModelUpdater>();
     controller_ = std::make_unique<test::TestAppListControllerDelegate>();
     builder_ = std::make_unique<ExtensionAppModelBuilder>(controller_.get());
     builder_->Initialize(nullptr, profile(), model_updater_.get());
@@ -287,7 +287,7 @@
   }
 
  private:
-  std::unique_ptr<app_list::FakeAppListModelUpdater> model_updater_;
+  std::unique_ptr<FakeAppListModelUpdater> model_updater_;
   std::unique_ptr<test::TestAppListControllerDelegate> controller_;
   std::unique_ptr<ExtensionAppModelBuilder> builder_;
 

diff --git a/chrome/browser/password_manager/chrome_password_manager_client.cc b/chrome/browser/password_manager/chrome_password_manager_client.cc
index ba6778f0..0248643 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.cc
+++ b/chrome/browser/password_manager/chrome_password_manager_client.cc

@@ -755,7 +755,7 @@
 
 // static
 void ChromePasswordManagerClient::BindCredentialManager(
-    password_manager::mojom::CredentialManagerAssociatedRequest request,
+    password_manager::mojom::CredentialManagerRequest request,
     content::RenderFrameHost* render_frame_host) {
   // Only valid for the main frame.
   if (render_frame_host->GetParent())

diff --git a/chrome/browser/password_manager/chrome_password_manager_client.h b/chrome/browser/password_manager/chrome_password_manager_client.h
index 3c21a23e..5b070e94 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.h
+++ b/chrome/browser/password_manager/chrome_password_manager_client.h

@@ -141,7 +141,7 @@
   void SetTestObserver(autofill::PasswordGenerationPopupObserver* observer);
 
   static void BindCredentialManager(
-      password_manager::mojom::CredentialManagerAssociatedRequest request,
+      password_manager::mojom::CredentialManagerRequest request,
       content::RenderFrameHost* render_frame_host);
 
   // A helper method to determine whether a save/update bubble can be shown

diff --git a/chrome/browser/password_manager/chrome_password_manager_client_unittest.cc b/chrome/browser/password_manager/chrome_password_manager_client_unittest.cc
index 8bd5ab9..11e00933 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client_unittest.cc
+++ b/chrome/browser/password_manager/chrome_password_manager_client_unittest.cc

@@ -675,7 +675,7 @@
 
   // This call should not crash.
   ChromePasswordManagerClient::BindCredentialManager(
-      password_manager::mojom::CredentialManagerAssociatedRequest(),
+      password_manager::mojom::CredentialManagerRequest(),
       web_contents->GetMainFrame());
 }
 

diff --git a/chrome/browser/password_manager/credential_manager_browsertest.cc b/chrome/browser/password_manager/credential_manager_browsertest.cc
index f04d6bb9..5e55fde 100644
--- a/chrome/browser/password_manager/credential_manager_browsertest.cc
+++ b/chrome/browser/password_manager/credential_manager_browsertest.cc

@@ -121,8 +121,8 @@
   }
 
   // Tests that when navigator.credentials.store() is called in an `unload`
-  // handler before a same-RenderFrame navigation, the request is guaranteed to
-  // be serviced in the context of the initial document.
+  // handler before a same-RenderFrame navigation, the request is either dropped
+  // or serviced in the context of the old document.
   //
   // If |preestablish_mojo_pipe| is set, then the CredentialManagerClient will
   // establish the Mojo connection to the ContentCredentialManager ahead of
@@ -142,8 +142,8 @@
     ChromePasswordManagerClient* client =
         ChromePasswordManagerClient::FromWebContents(WebContents());
 
+    EXPECT_FALSE(client->has_binding_for_credential_manager());
     if (preestablish_mojo_pipe) {
-      EXPECT_FALSE(client->has_binding_for_credential_manager());
       ASSERT_NO_FATAL_FAILURE(
           TriggerNavigatorGetPasswordCredentialsAndExpectHasResult(
               WebContents(), false));
@@ -159,11 +159,13 @@
     ui_test_utils::NavigateToURL(browser(), a_url2);
     ASSERT_EQ(old_rfh, WebContents()->GetMainFrame());
 
-    // Ensure that the old document no longer has a Mojo connection to the
-    // ContentCredentialManager, nor can it get one later.
+    // Ensure that the old document no longer has a mojom::CredentialManager
+    // interface connection to the ContentCredentialManager, nor can it get one
+    // later.
     //
     // The sequence of events for same-RFH navigations is as follows:
     //  1.) FrameHostMsg_DidStartProvisionalLoad
+    //  ... waiting for first response byte ...
     //  2.) FrameLoader::PrepareForCommit
     //  2.1) Document::Shutdown (old Document)
     //  3.) mojom::FrameHost::DidCommitProvisionalLoad (new load)
@@ -172,25 +174,38 @@
     //  5.) content::WaitForLoadStop inside NavigateToURL returns
     //  6.) NavigateToURL returns
     //
-    // After Step 2.1, the old Document cannot issue a new Mojo InterfaceRequest
-    // anymore. Plus, because the AssociatedInterfaceRegistry, through which the
-    // associated interface to the ContentCredentialManager is retrieved, is
-    // itself Channel-associated, any InterfaceRequest messages that may have
-    // been issued before or during Step 2.1, will be guaranteed to arrive to
-    // the browser side before DidCommitProvisionalLoad in Step 3.
+    // After Step 2.1, the old Document no longer executes any author JS, so
+    // there can be no more calls to the Credential Management API, hence no
+    // more InterfaceRequests for mojom::CredentialManager.
     //
-    // Hence it is sufficient to check that the Mojo connection is closed now.
+    // Because the InterfaceRegistry, through which the client end of the
+    // mojom::CredentialManager interface to the ContentCredentialManager is
+    // retrieved, is re-bound by the RenderFrameHostImpl to a new pipe on
+    // DidCommitProvisionalLoad, any InterfaceRequest messages issued before or
+    // during Step 2.1 will either have already been dispatched on the browser
+    // side and serviced before DidCommitProvisionalLoad in Step 3, or will be
+    // ignored altogether.
+    //
+    // Hence it is sufficient to check that the Mojo connection is closed now
+    // after NavigateToURL above has returned.
     EXPECT_FALSE(client->has_binding_for_credential_manager());
 
-    // Ensure that the navigator.credentials.store() call was serviced in the
-    // context of the old URL, |a_url|.
+    // Ensure that the navigator.credentials.store() call issued on the previous
+    // mojom::CredentialManager connection was either serviced in the context of
+    // the old URL, |a_url|, or dropped altogether.
     //
-    // The CredentialManager Mojo interface is Channel-associated, so message
-    // ordering with legacy IPC messages is preserved. Therefore, servicing the
-    // store() called from the `unload` handler, triggered from
-    // FrameLoader::PrepareForCommit, will be serviced before
-    // DidCommitProvisionalLoad, thus before DidFinishNavigation,
-    ASSERT_TRUE(client->was_store_ever_called());
+    // The behavior is non-deterministic because the mojom::CredentialManager
+    // interface is not Channel-associated, so message ordering with legacy IPC
+    // messages is not preserved.
+    //
+    // If the store() method invoked from the `unload` handler (in Step 2.1)
+    // happens to be speedily dispatched before DidCommitProvisionalLoad, it
+    // will have been serviced in the context of the old document. Otherwise the
+    // ContentCredentialManager should have closed the underlying interface
+    // connection in response to DidCommitProvisionalLoad in Step 3, and the
+    // method call should be ignored.
+    if (!client->was_store_ever_called())
+      return;
 
     BubbleObserver prompt_observer(WebContents());
     prompt_observer.WaitForAutomaticSavePrompt();
@@ -253,8 +268,7 @@
     // The sufficient conditions for this are:
     //  -- The swapped out RFH is destroyed, so the RenderFrame cannot
     //     establish a new Mojo connection to ContentCredentialManager anymore.
-    //  -- There is no already existing Mojo connection to
-    //  ContentCredentialManager
+    //  -- There is no pre-existing Mojo connection to ContentCredentialManager
     //     either, which could be used to call store() in the future.
     //  -- There have not been any calls to store() in the past.
     rfh_destruction_observer.WaitUntilDeleted();

diff --git a/chrome/browser/resources/local_ntp/local_ntp.css b/chrome/browser/resources/local_ntp/local_ntp.css
index 319a64a..a917539 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.css
+++ b/chrome/browser/resources/local_ntp/local_ntp.css

@@ -27,6 +27,8 @@
   /* Base height 16px, plus 8px each of padding on top and bottom. */
   --mv-notice-height: calc(8px + 16px + 8px);
 
+  --mv-notice-time: 10s;
+
   /* These can be overridden by themes. */
   --text-color: #000;
   --text-color-light: #fff;
@@ -478,9 +480,9 @@
   color: #fff;
 }
 
-#mv-notice.mv-notice-delayed-hide {
+#mv-notice.mv-notice-delayed-hide:not(:focus-within) {
   opacity: 0;
-  transition-delay: 10s;
+  transition-delay: var(--mv-notice-time);
   transition-property: opacity;
 }
 

diff --git a/chrome/browser/resources/local_ntp/local_ntp.html b/chrome/browser/resources/local_ntp/local_ntp.html
index 4766016..ccf0063 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.html
+++ b/chrome/browser/resources/local_ntp/local_ntp.html

@@ -56,13 +56,13 @@
       <!-- The container for the tiles. The MV iframe goes in here. -->
       <div id="mv-tiles"></div>
       <!-- Notification shown when a tile is blacklisted. -->
-      <div id="mv-notice" class="mv-notice-hide">
+      <div id="mv-notice" class="mv-notice-hide" role="alert">
         <span id="mv-msg"></span>
         <!-- Links in the notification. -->
         <span id="mv-notice-links">
-          <span id="mv-undo" tabindex="0"></span>
-          <span id="mv-restore" tabindex="0"></span>
-          <div id="mv-notice-x" tabindex="0"></div>
+          <span id="mv-undo" tabindex="0" role="button"></span>
+          <span id="mv-restore" tabindex="0" role="button"></span>
+          <div id="mv-notice-x" tabindex="0" role="button"></div>
         </span>
       </div>
     </div>

diff --git a/chrome/browser/resources/local_ntp/local_ntp.js b/chrome/browser/resources/local_ntp/local_ntp.js
index 17bbafb..d3c5726 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.js
+++ b/chrome/browser/resources/local_ntp/local_ntp.js

@@ -169,9 +169,7 @@
  * @enum {number}
  * @const
  */
-var KEYCODE = {
-  ENTER: 13
-};
+var KEYCODE = {ENTER: 13, SPACE: 32};
 
 
 /**
@@ -582,6 +580,12 @@
  * section, and Google-specific elements for a Google-provided page.
  */
 function init() {
+  // If an accessibility tool is in use, increase the time for which the
+  // "tile was blacklisted" notification is shown.
+  if (configData.isAccessibleBrowser) {
+    document.body.style.setProperty('--mv-notice-time', '30s');
+  }
+
   // Hide notifications after fade out, so we can't focus on links via keyboard.
   $(IDS.NOTIFICATION).addEventListener('transitionend', hideNotification);
 
@@ -591,11 +595,13 @@
   var undoLink = $(IDS.UNDO_LINK);
   undoLink.addEventListener('click', onUndo);
   registerKeyHandler(undoLink, KEYCODE.ENTER, onUndo);
+  registerKeyHandler(undoLink, KEYCODE.SPACE, onUndo);
   undoLink.textContent = configData.translatedStrings.undoThumbnailRemove;
 
   var restoreAllLink = $(IDS.RESTORE_ALL_LINK);
   restoreAllLink.addEventListener('click', onRestoreAll);
   registerKeyHandler(restoreAllLink, KEYCODE.ENTER, onRestoreAll);
+  registerKeyHandler(restoreAllLink, KEYCODE.SPACE, onRestoreAll);
   restoreAllLink.textContent =
       configData.translatedStrings.restoreThumbnailsShort;
 

diff --git a/chrome/browser/resources/optimize_webui.py b/chrome/browser/resources/optimize_webui.py
index b06fe52..6a8ddb4a 100755
--- a/chrome/browser/resources/optimize_webui.py
+++ b/chrome/browser/resources/optimize_webui.py

@@ -83,7 +83,7 @@
 def _undo_mapping(mappings, url):
   for (redirect_url, file_path) in mappings:
     if url.startswith(redirect_url):
-      return url.replace(redirect_url, file_path + os.sep)
+      return url.replace(redirect_url, file_path + os.sep, 1)
   # TODO(dbeam): can we make this stricter?
   return url
 

diff --git a/chrome/browser/resources/optimize_webui_test.py b/chrome/browser/resources/optimize_webui_test.py
index d8d819b..5a9c271 100755
--- a/chrome/browser/resources/optimize_webui_test.py
+++ b/chrome/browser/resources/optimize_webui_test.py

@@ -23,10 +23,15 @@
     for tmp_dir in self._tmp_dirs:
       shutil.rmtree(tmp_dir)
 
-  def _write_file_to_src_dir(self, file_name, file_contents):
+  def _write_file_to_src_dir(self, file_path, file_contents):
     if not self._tmp_src_dir:
       self._tmp_src_dir = self._create_tmp_dir()
-    with open(os.path.join(self._tmp_src_dir, file_name), 'w') as tmp_file:
+    file_path_normalized = os.path.normpath(os.path.join(self._tmp_src_dir,
+                                                         file_path))
+    file_dir = os.path.dirname(file_path_normalized)
+    if not os.path.exists(file_dir):
+      os.makedirs(file_dir)
+    with open(file_path_normalized, 'w') as tmp_file:
       tmp_file.write(file_contents)
 
   def _create_tmp_dir(self):
@@ -57,8 +62,13 @@
   def testSimpleOptimize(self):
     self._write_file_to_src_dir('element.html', '<div>got here!</div>')
     self._write_file_to_src_dir('element.js', "alert('yay');")
+    self._write_file_to_src_dir('element_in_dir/element_in_dir.html',
+                                '<script src="element_in_dir.js">')
+    self._write_file_to_src_dir('element_in_dir/element_in_dir.js',
+                                "alert('hello from element_in_dir');")
     self._write_file_to_src_dir('ui.html', '''
 <link rel="import" href="element.html">
+<link rel="import" href="element_in_dir/element_in_dir.html">
 <script src="element.js"></script>
 ''')
 
@@ -68,17 +78,24 @@
                        js_out_file='fast.js')
 
     fast_html = self._read_out_file('fast.html')
-    self.assertFalse('element.html' in fast_html)
-    self.assertFalse('element.js' in fast_html)
-    self.assertTrue('got here!' in fast_html)
-    self.assertTrue('<script src="fast.js"></script>' in fast_html)
+    self.assertNotIn('element.html', fast_html)
+    self.assertNotIn('element.js', fast_html)
+    self.assertNotIn('element_in_dir.html', fast_html)
+    self.assertNotIn('element_in_dir.js', fast_html)
+    self.assertIn('got here!', fast_html)
+    self.assertIn('<script src="fast.js"></script>', fast_html)
 
     fast_js = self._read_out_file('fast.js')
-    self.assertTrue('yay' in fast_js)
+    self.assertIn('yay', fast_js)
+    self.assertIn('hello from element_in_dir', fast_js)
 
     depfile_d = self._read_out_file('depfile.d')
-    self.assertTrue('element.html' in depfile_d)
-    self.assertTrue('element.js' in depfile_d)
+    self.assertIn('element.html', depfile_d)
+    self.assertIn('element.js', depfile_d)
+    self.assertIn(os.path.normpath('element_in_dir/element_in_dir.html'),
+                  depfile_d)
+    self.assertIn(os.path.normpath('element_in_dir/element_in_dir.js'),
+                  depfile_d)
 
 
 if __name__ == '__main__':

diff --git a/chrome/browser/search/local_ntp_source.cc b/chrome/browser/search/local_ntp_source.cc
index efea49d7..daffb035 100644
--- a/chrome/browser/search/local_ntp_source.cc
+++ b/chrome/browser/search/local_ntp_source.cc

@@ -44,6 +44,7 @@
 #include "components/search_provider_logos/logo_service.h"
 #include "components/search_provider_logos/logo_tracker.h"
 #include "components/strings/grit/components_strings.h"
+#include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/browser_thread.h"
 #include "net/base/url_util.h"
 #include "net/url_request/url_request.h"
@@ -165,6 +166,9 @@
   config_data.Set("translatedStrings", GetTranslatedStrings(is_google));
   config_data.SetBoolean("isGooglePage", is_google);
   config_data.SetString("googleBaseUrl", google_base_url.spec());
+  config_data.SetBoolean(
+      "isAccessibleBrowser",
+      content::BrowserAccessibilityState::GetInstance()->IsAccessibleBrowser());
 
   bool is_voice_search_enabled =
       base::FeatureList::IsEnabled(features::kVoiceSearchOnLocalNtp);
@@ -235,11 +239,23 @@
   auto result = base::MakeUnique<base::DictionaryValue>();
   result->SetString("type", LogoTypeToString(meta.type));
   result->SetString("onClickUrl", meta.on_click_url.spec());
-  result->SetString("fullPageUrl", meta.full_page_url.spec());
   result->SetString("altText", meta.alt_text);
   result->SetString("mimeType", meta.mime_type);
   result->SetString("animatedUrl", meta.animated_url.spec());
 
+  GURL full_page_url = meta.full_page_url;
+  if (base::GetFieldTrialParamByFeatureAsBool(
+          features::kDoodlesOnLocalNtp,
+          "local_ntp_interactive_doodles_prevent_redirects",
+          /*default_value=*/true) &&
+      meta.type == search_provider_logos::LogoType::INTERACTIVE &&
+      full_page_url.is_valid()) {
+    // Prevent the server from redirecting to ccTLDs. This is a temporary
+    // workaround, until the server doesn't redirect these requests by default.
+    full_page_url = net::AppendQueryParameter(full_page_url, "gws_rd", "cr");
+  }
+  result->SetString("fullPageUrl", full_page_url.spec());
+
   // If support for interactive Doodles is disabled, treat them as simple
   // Doodles instead and use the full page URL as the target URL.
   if (meta.type == search_provider_logos::LogoType::INTERACTIVE &&

diff --git a/chrome/browser/signin/identity_manager_factory.h b/chrome/browser/signin/identity_manager_factory.h
index 044338c..18e4830 100644
--- a/chrome/browser/signin/identity_manager_factory.h
+++ b/chrome/browser/signin/identity_manager_factory.h

@@ -15,8 +15,7 @@
 class Profile;
 
 // Singleton that owns all IdentityManager instances and associates them with
-// Profiles. Listens for the Profile's destruction notification and cleans up
-// the associated IdentityManager.
+// Profiles.
 class IdentityManagerFactory : public BrowserContextKeyedServiceFactory {
  public:
   static identity::IdentityManager* GetForProfile(Profile* profile);

diff --git a/chrome/browser/ui/app_list/app_list_model_builder.cc b/chrome/browser/ui/app_list/app_list_model_builder.cc
index b762748..9192f2b 100644
--- a/chrome/browser/ui/app_list/app_list_model_builder.cc
+++ b/chrome/browser/ui/app_list/app_list_model_builder.cc

@@ -14,10 +14,9 @@
 AppListModelBuilder::~AppListModelBuilder() {
 }
 
-void AppListModelBuilder::Initialize(
-    app_list::AppListSyncableService* service,
-    Profile* profile,
-    app_list::AppListModelUpdater* model_updater) {
+void AppListModelBuilder::Initialize(app_list::AppListSyncableService* service,
+                                     Profile* profile,
+                                     AppListModelUpdater* model_updater) {
   DCHECK(!service_ && !profile_ && !model_updater_);
   service_ = service;
   profile_ = profile;

diff --git a/chrome/browser/ui/app_list/app_list_model_builder.h b/chrome/browser/ui/app_list/app_list_model_builder.h
index e62cdb4..7c7c34c8 100644
--- a/chrome/browser/ui/app_list/app_list_model_builder.h
+++ b/chrome/browser/ui/app_list/app_list_model_builder.h

@@ -28,7 +28,7 @@
   // |service| is the owner of this instance.
   void Initialize(app_list::AppListSyncableService* service,
                   Profile* profile,
-                  app_list::AppListModelUpdater* model_updater);
+                  AppListModelUpdater* model_updater);
 
  protected:
   // Builds the model with the current profile.
@@ -40,7 +40,7 @@
 
   AppListControllerDelegate* controller() { return controller_; }
 
-  app_list::AppListModelUpdater* model_updater() { return model_updater_; }
+  AppListModelUpdater* model_updater() { return model_updater_; }
 
   // Inserts an app based on app ordinal prefs.
   void InsertApp(std::unique_ptr<ChromeAppListItem> app);
@@ -61,7 +61,7 @@
   Profile* profile_ = nullptr;
 
   // Unowned pointer to an app list model updater.
-  app_list::AppListModelUpdater* model_updater_ = nullptr;
+  AppListModelUpdater* model_updater_ = nullptr;
 
   // Unowned pointer to the app list controller.
   AppListControllerDelegate* controller_;

diff --git a/chrome/browser/ui/app_list/app_list_model_updater.h b/chrome/browser/ui/app_list/app_list_model_updater.h
index 0a08f78..d46d0a5b 100644
--- a/chrome/browser/ui/app_list/app_list_model_updater.h
+++ b/chrome/browser/ui/app_list/app_list_model_updater.h

@@ -13,8 +13,6 @@
 #include "ash/app_list/model/app_list_model.h"
 #include "chrome/browser/ui/app_list/chrome_app_list_item.h"
 
-namespace app_list {
-
 // An interface to wrap AppListModel access in browser.
 class AppListModelUpdater {
  public:
@@ -28,8 +26,8 @@
                                 const std::string& folder_id) {}
   virtual void SetItemPosition(const std::string& id,
                                const syncer::StringOrdinal& new_position) {}
-  virtual void SetStatus(AppListModel::Status status) {}
-  virtual void SetState(AppListModel::State state) {}
+  virtual void SetStatus(app_list::AppListModel::Status status) {}
+  virtual void SetState(app_list::AppListModel::State state) {}
   virtual void SetItemName(const std::string& id, const std::string& name) {}
   virtual void HighlightItemInstalledFromUI(const std::string& id) {}
   // For SearchModel:
@@ -40,7 +38,8 @@
   virtual size_t ItemCount() = 0;
   virtual ChromeAppListItem* ItemAtForTest(size_t index) = 0;
   // TODO(hejq): |FindFolderItem| will return |ChromeAppListItem|.
-  virtual AppListFolderItem* FindFolderItem(const std::string& folder_id) = 0;
+  virtual app_list::AppListFolderItem* FindFolderItem(
+      const std::string& folder_id) = 0;
   virtual bool FindItemIndexForTest(const std::string& id, size_t* index) = 0;
   virtual app_list::AppListViewState StateFullscreen() = 0;
   virtual std::map<std::string, size_t> GetIdToAppListIndexMap() = 0;
@@ -52,6 +51,5 @@
   virtual ~AppListModelUpdater() {}
 };
 
-}  // namespace app_list
 
 #endif  // CHROME_BROWSER_UI_APP_LIST_APP_LIST_MODEL_UPDATER_H_

diff --git a/chrome/browser/ui/app_list/app_list_service_impl_browsertest.cc b/chrome/browser/ui/app_list/app_list_service_impl_browsertest.cc
index 8268397..66ad991 100644
--- a/chrome/browser/ui/app_list/app_list_service_impl_browsertest.cc
+++ b/chrome/browser/ui/app_list/app_list_service_impl_browsertest.cc

@@ -107,7 +107,7 @@
 
   // Show the app list to ensure it has loaded a profile.
   service_->ShowForProfile(browser()->profile());
-  app_list::AppListModelUpdater* model_updater = test::GetModelUpdater(service);
+  AppListModelUpdater* model_updater = test::GetModelUpdater(service);
   EXPECT_TRUE(model_updater);
 
   // Get the webstore hosted app, which is always present.

diff --git a/chrome/browser/ui/app_list/app_list_syncable_service.h b/chrome/browser/ui/app_list/app_list_syncable_service.h
index 65e5490b0..82b6116 100644
--- a/chrome/browser/ui/app_list/app_list_syncable_service.h
+++ b/chrome/browser/ui/app_list/app_list_syncable_service.h

@@ -24,7 +24,9 @@
 #include "components/sync/model/syncable_service.h"
 #include "components/sync/protocol/app_list_specifics.pb.h"
 
+class AppListModelUpdater;
 class ArcAppModelBuilder;
+class ChromeAppListModelUpdater;
 class ChromeAppListItem;
 class ExtensionAppModelBuilder;
 class Profile;
@@ -48,9 +50,6 @@
 class AppListModel;
 class SearchModel;
 
-class AppListModelUpdater;
-class ChromeAppListModelUpdater;
-
 // Keyed Service that owns, stores, and syncs an AppListModel for a profile.
 class AppListSyncableService : public syncer::SyncableService,
                                public KeyedService {

diff --git a/chrome/browser/ui/app_list/app_list_syncable_service_unittest.cc b/chrome/browser/ui/app_list/app_list_syncable_service_unittest.cc
index 2d21697..ca7ab06 100644
--- a/chrome/browser/ui/app_list/app_list_syncable_service_unittest.cc
+++ b/chrome/browser/ui/app_list/app_list_syncable_service_unittest.cc

@@ -182,7 +182,7 @@
 
   void TearDown() override { app_list_syncable_service_.reset(); }
 
-  app_list::AppListModelUpdater* model_updater() {
+  AppListModelUpdater* model_updater() {
     return app_list_syncable_service_->GetModelUpdater();
   }
 

diff --git a/chrome/browser/ui/app_list/app_list_view_delegate.cc b/chrome/browser/ui/app_list/app_list_view_delegate.cc
index 183a43f..0ffc5f6f 100644
--- a/chrome/browser/ui/app_list/app_list_view_delegate.cc
+++ b/chrome/browser/ui/app_list/app_list_view_delegate.cc

@@ -226,7 +226,7 @@
     observer.OnWallpaperColorsChanged();
 }
 
-app_list::AppListModelUpdater* AppListViewDelegate::GetModelUpdater() {
+AppListModelUpdater* AppListViewDelegate::GetModelUpdater() {
   return model_updater_;
 }
 

diff --git a/chrome/browser/ui/app_list/app_list_view_delegate.h b/chrome/browser/ui/app_list/app_list_view_delegate.h
index bd60174..5224d67 100644
--- a/chrome/browser/ui/app_list/app_list_view_delegate.h
+++ b/chrome/browser/ui/app_list/app_list_view_delegate.h

@@ -63,7 +63,7 @@
       const scoped_refptr<content::SpeechRecognitionSessionPreamble>& preamble);
 
   // Gets the model updater.
-  app_list::AppListModelUpdater* GetModelUpdater();
+  AppListModelUpdater* GetModelUpdater();
 
   // Overridden from app_list::AppListViewDelegate:
   app_list::AppListModel* GetModel() override;
@@ -126,7 +126,7 @@
 
   // Unowned pointer to the model updater owned by AppListSyncableService.
   // Will change if |profile_| changes.
-  app_list::AppListModelUpdater* model_updater_;
+  AppListModelUpdater* model_updater_;
 
   // Note: order ensures |search_resource_manager_| is destroyed before
   // |speech_ui_|.

diff --git a/chrome/browser/ui/app_list/arc/arc_app_unittest.cc b/chrome/browser/ui/app_list/arc/arc_app_unittest.cc
index 070a534..ca553618 100644
--- a/chrome/browser/ui/app_list/arc/arc_app_unittest.cc
+++ b/chrome/browser/ui/app_list/arc/arc_app_unittest.cc

@@ -222,7 +222,7 @@
   void CreateBuilder() {
     ResetBuilder();  // Destroy any existing builder in the correct order.
 
-    model_updater_ = std::make_unique<app_list::FakeAppListModelUpdater>();
+    model_updater_ = std::make_unique<FakeAppListModelUpdater>();
     controller_ = std::make_unique<test::TestAppListControllerDelegate>();
     builder_ = std::make_unique<ArcAppModelBuilder>(controller_.get());
     builder_->Initialize(nullptr, profile_.get(), model_updater_.get());
@@ -464,7 +464,7 @@
 
  private:
   ArcAppTest arc_test_;
-  std::unique_ptr<app_list::FakeAppListModelUpdater> model_updater_;
+  std::unique_ptr<FakeAppListModelUpdater> model_updater_;
   std::unique_ptr<test::TestAppListControllerDelegate> controller_;
   std::unique_ptr<ArcAppModelBuilder> builder_;
 

diff --git a/chrome/browser/ui/app_list/chrome_app_list_item.h b/chrome/browser/ui/app_list/chrome_app_list_item.h
index 32d2868..5229474 100644
--- a/chrome/browser/ui/app_list/chrome_app_list_item.h
+++ b/chrome/browser/ui/app_list/chrome_app_list_item.h

@@ -12,11 +12,8 @@
 #include "chrome/browser/ui/app_list/app_list_syncable_service.h"
 
 class AppListControllerDelegate;
-class Profile;
-
-namespace app_list {
 class FakeAppListModelUpdater;
-}  // namespace app_list
+class Profile;
 
 namespace extensions {
 class AppSorting;
@@ -40,7 +37,7 @@
  protected:
   // TODO(hejq): Remove this once we break the inheritance from AppListItem and
   //             move those protected methods to public.
-  friend class app_list::FakeAppListModelUpdater;
+  friend class FakeAppListModelUpdater;
 
   ChromeAppListItem(Profile* profile, const std::string& app_id);
 

diff --git a/chrome/browser/ui/app_list/chrome_app_list_model_updater.cc b/chrome/browser/ui/app_list/chrome_app_list_model_updater.cc
index 71f5c447..19cdba5 100644
--- a/chrome/browser/ui/app_list/chrome_app_list_model_updater.cc
+++ b/chrome/browser/ui/app_list/chrome_app_list_model_updater.cc

@@ -13,11 +13,9 @@
 #include "ash/app_list/model/search/search_model.h"
 #include "extensions/common/constants.h"
 
-namespace app_list {
-
 ChromeAppListModelUpdater::ChromeAppListModelUpdater()
-    : model_(std::make_unique<AppListModel>()),
-      search_model_(std::make_unique<SearchModel>()) {}
+    : model_(std::make_unique<app_list::AppListModel>()),
+      search_model_(std::make_unique<app_list::SearchModel>()) {}
 
 ChromeAppListModelUpdater::~ChromeAppListModelUpdater() = default;
 
@@ -42,28 +40,29 @@
 
 void ChromeAppListModelUpdater::MoveItemToFolder(const std::string& id,
                                                  const std::string& folder_id) {
-  AppListItem* item = model_->FindItem(id);
+  app_list::AppListItem* item = model_->FindItem(id);
   model_->MoveItemToFolder(item, folder_id);
 }
 
 void ChromeAppListModelUpdater::SetItemPosition(
     const std::string& id,
     const syncer::StringOrdinal& new_position) {
-  AppListItem* item = model_->FindItem(id);
+  app_list::AppListItem* item = model_->FindItem(id);
   model_->SetItemPosition(item, new_position);
 }
 
-void ChromeAppListModelUpdater::SetStatus(AppListModel::Status status) {
+void ChromeAppListModelUpdater::SetStatus(
+    app_list::AppListModel::Status status) {
   model_->SetStatus(status);
 }
 
-void ChromeAppListModelUpdater::SetState(AppListModel::State state) {
+void ChromeAppListModelUpdater::SetState(app_list::AppListModel::State state) {
   model_->SetState(state);
 }
 
 void ChromeAppListModelUpdater::SetItemName(const std::string& id,
                                             const std::string& name) {
-  AppListItem* item = model_->FindItem(id);
+  app_list::AppListItem* item = model_->FindItem(id);
   if (item)
     model_->SetItemName(item, name);
 }
@@ -90,7 +89,7 @@
       model_->top_level_item_list()->item_at(index));
 }
 
-AppListFolderItem* ChromeAppListModelUpdater::FindFolderItem(
+app_list::AppListFolderItem* ChromeAppListModelUpdater::FindFolderItem(
     const std::string& folder_id) {
   return model_->FindFolderItem(folder_id);
 }
@@ -120,10 +119,11 @@
   return id_to_app_list_index;
 }
 
-AppListFolderItem* ChromeAppListModelUpdater::ResolveOemFolderPosition(
+app_list::AppListFolderItem*
+ChromeAppListModelUpdater::ResolveOemFolderPosition(
     const std::string& oem_folder_id,
     const syncer::StringOrdinal& preffered_oem_position) {
-  AppListFolderItem* oem_folder = FindFolderItem(oem_folder_id);
+  app_list::AppListFolderItem* oem_folder = FindFolderItem(oem_folder_id);
   if (oem_folder) {
     const syncer::StringOrdinal& oem_folder_pos =
         preffered_oem_position.IsValid() ? preffered_oem_position
@@ -136,7 +136,7 @@
 // For AppListSyncableService:
 void ChromeAppListModelUpdater::AddItemToOemFolder(
     std::unique_ptr<ChromeAppListItem> item,
-    AppListSyncableService::SyncItem* oem_sync_item,
+    app_list::AppListSyncableService::SyncItem* oem_sync_item,
     const std::string& oem_folder_id,
     const std::string& oem_folder_name,
     const syncer::StringOrdinal& preffered_oem_position) {
@@ -146,10 +146,10 @@
 }
 
 void ChromeAppListModelUpdater::UpdateAppItemFromSyncItem(
-    AppListSyncableService::SyncItem* sync_item,
+    app_list::AppListSyncableService::SyncItem* sync_item,
     bool update_name,
     bool update_folder) {
-  AppListItem* app_item = model_->FindItem(sync_item->item_id);
+  app_list::AppListItem* app_item = model_->FindItem(sync_item->item_id);
   if (!app_item)
     return;
 
@@ -160,7 +160,7 @@
   }
   // Only update the item name if it is a Folder or the name is empty.
   if (update_name && sync_item->item_name != app_item->name() &&
-      (app_item->GetItemType() == AppListFolderItem::kItemType ||
+      (app_item->GetItemType() == app_list::AppListFolderItem::kItemType ||
        app_item->name().empty())) {
     model_->SetItemName(app_item, sync_item->item_name);
   }
@@ -171,14 +171,16 @@
 }
 
 void ChromeAppListModelUpdater::FindOrCreateOemFolder(
-    AppListSyncableService::SyncItem* oem_sync_item,
+    app_list::AppListSyncableService::SyncItem* oem_sync_item,
     const std::string& oem_folder_id,
     const std::string& oem_folder_name,
     const syncer::StringOrdinal& preffered_oem_position) {
-  AppListFolderItem* oem_folder = model_->FindFolderItem(oem_folder_id);
+  app_list::AppListFolderItem* oem_folder =
+      model_->FindFolderItem(oem_folder_id);
   if (!oem_folder) {
-    std::unique_ptr<AppListFolderItem> new_folder(new AppListFolderItem(
-        oem_folder_id, AppListFolderItem::FOLDER_TYPE_OEM));
+    std::unique_ptr<app_list::AppListFolderItem> new_folder(
+        new app_list::AppListFolderItem(
+            oem_folder_id, app_list::AppListFolderItem::FOLDER_TYPE_OEM));
     syncer::StringOrdinal oem_position;
     if (oem_sync_item) {
       DCHECK(oem_sync_item->item_ordinal.IsValid());
@@ -191,8 +193,8 @@
       // Do not create a sync item for the OEM folder here, do it in
       // ResolveFolderPositions() when the item position is finalized.
     }
-    oem_folder =
-        static_cast<AppListFolderItem*>(model_->AddItem(std::move(new_folder)));
+    oem_folder = static_cast<app_list::AppListFolderItem*>(
+        model_->AddItem(std::move(new_folder)));
     model_->SetItemPosition(oem_folder, oem_position);
   }
   model_->SetItemName(oem_folder, oem_folder_name);
@@ -203,7 +205,7 @@
   // followed by a pre-installed app (e.g. Search), so the poosition should be
   // stable. TODO(stevenjb): consider explicitly setting the OEM folder location
   // along with the name in ServicesCustomizationDocument::SetOemFolderName().
-  AppListItemList* item_list = model_->top_level_item_list();
+  app_list::AppListItemList* item_list = model_->top_level_item_list();
   if (!item_list->item_count()) {
     LOG(ERROR) << "No top level item was found. "
                << "Placing OEM folder at the beginning.";
@@ -221,10 +223,10 @@
   }
 
   // Skip items with the same position.
-  const AppListItem* web_store_app_item =
+  const app_list::AppListItem* web_store_app_item =
       item_list->item_at(web_store_app_index);
   for (size_t j = web_store_app_index + 1; j < item_list->item_count(); ++j) {
-    const AppListItem* next_item = item_list->item_at(j);
+    const app_list::AppListItem* next_item = item_list->item_at(j);
     DCHECK(next_item->position().IsValid());
     if (!next_item->position().Equals(web_store_app_item->position())) {
       const syncer::StringOrdinal oem_ordinal =
@@ -241,5 +243,3 @@
           << " position: " << oem_ordinal.ToDebugString();
   return oem_ordinal;
 }
-
-};  // namespace app_list

diff --git a/chrome/browser/ui/app_list/chrome_app_list_model_updater.h b/chrome/browser/ui/app_list/chrome_app_list_model_updater.h
index bd5a235..d3f3c9e 100644
--- a/chrome/browser/ui/app_list/chrome_app_list_model_updater.h
+++ b/chrome/browser/ui/app_list/chrome_app_list_model_updater.h

@@ -13,9 +13,9 @@
 #include "chrome/browser/ui/app_list/app_list_syncable_service.h"
 
 namespace app_list {
-
 class AppListModel;
 class SearchModel;
+}  // namespace app_list
 
 class ChromeAppListModelUpdater : public AppListModelUpdater {
  public:
@@ -32,8 +32,8 @@
                         const std::string& folder_id) override;
   void SetItemPosition(const std::string& id,
                        const syncer::StringOrdinal& new_position) override;
-  void SetStatus(AppListModel::Status status) override;
-  void SetState(AppListModel::State state) override;
+  void SetStatus(app_list::AppListModel::Status status) override;
+  void SetState(app_list::AppListModel::State state) override;
   void SetItemName(const std::string& id, const std::string& name) override;
   void HighlightItemInstalledFromUI(const std::string& id) override;
   void SetSearchEngineIsGoogle(bool is_google) override;
@@ -41,7 +41,8 @@
   ChromeAppListItem* FindItem(const std::string& id) override;
   size_t ItemCount() override;
   ChromeAppListItem* ItemAtForTest(size_t index) override;
-  AppListFolderItem* FindFolderItem(const std::string& folder_id) override;
+  app_list::AppListFolderItem* FindFolderItem(
+      const std::string& folder_id) override;
   bool FindItemIndexForTest(const std::string& id, size_t* index) override;
   bool TabletMode() override;
   app_list::AppListViewState StateFullscreen() override;
@@ -49,37 +50,37 @@
   std::map<std::string, size_t> GetIdToAppListIndexMap() override;
 
   // For SynchableService:
-  void AddItemToOemFolder(std::unique_ptr<ChromeAppListItem> item,
-                          AppListSyncableService::SyncItem* oem_sync_item,
-                          const std::string& oem_folder_id,
-                          const std::string& oem_folder_name,
-                          const syncer::StringOrdinal& preffered_oem_position);
-  AppListFolderItem* ResolveOemFolderPosition(
+  void AddItemToOemFolder(
+      std::unique_ptr<ChromeAppListItem> item,
+      app_list::AppListSyncableService::SyncItem* oem_sync_item,
+      const std::string& oem_folder_id,
+      const std::string& oem_folder_name,
+      const syncer::StringOrdinal& preffered_oem_position);
+  app_list::AppListFolderItem* ResolveOemFolderPosition(
       const std::string& oem_folder_id,
       const syncer::StringOrdinal& preffered_oem_position);
-  void UpdateAppItemFromSyncItem(AppListSyncableService::SyncItem* sync_item,
-                                 bool update_name,
-                                 bool update_folder);
+  void UpdateAppItemFromSyncItem(
+      app_list::AppListSyncableService::SyncItem* sync_item,
+      bool update_name,
+      bool update_folder);
 
  private:
   // TODO(hejq): Remove this friend. Currently |model_| and |search_model_| are
   // exposed to AppListViewDelegate via AppListSyncableService. We'll remove
   // this once we remove AppListViewDelegate.
-  friend class AppListSyncableService;
+  friend class app_list::AppListSyncableService;
 
   void FindOrCreateOemFolder(
-      AppListSyncableService::SyncItem* oem_sync_item,
+      app_list::AppListSyncableService::SyncItem* oem_sync_item,
       const std::string& oem_folder_id,
       const std::string& oem_folder_name,
       const syncer::StringOrdinal& preffered_oem_position);
   syncer::StringOrdinal GetOemFolderPos();
 
-  std::unique_ptr<AppListModel> model_;
-  std::unique_ptr<SearchModel> search_model_;
+  std::unique_ptr<app_list::AppListModel> model_;
+  std::unique_ptr<app_list::SearchModel> search_model_;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeAppListModelUpdater);
 };
 
-}  // namespace app_list
-
 #endif  // CHROME_BROWSER_UI_APP_LIST_CHROME_APP_LIST_MODEL_UPDATER_H_

diff --git a/chrome/browser/ui/app_list/extension_app_model_builder_unittest.cc b/chrome/browser/ui/app_list/extension_app_model_builder_unittest.cc
index 154c5c6..ce82099 100644
--- a/chrome/browser/ui/app_list/extension_app_model_builder_unittest.cc
+++ b/chrome/browser/ui/app_list/extension_app_model_builder_unittest.cc

@@ -42,8 +42,7 @@
 namespace {
 
 // Get a set of all apps in |model|.
-std::set<std::string> GetModelContent(
-    app_list::AppListModelUpdater* model_updater) {
+std::set<std::string> GetModelContent(AppListModelUpdater* model_updater) {
   std::set<std::string> content;
   for (size_t i = 0; i < model_updater->ItemCount(); ++i)
     content.insert(model_updater->ItemAtForTest(i)->name());
@@ -94,7 +93,7 @@
   void CreateBuilder() {
     ResetBuilder();  // Destroy any existing builder in the correct order.
 
-    model_updater_ = std::make_unique<app_list::FakeAppListModelUpdater>();
+    model_updater_ = std::make_unique<FakeAppListModelUpdater>();
     controller_ = std::make_unique<test::TestAppListControllerDelegate>();
     builder_ = std::make_unique<ExtensionAppModelBuilder>(controller_.get());
     builder_->Initialize(nullptr, profile_.get(), model_updater_.get());
@@ -106,7 +105,7 @@
     model_updater_.reset();
   }
 
-  std::unique_ptr<app_list::FakeAppListModelUpdater> model_updater_;
+  std::unique_ptr<FakeAppListModelUpdater> model_updater_;
   std::unique_ptr<test::TestAppListControllerDelegate> controller_;
   std::unique_ptr<ExtensionAppModelBuilder> builder_;
   std::set<std::string> default_apps_;
@@ -141,7 +140,7 @@
   service_->AddExtension(enterprise_store.get());
 
   // Web stores should be present in the model.
-  app_list::FakeAppListModelUpdater model_updater1;
+  FakeAppListModelUpdater model_updater1;
   ExtensionAppModelBuilder builder1(controller_.get());
   builder1.Initialize(nullptr, profile_.get(), &model_updater1);
   EXPECT_TRUE(model_updater1.FindItem(store->id()));
@@ -155,7 +154,7 @@
   EXPECT_FALSE(model_updater1.FindItem(enterprise_store->id()));
 
   // Build a new model; web stores should NOT be present.
-  app_list::FakeAppListModelUpdater model_updater2;
+  FakeAppListModelUpdater model_updater2;
   ExtensionAppModelBuilder builder2(controller_.get());
   builder2.Initialize(nullptr, profile_.get(), &model_updater2);
   EXPECT_FALSE(model_updater2.FindItem(store->id()));

diff --git a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.cc b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.cc
index d55ee9a4..4e0d93d 100644
--- a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.cc
+++ b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.cc

@@ -60,7 +60,7 @@
 
 AnswerCardSearchProvider::AnswerCardSearchProvider(
     Profile* profile,
-    app_list::AppListModelUpdater* model_updater,
+    AppListModelUpdater* model_updater,
     AppListControllerDelegate* list_controller,
     std::unique_ptr<AnswerCardContents> contents0,
     std::unique_ptr<AnswerCardContents> contents1)

diff --git a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.h b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.h
index f23c1295..a0b7735 100644
--- a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.h
+++ b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider.h

@@ -14,21 +14,18 @@
 #include "url/gurl.h"
 
 class AppListControllerDelegate;
+class AppListModelUpdater;
 class Profile;
 class TemplateURLService;
 
 namespace app_list {
-class AppListModelUpdater;
-}
-
-namespace app_list {
 
 // Search provider for the answer card.
 class AnswerCardSearchProvider : public SearchProvider,
                                  public AnswerCardContents::Delegate {
  public:
   AnswerCardSearchProvider(Profile* profile,
-                           app_list::AppListModelUpdater* model_updater,
+                           AppListModelUpdater* model_updater,
                            AppListControllerDelegate* list_controller,
                            std::unique_ptr<AnswerCardContents> contents0,
                            std::unique_ptr<AnswerCardContents> contents1);
@@ -92,7 +89,7 @@
   Profile* const profile_;
 
   // Unowned pointer to app list model updater.
-  app_list::AppListModelUpdater* const model_updater_;
+  AppListModelUpdater* const model_updater_;
 
   // Unowned pointer to app list controller.
   AppListControllerDelegate* const list_controller_;

diff --git a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider_unittest.cc b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider_unittest.cc
index 79355b7..946c336e 100644
--- a/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider_unittest.cc
+++ b/chrome/browser/ui/app_list/search/answer_card/answer_card_search_provider_unittest.cc

@@ -134,7 +134,7 @@
   void SetUp() override {
     AppListTestBase::SetUp();
 
-    model_updater_ = std::make_unique<app_list::FakeAppListModelUpdater>();
+    model_updater_ = std::make_unique<FakeAppListModelUpdater>();
     model_updater_->SetSearchEngineIsGoogle(true);
 
     controller_ = base::MakeUnique<::test::TestAppListControllerDelegate>();
@@ -169,7 +169,7 @@
   }
 
  private:
-  std::unique_ptr<app_list::FakeAppListModelUpdater> model_updater_;
+  std::unique_ptr<FakeAppListModelUpdater> model_updater_;
   std::unique_ptr<AnswerCardSearchProvider> provider_;
   std::unique_ptr<::test::TestAppListControllerDelegate> controller_;
   MockAnswerCardContents* contents0_ = nullptr;  // Unowned.

diff --git a/chrome/browser/ui/app_list/search/app_search_provider.h b/chrome/browser/ui/app_list/search/app_search_provider.h
index bd9c54e..5a3364d 100644
--- a/chrome/browser/ui/app_list/search/app_search_provider.h
+++ b/chrome/browser/ui/app_list/search/app_search_provider.h

@@ -14,6 +14,7 @@
 #include "ui/app_list/search_provider.h"
 
 class AppListControllerDelegate;
+class AppListModelUpdater;
 class Profile;
 
 namespace base {
@@ -22,8 +23,6 @@
 
 namespace app_list {
 
-class AppListModelUpdater;
-
 class AppSearchProvider : public SearchProvider {
  public:
   class App;

diff --git a/chrome/browser/ui/app_list/search/app_search_provider_unittest.cc b/chrome/browser/ui/app_list/search/app_search_provider_unittest.cc
index e3e73e5e..dbac8db 100644
--- a/chrome/browser/ui/app_list/search/app_search_provider_unittest.cc
+++ b/chrome/browser/ui/app_list/search/app_search_provider_unittest.cc

@@ -64,7 +64,7 @@
   void SetUp() override {
     AppListTestBase::SetUp();
 
-    model_updater_ = std::make_unique<app_list::FakeAppListModelUpdater>();
+    model_updater_ = std::make_unique<FakeAppListModelUpdater>();
     controller_.reset(new ::test::TestAppListControllerDelegate);
   }
 
@@ -142,7 +142,7 @@
 
  private:
   std::unique_ptr<app_list::AppListModel> model_;
-  std::unique_ptr<app_list::FakeAppListModelUpdater> model_updater_;
+  std::unique_ptr<FakeAppListModelUpdater> model_updater_;
   std::unique_ptr<AppSearchProvider> app_search_;
   std::unique_ptr<::test::TestAppListControllerDelegate> controller_;
   ArcAppTest arc_test_;

diff --git a/chrome/browser/ui/app_list/test/chrome_app_list_test_support.cc b/chrome/browser/ui/app_list/test/chrome_app_list_test_support.cc
index a78d8fe..7c147d90 100644
--- a/chrome/browser/ui/app_list/test/chrome_app_list_test_support.cc
+++ b/chrome/browser/ui/app_list/test/chrome_app_list_test_support.cc

@@ -54,7 +54,7 @@
 
 }  // namespace
 
-app_list::AppListModelUpdater* GetModelUpdater(AppListService* service) {
+AppListModelUpdater* GetModelUpdater(AppListService* service) {
   return app_list::AppListSyncableServiceFactory::GetForProfile(
              service->GetCurrentAppListProfile())
       ->GetModelUpdater();

diff --git a/chrome/browser/ui/app_list/test/chrome_app_list_test_support.h b/chrome/browser/ui/app_list/test/chrome_app_list_test_support.h
index 557f671..3e94f91 100644
--- a/chrome/browser/ui/app_list/test/chrome_app_list_test_support.h
+++ b/chrome/browser/ui/app_list/test/chrome_app_list_test_support.h

@@ -6,10 +6,10 @@
 #define CHROME_BROWSER_UI_APP_LIST_TEST_CHROME_APP_LIST_TEST_SUPPORT_H_
 
 namespace app_list {
-class AppListModelUpdater;
 class SearchModel;
 }
 
+class AppListModelUpdater;
 class AppListService;
 class AppListServiceImpl;
 class Profile;
@@ -18,7 +18,7 @@
 
 // Gets the model updater keyed to the profile currently associated with
 // |service|.
-app_list::AppListModelUpdater* GetModelUpdater(AppListService* service);
+AppListModelUpdater* GetModelUpdater(AppListService* service);
 
 // TODO(hejq): Merge it into model updater.
 // Gets the search model keyed to the profile currently associated with

diff --git a/chrome/browser/ui/app_list/test/fake_app_list_model_updater.cc b/chrome/browser/ui/app_list/test/fake_app_list_model_updater.cc
index f2fe742..55f0f89 100644
--- a/chrome/browser/ui/app_list/test/fake_app_list_model_updater.cc
+++ b/chrome/browser/ui/app_list/test/fake_app_list_model_updater.cc

@@ -6,8 +6,6 @@
 
 #include <utility>
 
-namespace app_list {
-
 FakeAppListModelUpdater::FakeAppListModelUpdater() {}
 
 FakeAppListModelUpdater::~FakeAppListModelUpdater() {}
@@ -78,7 +76,7 @@
   return false;
 }
 
-AppListFolderItem* FakeAppListModelUpdater::FindFolderItem(
+app_list::AppListFolderItem* FakeAppListModelUpdater::FindFolderItem(
     const std::string& folder_id) {
   return nullptr;
 }
@@ -102,5 +100,3 @@
 bool FakeAppListModelUpdater::SearchEngineIsGoogle() {
   return search_engine_is_google_;
 }
-
-}  // namespace app_list

diff --git a/chrome/browser/ui/app_list/test/fake_app_list_model_updater.h b/chrome/browser/ui/app_list/test/fake_app_list_model_updater.h
index c9e2f30..9fee195 100644
--- a/chrome/browser/ui/app_list/test/fake_app_list_model_updater.h
+++ b/chrome/browser/ui/app_list/test/fake_app_list_model_updater.h

@@ -12,8 +12,6 @@
 
 #include "chrome/browser/ui/app_list/app_list_model_updater.h"
 
-namespace app_list {
-
 class FakeAppListModelUpdater : public AppListModelUpdater {
  public:
   FakeAppListModelUpdater();
@@ -37,7 +35,8 @@
   ChromeAppListItem* FindItem(const std::string& id) override;
   size_t ItemCount() override;
   ChromeAppListItem* ItemAtForTest(size_t index) override;
-  AppListFolderItem* FindFolderItem(const std::string& folder_id) override;
+  app_list::AppListFolderItem* FindFolderItem(
+      const std::string& folder_id) override;
   bool FindItemIndexForTest(const std::string& id, size_t* index) override;
   app_list::AppListViewState StateFullscreen() override;
   std::map<std::string, size_t> GetIdToAppListIndexMap() override;
@@ -52,6 +51,4 @@
   DISALLOW_COPY_AND_ASSIGN(FakeAppListModelUpdater);
 };
 
-}  // namespace app_list
-
 #endif  // CHROME_BROWSER_UI_APP_LIST_TEST_FAKE_APP_LIST_MODEL_UPDATER_H_

diff --git a/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.cc b/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.cc
index a05e10a..ceab8beb 100644
--- a/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.cc
+++ b/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.cc

@@ -7,9 +7,8 @@
 #include "chrome/browser/ui/app_list/app_list_model_updater.h"
 #include "chrome/browser/ui/ash/app_sync_ui_state.h"
 
-AppSyncUIStateWatcher::AppSyncUIStateWatcher(
-    Profile* profile,
-    app_list::AppListModelUpdater* model_updater)
+AppSyncUIStateWatcher::AppSyncUIStateWatcher(Profile* profile,
+                                             AppListModelUpdater* model_updater)
     : app_sync_ui_state_(AppSyncUIState::Get(profile)),
       model_updater_(model_updater) {
   if (app_sync_ui_state_) {

diff --git a/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.h b/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.h
index 34fe8cf..8c21e10 100644
--- a/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.h
+++ b/chrome/browser/ui/ash/app_list/app_sync_ui_state_watcher.h

@@ -9,10 +9,7 @@
 #include "base/macros.h"
 #include "chrome/browser/ui/ash/app_sync_ui_state_observer.h"
 
-namespace app_list {
 class AppListModelUpdater;
-}
-
 class AppSyncUIState;
 class Profile;
 
@@ -20,8 +17,7 @@
 // of the given profile changes.
 class AppSyncUIStateWatcher : public AppSyncUIStateObserver {
  public:
-  AppSyncUIStateWatcher(Profile* profile,
-                        app_list::AppListModelUpdater* model_updater);
+  AppSyncUIStateWatcher(Profile* profile, AppListModelUpdater* model_updater);
   ~AppSyncUIStateWatcher() override;
 
  private:
@@ -30,7 +26,7 @@
 
   AppSyncUIState* app_sync_ui_state_;
   // Owned by AppListSyncableService
-  app_list::AppListModelUpdater* model_updater_;
+  AppListModelUpdater* model_updater_;
 
   DISALLOW_COPY_AND_ASSIGN(AppSyncUIStateWatcher);
 };

diff --git a/chrome/browser/ui/cocoa/autofill/save_card_bubble_view_views.mm b/chrome/browser/ui/cocoa/autofill/save_card_bubble_view_views.mm
index 3f64022..52f2283 100644
--- a/chrome/browser/ui/cocoa/autofill/save_card_bubble_view_views.mm
+++ b/chrome/browser/ui/cocoa/autofill/save_card_bubble_view_views.mm

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/feature_list.h"
+#include "chrome/browser/platform_util.h"
 #include "chrome/browser/ui/cocoa/autofill/save_card_bubble_view_bridge.h"
 #include "chrome/browser/ui/cocoa/browser_dialogs_views_mac.h"
 #include "chrome/browser/ui/cocoa/browser_window_cocoa.h"
@@ -23,19 +24,19 @@
     BrowserWindowController* browser_window_controller,
     bool user_gesture) {
   if (base::FeatureList::IsEnabled(kAutofillToolkitViewsCreditCardDialogsMac)) {
+    NSWindow* parent_window = [browser_window_controller window];
     LocationBarViewMac* location_bar =
         [browser_window_controller locationBarBridge];
     gfx::Point anchor =
         gfx::ScreenPointFromNSPoint(ui::ConvertPointFromWindowToScreen(
-            [browser_window_controller window],
-            location_bar->GetSaveCreditCardBubblePoint()));
+            parent_window, location_bar->GetSaveCreditCardBubblePoint()));
     autofill::SaveCardBubbleViews* bubble =
         new SaveCardBubbleViews(nullptr, anchor, web_contents, controller);
 
     // Usually the anchor view determines the arrow type, but there is none in
     // MacViews. So always use TOP_RIGHT, even in fullscreen.
     bubble->set_arrow(views::BubbleBorder::TOP_RIGHT);
-    bubble->set_parent_window(web_contents->GetNativeView());
+    bubble->set_parent_window(platform_util::GetViewForWindow(parent_window));
     views::BubbleDialogDelegateView::CreateBubble(bubble);
     bubble->Show(user_gesture ? autofill::SaveCardBubbleViews::USER_GESTURE
                               : autofill::SaveCardBubbleViews::AUTOMATIC);

diff --git a/chrome/browser/ui/search/local_ntp_doodle_browsertest.cc b/chrome/browser/ui/search/local_ntp_doodle_browsertest.cc
index 034d0ef..ba5b0bc 100644
--- a/chrome/browser/ui/search/local_ntp_doodle_browsertest.cc
+++ b/chrome/browser/ui/search/local_ntp_doodle_browsertest.cc

@@ -320,8 +320,9 @@
   EXPECT_THAT(GetComputedDisplay(active_tab, "logo-doodle-iframe"),
               Eq<std::string>("block"));
 
-  EXPECT_THAT(GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
-              Eq<std::string>("https://www.chromium.org/interactive"));
+  EXPECT_THAT(
+      GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
+      Eq<std::string>("https://www.chromium.org/interactive?gws_rd=cr"));
   EXPECT_THAT(GetElementProperty(active_tab, "logo-doodle-iframe", "title"),
               Eq<std::string>("alt text"));
 }
@@ -435,8 +436,9 @@
               Eq<std::string>("none"));
   EXPECT_THAT(GetComputedDisplay(active_tab, "logo-doodle-iframe"),
               Eq<std::string>("block"));
-  EXPECT_THAT(GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
-              Eq<std::string>("https://www.chromium.org/interactive"));
+  EXPECT_THAT(
+      GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
+      Eq<std::string>("https://www.chromium.org/interactive?gws_rd=cr"));
 }
 
 IN_PROC_BROWSER_TEST_F(LocalNTPDoodleTest, ShouldNotFadeFromInteractiveDoodle) {
@@ -467,8 +469,9 @@
               Eq<std::string>("none"));
   EXPECT_THAT(GetComputedDisplay(active_tab, "logo-doodle-iframe"),
               Eq<std::string>("block"));
-  EXPECT_THAT(GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
-              Eq<std::string>("https://www.chromium.org/interactive"));
+  EXPECT_THAT(
+      GetElementProperty(active_tab, "logo-doodle-iframe", "src"),
+      Eq<std::string>("https://www.chromium.org/interactive?gws_rd=cr"));
 }
 
 IN_PROC_BROWSER_TEST_F(LocalNTPDoodleTest,

diff --git a/chrome/browser/ui/views/hover_button.cc b/chrome/browser/ui/views/hover_button.cc
index ffed61d..825cf47 100644
--- a/chrome/browser/ui/views/hover_button.cc
+++ b/chrome/browser/ui/views/hover_button.cc

@@ -9,6 +9,7 @@
 #include "chrome/browser/ui/views/harmony/chrome_layout_provider.h"
 #include "chrome/browser/ui/views/harmony/chrome_typography.h"
 #include "ui/base/material_design/material_design_controller.h"
+#include "ui/gfx/color_palette.h"
 #include "ui/views/animation/ink_drop_highlight.h"
 #include "ui/views/animation/ink_drop_ripple.h"
 #include "ui/views/background.h"
@@ -286,6 +287,32 @@
   }
 }
 
+void HoverButton::SetStyle(Style style) {
+  SkColor background_color = 0, subtitle_text_color = 0;
+  switch (style) {
+    case STYLE_PROMINENT:
+      // White text on |gfx::kGoogleBlue500| would be adjusted by
+      // AutoColorRedability. However, this specific combination has an
+      // exception (http://go/mdcontrast). So, disable AutoColorReadability.
+      title_->set_auto_color_readability_enabled(false);
+      background_color = GetNativeTheme()->GetSystemColor(
+          ui::NativeTheme::kColorId_ProminentButtonColor);
+      subtitle_text_color = GetNativeTheme()->GetSystemColor(
+          ui::NativeTheme::kColorId_TextOnProminentButtonColor);
+      break;
+    case STYLE_ERROR:
+      background_color = gfx::kGoogleRed700;
+      subtitle_text_color = SK_ColorWHITE;
+      break;
+    default:
+      NOTREACHED();
+  }
+  SetBackground(views::CreateSolidBackground(background_color));
+  SetTitleTextStyle(views::style::STYLE_DIALOG_BUTTON_DEFAULT,
+                    background_color);
+  SetSubtitleColor(subtitle_text_color);
+}
+
 void HoverButton::SetTitleTextStyle(views::style::TextStyle text_style,
                                     SkColor background_color) {
   title_->SetDisplayedOnBackgroundColor(background_color);

diff --git a/chrome/browser/ui/views/hover_button.h b/chrome/browser/ui/views/hover_button.h
index e97b47a..dd2b58c 100644
--- a/chrome/browser/ui/views/hover_button.h
+++ b/chrome/browser/ui/views/hover_button.h

@@ -24,6 +24,8 @@
 // when hovered over.
 class HoverButton : public views::LabelButton {
  public:
+  enum Style { STYLE_PROMINENT, STYLE_ERROR };
+
   // Creates a single line hover button with no icon.
   HoverButton(views::ButtonListener* button_listener,
               const base::string16& text);
@@ -54,6 +56,9 @@
   // non-empty subtitle.
   void SetSubtitleElideBehavior(gfx::ElideBehavior elide_behavior);
 
+  // Adjusts the background and the text color according to |style|.
+  void SetStyle(Style style);
+
   // Sets the text style of the title considering the color of the background.
   // Passing |background_color| makes sure that the text color will not be
   // changed to a color that is not readable on the specified background.

diff --git a/chrome/browser/ui/views/profiles/profile_chooser_view.cc b/chrome/browser/ui/views/profiles/profile_chooser_view.cc
index 3ab65d0..092d8fe7e 100644
--- a/chrome/browser/ui/views/profiles/profile_chooser_view.cc
+++ b/chrome/browser/ui/views/profiles/profile_chooser_view.cc

@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/macros.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
@@ -21,7 +22,9 @@
 #include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/profiles/profile_window.h"
 #include "chrome/browser/profiles/profiles_state.h"
+#include "chrome/browser/signin/account_tracker_service_factory.h"
 #include "chrome/browser/signin/chrome_signin_helper.h"
+#include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/signin/signin_error_controller_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
@@ -44,6 +47,7 @@
 #include "chrome/browser/ui/views/profiles/badged_profile_photo.h"
 #include "chrome/browser/ui/views/profiles/signin_view_controller_delegate_views.h"
 #include "chrome/browser/ui/views/profiles/user_manager_view.h"
+#include "chrome/browser/ui/webui/signin/dice_turn_sync_on_helper.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service_factory.h"
 #include "chrome/common/pref_names.h"
@@ -53,11 +57,14 @@
 #include "chrome/grit/theme_resources.h"
 #include "components/browser_sync/profile_sync_service.h"
 #include "components/prefs/pref_service.h"
+#include "components/signin/core/browser/account_tracker_service.h"
+#include "components/signin/core/browser/gaia_cookie_manager_service.h"
 #include "components/signin/core/browser/profile_management_switches.h"
 #include "components/signin/core/browser/profile_oauth2_token_service.h"
 #include "components/signin/core/browser/signin_error_controller.h"
 #include "components/signin/core/browser/signin_header_helper.h"
 #include "components/signin/core/browser/signin_manager.h"
+#include "components/signin/core/browser/signin_metrics.h"
 #include "components/sync/driver/sync_error_controller.h"
 #include "components/vector_icons/vector_icons.h"
 #include "content/public/browser/render_widget_host_view.h"
@@ -178,6 +185,41 @@
                             : BadgedProfilePhoto::BADGE_TYPE_SUPERVISOR;
 }
 
+// Returns the list of all accounts that have a token. The default account in
+// the Gaia cookies will be the first account in the list.
+// TODO(tangltom): Move this code to chrome/browser/ui/signin and add a unit
+// test.
+std::vector<AccountInfo> GetAccountsForProfile(Profile* profile) {
+  // Fetch account ids for accounts that have a token.
+  ProfileOAuth2TokenService* token_service =
+      ProfileOAuth2TokenServiceFactory::GetForProfile(profile);
+  std::vector<std::string> account_ids = token_service->GetAccounts();
+  // Fetch accounts in the Gaia cookies.
+  GaiaCookieManagerService* cookie_manager_service =
+      GaiaCookieManagerServiceFactory::GetForProfile(profile);
+  std::vector<gaia::ListedAccount> cookie_accounts;
+  bool gaia_accounts_stale = !cookie_manager_service->ListAccounts(
+      &cookie_accounts, nullptr, "ProfileChooserView");
+  UMA_HISTOGRAM_BOOLEAN("Profile.DiceUI.GaiaAccountsStale",
+                        gaia_accounts_stale);
+  // Fetch account information for each id and make sure that the first account
+  // in the list matches the first account in the Gaia cookies (if available).
+  AccountTrackerService* account_tracker_service =
+      AccountTrackerServiceFactory::GetForProfile(profile);
+  std::string gaia_default_account_id =
+      cookie_accounts.empty() ? "" : cookie_accounts[0].id;
+  std::vector<AccountInfo> accounts;
+  for (const std::string& account_id : account_ids) {
+    AccountInfo account_info =
+        account_tracker_service->GetAccountInfo(account_id);
+    if (account_id == cookie_accounts[0].id)
+      accounts.insert(accounts.begin(), account_info);
+    else
+      accounts.push_back(account_info);
+  }
+  return accounts;
+}
+
 }  // namespace
 
 // A title card with one back button left aligned and one label center aligned.
@@ -356,6 +398,7 @@
   manage_accounts_link_ = nullptr;
   manage_accounts_button_ = nullptr;
   signin_current_profile_button_ = nullptr;
+  signin_with_gaia_account_button_ = nullptr;
   current_profile_card_ = nullptr;
   first_profile_button_ = nullptr;
   guest_profile_button_ = nullptr;
@@ -629,9 +672,13 @@
         profiles::BUBBLE_VIEW_MODE_ACCOUNT_MANAGEMENT :
         profiles::BUBBLE_VIEW_MODE_PROFILE_CHOOSER);
   } else if (sender == current_profile_card_) {
-    avatar_menu_->EditProfile(avatar_menu_->GetActiveProfileIndex());
-    PostActionPerformed(ProfileMetrics::PROFILE_DESKTOP_MENU_EDIT_IMAGE);
-    PostActionPerformed(ProfileMetrics::PROFILE_DESKTOP_MENU_EDIT_NAME);
+    if (signin::IsDiceEnabledForProfile(browser_->profile()->GetPrefs())) {
+      chrome::ShowSettingsSubPage(browser_, chrome::kSyncSetupSubPage);
+    } else {
+      avatar_menu_->EditProfile(avatar_menu_->GetActiveProfileIndex());
+      PostActionPerformed(ProfileMetrics::PROFILE_DESKTOP_MENU_EDIT_IMAGE);
+      PostActionPerformed(ProfileMetrics::PROFILE_DESKTOP_MENU_EDIT_NAME);
+    }
   } else if (sender == manage_accounts_button_) {
     // This button can either mean show/hide the account management view,
     // depending on which view it is displayed.
@@ -640,6 +687,13 @@
                          : profiles::BUBBLE_VIEW_MODE_ACCOUNT_MANAGEMENT);
   } else if (sender == signin_current_profile_button_) {
     ShowViewFromMode(profiles::BUBBLE_VIEW_MODE_GAIA_SIGNIN);
+  } else if (sender == signin_with_gaia_account_button_) {
+    // DiceTurnSyncOnHelper deletes itself once it's done.
+    new DiceTurnSyncOnHelper(
+        browser_->profile(), browser_, access_point_,
+        signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT,
+        signin_with_gaia_account_id_);
+
   } else {
     // Either one of the "other profiles", or one of the profile accounts
     // buttons was pressed.
@@ -870,13 +924,7 @@
       new HoverButton(this, std::move(current_profile_photo),
                       l10n_util::GetStringUTF16(title_string_id),
                       l10n_util::GetStringUTF16(subtitle_string_id));
-  hover_button->SetBackground(views::CreateSolidBackground(gfx::kGoogleRed700));
-  // The sync-error hover button is supposed to look similar to a default
-  // button, therefore the title should have the same style as the title of a
-  // default button.
-  hover_button->SetTitleTextStyle(views::style::STYLE_DIALOG_BUTTON_DEFAULT,
-                                  gfx::kGoogleRed700);
-  hover_button->SetSubtitleColor(SK_ColorWHITE);
+  hover_button->SetStyle(HoverButton::STYLE_ERROR);
 
   view->AddChildView(hover_button);
   sync_error_button_ = hover_button;
@@ -991,15 +1039,22 @@
 }
 
 views::View* ProfileChooserView::CreateDiceSigninView() {
-  // Creates a view that holds an illustration and a promo, which includes a
+  // Fetch signed in GAIA web accounts.
+  std::vector<AccountInfo> accounts =
+      GetAccountsForProfile(browser_->profile());
+
+  // Create a view that holds an illustration and a promo, which includes a
   // button. The illustration should slightly overlap with the promo at the
   // bottom, therefore between_child_spacing of |view| is set to negative
   // |kIllustrationPromoOverlap|. The illustration will be changed in the
   // future, once the final asset is ready.
   constexpr int kIllustrationPromoOverlap = 48;
+  const int additional_bottom_spacing = accounts.empty() ? 0 : 8;
   views::View* view = new views::View();
   view->SetLayoutManager(std::make_unique<views::BoxLayout>(
-      views::BoxLayout::kVertical, gfx::Insets(), -kIllustrationPromoOverlap));
+      views::BoxLayout::kVertical,
+      gfx::Insets(0, 0, additional_bottom_spacing, 0),
+      -kIllustrationPromoOverlap));
 
   ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
   views::ImageView* illustration = new views::ImageView();
@@ -1008,23 +1063,79 @@
            .ToImageSkia());
   view->AddChildView(illustration);
 
-  views::View* promo_button_view = new views::View();
-  promo_button_view->SetLayoutManager(std::make_unique<views::BoxLayout>(
-      views::BoxLayout::kVertical,
-      gfx::Insets(0, kMenuEdgeMargin, kMenuEdgeMargin, kMenuEdgeMargin),
-      kMenuEdgeMargin));
+  views::View* promo_button_container = new views::View();
+  // There are no insets in |promo_button_container| because the child views
+  // have different borders. Even though |promo| and the sign-in button have
+  // borders on the left and right, |sync_to_another_account| stretches over the
+  // entire width.
+  promo_button_container->SetLayoutManager(
+      std::make_unique<views::BoxLayout>(views::BoxLayout::kVertical));
   views::Label* promo = new views::Label(
       l10n_util::GetStringUTF16(IDS_PROFILES_DICE_SIGNIN_PROMO));
   promo->SetMultiLine(true);
   promo->SetHorizontalAlignment(gfx::ALIGN_LEFT);
   promo->SetMaximumWidth(menu_width_ - 2 * kMenuEdgeMargin);
-  promo_button_view->AddChildView(promo);
+  promo->SetBorder(
+      views::CreateEmptyBorder(0, kMenuEdgeMargin, 0, kMenuEdgeMargin));
+  promo_button_container->AddChildView(promo);
 
-  signin_current_profile_button_ =
-      views::MdTextButton::CreateSecondaryUiBlueButton(
-          this, l10n_util::GetStringUTF16(IDS_PROFILES_DICE_SIGNIN_BUTTON));
-  promo_button_view->AddChildView(signin_current_profile_button_);
-  view->AddChildView(promo_button_view);
+  // A border around the sign-in button is created. HoverButton already has its
+  // own border and a second border can't be added, therefore a parent view with
+  // a border has to be created.
+  views::View* signin_button_view = new views::View();
+  signin_button_view->SetLayoutManager(new views::FillLayout());
+  signin_button_view->SetBorder(
+      views::CreateSolidBorder(kMenuEdgeMargin, SK_ColorTRANSPARENT));
+
+  if (accounts.empty()) {
+    // When there is no signed in web account, just display a sign-in button.
+    signin_current_profile_button_ =
+        views::MdTextButton::CreateSecondaryUiBlueButton(
+            this, l10n_util::GetStringUTF16(IDS_PROFILES_DICE_SIGNIN_BUTTON));
+
+    signin_button_view->AddChildView(signin_current_profile_button_);
+    promo_button_container->AddChildView(signin_button_view);
+    view->AddChildView(promo_button_container);
+    return view;
+  }
+
+  // Create a hover button to sign in the first account of |accounts|.
+  // TODO(http://crbug.com/794522): Use the account picture instead of the
+  // default avatar.
+  gfx::Image account_icon =
+      ui::ResourceBundle::GetSharedInstance().GetImageNamed(
+          profiles::GetPlaceholderAvatarIconResourceID());
+  auto account_photo = std::make_unique<BadgedProfilePhoto>(
+      BadgedProfilePhoto::BADGE_TYPE_NONE, account_icon);
+  base::string16 first_account_button_title =
+      accounts[0].full_name.empty()
+          ? l10n_util::GetStringUTF16(
+                IDS_PROFILES_DICE_SIGNIN_FIRST_ACCOUNT_BUTTON_NO_NAME)
+          : l10n_util::GetStringFUTF16(
+                IDS_PROFILES_DICE_SIGNIN_FIRST_ACCOUNT_BUTTON,
+                base::UTF8ToUTF16(accounts[0].full_name));
+  HoverButton* first_account_button = new HoverButton(
+      this, std::move(account_photo), first_account_button_title,
+      base::UTF8ToUTF16(accounts[0].email));
+  first_account_button->SetStyle(HoverButton::STYLE_PROMINENT);
+
+  signin_button_view->AddChildView(first_account_button);
+  promo_button_container->AddChildView(signin_button_view);
+
+  signin_with_gaia_account_button_ = first_account_button;
+  signin_with_gaia_account_id_ = accounts[0].account_id;
+
+  constexpr int kSmallMenuIconSize = 16;
+  HoverButton* sync_to_another_account_button = new HoverButton(
+      this,
+      gfx::CreateVectorIcon(kSyncSwitchAccountIcon, kSmallMenuIconSize,
+                            gfx::kChromeIconGrey),
+      l10n_util::GetStringUTF16(
+          IDS_PROFILES_DICE_SIGNIN_WITH_ANOTHER_ACCOUNT_BUTTON));
+  signin_current_profile_button_ = sync_to_another_account_button;
+  promo_button_container->AddChildView(sync_to_another_account_button);
+
+  view->AddChildView(promo_button_container);
   return view;
 }
 

diff --git a/chrome/browser/ui/views/profiles/profile_chooser_view.h b/chrome/browser/ui/views/profiles/profile_chooser_view.h
index ae770a5..da20cea 100644
--- a/chrome/browser/ui/views/profiles/profile_chooser_view.h
+++ b/chrome/browser/ui/views/profiles/profile_chooser_view.h

@@ -193,6 +193,7 @@
   views::Link* manage_accounts_link_;
   views::LabelButton* manage_accounts_button_;
   views::LabelButton* signin_current_profile_button_;
+  views::LabelButton* signin_with_gaia_account_button_;
 
   // For material design user menu, the active profile card owns the profile
   // name and photo.
@@ -228,6 +229,10 @@
 
   CloseBubbleOnTabActivationHelper close_bubble_helper_;
 
+  // ID of the GAIA account that should be signed in when
+  // |signin_with_gaia_account_button_| is pressed.
+  std::string signin_with_gaia_account_id_;
+
   const int menu_width_;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileChooserView);

diff --git a/chrome/browser/vr/ui_scene_creator.cc b/chrome/browser/vr/ui_scene_creator.cc
index 2f03153..637ed004 100644
--- a/chrome/browser/vr/ui_scene_creator.cc
+++ b/chrome/browser/vr/ui_scene_creator.cc

@@ -531,13 +531,13 @@
   scene_->AddUiElement(kSplashScreenViewportAwareRoot,
                        std::move(transient_parent));
 
-  // Add "Powered by Chrome" text.
+  // Add "Running in Chrome" text.
   auto text_scaler =
       base::MakeUnique<ScaledDepthAdjuster>(kSplashScreenTextDistance);
   auto text = base::MakeUnique<Text>(kSplashScreenTextFontHeightDMM);
   BindColor(model_, text.get(), &ColorScheme::splash_screen_text_color,
             &Text::SetColor);
-  text->SetText(l10n_util::GetStringUTF16(IDS_VR_POWERED_BY_CHROME_MESSAGE));
+  text->SetText(l10n_util::GetStringUTF16(IDS_VR_RUNNING_IN_CHROME_MESSAGE));
   text->SetName(kSplashScreenText);
   text->SetDrawPhase(kPhaseOverlayForeground);
   text->set_hit_testable(false);

diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
index 71549a8..cffc929 100644
--- a/chrome/renderer/BUILD.gn
+++ b/chrome/renderer/BUILD.gn

@@ -116,7 +116,6 @@
     "//components/dom_distiller/content/renderer",
     "//components/network_hints/renderer",
     "//components/omnibox/common",
-    "//components/password_manager/content/renderer",
     "//components/plugins/renderer",
     "//components/rappor/public/interfaces",
     "//components/resources:components_resources",

diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index e140efc..3346c213 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc

@@ -77,7 +77,6 @@
 #include "components/error_page/common/error.h"
 #include "components/error_page/common/localized_error.h"
 #include "components/network_hints/renderer/prescient_networking_dispatcher.h"
-#include "components/password_manager/content/renderer/credential_manager_client.h"
 #include "components/pdf/renderer/pepper_pdf_host.h"
 #include "components/safe_browsing/renderer/renderer_url_loader_throttle.h"
 #include "components/safe_browsing/renderer/threat_dom_details.h"
@@ -643,8 +642,6 @@
   new prerender::PrerendererClient(render_view);
 
   new ChromeRenderViewObserver(render_view, web_cache_impl_.get());
-
-  new password_manager::CredentialManagerClient(render_view);
 }
 
 SkBitmap* ChromeContentRendererClient::GetSadPluginBitmap() {

diff --git a/chrome/renderer/media/cast_rtp_stream.cc b/chrome/renderer/media/cast_rtp_stream.cc
index f4bbad5c..6138b0c 100644
--- a/chrome/renderer/media/cast_rtp_stream.cc
+++ b/chrome/renderer/media/cast_rtp_stream.cc

@@ -224,13 +224,13 @@
 
       if (!(video_frame->format() == media::PIXEL_FORMAT_I420 ||
             video_frame->format() == media::PIXEL_FORMAT_YV12 ||
-            video_frame->format() == media::PIXEL_FORMAT_YV12A)) {
+            video_frame->format() == media::PIXEL_FORMAT_I420A)) {
         error_callback_.Run("Incompatible video frame format.");
         return;
       }
       scoped_refptr<media::VideoFrame> frame = video_frame;
       // Drop alpha channel since we do not support it yet.
-      if (frame->format() == media::PIXEL_FORMAT_YV12A)
+      if (frame->format() == media::PIXEL_FORMAT_I420A)
         frame = media::WrapAsI420VideoFrame(video_frame);
 
       // Used by chrome/browser/extension/api/cast_streaming/performance_test.cc

diff --git a/components/BUILD.gn b/components/BUILD.gn
index 6cf7411..fa3473a 100644
--- a/components/BUILD.gn
+++ b/components/BUILD.gn

@@ -406,7 +406,6 @@
       "dom_distiller/content/browser/distiller_page_web_contents_browsertest.cc",
       "dom_distiller/content/browser/test/dom_distiller_js_browsertest.cc",
       "offline_pages/content/renovations/test/page_renovator_browsertest.cc",
-      "password_manager/content/renderer/credential_manager_client_browsertest.cc",
       "security_state/content/content_utils_browsertest.cc",
       "ukm/content/source_url_recorder_browsertest.cc",
     ]
@@ -434,7 +433,6 @@
       "//components/offline_pages/content/renovations",
       "//components/offline_pages/core/renovations",
       "//components/password_manager/content/browser",
-      "//components/password_manager/content/renderer",
       "//components/security_state/content",
       "//components/security_state/core",
       "//components/strings",

diff --git a/components/autofill/core/browser/BUILD.gn b/components/autofill/core/browser/BUILD.gn
index c9a2e82..26b08fb 100644
--- a/components/autofill/core/browser/BUILD.gn
+++ b/components/autofill/core/browser/BUILD.gn

@@ -279,6 +279,8 @@
     "autofill_test_utils.h",
     "data_driven_test.cc",
     "data_driven_test.h",
+    "payments/test_payments_client.cc",
+    "payments/test_payments_client.h",
     "suggestion_test_helpers.h",
     "test_address_normalizer.cc",
     "test_address_normalizer.h",
@@ -292,6 +294,8 @@
     "test_autofill_external_delegate.h",
     "test_autofill_provider.cc",
     "test_autofill_provider.h",
+    "test_form_data_importer.cc",
+    "test_form_data_importer.h",
     "test_personal_data_manager.cc",
     "test_personal_data_manager.h",
     "test_region_data_loader.cc",

diff --git a/components/autofill/core/browser/credit_card_save_manager_unittest.cc b/components/autofill/core/browser/credit_card_save_manager_unittest.cc
index 6a64002..4d5e180a 100644
--- a/components/autofill/core/browser/credit_card_save_manager_unittest.cc
+++ b/components/autofill/core/browser/credit_card_save_manager_unittest.cc

@@ -32,10 +32,12 @@
 #include "components/autofill/core/browser/autofill_test_utils.h"
 #include "components/autofill/core/browser/credit_card.h"
 #include "components/autofill/core/browser/form_structure.h"
+#include "components/autofill/core/browser/payments/test_payments_client.h"
 #include "components/autofill/core/browser/personal_data_manager.h"
 #include "components/autofill/core/browser/test_autofill_client.h"
 #include "components/autofill/core/browser/test_autofill_clock.h"
 #include "components/autofill/core/browser/test_autofill_driver.h"
+#include "components/autofill/core/browser/test_form_data_importer.h"
 #include "components/autofill/core/browser/test_personal_data_manager.h"
 #include "components/autofill/core/browser/validation.h"
 #include "components/autofill/core/browser/webdata/autofill_webdata_service.h"
@@ -88,80 +90,12 @@
   DISALLOW_COPY_AND_ASSIGN(MockAutofillClient);
 };
 
-class TestPaymentsClient : public payments::PaymentsClient {
- public:
-  TestPaymentsClient(net::URLRequestContextGetter* context_getter,
-                     PrefService* pref_service,
-                     IdentityProvider* identity_provider,
-                     payments::PaymentsClientUnmaskDelegate* unmask_delegate,
-                     payments::PaymentsClientSaveDelegate* save_delegate)
-      : PaymentsClient(context_getter,
-                       pref_service,
-                       identity_provider,
-                       unmask_delegate,
-                       save_delegate),
-        save_delegate_(save_delegate) {}
-
-  ~TestPaymentsClient() override {}
-
-  void GetUploadDetails(const std::vector<AutofillProfile>& addresses,
-                        const int detected_values,
-                        const std::string& pan_first_six,
-                        const std::vector<const char*>& active_experiments,
-                        const std::string& app_locale) override {
-    detected_values_ = detected_values;
-    pan_first_six_ = pan_first_six;
-    active_experiments_ = active_experiments;
-    save_delegate_->OnDidGetUploadDetails(
-        app_locale == "en-US" ? AutofillClient::SUCCESS
-                              : AutofillClient::PERMANENT_FAILURE,
-        ASCIIToUTF16("this is a context token"),
-        std::unique_ptr<base::DictionaryValue>(nullptr));
-  }
-
-  void UploadCard(const payments::PaymentsClient::UploadRequestDetails&
-                      request_details) override {
-    active_experiments_ = request_details.active_experiments;
-    save_delegate_->OnDidUploadCard(AutofillClient::SUCCESS, server_id_);
-  }
-
-  std::string server_id_;
-  int detected_values_;
-  std::string pan_first_six_;
-  std::vector<const char*> active_experiments_;
-
-  void SetSaveDelegate(payments::PaymentsClientSaveDelegate* save_delegate) {
-    save_delegate_ = save_delegate;
-    payments::PaymentsClient::SetSaveDelegate(save_delegate);
-  }
-
- private:
-  payments::PaymentsClientSaveDelegate* save_delegate_;
-
-  DISALLOW_COPY_AND_ASSIGN(TestPaymentsClient);
-};
-
-class TestFormDataImporter : public FormDataImporter {
- public:
-  TestFormDataImporter(AutofillClient* client,
-                       payments::PaymentsClient* payments_client,
-                       CreditCardSaveManager* credit_card_save_manager,
-                       PersonalDataManager* personal_data_manager,
-                       const std::string& app_locale)
-      : FormDataImporter(client,
-                         payments_client,
-                         personal_data_manager,
-                         app_locale) {
-    set_credit_card_save_manager(credit_card_save_manager);
-  }
-};
-
 class TestAutofillManager : public AutofillManager {
  public:
   TestAutofillManager(AutofillDriver* driver,
                       AutofillClient* client,
                       CreditCardSaveManager* credit_card_save_manager,
-                      TestPaymentsClient* payments_client,
+                      payments::TestPaymentsClient* payments_client,
                       TestPersonalDataManager* personal_data)
       : AutofillManager(driver, client, personal_data),
         personal_data_(personal_data),
@@ -248,7 +182,7 @@
  public:
   TestCreditCardSaveManager(AutofillDriver* driver,
                             AutofillClient* client,
-                            TestPaymentsClient* payments_client,
+                            payments::TestPaymentsClient* payments_client,
                             PersonalDataManager* personal_data_manager)
       : CreditCardSaveManager(client,
                               payments_client,
@@ -271,22 +205,6 @@
 
   bool credit_card_was_uploaded() { return credit_card_was_uploaded_; }
 
-  int GetDetectedValuesSetInRequest() const {
-    return test_payments_client_->detected_values_;
-  }
-
-  const std::string GetPanFirstSix() const {
-    return test_payments_client_->pan_first_six_;
-  }
-
-  const std::vector<const char*>& GetActiveExperiments() const {
-    return test_payments_client_->active_experiments_;
-  }
-
-  void SetPaymentsClientServerIdForCardUpload(const char* server_id) {
-    test_payments_client_->server_id_ = server_id;
-  }
-
  private:
   void OnDidUploadCard(AutofillClient::PaymentsRpcResult result,
                        const std::string& server_id) override {
@@ -294,7 +212,7 @@
     CreditCardSaveManager::OnDidUploadCard(result, server_id);
   };
 
-  TestPaymentsClient* test_payments_client_;  // Weak reference.
+  payments::TestPaymentsClient* test_payments_client_;  // Weak reference.
   bool credit_card_upload_enabled_ = false;
   bool credit_card_was_uploaded_ = false;
 
@@ -311,7 +229,7 @@
     request_context_ = new net::TestURLRequestContextGetter(
         base::ThreadTaskRunnerHandle::Get());
     autofill_driver_->SetURLRequestContext(request_context_.get());
-    payments_client_ = new TestPaymentsClient(
+    payments_client_ = new payments::TestPaymentsClient(
         autofill_driver_->GetURLRequestContext(), autofill_client_.GetPrefs(),
         autofill_client_.GetIdentityProvider(),
         /*unmask_delegate=*/nullptr,
@@ -523,7 +441,7 @@
   // Ends up getting owned (and destroyed) by TestFormDataImporter:
   TestCreditCardSaveManager* credit_card_save_manager_;
   // Ends up getting owned (and destroyed) by TestAutofillManager:
-  TestPaymentsClient* payments_client_;
+  payments::TestPaymentsClient* payments_client_;
 
  private:
   int ToHistogramSample(AutofillMetrics::CardUploadDecisionMetric metric) {
@@ -674,7 +592,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Server did not send a server_id, expect copy of card is not stored.
   EXPECT_TRUE(personal_data_.GetCreditCards().empty());
@@ -725,7 +643,7 @@
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
   // Submitted form included CVC, so user did not need to enter CVC.
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 }
 
 TEST_F(CreditCardSaveManagerTest, UploadCreditCardAndSaveCopy) {
@@ -734,7 +652,7 @@
   credit_card_save_manager_->set_credit_card_upload_enabled(true);
 
   const char* const server_id = "InstrumentData:1234";
-  credit_card_save_manager_->SetPaymentsClientServerIdForCardUpload(server_id);
+  payments_client_->SetServerIdForCardUpload(server_id);
 
   // Create, fill and submit an address form in order to establish a recent
   // profile which can be selected for the upload request.
@@ -1251,7 +1169,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_THAT(credit_card_save_manager_->GetActiveExperiments(),
+  EXPECT_THAT(payments_client_->GetActiveExperimentsSetInRequest(),
               UnorderedElementsAre(kAutofillUpstreamRequestCvcIfMissing.name));
 
   // Verify that the correct histogram entries were logged.
@@ -1611,7 +1529,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_FALSE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Verify that the correct histogram entry (and only that) was logged.
   ExpectUniqueCardUploadDecision(
@@ -1746,7 +1664,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Verify that the correct histogram entry (and only that) was logged.
   ExpectUniqueCardUploadDecision(histogram_tester,
@@ -1827,7 +1745,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_FALSE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Verify that the correct histogram entry (and only that) was logged.
   ExpectUniqueCardUploadDecision(
@@ -1863,7 +1781,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_FALSE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Verify that the correct histogram entry (and only that) was logged.
   ExpectUniqueCardUploadDecision(
@@ -1911,7 +1829,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_FALSE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 
   // Verify that the correct histogram entry (and only that) was logged.
   ExpectUniqueCardUploadDecision(
@@ -2160,7 +2078,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(), 0);
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(), 0);
 }
 
 TEST_F(CreditCardSaveManagerTest, GetDetectedValues_DetectCvc) {
@@ -2182,7 +2100,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::CVC);
 }
 
@@ -2214,7 +2132,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_TRUE(credit_card_save_manager_->GetDetectedValuesSetInRequest() &
+  EXPECT_TRUE(payments_client_->GetDetectedValuesSetInRequest() &
               CreditCardSaveManager::DetectedValue::CVC);
 }
 
@@ -2244,7 +2162,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_FALSE(credit_card_save_manager_->GetDetectedValuesSetInRequest() &
+  EXPECT_FALSE(payments_client_->GetDetectedValuesSetInRequest() &
                CreditCardSaveManager::DetectedValue::CVC);
 }
 
@@ -2268,7 +2186,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_FALSE(credit_card_save_manager_->GetDetectedValuesSetInRequest() &
+  EXPECT_FALSE(payments_client_->GetDetectedValuesSetInRequest() &
                CreditCardSaveManager::DetectedValue::CVC);
 }
 #endif
@@ -2292,7 +2210,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::CARDHOLDER_NAME);
 }
 
@@ -2321,7 +2239,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::ADDRESS_NAME);
 }
 
@@ -2351,7 +2269,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::CARDHOLDER_NAME |
                 CreditCardSaveManager::DetectedValue::ADDRESS_NAME);
 }
@@ -2382,7 +2300,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(), 0);
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(), 0);
 }
 
 TEST_F(CreditCardSaveManagerTest, GetDetectedValues_DetectPostalCode) {
@@ -2410,7 +2328,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::POSTAL_CODE);
 }
 
@@ -2444,7 +2362,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(), 0);
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(), 0);
 }
 
 TEST_F(CreditCardSaveManagerTest, GetDetectedValues_DetectAddressLine) {
@@ -2472,7 +2390,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::ADDRESS_LINE);
 }
 
@@ -2501,7 +2419,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::LOCALITY);
 }
 
@@ -2530,7 +2448,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::ADMINISTRATIVE_AREA);
 }
 
@@ -2559,7 +2477,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::COUNTRY_CODE);
 }
 
@@ -2593,7 +2511,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::CVC |
                 CreditCardSaveManager::DetectedValue::CARDHOLDER_NAME |
                 CreditCardSaveManager::DetectedValue::ADDRESS_NAME |
@@ -2633,7 +2551,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::CVC |
                 CreditCardSaveManager::DetectedValue::LOCALITY |
                 CreditCardSaveManager::DetectedValue::POSTAL_CODE |
@@ -2682,7 +2600,7 @@
 
   // Submit the form and check what detected_values for an upload save would be.
   FormSubmitted(credit_card_form);
-  EXPECT_EQ(credit_card_save_manager_->GetDetectedValuesSetInRequest(),
+  EXPECT_EQ(payments_client_->GetDetectedValuesSetInRequest(),
             CreditCardSaveManager::DetectedValue::ADDRESS_LINE |
                 CreditCardSaveManager::DetectedValue::LOCALITY |
                 CreditCardSaveManager::DetectedValue::ADMINISTRATIVE_AREA |
@@ -2712,7 +2630,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_THAT(credit_card_save_manager_->GetActiveExperiments(),
+  EXPECT_THAT(payments_client_->GetActiveExperimentsSetInRequest(),
               UnorderedElementsAre(kAutofillUpstreamSendDetectedValues.name));
 }
 
@@ -3191,7 +3109,7 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_TRUE(credit_card_save_manager_->GetActiveExperiments().empty());
+  EXPECT_TRUE(payments_client_->GetActiveExperimentsSetInRequest().empty());
 }
 
 TEST_F(CreditCardSaveManagerTest, UploadCreditCard_AddPanFirstSixToRequest) {
@@ -3224,10 +3142,10 @@
   EXPECT_CALL(autofill_client_, ConfirmSaveCreditCardLocally(_, _)).Times(0);
   FormSubmitted(credit_card_form);
   EXPECT_TRUE(credit_card_save_manager_->credit_card_was_uploaded());
-  EXPECT_EQ(credit_card_save_manager_->GetPanFirstSix(), "444433");
+  EXPECT_EQ(payments_client_->GetPanFirstSixSetInRequest(), "444433");
   // Confirm that the "send pan first six" experiment flag was sent in the
   // request.
-  EXPECT_THAT(credit_card_save_manager_->GetActiveExperiments(),
+  EXPECT_THAT(payments_client_->GetActiveExperimentsSetInRequest(),
               UnorderedElementsAre(kAutofillUpstreamSendPanFirstSix.name));
 }
 

diff --git a/components/autofill/core/browser/payments/test_payments_client.cc b/components/autofill/core/browser/payments/test_payments_client.cc
new file mode 100644
index 0000000..c8d5be1
--- /dev/null
+++ b/components/autofill/core/browser/payments/test_payments_client.cc

@@ -0,0 +1,73 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/autofill/core/browser/payments/test_payments_client.h"
+
+#include "base/strings/utf_string_conversions.h"
+
+namespace autofill {
+namespace payments {
+
+TestPaymentsClient::TestPaymentsClient(
+    net::URLRequestContextGetter* context_getter,
+    PrefService* pref_service,
+    IdentityProvider* identity_provider,
+    payments::PaymentsClientUnmaskDelegate* unmask_delegate,
+    payments::PaymentsClientSaveDelegate* save_delegate)
+    : PaymentsClient(context_getter,
+                     pref_service,
+                     identity_provider,
+                     unmask_delegate,
+                     save_delegate),
+      save_delegate_(save_delegate) {}
+
+TestPaymentsClient::~TestPaymentsClient() {}
+
+void TestPaymentsClient::GetUploadDetails(
+    const std::vector<AutofillProfile>& addresses,
+    const int detected_values,
+    const std::string& pan_first_six,
+    const std::vector<const char*>& active_experiments,
+    const std::string& app_locale) {
+  detected_values_ = detected_values;
+  pan_first_six_ = pan_first_six;
+  active_experiments_ = active_experiments;
+  save_delegate_->OnDidGetUploadDetails(
+      app_locale == "en-US" ? AutofillClient::SUCCESS
+                            : AutofillClient::PERMANENT_FAILURE,
+      base::ASCIIToUTF16("this is a context token"),
+      std::unique_ptr<base::DictionaryValue>(nullptr));
+}
+
+void TestPaymentsClient::UploadCard(
+    const payments::PaymentsClient::UploadRequestDetails& request_details) {
+  active_experiments_ = request_details.active_experiments;
+  save_delegate_->OnDidUploadCard(AutofillClient::SUCCESS, server_id_);
+}
+
+void TestPaymentsClient::SetSaveDelegate(
+    payments::PaymentsClientSaveDelegate* save_delegate) {
+  save_delegate_ = save_delegate;
+  payments::PaymentsClient::SetSaveDelegate(save_delegate);
+}
+
+void TestPaymentsClient::SetServerIdForCardUpload(std::string server_id) {
+  server_id_ = server_id;
+}
+
+int TestPaymentsClient::GetDetectedValuesSetInRequest() const {
+  return detected_values_;
+}
+
+std::string TestPaymentsClient::GetPanFirstSixSetInRequest() const {
+  return pan_first_six_;
+}
+
+std::vector<const char*> TestPaymentsClient::GetActiveExperimentsSetInRequest()
+    const {
+  return active_experiments_;
+}
+
+}  // namespace payments
+}  // namespace autofill

diff --git a/components/autofill/core/browser/payments/test_payments_client.h b/components/autofill/core/browser/payments/test_payments_client.h
new file mode 100644
index 0000000..49b5ddfc
--- /dev/null
+++ b/components/autofill/core/browser/payments/test_payments_client.h

@@ -0,0 +1,56 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_AUTOFILL_CORE_BROWSER_PAYMENTS_TEST_PAYMENTS_CLIENT_H_
+#define COMPONENTS_AUTOFILL_CORE_BROWSER_PAYMENTS_TEST_PAYMENTS_CLIENT_H_
+
+#include <string>
+#include <vector>
+
+#include "components/autofill/core/browser/payments/payments_client.h"
+
+namespace autofill {
+namespace payments {
+
+class TestPaymentsClient : public payments::PaymentsClient {
+ public:
+  TestPaymentsClient(net::URLRequestContextGetter* context_getter,
+                     PrefService* pref_service,
+                     IdentityProvider* identity_provider,
+                     payments::PaymentsClientUnmaskDelegate* unmask_delegate,
+                     payments::PaymentsClientSaveDelegate* save_delegate);
+
+  ~TestPaymentsClient() override;
+
+  void GetUploadDetails(const std::vector<AutofillProfile>& addresses,
+                        const int detected_values,
+                        const std::string& pan_first_six,
+                        const std::vector<const char*>& active_experiments,
+                        const std::string& app_locale) override;
+
+  void UploadCard(const payments::PaymentsClient::UploadRequestDetails&
+                      request_details) override;
+
+  void SetSaveDelegate(payments::PaymentsClientSaveDelegate* save_delegate);
+
+  void SetServerIdForCardUpload(std::string);
+
+  int GetDetectedValuesSetInRequest() const;
+  std::string GetPanFirstSixSetInRequest() const;
+  std::vector<const char*> GetActiveExperimentsSetInRequest() const;
+
+ private:
+  payments::PaymentsClientSaveDelegate* save_delegate_;
+  std::string server_id_;
+  int detected_values_;
+  std::string pan_first_six_;
+  std::vector<const char*> active_experiments_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestPaymentsClient);
+};
+
+}  // namespace payments
+}  // namespace autofill
+
+#endif  // COMPONENTS_AUTOFILL_CORE_BROWSER_PAYMENTS_TEST_PAYMENTS_CLIENT_H_

diff --git a/components/autofill/core/browser/test_form_data_importer.cc b/components/autofill/core/browser/test_form_data_importer.cc
new file mode 100644
index 0000000..970b322
--- /dev/null
+++ b/components/autofill/core/browser/test_form_data_importer.cc

@@ -0,0 +1,22 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/autofill/core/browser/test_form_data_importer.h"
+
+namespace autofill {
+
+TestFormDataImporter::TestFormDataImporter(
+    AutofillClient* client,
+    payments::PaymentsClient* payments_client,
+    CreditCardSaveManager* credit_card_save_manager,
+    PersonalDataManager* personal_data_manager,
+    const std::string& app_locale)
+    : FormDataImporter(client,
+                       payments_client,
+                       personal_data_manager,
+                       app_locale) {
+  set_credit_card_save_manager(credit_card_save_manager);
+}
+
+}  // namespace autofill

diff --git a/components/autofill/core/browser/test_form_data_importer.h b/components/autofill/core/browser/test_form_data_importer.h
new file mode 100644
index 0000000..c6bf838
--- /dev/null
+++ b/components/autofill/core/browser/test_form_data_importer.h

@@ -0,0 +1,23 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_AUTOFILL_CORE_BROWSER_TEST_FORM_DATA_IMPORTER_H_
+#define COMPONENTS_AUTOFILL_CORE_BROWSER_TEST_FORM_DATA_IMPORTER_H_
+
+#include "components/autofill/core/browser/form_data_importer.h"
+
+namespace autofill {
+
+class TestFormDataImporter : public FormDataImporter {
+ public:
+  TestFormDataImporter(AutofillClient* client,
+                       payments::PaymentsClient* payments_client,
+                       CreditCardSaveManager* credit_card_save_manager,
+                       PersonalDataManager* personal_data_manager,
+                       const std::string& app_locale);
+};
+
+}  // namespace autofill
+
+#endif  // COMPONENTS_AUTOFILL_CORE_BROWSER_TEST_FORM_DATA_IMPORTER_H_

diff --git a/components/exo/wm_helper.cc b/components/exo/wm_helper.cc
index 3a42f7248..f01a5c88 100644
--- a/components/exo/wm_helper.cc
+++ b/components/exo/wm_helper.cc

@@ -78,7 +78,7 @@
 
 void WMHelper::RemoveCursorObserver(
     aura::client::CursorClientObserver* observer) {
-  if (ash::Shell::GetAshConfig() == ash::Config::CLASSIC)
+  if (ash::Shell::GetAshConfig() != ash::Config::MASH)
     ash::Shell::Get()->cursor_manager()->RemoveObserver(observer);
 }
 

diff --git a/components/ntp_snippets/breaking_news/subscription_manager_impl.cc b/components/ntp_snippets/breaking_news/subscription_manager_impl.cc
index 2fb5ee2..04b12ab 100644
--- a/components/ntp_snippets/breaking_news/subscription_manager_impl.cc
+++ b/components/ntp_snippets/breaking_news/subscription_manager_impl.cc

@@ -133,10 +133,11 @@
   }
 
   OAuth2TokenService::ScopeSet scopes = {kContentSuggestionsApiScope};
-  access_token_fetcher_ = base::MakeUnique<PrimaryAccountAccessTokenFetcher>(
-      "ntp_snippets", signin_manager_, access_token_service_, scopes,
-      base::BindOnce(&SubscriptionManagerImpl::AccessTokenFetchFinished,
-                     base::Unretained(this), subscription_token));
+  access_token_fetcher_ =
+      base::MakeUnique<identity::PrimaryAccountAccessTokenFetcher>(
+          "ntp_snippets", signin_manager_, access_token_service_, scopes,
+          base::BindOnce(&SubscriptionManagerImpl::AccessTokenFetchFinished,
+                         base::Unretained(this), subscription_token));
 }
 
 void SubscriptionManagerImpl::AccessTokenFetchFinished(
@@ -145,7 +146,7 @@
     const std::string& access_token) {
   // Delete the fetcher only after we leave this method (which is called from
   // the fetcher itself).
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher>
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
       access_token_fetcher_deleter(std::move(access_token_fetcher_));
 
   if (error.state() != GoogleServiceAuthError::NONE) {

diff --git a/components/ntp_snippets/breaking_news/subscription_manager_impl.h b/components/ntp_snippets/breaking_news/subscription_manager_impl.h
index 6e6800a..fbaf160 100644
--- a/components/ntp_snippets/breaking_news/subscription_manager_impl.h
+++ b/components/ntp_snippets/breaking_news/subscription_manager_impl.h

@@ -15,11 +15,14 @@
 #include "net/url_request/url_request_context_getter.h"
 #include "url/gurl.h"
 
-class PrimaryAccountAccessTokenFetcher;
 class OAuth2TokenService;
 class PrefRegistrySimple;
 class PrefService;
 
+namespace identity {
+class PrimaryAccountAccessTokenFetcher;
+}
+
 namespace variations {
 class VariationsService;
 }
@@ -88,7 +91,8 @@
   scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;
 
   std::unique_ptr<internal::SubscriptionJsonRequest> request_;
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> access_token_fetcher_;
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      access_token_fetcher_;
 
   PrefService* pref_service_;
 

diff --git a/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.cc b/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.cc
index b26b0ed..b3d8431 100644
--- a/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.cc
+++ b/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.cc

@@ -171,7 +171,7 @@
   }
 
   OAuth2TokenService::ScopeSet scopes{kContentSuggestionsApiScope};
-  token_fetcher_ = base::MakeUnique<PrimaryAccountAccessTokenFetcher>(
+  token_fetcher_ = base::MakeUnique<identity::PrimaryAccountAccessTokenFetcher>(
       "ntp_snippets", signin_manager_, token_service_, scopes,
       base::BindOnce(
           &ContextualSuggestionsFetcherImpl::AccessTokenFetchFinished,
@@ -184,8 +184,8 @@
   // Delete the fetcher only after we leave this method (which is called from
   // the fetcher itself).
   DCHECK(token_fetcher_);
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_deleter(
-      std::move(token_fetcher_));
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      token_fetcher_deleter(std::move(token_fetcher_));
 
   if (error.state() != GoogleServiceAuthError::NONE) {
     AccessTokenError(error);

diff --git a/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.h b/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.h
index 9b7c957..76bd1c84 100644
--- a/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.h
+++ b/components/ntp_snippets/contextual/contextual_suggestions_fetcher_impl.h

@@ -21,11 +21,14 @@
 #include "components/ntp_snippets/status.h"
 #include "net/url_request/url_request_context_getter.h"
 
-class PrimaryAccountAccessTokenFetcher;
 class OAuth2TokenService;
 class PrefService;
 class SigninManagerBase;
 
+namespace identity {
+class PrimaryAccountAccessTokenFetcher;
+}
+
 namespace ntp_snippets {
 
 // TODO(gaschler): Move authentication that is in common with
@@ -77,7 +80,7 @@
   SigninManagerBase* signin_manager_;
   OAuth2TokenService* token_service_;
 
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_;
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher> token_fetcher_;
 
   // Holds the URL request context.
   scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;

diff --git a/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.cc b/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.cc
index c9ab836..c0a4449 100644
--- a/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.cc
+++ b/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.cc

@@ -235,7 +235,7 @@
   }
 
   OAuth2TokenService::ScopeSet scopes{kContentSuggestionsApiScope};
-  token_fetcher_ = base::MakeUnique<PrimaryAccountAccessTokenFetcher>(
+  token_fetcher_ = base::MakeUnique<identity::PrimaryAccountAccessTokenFetcher>(
       "ntp_snippets", signin_manager_, token_service_, scopes,
       base::BindOnce(&RemoteSuggestionsFetcherImpl::AccessTokenFetchFinished,
                      base::Unretained(this)));
@@ -247,8 +247,8 @@
   // Delete the fetcher only after we leave this method (which is called from
   // the fetcher itself).
   DCHECK(token_fetcher_);
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_deleter(
-      std::move(token_fetcher_));
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      token_fetcher_deleter(std::move(token_fetcher_));
 
   if (error.state() != GoogleServiceAuthError::NONE) {
     AccessTokenError(error);

diff --git a/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.h b/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.h
index 627071bc..0d95ca46 100644
--- a/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.h
+++ b/components/ntp_snippets/remote/remote_suggestions_fetcher_impl.h

@@ -20,7 +20,6 @@
 #include "components/ntp_snippets/remote/request_params.h"
 #include "net/url_request/url_request_context_getter.h"
 
-class PrimaryAccountAccessTokenFetcher;
 class OAuth2TokenService;
 class PrefService;
 class SigninManagerBase;
@@ -29,6 +28,10 @@
 class Value;
 }  // namespace base
 
+namespace identity {
+class PrimaryAccountAccessTokenFetcher;
+}
+
 namespace language {
 class UrlLanguageHistogram;
 }  // namespace language
@@ -90,7 +93,7 @@
   SigninManagerBase* signin_manager_;
   OAuth2TokenService* token_service_;
 
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_;
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher> token_fetcher_;
 
   // Holds the URL request context.
   scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_;

diff --git a/components/omnibox/browser/contextual_suggestions_service.cc b/components/omnibox/browser/contextual_suggestions_service.cc
index 3c8ba8c..7afc5b0 100644
--- a/components/omnibox/browser/contextual_suggestions_service.cc
+++ b/components/omnibox/browser/contextual_suggestions_service.cc

@@ -110,8 +110,8 @@
 }
 
 void ContextualSuggestionsService::StopCreatingContextualSuggestionsRequest() {
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_deleter(
-      std::move(token_fetcher_));
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      token_fetcher_deleter(std::move(token_fetcher_));
 }
 
 // static
@@ -298,7 +298,7 @@
   // Create the oauth2 token fetcher.
   const OAuth2TokenService::ScopeSet scopes{
       "https://www.googleapis.com/auth/cusco-chrome-extension"};
-  token_fetcher_ = std::make_unique<PrimaryAccountAccessTokenFetcher>(
+  token_fetcher_ = std::make_unique<identity::PrimaryAccountAccessTokenFetcher>(
       "contextual_suggestions_service", signin_manager_, token_service_, scopes,
       base::BindOnce(&ContextualSuggestionsService::AccessTokenAvailable,
                      base::Unretained(this), std::move(fetcher),
@@ -311,8 +311,8 @@
     const GoogleServiceAuthError& error,
     const std::string& access_token) {
   DCHECK(token_fetcher_);
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_deleter(
-      std::move(token_fetcher_));
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      token_fetcher_deleter(std::move(token_fetcher_));
 
   // If there were no errors obtaining the access token, append it to the
   // request as a header.

diff --git a/components/omnibox/browser/contextual_suggestions_service.h b/components/omnibox/browser/contextual_suggestions_service.h
index 9bdea30..61bb0d6 100644
--- a/components/omnibox/browser/contextual_suggestions_service.h
+++ b/components/omnibox/browser/contextual_suggestions_service.h

@@ -128,7 +128,7 @@
 
   // Helper for fetching OAuth2 access tokens. This is non-null when an access
   // token request is currently in progress.
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_;
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher> token_fetcher_;
 
   DISALLOW_COPY_AND_ASSIGN(ContextualSuggestionsService);
 };

diff --git a/components/password_manager/content/browser/content_credential_manager.cc b/components/password_manager/content/browser/content_credential_manager.cc
index 7e8b20f..2bf69bd 100644
--- a/components/password_manager/content/browser/content_credential_manager.cc
+++ b/components/password_manager/content/browser/content_credential_manager.cc

@@ -19,7 +19,7 @@
 ContentCredentialManager::~ContentCredentialManager() {}
 
 void ContentCredentialManager::BindRequest(
-    mojom::CredentialManagerAssociatedRequest request) {
+    mojom::CredentialManagerRequest request) {
   DCHECK(!binding_.is_bound());
   binding_.Bind(std::move(request));
 

diff --git a/components/password_manager/content/browser/content_credential_manager.h b/components/password_manager/content/browser/content_credential_manager.h
index 8e3f02c3..0e7ff21 100644
--- a/components/password_manager/content/browser/content_credential_manager.h
+++ b/components/password_manager/content/browser/content_credential_manager.h

@@ -7,7 +7,7 @@
 
 #include "components/password_manager/core/browser/credential_manager_impl.h"
 #include "components/password_manager/core/common/credential_manager_types.h"
-#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/binding.h"
 #include "third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.h"
 
 class GURL;
@@ -24,7 +24,7 @@
   explicit ContentCredentialManager(PasswordManagerClient* client);
   ~ContentCredentialManager() override;
 
-  void BindRequest(mojom::CredentialManagerAssociatedRequest request);
+  void BindRequest(mojom::CredentialManagerRequest request);
   bool HasBinding() const;
   void DisconnectBinding();
 
@@ -39,7 +39,7 @@
  private:
   CredentialManagerImpl impl_;
 
-  mojo::AssociatedBinding<mojom::CredentialManager> binding_;
+  mojo::Binding<mojom::CredentialManager> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(ContentCredentialManager);
 };

diff --git a/components/password_manager/content/common/credential_manager_struct_traits.cc b/components/password_manager/content/common/credential_manager_struct_traits.cc
index 49105d56..de1bdac 100644
--- a/components/password_manager/content/common/credential_manager_struct_traits.cc
+++ b/components/password_manager/content/common/credential_manager_struct_traits.cc

@@ -56,13 +56,11 @@
   switch (input) {
     case password_manager::CredentialManagerError::SUCCESS:
       return password_manager::mojom::CredentialManagerError::SUCCESS;
-    case password_manager::CredentialManagerError::DISABLED:
-      return password_manager::mojom::CredentialManagerError::DISABLED;
-    case password_manager::CredentialManagerError::PENDINGREQUEST:
-      return password_manager::mojom::CredentialManagerError::PENDINGREQUEST;
+    case password_manager::CredentialManagerError::PENDING_REQUEST:
+      return password_manager::mojom::CredentialManagerError::PENDING_REQUEST;
     case password_manager::CredentialManagerError::PASSWORDSTOREUNAVAILABLE:
       return password_manager::mojom::CredentialManagerError::
-          PASSWORDSTOREUNAVAILABLE;
+          PASSWORD_STORE_UNAVAILABLE;
     case password_manager::CredentialManagerError::UNKNOWN:
       return password_manager::mojom::CredentialManagerError::UNKNOWN;
   }
@@ -80,17 +78,16 @@
     case password_manager::mojom::CredentialManagerError::SUCCESS:
       *output = password_manager::CredentialManagerError::SUCCESS;
       return true;
-    case password_manager::mojom::CredentialManagerError::DISABLED:
-      *output = password_manager::CredentialManagerError::DISABLED;
-      return true;
-    case password_manager::mojom::CredentialManagerError::PENDINGREQUEST:
-      *output = password_manager::CredentialManagerError::PENDINGREQUEST;
+    case password_manager::mojom::CredentialManagerError::PENDING_REQUEST:
+      *output = password_manager::CredentialManagerError::PENDING_REQUEST;
       return true;
     case password_manager::mojom::CredentialManagerError::
-        PASSWORDSTOREUNAVAILABLE:
+        PASSWORD_STORE_UNAVAILABLE:
       *output =
           password_manager::CredentialManagerError::PASSWORDSTOREUNAVAILABLE;
       return true;
+    case password_manager::mojom::CredentialManagerError::NOT_ALLOWED:
+    case password_manager::mojom::CredentialManagerError::NOT_SUPPORTED:
     case password_manager::mojom::CredentialManagerError::UNKNOWN:
       *output = password_manager::CredentialManagerError::UNKNOWN;
       return true;

diff --git a/components/password_manager/content/renderer/BUILD.gn b/components/password_manager/content/renderer/BUILD.gn
deleted file mode 100644
index 0d43743..0000000
--- a/components/password_manager/content/renderer/BUILD.gn
+++ /dev/null

@@ -1,38 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-static_library("renderer") {
-  sources = [
-    "credential_manager_client.cc",
-    "credential_manager_client.h",
-  ]
-
-  deps = [
-    "//base",
-    "//components/password_manager/core/common",
-    "//components/strings",
-    "//content/public/common",
-    "//content/public/renderer",
-    "//services/service_manager/public/cpp",
-    "//third_party/WebKit/public:blink",
-    "//url",
-  ]
-}
-
-source_set("browser_tests") {
-  testonly = true
-  sources = [
-    "credential_manager_client_browsertest.cc",
-  ]
-
-  deps = [
-    ":renderer",
-    "//content/public/renderer",
-    "//content/test:test_support",
-    "//services/service_manager/public/cpp",
-    "//testing/gmock",
-    "//testing/gtest",
-    "//third_party/WebKit/public:blink",
-  ]
-}

diff --git a/components/password_manager/content/renderer/DEPS b/components/password_manager/content/renderer/DEPS
deleted file mode 100644
index 440a225..0000000
--- a/components/password_manager/content/renderer/DEPS
+++ /dev/null

@@ -1,9 +0,0 @@
-include_rules = [
-  "+content/public/common",
-  "+content/public/renderer",
-  "+content/test",
-  "+services/service_manager/public/cpp",
-  "+third_party/WebKit/common",
-  "+third_party/WebKit/public/platform",
-  "+third_party/WebKit/public/web",
-]

diff --git a/components/password_manager/content/renderer/credential_manager_client.cc b/components/password_manager/content/renderer/credential_manager_client.cc
deleted file mode 100644
index c394e25..0000000
--- a/components/password_manager/content/renderer/credential_manager_client.cc
+++ /dev/null

@@ -1,293 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/password_manager/content/renderer/credential_manager_client.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "components/password_manager/core/common/credential_manager_types.h"
-#include "content/public/renderer/render_frame.h"
-#include "content/public/renderer/render_view.h"
-#include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
-#include "third_party/WebKit/public/platform/WebCredential.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
-#include "third_party/WebKit/public/platform/WebFederatedCredential.h"
-#include "third_party/WebKit/public/platform/WebPasswordCredential.h"
-#include "third_party/WebKit/public/web/WebView.h"
-
-namespace password_manager {
-
-namespace {
-
-void WebCredentialToCredentialInfo(const blink::WebCredential& credential,
-                                   CredentialInfo* out) {
-  out->id = credential.Id().Utf16();
-  if (credential.IsPasswordCredential()) {
-    out->type = CredentialType::CREDENTIAL_TYPE_PASSWORD;
-    out->password = static_cast<const blink::WebPasswordCredential&>(credential)
-                        .Password()
-                        .Utf16();
-    out->name = static_cast<const blink::WebPasswordCredential&>(credential)
-                    .Name()
-                    .Utf16();
-    out->icon =
-        static_cast<const blink::WebPasswordCredential&>(credential).IconURL();
-  } else {
-    DCHECK(credential.IsFederatedCredential());
-    out->type = CredentialType::CREDENTIAL_TYPE_FEDERATED;
-    out->federation =
-        static_cast<const blink::WebFederatedCredential&>(credential)
-            .Provider();
-    out->name = static_cast<const blink::WebFederatedCredential&>(credential)
-                    .Name()
-                    .Utf16();
-    out->icon =
-        static_cast<const blink::WebFederatedCredential&>(credential).IconURL();
-  }
-}
-
-std::unique_ptr<blink::WebCredential> CredentialInfoToWebCredential(
-    const CredentialInfo& info) {
-  switch (info.type) {
-    case CredentialType::CREDENTIAL_TYPE_FEDERATED:
-      return std::make_unique<blink::WebFederatedCredential>(
-          blink::WebString::FromUTF16(info.id), info.federation,
-          blink::WebString::FromUTF16(info.name), info.icon);
-    case CredentialType::CREDENTIAL_TYPE_PASSWORD:
-      return std::make_unique<blink::WebPasswordCredential>(
-          blink::WebString::FromUTF16(info.id),
-          blink::WebString::FromUTF16(info.password),
-          blink::WebString::FromUTF16(info.name), info.icon);
-    case CredentialType::CREDENTIAL_TYPE_EMPTY:
-      return nullptr;
-  }
-
-  NOTREACHED();
-  return nullptr;
-}
-
-CredentialMediationRequirement GetCredentialMediationRequirementFromBlink(
-    blink::WebCredentialMediationRequirement mediation) {
-  switch (mediation) {
-    case blink::WebCredentialMediationRequirement::kSilent:
-      return CredentialMediationRequirement::kSilent;
-    case blink::WebCredentialMediationRequirement::kOptional:
-      return CredentialMediationRequirement::kOptional;
-    case blink::WebCredentialMediationRequirement::kRequired:
-      return CredentialMediationRequirement::kRequired;
-  }
-
-  NOTREACHED();
-  return CredentialMediationRequirement::kOptional;
-}
-
-blink::WebCredentialManagerError GetWebCredentialManagerErrorFromMojo(
-    CredentialManagerError error) {
-  switch (error) {
-    case CredentialManagerError::DISABLED:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerDisabledError;
-    case CredentialManagerError::PENDINGREQUEST:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerPendingRequestError;
-    case CredentialManagerError::PASSWORDSTOREUNAVAILABLE:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerPasswordStoreUnavailableError;
-    case CredentialManagerError::UNKNOWN:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerUnknownError;
-    case CredentialManagerError::SUCCESS:
-      NOTREACHED();
-      break;
-  }
-
-  NOTREACHED();
-  return blink::WebCredentialManagerError::kWebCredentialManagerUnknownError;
-}
-
-// Takes ownership of blink::WebCredentialManagerClient::NotificationCallbacks
-// pointer. When the wrapper is destroyed, if |callbacks| is still alive
-// its onError() will get called.
-class NotificationCallbacksWrapper {
- public:
-  explicit NotificationCallbacksWrapper(
-      blink::WebCredentialManagerClient::NotificationCallbacks* callbacks);
-
-  ~NotificationCallbacksWrapper();
-
-  void NotifySuccess();
-
- private:
-  std::unique_ptr<blink::WebCredentialManagerClient::NotificationCallbacks>
-      callbacks_;
-
-  DISALLOW_COPY_AND_ASSIGN(NotificationCallbacksWrapper);
-};
-
-NotificationCallbacksWrapper::NotificationCallbacksWrapper(
-    blink::WebCredentialManagerClient::NotificationCallbacks* callbacks)
-    : callbacks_(callbacks) {}
-
-NotificationCallbacksWrapper::~NotificationCallbacksWrapper() {
-  if (callbacks_)
-    callbacks_->OnError(blink::kWebCredentialManagerUnknownError);
-}
-
-void NotificationCallbacksWrapper::NotifySuccess() {
-  // Call onSuccess() and reset callbacks to avoid calling onError() in
-  // destructor.
-  if (callbacks_) {
-    callbacks_->OnSuccess();
-    callbacks_.reset();
-  }
-}
-
-// Takes ownership of blink::WebCredentialManagerClient::RequestCallbacks
-// pointer. When the wrapper is destroied, if |callbacks| is still alive
-// its onError() will get called.
-class RequestCallbacksWrapper {
- public:
-  explicit RequestCallbacksWrapper(
-      blink::WebCredentialManagerClient::RequestCallbacks* callbacks);
-
-  ~RequestCallbacksWrapper();
-
-  void NotifySuccess(const CredentialInfo& info);
-
-  void NotifyError(CredentialManagerError error);
-
- private:
-  std::unique_ptr<blink::WebCredentialManagerClient::RequestCallbacks>
-      callbacks_;
-
-  DISALLOW_COPY_AND_ASSIGN(RequestCallbacksWrapper);
-};
-
-RequestCallbacksWrapper::RequestCallbacksWrapper(
-    blink::WebCredentialManagerClient::RequestCallbacks* callbacks)
-    : callbacks_(callbacks) {}
-
-RequestCallbacksWrapper::~RequestCallbacksWrapper() {
-  if (callbacks_)
-    callbacks_->OnError(blink::kWebCredentialManagerUnknownError);
-}
-
-void RequestCallbacksWrapper::NotifySuccess(const CredentialInfo& info) {
-  // Call onSuccess() and reset callbacks to avoid calling onError() in
-  // destructor.
-  if (callbacks_) {
-    callbacks_->OnSuccess(CredentialInfoToWebCredential(info));
-    callbacks_.reset();
-  }
-}
-
-void RequestCallbacksWrapper::NotifyError(CredentialManagerError error) {
-  if (callbacks_) {
-    callbacks_->OnError(GetWebCredentialManagerErrorFromMojo(error));
-    callbacks_.reset();
-  }
-}
-
-void RespondToNotificationCallback(
-    NotificationCallbacksWrapper* callbacks_wrapper) {
-  callbacks_wrapper->NotifySuccess();
-}
-
-void RespondToRequestCallback(RequestCallbacksWrapper* callbacks_wrapper,
-                              CredentialManagerError error,
-                              const base::Optional<CredentialInfo>& info) {
-  if (error == CredentialManagerError::SUCCESS) {
-    DCHECK(info);
-    callbacks_wrapper->NotifySuccess(*info);
-  } else {
-    DCHECK(!info);
-    callbacks_wrapper->NotifyError(error);
-  }
-}
-
-}  // namespace
-
-CredentialManagerClient::CredentialManagerClient(
-    content::RenderView* render_view)
-    : content::RenderViewObserver(render_view) {
-  render_view->GetWebView()->SetCredentialManagerClient(this);
-}
-
-CredentialManagerClient::~CredentialManagerClient() {}
-
-// -----------------------------------------------------------------------------
-// Access mojo CredentialManagerService.
-
-void CredentialManagerClient::DispatchStore(
-    const blink::WebCredential& credential,
-    blink::WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  DCHECK(callbacks);
-  ConnectToMojoCMIfNeeded();
-
-  CredentialInfo info;
-  WebCredentialToCredentialInfo(credential, &info);
-  mojo_cm_service_->Store(
-      info,
-      base::Bind(&RespondToNotificationCallback,
-                 base::Owned(new NotificationCallbacksWrapper(callbacks))));
-}
-
-void CredentialManagerClient::DispatchPreventSilentAccess(
-    blink::WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  DCHECK(callbacks);
-  ConnectToMojoCMIfNeeded();
-
-  mojo_cm_service_->PreventSilentAccess(
-      base::Bind(&RespondToNotificationCallback,
-                 base::Owned(new NotificationCallbacksWrapper(callbacks))));
-}
-
-void CredentialManagerClient::DispatchGet(
-    blink::WebCredentialMediationRequirement mediation,
-    bool include_passwords,
-    const blink::WebVector<blink::WebURL>& federations,
-    RequestCallbacks* callbacks) {
-  DCHECK(callbacks);
-  ConnectToMojoCMIfNeeded();
-
-  std::vector<GURL> federation_vector;
-  for (size_t i = 0; i < std::min(federations.size(), kMaxFederations); ++i)
-    federation_vector.push_back(federations[i]);
-
-  mojo_cm_service_->Get(
-      GetCredentialMediationRequirementFromBlink(mediation), include_passwords,
-      federation_vector,
-      base::Bind(&RespondToRequestCallback,
-                 base::Owned(new RequestCallbacksWrapper(callbacks))));
-}
-
-void CredentialManagerClient::ConnectToMojoCMIfNeeded() {
-  if (mojo_cm_service_)
-    return;
-
-  content::RenderFrame* main_frame = render_view()->GetMainRenderFrame();
-  main_frame->GetRemoteAssociatedInterfaces()->GetInterface(&mojo_cm_service_);
-
-  // The remote end of the pipe will be forcibly closed by the browser side
-  // after each main frame navigation. Set up an error handler to reset the
-  // local end so that there will be an attempt at reestablishing the connection
-  // at the next call to the API.
-  mojo_cm_service_.set_connection_error_handler(base::Bind(
-      &CredentialManagerClient::OnMojoConnectionError, base::Unretained(this)));
-}
-
-void CredentialManagerClient::OnMojoConnectionError() {
-  mojo_cm_service_.reset();
-}
-
-void CredentialManagerClient::OnDestruct() {
-  delete this;
-}
-
-}  // namespace password_manager

diff --git a/components/password_manager/content/renderer/credential_manager_client.h b/components/password_manager/content/renderer/credential_manager_client.h
deleted file mode 100644
index 918e35e..0000000
--- a/components/password_manager/content/renderer/credential_manager_client.h
+++ /dev/null

@@ -1,70 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_PASSWORD_MANAGER_CONTENT_RENDERER_CREDENTIAL_MANAGER_CLIENT_H_
-#define COMPONENTS_PASSWORD_MANAGER_CONTENT_RENDERER_CREDENTIAL_MANAGER_CLIENT_H_
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "content/public/renderer/render_view_observer.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerClient.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
-#include "third_party/WebKit/public/platform/WebCredentialMediationRequirement.h"
-#include "third_party/WebKit/public/platform/WebVector.h"
-#include "third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.h"
-
-namespace blink {
-class WebCredential;
-class WebURL;
-}
-
-namespace content {
-class RenderView;
-}
-
-namespace password_manager {
-
-// The CredentialManagerClient implements the Blink platform interface
-// WebCredentialManagerClient, and acts as an intermediary between Blink-side
-// calls to 'navigator.credential.*' and the password manager internals which
-// live in the browser process.
-//
-// One instance of CredentialManagerClient is created per RenderView,
-// acts as RenderViewObserver so it can send messages to the browser process,
-// and route responses to itself.
-// Once RenderView is gone away, the instance will be deleted.
-//
-// Note that each RenderView's WebView holds a pointer to the
-// CredentialManagerClient (set in 'OnRenderViewCreated()') but does not own it.
-class CredentialManagerClient : public blink::WebCredentialManagerClient,
-                                public content::RenderViewObserver {
- public:
-  explicit CredentialManagerClient(content::RenderView* render_view);
-  ~CredentialManagerClient() override;
-
-  // blink::WebCredentialManagerClient:
-  void DispatchStore(
-      const blink::WebCredential& credential,
-      WebCredentialManagerClient::NotificationCallbacks* callbacks) override;
-  void DispatchPreventSilentAccess(NotificationCallbacks* callbacks) override;
-  void DispatchGet(blink::WebCredentialMediationRequirement mediation,
-                   bool include_passwords,
-                   const blink::WebVector<blink::WebURL>& federations,
-                   RequestCallbacks* callbacks) override;
-
- private:
-  // RenderViewObserver implementation.
-  void OnDestruct() override;
-
-  void ConnectToMojoCMIfNeeded();
-  void OnMojoConnectionError();
-
-  mojom::CredentialManagerAssociatedPtr mojo_cm_service_;
-
-  DISALLOW_COPY_AND_ASSIGN(CredentialManagerClient);
-};
-
-}  // namespace password_manager
-
-#endif  // COMPONENTS_PASSWORD_MANAGER_CONTENT_RENDERER_CREDENTIAL_MANAGER_CLIENT_H_

diff --git a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc b/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
deleted file mode 100644
index fca3c878..0000000
--- a/components/password_manager/content/renderer/credential_manager_client_browsertest.cc
+++ /dev/null

@@ -1,251 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/password_manager/content/renderer/credential_manager_client.h"
-
-#include <stdint.h>
-
-#include <memory>
-#include <tuple>
-#include <utility>
-
-#include "base/location.h"
-#include "base/message_loop/message_loop.h"
-#include "base/run_loop.h"
-#include "content/public/renderer/render_frame.h"
-#include "content/public/renderer/render_view.h"
-#include "content/public/test/render_view_test.h"
-#include "content/public/test/test_utils.h"
-#include "mojo/public/cpp/bindings/associated_binding_set.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
-#include "third_party/WebKit/public/platform/WebCredential.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerClient.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
-#include "third_party/WebKit/public/platform/WebCredentialMediationRequirement.h"
-#include "third_party/WebKit/public/platform/WebPasswordCredential.h"
-
-namespace password_manager {
-
-namespace {
-
-const char kTestCredentialPassword[] = "https://password.com/";
-const char kTestCredentialEmpty[] = "https://empty.com/";
-const char kTestCredentialReject[] = "https://reject.com/";
-
-class FakeCredentialManager : public mojom::CredentialManager {
- public:
-  FakeCredentialManager() {}
-  ~FakeCredentialManager() override {}
-
-  void BindRequest(mojom::CredentialManagerAssociatedRequest request) {
-    bindings_.AddBinding(this, std::move(request));
-  }
-
- private:
-  // mojom::CredentialManager methods:
-  void Store(const CredentialInfo& credential,
-             StoreCallback callback) override {
-    std::move(callback).Run();
-  }
-
-  void PreventSilentAccess(PreventSilentAccessCallback callback) override {
-    std::move(callback).Run();
-  }
-
-  void Get(CredentialMediationRequirement mediation,
-           bool include_passwords,
-           const std::vector<GURL>& federations,
-           GetCallback callback) override {
-    const std::string& url = federations[0].spec();
-
-    if (url == kTestCredentialPassword) {
-      CredentialInfo info;
-      info.type = CredentialType::CREDENTIAL_TYPE_PASSWORD;
-      std::move(callback).Run(CredentialManagerError::SUCCESS, info);
-    } else if (url == kTestCredentialEmpty) {
-      std::move(callback).Run(CredentialManagerError::SUCCESS,
-                              CredentialInfo());
-    } else if (url == kTestCredentialReject) {
-      std::move(callback).Run(CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
-                              base::nullopt);
-    }
-  }
-
-  mojo::AssociatedBindingSet<mojom::CredentialManager> bindings_;
-};
-
-class CredentialManagerClientTest : public content::RenderViewTest {
- public:
-  CredentialManagerClientTest()
-      : callback_errored_(false), callback_succeeded_(false) {}
-  ~CredentialManagerClientTest() override {}
-
-  void SetUp() override {
-    content::RenderViewTest::SetUp();
-    client_.reset(new CredentialManagerClient(view_));
-
-    blink::AssociatedInterfaceProvider* remote_interfaces =
-        view_->GetMainRenderFrame()->GetRemoteAssociatedInterfaces();
-    remote_interfaces->OverrideBinderForTesting(
-        mojom::CredentialManager::Name_,
-        base::Bind(&CredentialManagerClientTest::BindCredentialManager,
-                   base::Unretained(this)));
-  }
-
-  void TearDown() override {
-    credential_.reset();
-    client_.reset();
-    content::RenderViewTest::TearDown();
-  }
-
-  bool callback_errored() const { return callback_errored_; }
-  void set_callback_errored(bool state) { callback_errored_ = state; }
-  bool callback_succeeded() const { return callback_succeeded_; }
-  void set_callback_succeeded(bool state) { callback_succeeded_ = state; }
-
-  void BindCredentialManager(mojo::ScopedInterfaceEndpointHandle handle) {
-    fake_cm_.BindRequest(
-        mojom::CredentialManagerAssociatedRequest(std::move(handle)));
-  }
-
-  std::unique_ptr<blink::WebPasswordCredential> credential_;
-  blink::WebCredentialManagerError error_;
-
- protected:
-  std::unique_ptr<CredentialManagerClient> client_;
-
-  FakeCredentialManager fake_cm_;
-
-  // True if a message's callback's 'onSuccess'/'onError' methods were called,
-  // false otherwise. We put these on the test object rather than on the
-  // Test*Callbacks objects because ownership of those objects passes into the
-  // client, which destroys the callbacks after calling them to resolve the
-  // pending Blink-side Promise.
-  bool callback_errored_;
-  bool callback_succeeded_;
-};
-
-class TestNotificationCallbacks
-    : public blink::WebCredentialManagerClient::NotificationCallbacks {
- public:
-  explicit TestNotificationCallbacks(CredentialManagerClientTest* test)
-      : test_(test) {}
-
-  ~TestNotificationCallbacks() override {}
-
-  void OnSuccess() override { test_->set_callback_succeeded(true); }
-
-  void OnError(blink::WebCredentialManagerError reason) override {
-    test_->set_callback_errored(true);
-  }
-
- private:
-  CredentialManagerClientTest* test_;
-};
-
-class TestRequestCallbacks
-    : public blink::WebCredentialManagerClient::RequestCallbacks {
- public:
-  explicit TestRequestCallbacks(CredentialManagerClientTest* test)
-      : test_(test) {}
-
-  ~TestRequestCallbacks() override {}
-
-  void OnSuccess(std::unique_ptr<blink::WebCredential> credential) override {
-    test_->set_callback_succeeded(true);
-
-    blink::WebCredential* ptr = credential.release();
-    test_->credential_.reset(static_cast<blink::WebPasswordCredential*>(ptr));
-  }
-
-  void OnError(blink::WebCredentialManagerError reason) override {
-    test_->set_callback_errored(true);
-    test_->credential_.reset();
-    test_->error_ = reason;
-  }
-
- private:
-  CredentialManagerClientTest* test_;
-};
-
-void RunAllPendingTasks() {
-  content::RunAllTasksUntilIdle();
-}
-
-}  // namespace
-
-TEST_F(CredentialManagerClientTest, SendStore) {
-  credential_.reset(new blink::WebPasswordCredential("", "", "", GURL()));
-  std::unique_ptr<TestNotificationCallbacks> callbacks(
-      new TestNotificationCallbacks(this));
-  client_->DispatchStore(*credential_, callbacks.release());
-
-  RunAllPendingTasks();
-
-  EXPECT_TRUE(callback_succeeded());
-  EXPECT_FALSE(callback_errored());
-}
-
-TEST_F(CredentialManagerClientTest, SendRequestUserMediation) {
-  std::unique_ptr<TestNotificationCallbacks> callbacks(
-      new TestNotificationCallbacks(this));
-  client_->DispatchPreventSilentAccess(callbacks.release());
-
-  RunAllPendingTasks();
-
-  EXPECT_TRUE(callback_succeeded());
-  EXPECT_FALSE(callback_errored());
-}
-
-TEST_F(CredentialManagerClientTest, SendRequestCredential) {
-  std::unique_ptr<TestRequestCallbacks> callbacks(
-      new TestRequestCallbacks(this));
-  std::vector<GURL> federations;
-  federations.push_back(GURL(kTestCredentialPassword));
-  client_->DispatchGet(blink::WebCredentialMediationRequirement::kOptional,
-                       true, federations, callbacks.release());
-
-  RunAllPendingTasks();
-
-  EXPECT_TRUE(callback_succeeded());
-  EXPECT_FALSE(callback_errored());
-  EXPECT_TRUE(credential_);
-  EXPECT_EQ("password", credential_->GetType());
-}
-
-TEST_F(CredentialManagerClientTest, SendRequestCredentialEmpty) {
-  std::unique_ptr<TestRequestCallbacks> callbacks(
-      new TestRequestCallbacks(this));
-  std::vector<GURL> federations;
-  federations.push_back(GURL(kTestCredentialEmpty));
-  client_->DispatchGet(blink::WebCredentialMediationRequirement::kOptional,
-                       true, federations, callbacks.release());
-
-  RunAllPendingTasks();
-
-  EXPECT_TRUE(callback_succeeded());
-  EXPECT_FALSE(callback_errored());
-  EXPECT_FALSE(credential_);
-}
-
-TEST_F(CredentialManagerClientTest, SendRequestCredentialReject) {
-  std::unique_ptr<TestRequestCallbacks> callbacks(
-      new TestRequestCallbacks(this));
-  std::vector<GURL> federations;
-  federations.push_back(GURL(kTestCredentialReject));
-  client_->DispatchGet(blink::WebCredentialMediationRequirement::kOptional,
-                       true, federations, callbacks.release());
-
-  RunAllPendingTasks();
-
-  EXPECT_FALSE(callback_succeeded());
-  EXPECT_TRUE(callback_errored());
-  EXPECT_FALSE(credential_);
-  EXPECT_EQ(blink::WebCredentialManagerError::
-                kWebCredentialManagerPasswordStoreUnavailableError,
-            error_);
-}
-
-}  // namespace password_manager

diff --git a/components/password_manager/core/browser/credential_manager_impl.cc b/components/password_manager/core/browser/credential_manager_impl.cc
index 280fbe5..27b6896 100644
--- a/components/password_manager/core/browser/credential_manager_impl.cc
+++ b/components/password_manager/core/browser/credential_manager_impl.cc

@@ -100,7 +100,7 @@
   if (pending_request_ || !store) {
     // Callback error.
     std::move(callback).Run(
-        pending_request_ ? CredentialManagerError::PENDINGREQUEST
+        pending_request_ ? CredentialManagerError::PENDING_REQUEST
                          : CredentialManagerError::PASSWORDSTOREUNAVAILABLE,
         base::nullopt);
     LogCredentialManagerGetResult(metrics_util::CREDENTIAL_MANAGER_GET_REJECTED,

diff --git a/components/password_manager/core/browser/credential_manager_impl_unittest.cc b/components/password_manager/core/browser/credential_manager_impl_unittest.cc
index 4a09597..eedb852 100644
--- a/components/password_manager/core/browser/credential_manager_impl_unittest.cc
+++ b/components/password_manager/core/browser/credential_manager_impl_unittest.cc

@@ -1215,7 +1215,7 @@
 
   // Check that the second request triggered a rejection.
   EXPECT_TRUE(called_2);
-  EXPECT_EQ(CredentialManagerError::PENDINGREQUEST, error_2);
+  EXPECT_EQ(CredentialManagerError::PENDING_REQUEST, error_2);
   EXPECT_FALSE(credential_2);
 
   // Check that the first request resolves.

diff --git a/components/password_manager/core/common/credential_manager_types.h b/components/password_manager/core/common/credential_manager_types.h
index 876b447..cc2a6d5 100644
--- a/components/password_manager/core/common/credential_manager_types.h
+++ b/components/password_manager/core/common/credential_manager_types.h

@@ -35,8 +35,7 @@
 
 enum class CredentialManagerError {
   SUCCESS,
-  DISABLED,
-  PENDINGREQUEST,
+  PENDING_REQUEST,
   PASSWORDSTOREUNAVAILABLE,
   UNKNOWN,
 };

diff --git a/components/suggestions/suggestions_service_impl.cc b/components/suggestions/suggestions_service_impl.cc
index d1de9d9..341c75fe 100644
--- a/components/suggestions/suggestions_service_impl.cc
+++ b/components/suggestions/suggestions_service_impl.cc

@@ -401,7 +401,7 @@
   }
 
   OAuth2TokenService::ScopeSet scopes{GaiaConstants::kChromeSyncOAuth2Scope};
-  token_fetcher_ = base::MakeUnique<PrimaryAccountAccessTokenFetcher>(
+  token_fetcher_ = base::MakeUnique<identity::PrimaryAccountAccessTokenFetcher>(
       "suggestions_service", signin_manager_, token_service_, scopes,
       base::BindOnce(&SuggestionsServiceImpl::AccessTokenAvailable,
                      base::Unretained(this), url));
@@ -412,8 +412,8 @@
     const GoogleServiceAuthError& error,
     const std::string& access_token) {
   DCHECK(token_fetcher_);
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_deleter(
-      std::move(token_fetcher_));
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher>
+      token_fetcher_deleter(std::move(token_fetcher_));
 
   if (error.state() != GoogleServiceAuthError::NONE) {
     blacklist_upload_backoff_.InformOfRequest(/*succeeded=*/false);

diff --git a/components/suggestions/suggestions_service_impl.h b/components/suggestions/suggestions_service_impl.h
index a19104e..79f1422 100644
--- a/components/suggestions/suggestions_service_impl.h
+++ b/components/suggestions/suggestions_service_impl.h

@@ -205,7 +205,7 @@
 
   // Helper for fetching OAuth2 access tokens. This is non-null iff an access
   // token request is currently in progress.
-  std::unique_ptr<PrimaryAccountAccessTokenFetcher> token_fetcher_;
+  std::unique_ptr<identity::PrimaryAccountAccessTokenFetcher> token_fetcher_;
 
   // Contains the current suggestions fetch request. Will only have a value
   // while a request is pending, and will be reset by |OnURLFetchComplete| or

diff --git a/components/viz/service/display/renderer_pixeltest.cc b/components/viz/service/display/renderer_pixeltest.cc
index 9acc71b..eed90ad5 100644
--- a/components/viz/service/display/renderer_pixeltest.cc
+++ b/components/viz/service/display/renderer_pixeltest.cc

@@ -222,7 +222,7 @@
     const gfx::Rect& visible_rect,
     cc::DisplayResourceProvider* resource_provider,
     cc::LayerTreeResourceProvider* child_resource_provider) {
-  const bool with_alpha = (video_frame->format() == media::PIXEL_FORMAT_YV12A);
+  const bool with_alpha = (video_frame->format() == media::PIXEL_FORMAT_I420A);
 
   gfx::ColorSpace video_color_space = video_frame->ColorSpace();
   DCHECK(video_color_space.IsValid());
@@ -1615,7 +1615,7 @@
 
 TEST_F(VideoGLRendererPixelTest, YUVAEdgeBleed) {
   RenderPassList pass_list;
-  CreateEdgeBleedPass(media::PIXEL_FORMAT_YV12A, media::COLOR_SPACE_SD_REC601,
+  CreateEdgeBleedPass(media::PIXEL_FORMAT_I420A, media::COLOR_SPACE_SD_REC601,
                       &pass_list);
   // Set the output color space to match the input primaries and transfer.
   pass_list.back()->color_space =
@@ -1663,7 +1663,7 @@
       CreateTestSharedQuadState(gfx::Transform(), rect, pass.get());
 
   CreateTestYUVVideoDrawQuad_Striped(
-      shared_state, media::PIXEL_FORMAT_YV12A, media::COLOR_SPACE_SD_REC601,
+      shared_state, media::PIXEL_FORMAT_I420A, media::COLOR_SPACE_SD_REC601,
       false, false, gfx::RectF(0.0f, 0.0f, 1.0f, 1.0f), pass.get(),
       video_resource_updater_.get(), rect, rect, resource_provider_.get(),
       child_resource_provider_.get());
@@ -1692,7 +1692,7 @@
       CreateTestSharedQuadState(gfx::Transform(), rect, pass.get());
 
   CreateTestYUVVideoDrawQuad_Striped(
-      shared_state, media::PIXEL_FORMAT_YV12A, media::COLOR_SPACE_SD_REC601,
+      shared_state, media::PIXEL_FORMAT_I420A, media::COLOR_SPACE_SD_REC601,
       true, false, gfx::RectF(0.0f, 0.0f, 1.0f, 1.0f), pass.get(),
       video_resource_updater_.get(), rect, rect, resource_provider_.get(),
       child_resource_provider_.get());

diff --git a/content/browser/appcache/appcache_subresource_url_factory.cc b/content/browser/appcache/appcache_subresource_url_factory.cc
index 1213a50..29ea40f2 100644
--- a/content/browser/appcache/appcache_subresource_url_factory.cc
+++ b/content/browser/appcache/appcache_subresource_url_factory.cc

@@ -136,6 +136,9 @@
                        weak_factory_.GetWeakPtr()));
   }
 
+  // mojom::URLLoader implementation
+  void ProceedWithResponse() override { NOTREACHED(); }
+
   void ContinueFollowRedirect(StartLoaderCallback start_function) {
     if (start_function)
       CreateAndStartAppCacheLoader(std::move(start_function));

diff --git a/content/browser/appcache/appcache_url_loader_job.cc b/content/browser/appcache/appcache_url_loader_job.cc
index a7aeb018..321d10a 100644
--- a/content/browser/appcache/appcache_url_loader_job.cc
+++ b/content/browser/appcache/appcache_url_loader_job.cc

@@ -109,6 +109,12 @@
   NOTREACHED() << "appcache never produces redirects";
 }
 
+void AppCacheURLLoaderJob::ProceedWithResponse() {
+  // TODO(arthursonzogni):  Implement this if AppCache starts using the
+  // AppCacheURLLoader before the Network Service has shipped.
+  NOTREACHED();
+}
+
 void AppCacheURLLoaderJob::SetPriority(net::RequestPriority priority,
                                        int32_t intra_priority_value) {}
 void AppCacheURLLoaderJob::PauseReadingBodyFromNet() {}

diff --git a/content/browser/appcache/appcache_url_loader_job.h b/content/browser/appcache/appcache_url_loader_job.h
index bc8d93f..1a1d40e4 100644
--- a/content/browser/appcache/appcache_url_loader_job.h
+++ b/content/browser/appcache/appcache_url_loader_job.h

@@ -56,6 +56,7 @@
 
   // mojom::URLLoader implementation:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/browser/blob_storage/blob_url_loader_factory.cc b/content/browser/blob_storage/blob_url_loader_factory.cc
index 2b15928..5ee168b7 100644
--- a/content/browser/blob_storage/blob_url_loader_factory.cc
+++ b/content/browser/blob_storage/blob_url_loader_factory.cc

@@ -98,6 +98,7 @@
 
   // mojom::URLLoader implementation:
   void FollowRedirect() override { NOTREACHED(); }
+  void ProceedWithResponse() override { NOTREACHED(); }
 
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}

diff --git a/content/browser/file_url_loader_factory.cc b/content/browser/file_url_loader_factory.cc
index 9a52132..30b8caa0 100644
--- a/content/browser/file_url_loader_factory.cc
+++ b/content/browser/file_url_loader_factory.cc

@@ -101,6 +101,7 @@
 
   // mojom::URLLoader:
   void FollowRedirect() override {}
+  void ProceedWithResponse() override { NOTREACHED(); }
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}
@@ -300,6 +301,7 @@
 
   // mojom::URLLoader:
   void FollowRedirect() override {}
+  void ProceedWithResponse() override {}
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}

diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index e78ec32..6923be31 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc

@@ -57,12 +57,6 @@
   *to_update = result;
 }
 
-void NotifyAbandonedTransferNavigation(const GlobalRequestID& id) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  if (ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get())
-    rdh->CancelRequest(id.child_id, id.request_id);
-}
-
 }  // namespace
 
 // static
@@ -198,23 +192,9 @@
     }
   }
 
-  // Transfer requests that have not matched up with another navigation request
-  // from the renderer need to be cleaned up. These are marked as protected in
-  // the RDHI, so they do not get cancelled when frames are destroyed.
-  if (is_transferring()) {
-    BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
-                            base::BindOnce(&NotifyAbandonedTransferNavigation,
-                                           GetGlobalRequestID()));
-  }
-
   if (!IsRendererDebugURL(url_))
     GetDelegate()->DidFinishNavigation(this);
 
-  // Cancel the navigation on the IO thread if the NavigationHandle is being
-  // destroyed in the middle of the NavigationThrottles checks.
-  if (!IsBrowserSideNavigationEnabled() && !complete_callback_.is_null())
-    RunCompleteCallback(NavigationThrottle::CANCEL_AND_IGNORE);
-
   if (IsInMainFrame()) {
     TRACE_EVENT_ASYNC_END2("navigation", "Navigation StartToCommit", this,
                            "URL", url_.spec(), "Net Error Code",
@@ -467,7 +447,7 @@
   WillProcessResponse(static_cast<RenderFrameHostImpl*>(render_frame_host),
                       headers, net::HttpResponseInfo::CONNECTION_INFO_UNKNOWN,
                       net::HostPortPair(), net::SSLInfo(), GlobalRequestID(),
-                      false, false, false, base::Closure(),
+                      false, false, false,
                       base::Bind(&UpdateThrottleCheckResult, &result));
 
   // Reset the callback to ensure it will not be called later.
@@ -545,14 +525,12 @@
 
 void NavigationHandleImpl::InitServiceWorkerHandle(
     ServiceWorkerContextWrapper* service_worker_context) {
-  DCHECK(IsBrowserSideNavigationEnabled());
   service_worker_handle_.reset(
       new ServiceWorkerNavigationHandle(service_worker_context));
 }
 
 void NavigationHandleImpl::InitAppCacheHandle(
     ChromeAppCacheService* appcache_service) {
-  DCHECK(IsBrowserSideNavigationEnabled());
   appcache_handle_.reset(new AppCacheNavigationHandle(appcache_service));
 }
 
@@ -608,8 +586,7 @@
   if (!IsRendererDebugURL(url_))
     RegisterNavigationThrottles();
 
-  if (IsBrowserSideNavigationEnabled())
-    navigation_ui_data_ = GetDelegate()->GetNavigationUIData(this);
+  navigation_ui_data_ = GetDelegate()->GetNavigationUIData(this);
 
   // Notify each throttle of the request.
   base::Closure on_defer_callback_copy = on_defer_callback_for_testing_;
@@ -741,7 +718,6 @@
     bool should_replace_current_entry,
     bool is_download,
     bool is_stream,
-    const base::Closure& transfer_callback,
     const ThrottleChecksFinishedCallback& callback) {
   TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle", this,
                                "WillProcessResponse");
@@ -758,7 +734,6 @@
   ssl_info_ = ssl_info;
   socket_address_ = socket_address;
   complete_callback_ = callback;
-  transfer_callback_ = transfer_callback;
 
   // Notify each throttle of the response.
   base::Closure on_defer_callback_copy = on_defer_callback_for_testing_;
@@ -772,13 +747,10 @@
   }
 
   // If the navigation is done processing the response, then it's ready to
-  // commit. Determine which RenderFrameHost should render the response, based
-  // on its site (after any redirects).
-  // Note: if MaybeTransferAndProceed returns false, this means that this
-  // NavigationHandle was deleted, so return immediately.
-  if (result.action() == NavigationThrottle::PROCEED &&
-      !MaybeTransferAndProceed())
-    return;
+  // commit. Inform observers that the navigation is now ready to commit, unless
+  // it is not set to commit (204/205s/downloads).
+  if (result.action() == NavigationThrottle::PROCEED && render_frame_host_)
+    ReadyToCommitNavigation(render_frame_host_);
 
   TRACE_EVENT_ASYNC_STEP_INTO1("navigation", "NavigationHandle", this,
                                "ProcessResponse", "result", result.action());
@@ -806,8 +778,7 @@
                         ready_to_commit_time_ - navigation_start_);
   }
 
-  if (IsBrowserSideNavigationEnabled())
-    SetExpectedProcess(render_frame_host->GetProcess());
+  SetExpectedProcess(render_frame_host->GetProcess());
 
   if (!IsRendererDebugURL(url_) && !IsSameDocument())
     GetDelegate()->ReadyToCommitNavigation(this);
@@ -904,19 +875,6 @@
       expected_process, site_url_);
 }
 
-void NavigationHandleImpl::Transfer() {
-  DCHECK(!IsBrowserSideNavigationEnabled());
-  // This is an actual transfer. Inform the NavigationResourceThrottle. This
-  // will allow to mark the URLRequest as transferring. When it is marked as
-  // transferring, the URLRequest can no longer be cancelled by its original
-  // RenderFrame. Instead it will persist until being picked up by the transfer
-  // RenderFrame, even if the original RenderFrame is destroyed.
-  // Note: |transfer_callback_| can be null in unit tests.
-  if (!transfer_callback_.is_null())
-    BrowserThread::PostTask(BrowserThread::IO, FROM_HERE, transfer_callback_);
-  transfer_callback_.Reset();
-}
-
 NavigationThrottle::ThrottleCheckResult
 NavigationHandleImpl::CheckWillStartRequest() {
   DCHECK(state_ == WILL_SEND_REQUEST || state_ == DEFERRING_START);
@@ -995,9 +953,6 @@
       case NavigationThrottle::BLOCK_REQUEST_AND_COLLAPSE:
         frame_tree_node_->SetCollapsed(true);  // Fall through.
       case NavigationThrottle::BLOCK_REQUEST:
-        CHECK(IsBrowserSideNavigationEnabled())
-            << "BLOCK_REQUEST and BLOCK_REQUEST_AND_COLLAPSE must not be used "
-               "on redirect without PlzNavigate";
       case NavigationThrottle::CANCEL:
       case NavigationThrottle::CANCEL_AND_IGNORE:
         state_ = CANCELING;
@@ -1161,14 +1116,11 @@
     }
 
     // If the navigation is about to proceed after having been deferred while
-    // processing the response, then it's ready to commit. Determine which
-    // RenderFrameHost should render the response, based on its site (after any
-    // redirects).
-    // Note: if MaybeTransferAndProceed returns false, this means that this
-    // NavigationHandle was deleted, so return immediately.
-    if (result.action() == NavigationThrottle::PROCEED &&
-        !MaybeTransferAndProceed())
-      return;
+    // processing the response, then it's ready to commit. Inform observers that
+    // the navigation is now ready to commit, unless it is not set to commit
+    // (204/205s/downloads).
+    if (result.action() == NavigationThrottle::PROCEED && render_frame_host_)
+      ReadyToCommitNavigation(render_frame_host_);
   }
   DCHECK_NE(NavigationThrottle::DEFER, result.action());
 
@@ -1185,8 +1137,7 @@
          result.action() == NavigationThrottle::CANCEL ||
          result.action() == NavigationThrottle::BLOCK_REQUEST_AND_COLLAPSE);
   DCHECK(result.action() != NavigationThrottle::BLOCK_REQUEST_AND_COLLAPSE ||
-         state_ == DEFERRING_START ||
-         (state_ == DEFERRING_REDIRECT && IsBrowserSideNavigationEnabled()));
+         state_ == DEFERRING_START || state_ == DEFERRING_REDIRECT);
 
   if (result.action() == NavigationThrottle::BLOCK_REQUEST_AND_COLLAPSE)
     frame_tree_node_->SetCollapsed(true);
@@ -1197,85 +1148,6 @@
   RunCompleteCallback(result);
 }
 
-bool NavigationHandleImpl::MaybeTransferAndProceed() {
-  DCHECK_EQ(WILL_PROCESS_RESPONSE, state_);
-
-  // Check if the navigation should transfer. This may result in the
-  // destruction of this NavigationHandle, and the cancellation of the request.
-  if (!MaybeTransferAndProceedInternal())
-    return false;
-
-  // Inform observers that the navigation is now ready to commit, unless a
-  // transfer of the navigation failed.
-  // PlzNavigate: when a navigation is not set to commit (204/205s/downloads) do
-  // not call ReadyToCommitNavigation.
-  DCHECK(!IsBrowserSideNavigationEnabled() || render_frame_host_ ||
-         net_error_code_ == net::ERR_ABORTED);
-  if (!IsBrowserSideNavigationEnabled() || render_frame_host_)
-    ReadyToCommitNavigation(render_frame_host_);
-  return true;
-}
-
-bool NavigationHandleImpl::MaybeTransferAndProceedInternal() {
-  DCHECK(render_frame_host_ || (IsBrowserSideNavigationEnabled() &&
-                                net_error_code_ == net::ERR_ABORTED));
-
-  // PlzNavigate: the final RenderFrameHost handling this navigation has been
-  // decided before calling WillProcessResponse in
-  // NavigationRequest::OnResponseStarted.
-  // TODO(clamy): See if PlzNavigate could use this code to check whether to
-  // use the RFH determined at the start of the navigation or to switch to
-  // another one.
-  if (IsBrowserSideNavigationEnabled())
-    return true;
-
-  // A navigation from a RenderFrame that is no longer active should not attempt
-  // to transfer.
-  if (!render_frame_host_->is_active()) {
-    // This will cause the deletion of this NavigationHandle and the
-    // cancellation of the navigation.
-    render_frame_host_->SetNavigationHandle(nullptr);
-    return false;
-  }
-
-  // If this is a download, do not do a cross-site check. The renderer will
-  // see it is a download and abort the request.
-  //
-  // Similarly, HTTP 204 (No Content) responses leave the renderer showing the
-  // previous page. The navigation should be allowed to finish without running
-  // the unload handler or swapping in the pending RenderFrameHost.
-  if (is_download_ || is_stream_ ||
-      (response_headers_.get() && response_headers_->response_code() == 204)) {
-    return true;
-  }
-
-  // In the site-per-process model, the RenderFrameHostManager may decide
-  // that a process transfer is needed. Process transfers are skipped for
-  // WebUI processes for now, since e.g. chrome://settings has multiple
-  // "cross-site" chrome:// frames, and that doesn't yet work cross-process.
-  RenderFrameHostManager* manager =
-      render_frame_host_->frame_tree_node()->render_manager();
-  bool should_transfer = false;
-  if (!ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
-          render_frame_host_->GetProcess()->GetID())) {
-    should_transfer |= manager->IsRendererTransferNeededForNavigation(
-        render_frame_host_, url_);
-  }
-
-  // Start the transfer if needed.
-  if (should_transfer) {
-    // This may destroy the NavigationHandle if the transfer fails.
-    base::WeakPtr<NavigationHandleImpl> weak_self = weak_factory_.GetWeakPtr();
-    manager->OnCrossSiteResponse(render_frame_host_, request_id_,
-                                 redirect_chain_, sanitized_referrer_,
-                                 transition_, should_replace_current_entry_);
-    if (!weak_self)
-      return false;
-  }
-
-  return true;
-}
-
 void NavigationHandleImpl::RunCompleteCallback(
     NavigationThrottle::ThrottleCheckResult result) {
   DCHECK(result.action() != NavigationThrottle::DEFER);

diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index 9c3f20d..6c37ca47a 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h

@@ -42,39 +42,12 @@
 class ServiceWorkerContextWrapper;
 class ServiceWorkerNavigationHandle;
 
-// This class keeps track of a single navigation. It is created upon receipt of
-// a DidStartProvisionalLoad IPC in a RenderFrameHost. The RenderFrameHost owns
-// the newly created NavigationHandleImpl as long as the navigation is ongoing.
-// The NavigationHandleImpl in the RenderFrameHost will be reset when the
-// navigation stops, that is if one of the following events happen:
-//   - The RenderFrameHost receives a DidStartProvisionalLoad IPC for a new
-//   navigation (see below for special cases where the DidStartProvisionalLoad
-//   message does not indicate the start of a new navigation).
-//   - The RenderFrameHost stops loading.
-//   - The RenderFrameHost receives a DidDropNavigation IPC.
-//
-// When the navigation encounters an error, the DidStartProvisionalLoad marking
-// the start of the load of the error page will not be considered as marking a
-// new navigation. It will not reset the NavigationHandleImpl in the
-// RenderFrameHost.
-//
-// If the navigation needs a cross-site transfer, then the NavigationHandleImpl
-// will briefly be held by the RenderFrameHostManager, until a suitable
-// RenderFrameHost for the navigation has been found. The ownership of the
-// NavigationHandleImpl will then be transferred to the new RenderFrameHost.
-// The DidStartProvisionalLoad received by the new RenderFrameHost for the
-// transferring navigation will not reset the NavigationHandleImpl, as it does
-// not mark the start of a new navigation.
-//
-// PlzNavigate: the NavigationHandleImpl is created just after creating a new
-// NavigationRequest. It is then owned by the NavigationRequest until the
-// navigation is ready to commit. The NavigationHandleImpl ownership is then
-// transferred to the RenderFrameHost in which the navigation will commit.
-//
-// When PlzNavigate is enabled, the NavigationHandleImpl will never be reset
-// following the receipt of a DidStartProvisionalLoad IPC. There are also no
-// transferring navigations. The other causes of NavigationHandleImpl reset in
-// the RenderFrameHost still apply.
+// This class keeps track of a single navigation. It is created after the
+// BeforeUnload for the navigation has run. It is then owned by the
+// NavigationRequest until the navigation is ready to commit. The
+// NavigationHandleImpl ownership is then transferred to the RenderFrameHost in
+// which the navigation will commit. It is finaly destroyed when the navigation
+// commits.
 class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
  public:
   // If |redirect_chain| is empty, then the redirect chain will be created to
@@ -188,8 +161,6 @@
   void SetOnDeferCallbackForTesting(const base::Closure& on_defer_callback);
 
   // Whether or not the navigation has been initiated by a form submission.
-  // TODO(arthursonzogni): This value is correct only when PlzNavigate is
-  // enabled. Make it work in both modes.
   bool is_form_submission() const { return is_form_submission_; }
 
   // The NavigatorDelegate to notify/query for various navigation events.
@@ -219,14 +190,6 @@
   // will not have a NavigationEntry associated with it, and this will return 0.
   int pending_nav_entry_id() const { return pending_nav_entry_id_; }
 
-  // Changes the pending NavigationEntry ID for this handle.  This is currently
-  // required during transfer navigations.
-  // TODO(creis): Remove this when transfer navigations do not require pending
-  // entries.  See https://crbug.com/495161.
-  void update_entry_id_for_transfer(int nav_entry_id) {
-    pending_nav_entry_id_ = nav_entry_id;
-  }
-
   void set_net_error_code(net::Error net_error_code) {
     net_error_code_ = net_error_code;
   }
@@ -246,14 +209,12 @@
     render_frame_host_ = render_frame_host;
   }
 
-  // PlzNavigate
   void InitServiceWorkerHandle(
       ServiceWorkerContextWrapper* service_worker_context);
   ServiceWorkerNavigationHandle* service_worker_handle() const {
     return service_worker_handle_.get();
   }
 
-  // PlzNavigate
   void InitAppCacheHandle(ChromeAppCacheService* appcache_service);
   AppCacheNavigationHandle* appcache_handle() const {
     return appcache_handle_.get();
@@ -292,7 +253,7 @@
   // will allow the caller to cancel the navigation or let it proceed.
   // This will also inform the delegate that the request was redirected.
   //
-  // PlzNavigate: |post_redirect_process| is the renderer process we expect to
+  // |post_redirect_process| is the renderer process we expect to
   // use to commit the navigation now that it has been redirected. It can be
   // null if there is no live process that can be used. In that case, a suitable
   // renderer process will be created at commit time.
@@ -319,9 +280,7 @@
   // NavigationHandle will not call |callback| with a result of DEFER.
   // If the result is PROCEED, then 'ReadyToCommitNavigation' will be called
   // with |render_frame_host| and |response_headers| just before calling
-  // |callback|. Should a transfer navigation happen, |transfer_callback| will
-  // be run on the IO thread.
-  // PlzNavigate: transfer navigations are not possible.
+  // |callback|.
   void WillProcessResponse(
       RenderFrameHostImpl* render_frame_host,
       scoped_refptr<net::HttpResponseHeaders> response_headers,
@@ -332,7 +291,6 @@
       bool should_replace_current_entry,
       bool is_download,
       bool is_stream,
-      const base::Closure& transfer_callback,
       const ThrottleChecksFinishedCallback& callback);
 
   // Returns the FrameTreeNode this navigation is happening in.
@@ -364,9 +322,6 @@
     navigation_data_ = std::move(navigation_data);
   }
 
-  // Called when the navigation is transferred to a different renderer.
-  void Transfer();
-
   NavigationUIData* navigation_ui_data() const {
     return navigation_ui_data_.get();
   }
@@ -402,7 +357,6 @@
     source_location_ = source_location;
   }
 
-  // PlzNavigate
   // Sets ID of the RenderProcessHost we expect the navigation to commit in.
   // This is used to inform the RenderProcessHost to expect a navigation to the
   // url we're navigating to.
@@ -431,19 +385,6 @@
   void CancelDeferredNavigationInternal(
       NavigationThrottle::ThrottleCheckResult result);
 
-  // Called when WillProcessResponse checks are done, to find the final
-  // RenderFrameHost for the navigation. Checks whether the navigation should be
-  // transferred. Returns false if the transfer attempt results in the
-  // destruction of this NavigationHandle and the navigation should no longer
-  // proceed. This can happen when the RenderFrameHostManager determines a
-  // transfer is needed, but WebContentsDelegate::ShouldTransferNavigation
-  // returns false.
-  bool MaybeTransferAndProceed();
-
-  // Helper method for MaybeTransferAndProceed. Returns false if the transfer
-  // attempt results in the destruction of this NavigationHandle.
-  bool MaybeTransferAndProceedInternal();
-
   // Helper function to run and reset the |complete_callback_|. This marks the
   // end of a round of NavigationThrottleChecks.
   void RunCompleteCallback(NavigationThrottle::ThrottleCheckResult result);
@@ -463,8 +404,7 @@
   bool IsSelfReferentialURL();
 
   // Updates the destination site URL for this navigation. This is called on
-  // redirects.
-  // PlzNavigate: |post_redirect_process| is the renderer process that should
+  // redirects. |post_redirect_process| is the renderer process that should
   // handle the navigation following the redirect if it can be handled by an
   // existing RenderProcessHost. Otherwise, it should be null.
   void UpdateSiteURL(RenderProcessHost* post_redirect_process);
@@ -549,12 +489,10 @@
   // TODO(clamy): Revisit the unit test architecture when PlzNavigate ships.
   ThrottleChecksFinishedCallback complete_callback_for_testing_;
 
-  // PlzNavigate
   // Manages the lifetime of a pre-created ServiceWorkerProviderHost until a
   // corresponding ServiceWorkerNetworkProvider is created in the renderer.
   std::unique_ptr<ServiceWorkerNavigationHandle> service_worker_handle_;
 
-  // PlzNavigate
   // Manages the lifetime of a pre-created AppCacheHost until a browser side
   // navigation is ready to be committed, i.e we have a renderer process ready
   // to service the navigation request.
@@ -563,7 +501,6 @@
   // Embedder data from the IO thread tied to this navigation.
   std::unique_ptr<NavigationData> navigation_data_;
 
-  // PlzNavigate
   // Embedder data from the UI thread tied to this navigation.
   std::unique_ptr<NavigationUIData> navigation_ui_data_;
 
@@ -579,9 +516,6 @@
   // The chain of redirects.
   std::vector<GURL> redirect_chain_;
 
-  // A callback to run on the IO thread if the navigation transfers.
-  base::Closure transfer_callback_;
-
   // Whether the navigation ended up being a download or a stream.
   bool is_download_;
   bool is_stream_;
@@ -612,12 +546,10 @@
   // Whether or not the navigation results from the submission of a form.
   bool is_form_submission_;
 
-  // PlzNavigate
   // Information about the JavaScript that started the navigation. For
   // navigations initiated by Javascript.
   SourceLocation source_location_;
 
-  // PlzNavigate
   // Used to inform a RenderProcessHost that we expect this navigation to commit
   // in it.
   int expected_render_process_host_id_;

diff --git a/content/browser/frame_host/navigation_handle_impl_unittest.cc b/content/browser/frame_host/navigation_handle_impl_unittest.cc
index 1e315de..db70600 100644
--- a/content/browser/frame_host/navigation_handle_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_handle_impl_unittest.cc

@@ -172,7 +172,7 @@
     test_handle_->WillProcessResponse(
         main_test_rfh(), scoped_refptr<net::HttpResponseHeaders>(),
         net::HttpResponseInfo::CONNECTION_INFO_QUIC_35, net::HostPortPair(),
-        net::SSLInfo(), GlobalRequestID(), false, false, false, base::Closure(),
+        net::SSLInfo(), GlobalRequestID(), false, false, false,
         base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }

diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 2ab85430..cf198bf 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc

@@ -858,7 +858,7 @@
       render_frame_host, response->head.headers.get(),
       response->head.connection_info, response->head.socket_address, ssl_info_,
       request_id, common_params_.should_replace_current_entry, is_download,
-      is_stream, base::Closure(),
+      is_stream,
       base::Bind(&NavigationRequest::OnWillProcessResponseChecksComplete,
                  base::Unretained(this)));
 }
@@ -1171,7 +1171,26 @@
       OnRequestFailed(false, net::ERR_ABORTED, base::nullopt);
       return;
     }
-    loader_->ProceedWithResponse();
+
+    // Call ProceedWithResponse()
+    // Note: There is no need to call ProceedWithResponse() when the Network
+    // Service is enabled. See https://crbug.com/791049.
+    if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+      if (!IsNavigationMojoResponseEnabled()) {
+        loader_->ProceedWithResponse();
+      } else {
+        // |url_loader_client_endpoints_| is always valid, except in some tests
+        // where the TestNavigationLoader is used.
+        if (url_loader_client_endpoints_) {
+          mojom::URLLoaderPtr url_loader(
+              std::move(url_loader_client_endpoints_->url_loader));
+          url_loader->ProceedWithResponse();
+          url_loader_client_endpoints_->url_loader = url_loader.PassInterface();
+        } else {
+          loader_->ProceedWithResponse();
+        }
+      }
+    }
   }
 
   // Abort the request if needed. This includes requests that were blocked by

diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index 99feb65..4fc67e8 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc

@@ -371,100 +371,25 @@
   if (delegate_)
     delegate_->AdjustPreviewsStateForNavigation(&previews_state);
 
-  // PlzNavigate: the RenderFrameHosts are no longer asked to navigate.
-  if (IsBrowserSideNavigationEnabled()) {
-    navigation_data_.reset(new NavigationMetricsData(navigation_start, dest_url,
-                                                     entry.restore_type()));
-    RequestNavigation(
-        frame_tree_node, dest_url, dest_referrer, frame_entry, entry,
-        reload_type, previews_state, is_same_document_history_load,
-        is_history_navigation_in_new_child, post_body, navigation_start);
-    if (frame_tree_node->IsMainFrame() &&
-        frame_tree_node->navigation_request()) {
-      // TODO(carlosk): extend these traces to support subframes and
-      // non-PlzNavigate navigations.
-      // For the trace below we're using the navigation handle as the async
-      // trace id, |navigation_start| as the timestamp and reporting the
-      // FrameTreeNode id as a parameter. For navigations where no network
-      // request is made (data URLs, JavaScript URLs, etc) there is no handle
-      // and so no tracing is done.
-      TRACE_EVENT_ASYNC_BEGIN_WITH_TIMESTAMP1(
-          "navigation", "Navigation timeToNetworkStack",
-          frame_tree_node->navigation_request()->navigation_handle(),
-          navigation_start, "FrameTreeNode id",
-          frame_tree_node->frame_tree_node_id());
-    }
-
-  } else {
-    RenderFrameHostImpl* dest_render_frame_host =
-        frame_tree_node->render_manager()->Navigate(
-            dest_url, frame_entry, entry, reload_type != ReloadType::NONE);
-    if (!dest_render_frame_host)
-      return false;  // Unable to create the desired RenderFrameHost.
-
-    // Make sure no code called via RFHM::Navigate clears the pending entry.
-    if (is_pending_entry)
-      CHECK_EQ(controller_->GetPendingEntry(), &entry);
-
-    // For security, we should never send non-Web-UI URLs to a Web UI renderer.
-    // Double check that here.
-    CheckWebUIRendererDoesNotDisplayNormalURL(dest_render_frame_host, dest_url);
-
-    // In the case of a transfer navigation, set the destination
-    // RenderFrameHost as loading.  This ensures that the RenderFrameHost gets
-    // in a loading state without emitting a spurious DidStartLoading
-    // notification at the FrameTreeNode level (since the FrameTreeNode was
-    // already loading). Note that this works both for a transfer to a
-    // different RenderFrameHost and in the rare case where the navigation is
-    // transferred back to the same RenderFrameHost.
-    bool is_transfer = entry.transferred_global_request_id().child_id != -1;
-    if (is_transfer)
-      dest_render_frame_host->set_is_loading(true);
-
-    // A session history navigation should have been accompanied by state.
-    // TODO(creis): This is known to be failing in UseSubframeNavigationEntries
-    // in https://crbug.com/568703, when the PageState on a FrameNavigationEntry
-    // is unexpectedly empty.  Until the cause is found, keep this as a DCHECK
-    // and load the URL without PageState.
-    if (is_pending_entry && controller_->GetPendingEntryIndex() != -1)
-      DCHECK(frame_entry.page_state().IsValid());
-
-    // Navigate in the desired RenderFrameHost.
-    // We can skip this step in the rare case that this is a transfer navigation
-    // which began in the chosen RenderFrameHost, since the request has already
-    // been issued.  In that case, simply resume the response.
-    bool is_transfer_to_same =
-        is_transfer && entry.transferred_global_request_id().child_id ==
-                           dest_render_frame_host->GetProcess()->GetID();
-    if (!is_transfer_to_same) {
-      navigation_data_.reset(new NavigationMetricsData(
-          navigation_start, dest_url, entry.restore_type()));
-      // Create the navigation parameters.
-      FrameMsg_Navigate_Type::Value navigation_type = GetNavigationType(
-          frame_tree_node->current_url(),  // old_url
-          dest_url,                        // new_url
-          reload_type,                     // reload_type
-          entry,                           // entry
-          frame_entry,                     // frame_entry
-          is_same_document_history_load);  // is_same_document_history_load
-
-      dest_render_frame_host->Navigate(
-          entry.ConstructCommonNavigationParams(
-              frame_entry, post_body, dest_url, dest_referrer, navigation_type,
-              previews_state, navigation_start),
-          entry.ConstructStartNavigationParams(),
-          entry.ConstructRequestNavigationParams(
-              frame_entry, GURL(), std::string(),
-              is_history_navigation_in_new_child,
-              entry.GetSubframeUniqueNames(frame_tree_node),
-              frame_tree_node->has_committed_real_load(),
-              controller_->GetPendingEntryIndex() == -1,
-              controller_->GetIndexOfEntry(&entry),
-              controller_->GetLastCommittedEntryIndex(),
-              controller_->GetEntryCount()));
-    } else {
-      dest_render_frame_host->navigation_handle()->set_is_transferring(false);
-    }
+  navigation_data_.reset(new NavigationMetricsData(navigation_start, dest_url,
+                                                   entry.restore_type()));
+  RequestNavigation(
+      frame_tree_node, dest_url, dest_referrer, frame_entry, entry, reload_type,
+      previews_state, is_same_document_history_load,
+      is_history_navigation_in_new_child, post_body, navigation_start);
+  if (frame_tree_node->IsMainFrame() && frame_tree_node->navigation_request()) {
+    // TODO(carlosk): extend these traces to support subframes and
+    // non-PlzNavigate navigations.
+    // For the trace below we're using the navigation handle as the async
+    // trace id, |navigation_start| as the timestamp and reporting the
+    // FrameTreeNode id as a parameter. For navigations where no network
+    // request is made (data URLs, JavaScript URLs, etc) there is no handle
+    // and so no tracing is done.
+    TRACE_EVENT_ASYNC_BEGIN_WITH_TIMESTAMP1(
+        "navigation", "Navigation timeToNetworkStack",
+        frame_tree_node->navigation_request()->navigation_handle(),
+        navigation_start, "FrameTreeNode id",
+        frame_tree_node->frame_tree_node_id());
   }
 
   // Make sure no code called via RFH::Navigate clears the pending entry.
@@ -477,10 +402,11 @@
     // than a history one), and the user typed in a javascript: URL, don't add
     // it to the session history.
     //
-    // This is a hack. What we really want is to avoid adding to the history any
-    // URL that doesn't generate content, and what would be great would be if we
-    // had a message from the renderer telling us that a new page was not
-    // created. The same message could be used for mailto: URLs and the like.
+    // This is a hack. What we really want is to avoid adding to the history
+    // any URL that doesn't generate content, and what would be great would be
+    // if we had a message from the renderer telling us that a new page was
+    // not created. The same message could be used for mailto: URLs and the
+    // like.
     return false;
   }
 
@@ -1289,12 +1215,6 @@
       entry->SetRedirectChain(pending_entry->GetRedirectChain());
     }
 
-    // If there's a current NavigationHandle, update its pending NavEntry ID.
-    // This is necessary for transfer navigations.  The handle may be null in
-    // PlzNavigate.
-    if (navigation_handle)
-      navigation_handle->update_entry_id_for_transfer(entry->GetUniqueID());
-
     controller_->SetPendingEntry(std::move(entry));
     if (delegate_)
       delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);

diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 15eaa55..c4aefcbc 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc

@@ -113,7 +113,6 @@
 #include "content/public/browser/stream_handle.h"
 #include "content/public/browser/webvr_service_provider.h"
 #include "content/public/common/bindings_policy.h"
-#include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -330,9 +329,7 @@
   for (FrameTreeNode* node : frame_tree->Nodes()) {
     RenderFrameHostImpl* frame_host = node->current_frame_host();
     RenderFrameHostImpl* pending_frame_host =
-        IsBrowserSideNavigationEnabled()
-            ? node->render_manager()->speculative_frame_host()
-            : node->render_manager()->pending_frame_host();
+        node->render_manager()->speculative_frame_host();
     if (frame_host)
       routing_ids->insert(frame_host->GetGlobalFrameRoutingId());
     if (pending_frame_host)
@@ -482,7 +479,6 @@
       routing_id_(routing_id),
       is_waiting_for_swapout_ack_(false),
       render_frame_created_(false),
-      navigations_suspended_(false),
       is_waiting_for_beforeunload_ack_(false),
       unload_ack_is_for_navigation_(false),
       is_loading_(false),
@@ -1429,7 +1425,7 @@
 void RenderFrameHostImpl::CancelInitialHistoryLoad() {
   // A Javascript navigation interrupted the initial history load.  Check if an
   // initial subframe cross-process navigation needs to be canceled as a result.
-  // TODO(creis, clamy): Cancel any cross-process navigation in PlzNavigate.
+  // TODO(creis, clamy): Cancel any cross-process navigation.
   if (GetParent() && !frame_tree_node_->has_committed_real_load() &&
       frame_tree_node_->render_manager()->pending_frame_host()) {
     frame_tree_node_->render_manager()->CancelPendingIfNecessary(
@@ -1659,11 +1655,10 @@
     return;
   }
 
-  // PlzNavigate
-  if (!navigation_handle_ && IsBrowserSideNavigationEnabled()) {
-    // PlzNavigate: the browser has not been notified about the start of the
-    // load in this renderer yet (e.g., for same-document navigations that start
-    // in the renderer). Do it now.
+  if (!navigation_handle_) {
+    // The browser has not been notified about the start of the load in this
+    // renderer yet (e.g., for same-document navigations that start in the
+    // renderer). Do it now.
     if (!is_loading()) {
       bool was_loading = frame_tree_node()->frame_tree()->IsLoading();
       is_loading_ = true;
@@ -1686,23 +1681,6 @@
     SetLastCommittedSiteUrl(validated_params->url);
   }
 
-  // PlzNavigate sends searchable form data in the BeginNavigation message
-  // while non-PlzNavigate sends it in the DidCommitProvisionalLoad message.
-  // Update |navigation_handle| if necessary.
-  if (!IsBrowserSideNavigationEnabled() &&
-      !validated_params->searchable_form_url.is_empty()) {
-    navigation_handle->set_searchable_form_url(
-        validated_params->searchable_form_url);
-    navigation_handle->set_searchable_form_encoding(
-        validated_params->searchable_form_encoding);
-
-    // Reset them so that they are consistent in both the PlzNavigate and
-    // non-PlzNavigate case. Users should use those values from
-    // NavigationHandle.
-    validated_params->searchable_form_url = GURL();
-    validated_params->searchable_form_encoding = std::string();
-  }
-
   accessibility_reset_count_ = 0;
   frame_tree_node()->navigator()->DidNavigate(this, *validated_params,
                                               std::move(navigation_handle));
@@ -1763,14 +1741,6 @@
   navigation_handle_ = std::move(navigation_handle);
 }
 
-std::unique_ptr<NavigationHandleImpl>
-RenderFrameHostImpl::PassNavigationHandleOwnership() {
-  DCHECK(!IsBrowserSideNavigationEnabled());
-  if (navigation_handle_)
-    navigation_handle_->set_is_transferring(true);
-  return std::move(navigation_handle_);
-}
-
 void RenderFrameHostImpl::SwapOut(
     RenderFrameProxyHost* proxy,
     bool is_loading) {
@@ -1875,17 +1845,15 @@
     beforeunload_timeout_->Stop();
   send_before_unload_start_time_ = base::TimeTicks();
 
-  // PlzNavigate: if the ACK is for a navigation, send it to the Navigator to
-  // have the current navigation stop/proceed. Otherwise, send it to the
+  // If the ACK is for a navigation, send it to the Navigator to have the
+  // current navigation stop/proceed. Otherwise, send it to the
   // RenderFrameHostManager which handles closing.
-  if (IsBrowserSideNavigationEnabled() && unload_ack_is_for_navigation_) {
-    // TODO(clamy): see if before_unload_end_time should be transmitted to the
-    // Navigator.
+  if (unload_ack_is_for_navigation_) {
     frame_tree_node_->navigator()->OnBeforeUnloadACK(frame_tree_node_, proceed,
                                                      before_unload_end_time);
   } else {
     frame_tree_node_->render_manager()->OnBeforeUnloadACK(
-        unload_ack_is_for_navigation_, proceed, before_unload_end_time);
+        proceed, before_unload_end_time);
   }
 
   // If canceled, notify the delegate to cancel its pending navigation entry.
@@ -2396,10 +2364,6 @@
 void RenderFrameHostImpl::OnAbortNavigation() {
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::OnAbortNavigation",
                "frame_tree_node", frame_tree_node_->frame_tree_node_id());
-  if (!IsBrowserSideNavigationEnabled()) {
-    NOTREACHED();
-    return;
-  }
   if (!is_active())
     return;
   frame_tree_node()->navigator()->OnAbortNavigation(frame_tree_node());
@@ -2665,12 +2629,14 @@
   render_view_host_->GetWidget()->WasResized();
 }
 
+// TODO(clamy): Remove this IPC now that it is only used for same-document
+// navigations.
 void RenderFrameHostImpl::OnDidStartLoading(bool to_different_document) {
   TRACE_EVENT2("navigation", "RenderFrameHostImpl::OnDidStartLoading",
                "frame_tree_node", frame_tree_node_->frame_tree_node_id(),
                "to different document", to_different_document);
 
-  if (IsBrowserSideNavigationEnabled() && to_different_document) {
+  if (to_different_document) {
     bad_message::ReceivedBadMessage(GetProcess(),
                                     bad_message::RFH_UNEXPECTED_LOAD_START);
     return;
@@ -2990,7 +2956,6 @@
 void RenderFrameHostImpl::BeginNavigation(
     const CommonNavigationParams& common_params,
     mojom::BeginNavigationParamsPtr begin_params) {
-  CHECK(IsBrowserSideNavigationEnabled());
   if (!is_active())
     return;
 
@@ -3272,47 +3237,6 @@
   return CanCommitURL(origin_url);
 }
 
-void RenderFrameHostImpl::Navigate(
-    const CommonNavigationParams& common_params,
-    const StartNavigationParams& start_params,
-    const RequestNavigationParams& request_params) {
-  TRACE_EVENT1("navigation", "RenderFrameHostImpl::Navigate", "frame_tree_node",
-               frame_tree_node_->frame_tree_node_id());
-  DCHECK(!IsBrowserSideNavigationEnabled());
-
-  UpdatePermissionsForNavigation(common_params, request_params);
-
-  // Only send the message if we aren't suspended at the start of a cross-site
-  // request.
-  if (navigations_suspended_) {
-    // This may replace an existing set of params, if this is a pending RFH that
-    // is navigated twice consecutively.
-    suspended_nav_params_.reset(
-        new NavigationParams(common_params, start_params, request_params));
-  } else {
-    // Get back to a clean state, in case we start a new navigation without
-    // completing an unload handler.
-    ResetWaitingState();
-    SendNavigateMessage(common_params, start_params, request_params);
-  }
-
-  // Force the throbber to start. This is done because Blink's "started loading"
-  // message will be received asynchronously from the UI of the browser. But the
-  // throbber needs to be kept in sync with what's happening in the UI. For
-  // example, the throbber will start immediately when the user navigates even
-  // if the renderer is delayed. There is also an issue with the throbber
-  // starting because the WebUI (which controls whether the favicon is
-  // displayed) happens synchronously. If the start loading messages was
-  // asynchronous, then the default favicon would flash in.
-  //
-  // Blink doesn't send throb notifications for JavaScript URLs, so it is not
-  // done here either.
-  if (!common_params.url.SchemeIs(url::kJavaScriptScheme) &&
-      (!navigation_handle_ || !navigation_handle_->is_transferring())) {
-    OnDidStartLoading(true);
-  }
-}
-
 void RenderFrameHostImpl::NavigateToInterstitialURL(const GURL& data_url) {
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::NavigateToInterstitialURL",
                "frame_tree_node", frame_tree_node_->frame_tree_node_id());
@@ -3325,14 +3249,10 @@
       base::Optional<SourceLocation>(),
       CSPDisposition::CHECK /* should_check_main_world_csp */,
       false /* started_from_context_menu */, false /* has_user_gesture */);
-  if (IsBrowserSideNavigationEnabled()) {
-    CommitNavigation(nullptr, mojom::URLLoaderClientEndpointsPtr(),
-                     std::unique_ptr<StreamHandle>(), common_params,
-                     RequestNavigationParams(), false, base::nullopt,
-                     base::UnguessableToken::Create() /* not traced */);
-  } else {
-    Navigate(common_params, StartNavigationParams(), RequestNavigationParams());
-  }
+  CommitNavigation(nullptr, mojom::URLLoaderClientEndpointsPtr(),
+                   std::unique_ptr<StreamHandle>(), common_params,
+                   RequestNavigationParams(), false, base::nullopt,
+                   base::UnguessableToken::Create() /* not traced */);
 }
 
 void RenderFrameHostImpl::Stop() {
@@ -3345,7 +3265,7 @@
                                                bool is_reload) {
   DCHECK(for_navigation || !is_reload);
 
-  if (IsBrowserSideNavigationEnabled() && !for_navigation) {
+  if (!for_navigation) {
     // Cancel any pending navigations, to avoid their navigation commit/fail
     // event from wiping out the is_waiting_for_beforeunload_ack_ state.
     if (frame_tree_node_->navigation_request() &&
@@ -3360,9 +3280,9 @@
   // TODO(creis): Support beforeunload on subframes.  For now just pretend that
   // the handler ran and allowed the navigation to proceed.
   if (!ShouldDispatchBeforeUnload()) {
-    DCHECK(!(IsBrowserSideNavigationEnabled() && for_navigation));
+    DCHECK(!for_navigation);
     frame_tree_node_->render_manager()->OnBeforeUnloadACK(
-        for_navigation, true, base::TimeTicks::Now());
+        true, base::TimeTicks::Now());
     return;
   }
   TRACE_EVENT_ASYNC_BEGIN1("navigation", "RenderFrameHostImpl BeforeUnload",
@@ -3472,7 +3392,6 @@
   Send(reply_msg);
 }
 
-// PlzNavigate
 void RenderFrameHostImpl::CommitNavigation(
     ResourceResponse* response,
     mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
@@ -4078,58 +3997,6 @@
 #endif
 #endif
 
-void RenderFrameHostImpl::SetNavigationsSuspended(
-    bool suspend,
-    const base::TimeTicks& proceed_time) {
-  // This should only be called to toggle the state.
-  DCHECK(navigations_suspended_ != suspend);
-
-  navigations_suspended_ = suspend;
-  if (navigations_suspended_) {
-    TRACE_EVENT_ASYNC_BEGIN0("navigation",
-                             "RenderFrameHostImpl navigation suspended", this);
-  } else {
-    TRACE_EVENT_ASYNC_END0("navigation",
-                           "RenderFrameHostImpl navigation suspended", this);
-  }
-
-  if (!suspend && suspended_nav_params_) {
-    // There's navigation message params waiting to be sent. Now that we're not
-    // suspended anymore, resume navigation by sending them.
-    ResetWaitingState();
-
-    DCHECK(!proceed_time.is_null());
-    // TODO(csharrison): Make sure that PlzNavigate and the current architecture
-    // measure navigation start in the same way in the presence of the
-    // BeforeUnload event.
-    suspended_nav_params_->common_params.navigation_start = proceed_time;
-    SendNavigateMessage(suspended_nav_params_->common_params,
-                        suspended_nav_params_->start_params,
-                        suspended_nav_params_->request_params);
-    suspended_nav_params_.reset();
-  }
-}
-
-void RenderFrameHostImpl::CancelSuspendedNavigations() {
-  // Clear any state if a pending navigation is canceled or preempted.
-  if (suspended_nav_params_)
-    suspended_nav_params_.reset();
-
-  TRACE_EVENT_ASYNC_END0("navigation",
-                         "RenderFrameHostImpl navigation suspended", this);
-  navigations_suspended_ = false;
-}
-
-void RenderFrameHostImpl::SendNavigateMessage(
-    const CommonNavigationParams& common_params,
-    const StartNavigationParams& start_params,
-    const RequestNavigationParams& request_params) {
-  RenderFrameDevToolsAgentHost::OnBeforeNavigation(
-      frame_tree_node_->current_frame_host(), this);
-  Send(new FrameMsg_Navigate(
-      routing_id_, common_params, start_params, request_params));
-}
-
 bool RenderFrameHostImpl::CanAccessFilesOfPageState(const PageState& state) {
   return ChildProcessSecurityPolicyImpl::GetInstance()->CanReadAllFiles(
       GetProcess()->GetID(), state.GetReferencedFiles());
@@ -4425,21 +4292,15 @@
   bool is_browser_initiated = (params.nav_entry_id != 0);
 
   if (params.was_within_same_document) {
-    if (IsBrowserSideNavigationEnabled()) {
-      // When browser-side navigation is enabled, a NavigationHandle is created
-      // for browser-initiated same-document navigation. Try to take it if it's
-      // still available and matches the current navigation.
-      if (is_browser_initiated && navigation_handle_ &&
-          navigation_handle_->IsSameDocument() &&
-          navigation_handle_->GetURL() == params.url) {
-        return std::move(navigation_handle_);
-      }
-    } else {
-      // When browser-side navigation is disabled, there is never any existing
-      // NavigationHandle to use for the navigation. We don't ever expect
-      // navigation_handle_ to match.
-      DCHECK(!navigation_handle_ || !navigation_handle_->IsSameDocument());
+    // A NavigationHandle is created for browser-initiated same-document
+    // navigation. Try to take it if it's still available and matches the
+    // current navigation.
+    if (is_browser_initiated && navigation_handle_ &&
+        navigation_handle_->IsSameDocument() &&
+        navigation_handle_->GetURL() == params.url) {
+      return std::move(navigation_handle_);
     }
+
     // No existing NavigationHandle has been found. Create a new one, but don't
     // reset any NavigationHandle tracking an ongoing navigation, since this may
     // lead to the cancellation of the navigation.

diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index ee831e1..f4b1a4a 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h

@@ -130,11 +130,9 @@
 struct ContextMenuParams;
 struct FileChooserParams;
 struct FrameOwnerProperties;
-struct NavigationParams;
 struct RequestNavigationParams;
 struct ResourceResponse;
 struct SubresourceLoaderParams;
-struct StartNavigationParams;
 
 class CONTENT_EXPORT RenderFrameHostImpl
     : public RenderFrameHost,
@@ -346,12 +344,6 @@
   // call FrameTreeNode::IsLoading.
   bool is_loading() const { return is_loading_; }
 
-  // Sets this RenderFrameHost loading state. This is only used in the case of
-  // transfer navigations, where no DidStart/DidStopLoading notifications
-  // should be sent during the transfer.
-  // TODO(clamy): Remove this once PlzNavigate ships.
-  void set_is_loading(bool is_loading) { is_loading_ = is_loading; }
-
   // Returns true if this is a top-level frame, or if this frame's RenderFrame
   // is in a different process from its parent frame. Local roots are
   // distinguished by owning a RenderWidgetHost, which manages input events
@@ -392,12 +384,6 @@
   void SetNavigationHandle(
       std::unique_ptr<NavigationHandleImpl> navigation_handle);
 
-  // Gives the ownership of |navigation_handle_| to the caller.
-  // This happens during transfer navigations, where it should be transferred
-  // from the RenderFrameHost that issued the initial request to the new
-  // RenderFrameHost that will issue the transferring request.
-  std::unique_ptr<NavigationHandleImpl> PassNavigationHandleOwnership();
-
   // Tells the renderer that this RenderFrame is being swapped out for one in a
   // different renderer process.  It should run its unload handler and move to
   // a blank document.  If |proxy| is not null, it should also create a
@@ -408,9 +394,7 @@
   void SwapOut(RenderFrameProxyHost* proxy, bool is_loading);
 
   // Whether an ongoing navigation is waiting for a BeforeUnload ACK from the
-  // RenderFrame. Currently this only happens in cross-site navigations.
-  // PlzNavigate: this happens in every browser-initiated navigation that is not
-  // same-page.
+  // RenderFrame.
   bool is_waiting_for_beforeunload_ack() const {
     return is_waiting_for_beforeunload_ack_;
   }
@@ -426,53 +410,17 @@
   // until SwapOut is called, at which point it is pending deletion.
   bool is_active() { return !is_waiting_for_swapout_ack_; }
 
-  // Sends the given navigation message. Use this rather than sending it
-  // yourself since this does the internal bookkeeping described below. This
-  // function takes ownership of the provided message pointer.
-  //
-  // If a cross-site request is in progress, we may be suspended while waiting
-  // for the onbeforeunload handler, so this function might buffer the message
-  // rather than sending it.
-  void Navigate(const CommonNavigationParams& common_params,
-                const StartNavigationParams& start_params,
-                const RequestNavigationParams& request_params);
-
   // Navigates to an interstitial page represented by the provided data URL.
   void NavigateToInterstitialURL(const GURL& data_url);
 
   // Stop the load in progress.
   void Stop();
 
-  // Returns whether navigation messages are currently suspended for this
-  // RenderFrameHost. Only true during a cross-site navigation, while waiting
-  // for the onbeforeunload handler.
-  bool are_navigations_suspended() const { return navigations_suspended_; }
-
-  // Suspends (or unsuspends) any navigation messages from being sent from this
-  // RenderFrameHost. This is called when a pending RenderFrameHost is created
-  // for a cross-site navigation, because we must suspend any navigations until
-  // we hear back from the old renderer's onbeforeunload handler. Note that it
-  // is important that only one navigation event happen after calling this
-  // method with |suspend| equal to true. If |suspend| is false and there is a
-  // suspended_nav_message_, this will send the message. This function should
-  // only be called to toggle the state; callers should check
-  // are_navigations_suspended() first. If |suspend| is false, the time that the
-  // user decided the navigation should proceed should be passed as
-  // |proceed_time|.
-  void SetNavigationsSuspended(bool suspend,
-                               const base::TimeTicks& proceed_time);
-
-  // Clears any suspended navigation state after a cross-site navigation is
-  // canceled or suspended. This is important if we later return to this
-  // RenderFrameHost.
-  void CancelSuspendedNavigations();
-
   // Runs the beforeunload handler for this frame. |for_navigation| indicates
-  // whether this call is for the current frame during a cross-process
-  // navigation. False means we're closing the entire tab. |is_reload|
-  // indicates whether the navigation is a reload of the page or not. If
-  // |for_navigation| is false, |is_reload| should be false as well.
-  // PlzNavigate: this call happens on all browser-initiated navigations.
+  // whether this call is for the current frame during a navigation. False means
+  // we're closing the entire tab. |is_reload| indicates whether the navigation
+  // is a reload of the page or not. If |for_navigation| is false, |is_reload|
+  // should be false as well.
   void DispatchBeforeUnload(bool for_navigation, bool is_reload);
 
   // Simulate beforeunload ack on behalf of renderer if it's unrenresponsive.
@@ -580,7 +528,7 @@
 #endif
 #endif
 
-  // PlzNavigate: Indicates that a navigation is ready to commit and can be
+  // Indicates that a navigation is ready to commit and can be
   // handled by this RenderFrame.
   // |subresource_loader_params| is used in network service land to pass
   // the parameters to create a custom subresource loader in the renderer
@@ -595,7 +543,6 @@
       base::Optional<SubresourceLoaderParams> subresource_loader_params,
       const base::UnguessableToken& devtools_navigation_token);
 
-  // PlzNavigate
   // Indicates that a navigation failed and that this RenderFrame should display
   // an error page.
   void FailedNavigation(const CommonNavigationParams& common_params,
@@ -663,7 +610,7 @@
   // it will be used to kill processes that commit unauthorized URLs.
   bool CanCommitURL(const GURL& url);
 
-  // PlzNavigate: returns the PreviewsState of the last successful navigation
+  // Returns the PreviewsState of the last successful navigation
   // that made a network request. The PreviewsState is a bitmask of potentially
   // several Previews optimizations.
   PreviewsState last_navigation_previews_state() const {
@@ -979,13 +926,6 @@
   // frames, it will return the current frame's view.
   RenderWidgetHostViewBase* GetViewForAccessibility();
 
-  // Sends a navigate message to the RenderFrame and notifies DevTools about
-  // navigation happening. Should be used instead of sending the message
-  // directly.
-  void SendNavigateMessage(const CommonNavigationParams& common_params,
-                           const StartNavigationParams& start_params,
-                           const RequestNavigationParams& request_params);
-
   // Returns the child FrameTreeNode if |child_frame_routing_id| is an
   // immediate child of this FrameTreeNode.  |child_frame_routing_id| is
   // considered untrusted, so the renderer process is killed if it refers to a
@@ -1060,8 +1000,7 @@
   // based on its parent frame.
   void ResetFeaturePolicy();
 
-  // PlzNavigate: Called when the frame has consumed the StreamHandle and it
-  // can be released.
+  // Called when the frame has consumed the StreamHandle and it can be released.
   void OnStreamHandleConsumed(const GURL& stream_url);
 
   // TODO(ekaramad): One major purpose behind the API is to traverse the frame
@@ -1167,20 +1106,6 @@
   // TODO(creis): Use this for main frames as well when RVH goes away.
   bool render_frame_created_;
 
-  // Whether we should buffer outgoing Navigate messages rather than sending
-  // them. This will be true when a RenderFrameHost is created for a cross-site
-  // request, until we hear back from the onbeforeunload handler of the old
-  // RenderFrameHost.
-  bool navigations_suspended_;
-
-  // Holds the parameters for a suspended navigation. This can only happen while
-  // this RFH is the pending RenderFrameHost of a RenderFrameHostManager. There
-  // will only ever be one suspended navigation, because RenderFrameHostManager
-  // will destroy the pending RenderFrameHost and create a new one if a second
-  // navigation occurs.
-  // PlzNavigate: unused as navigations are never suspended.
-  std::unique_ptr<NavigationParams> suspended_nav_params_;
-
   // When the last BeforeUnload message was sent.
   base::TimeTicks send_before_unload_start_time_;
 
@@ -1196,9 +1121,7 @@
   // Valid only when is_waiting_for_beforeunload_ack_ or
   // IsWaitingForUnloadACK is true.  This tells us if the unload request
   // is for closing the entire tab ( = false), or only this RenderFrameHost in
-  // the case of a navigation ( = true). Currently only cross-site navigations
-  // require a beforeUnload/unload ACK.
-  // PlzNavigate: all navigations require a beforeUnload ACK.
+  // the case of a navigation ( = true).
   bool unload_ack_is_for_navigation_;
 
   // The timeout monitor that runs from when the beforeunload is started in
@@ -1210,7 +1133,6 @@
   // document or not.
   bool is_loading_;
 
-  // PlzNavigate
   // Used to track whether a commit is expected in this frame. Only used in
   // tests.
   bool pending_commit_;
@@ -1281,8 +1203,8 @@
   // already exists it will still be used.
   bool no_create_browser_accessibility_manager_for_testing_;
 
-  // PlzNavigate: Owns the stream used in navigations to store the body of the
-  // response once it has started.
+  // Owns the stream used in navigations to store the body of the response once
+  // it has started.
   std::unique_ptr<StreamHandle> stream_handle_;
 
   // Context shared for each mojom::PermissionService instance created for this
@@ -1299,8 +1221,8 @@
   // Tracks a navigation happening in this frame. Note that while there can be
   // two navigations in the same FrameTreeNode, there can only be one
   // navigation per RenderFrameHost.
-  // PlzNavigate: before the navigation is ready to be committed, the
-  // NavigationHandle for it is owned by the NavigationRequest.
+  // Before the navigation is ready to be committed, the NavigationHandle for it
+  // is owned by the NavigationRequest.
   std::unique_ptr<NavigationHandleImpl> navigation_handle_;
 
   // The associated WebUIImpl and its type. They will be set if the current
@@ -1327,9 +1249,9 @@
   // audio streams).
   bool is_audible_;
 
-  // PlzNavigate: The Previews state of the last navigation. This is used during
-  // history navigation of subframes to ensure that subframes navigate with the
-  // same Previews status as the top-level frame.
+  // The Previews state of the last navigation. This is used during history
+  // navigation of subframes to ensure that subframes navigate with the same
+  // Previews status as the top-level frame.
   PreviewsState last_navigation_previews_state_;
 
   bool has_committed_any_navigation_ = false;

diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 1e91cb0..d5b588a 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc

@@ -306,131 +306,28 @@
 }
 
 void RenderFrameHostManager::OnBeforeUnloadACK(
-    bool for_cross_site_transition,
     bool proceed,
     const base::TimeTicks& proceed_time) {
-  if (for_cross_site_transition) {
-    DCHECK(!IsBrowserSideNavigationEnabled());
-    // Ignore if we're not in a cross-process navigation.
-    if (!pending_render_frame_host_)
-      return;
+  bool proceed_to_fire_unload;
+  delegate_->BeforeUnloadFiredFromRenderManager(proceed, proceed_time,
+                                                &proceed_to_fire_unload);
 
-    if (proceed) {
-      // Ok to unload the current page, so proceed with the cross-process
-      // navigation.
-      if (pending_render_frame_host_ &&
-          pending_render_frame_host_->are_navigations_suspended()) {
-        pending_render_frame_host_->SetNavigationsSuspended(false,
-                                                            proceed_time);
-      }
-    } else {
-      // Current page says to cancel.
+  if (proceed_to_fire_unload) {
+    // If we're about to close the tab and there's a pending RFH, cancel it.
+    // Otherwise, if the navigation in the pending RFH completes before the
+    // close in the current RFH, we'll lose the tab close.
+    if (pending_render_frame_host_) {
       CancelPending();
     }
-  } else {
-    // Non-cross-process transition means closing the entire tab.
-    bool proceed_to_fire_unload;
-    delegate_->BeforeUnloadFiredFromRenderManager(proceed, proceed_time,
-                                                  &proceed_to_fire_unload);
 
-    if (proceed_to_fire_unload) {
-      // If we're about to close the tab and there's a pending RFH, cancel it.
-      // Otherwise, if the navigation in the pending RFH completes before the
-      // close in the current RFH, we'll lose the tab close.
-      if (pending_render_frame_host_) {
-        CancelPending();
-      }
+    // Clean up the speculative RenderFrameHost if there is one.
+    if (speculative_render_frame_host_)
+      CleanUpNavigation();
 
-      // PlzNavigate: clean up the speculative RenderFrameHost if there is one.
-      if (IsBrowserSideNavigationEnabled() && speculative_render_frame_host_)
-        CleanUpNavigation();
-
-      // This is not a cross-process navigation; the tab is being closed.
-      render_frame_host_->render_view_host()->ClosePage();
-    }
+    render_frame_host_->render_view_host()->ClosePage();
   }
 }
 
-void RenderFrameHostManager::OnCrossSiteResponse(
-    RenderFrameHostImpl* transferring_render_frame_host,
-    const GlobalRequestID& global_request_id,
-    const std::vector<GURL>& transfer_url_chain,
-    const Referrer& referrer,
-    ui::PageTransition page_transition,
-    bool should_replace_current_entry) {
-  // A transfer should only have come from our pending or current RFH.  If it
-  // started as a cross-process navigation via OpenURL, this is the pending
-  // one.  If it wasn't cross-process until the transfer, this is the current
-  // one.
-  //
-  // Note that having a pending RFH does not imply that it was the one that
-  // made the request.  Suppose that during a pending cross-site navigation,
-  // the frame performs a different same-site navigation which redirects
-  // cross-site.  In this case, there will be a pending RFH, but this request
-  // is made by the current RFH. Later, this will create a new pending RFH and
-  // clean up the old one.
-  //
-  // TODO(creis): We need to handle the case that the pending RFH has changed
-  // in the mean time, while this was being posted from the IO thread.  We
-  // should probably cancel the request in that case.
-  DCHECK(transferring_render_frame_host == pending_render_frame_host_.get() ||
-         transferring_render_frame_host == render_frame_host_.get());
-
-  // Check if the FrameTreeNode is loading. This will be used later to notify
-  // the FrameTreeNode that the load stop if the transfer fails.
-  bool frame_tree_node_was_loading = frame_tree_node_->IsLoading();
-
-  // Store the NavigationHandle to give it to the appropriate RenderFrameHost
-  // after it started navigating.
-  transfer_navigation_handle_ =
-      transferring_render_frame_host->PassNavigationHandleOwnership();
-  CHECK(transfer_navigation_handle_);
-
-  // Set the transferring RenderFrameHost as not loading, so that it does not
-  // emit a DidStopLoading notification if it is destroyed when creating the
-  // new navigating RenderFrameHost.
-  transferring_render_frame_host->set_is_loading(false);
-
-  // Treat the last URL in the chain as the destination and the remainder as
-  // the redirect chain.
-  CHECK(transfer_url_chain.size());
-  GURL transfer_url = transfer_url_chain.back();
-  std::vector<GURL> rest_of_chain = transfer_url_chain;
-  rest_of_chain.pop_back();
-
-  // |extra_headers| passed to RequestTransferURL below are always empty for
-  // now, because there are no known scenarios where headers (from POST request
-  // made from one renderer) need to be forwarded into the renderer where that
-  // request ends up being transfered to.  In particular, XSSAuditor doesn't
-  // look at the headers (e.g. the Content-Type header) when analyzing the body
-  // of the POST request.
-  std::string extra_headers;
-
-  transferring_render_frame_host->frame_tree_node()
-      ->navigator()
-      ->RequestTransferURL(
-          transferring_render_frame_host, transfer_url, nullptr, rest_of_chain,
-          referrer, page_transition, global_request_id,
-          should_replace_current_entry,
-          transfer_navigation_handle_->IsPost() ? "POST" : "GET",
-          transfer_navigation_handle_->GetResourceRequestBody(), extra_headers);
-
-  // If the navigation continued, the NavigationHandle should have been
-  // transfered to a RenderFrameHost. In the other cases, it should be cleared.
-  // If the NavigationHandle wasn't claimed, this will lead to the cancelation
-  // of the request in the network stack.
-  if (transfer_navigation_handle_) {
-    transfer_navigation_handle_->set_net_error_code(net::ERR_ABORTED);
-    transfer_navigation_handle_->set_is_transferring(false);
-    transfer_navigation_handle_.reset();
-  }
-
-  // If the navigation in the new renderer did not start, inform the
-  // FrameTreeNode that it stopped loading.
-  if (!frame_tree_node_->IsLoading() && frame_tree_node_was_loading)
-    frame_tree_node_->DidStopLoading();
-}
-
 void RenderFrameHostManager::DidNavigateFrame(
     RenderFrameHostImpl* render_frame_host,
     bool was_caused_by_user_gesture) {
@@ -626,9 +523,6 @@
   RenderViewHostImpl* rvh = render_frame_host->render_view_host();
   RenderFrameProxyHost* proxy = nullptr;
   if (site_instance->HasSite() && site_instance->active_frame_count() > 1) {
-    // Any currently suspended navigations are no longer needed.
-    render_frame_host->CancelSuspendedNavigations();
-
     // If a proxy already exists for the |site_instance|, just reuse it instead
     // of creating a new one. There is no need to call SwapOut on the
     // |render_frame_host|, as this method is only called to discard a pending
@@ -2367,6 +2261,7 @@
   CHECK(!GetRenderFrameProxyHost(render_frame_host_->GetSiteInstance()));
 }
 
+// TODO(clamy): Remove this function.
 RenderFrameHostImpl* RenderFrameHostManager::UpdateStateForNavigate(
     const GURL& dest_url,
     SiteInstance* source_instance,
@@ -2391,31 +2286,6 @@
       CanSubframeSwapProcess(dest_url, source_instance, dest_instance,
                              was_server_redirect);
 
-  // Inform the transferring NavigationHandle of a transfer to a different
-  // SiteInstance.  It is important do so now, in order to mark the request as
-  // transferring on the IO thread before attempting to destroy the pending RFH.
-  // This ensures the network request will not be destroyed along the pending
-  // RFH but will persist until it is picked up by the new RFH.
-  if (transfer_navigation_handle_.get() &&
-      transfer_navigation_handle_->GetGlobalRequestID() ==
-          transferred_request_id) {
-    // The transfer is needed when switching to a new SiteInstance.  One
-    // exception is if the process swap is not allowed and the transfer started
-    // in the current RFH, the navigation will stay in the current RFH (even
-    // when there is a new SiteInstance), so avoid calling Transfer() on it.
-    // This matters for some renderer-initiated data URLs navigations, see
-    // https://crbug.com/697513.
-    RenderFrameHostImpl* transferring_rfh =
-        transfer_navigation_handle_->GetRenderFrameHost();
-    bool transfer_started_from_current_rfh =
-        transferring_rfh == render_frame_host_.get();
-    bool should_transfer =
-        new_instance.get() != transferring_rfh->GetSiteInstance() &&
-        (!transfer_started_from_current_rfh || allowed_to_swap_process);
-    if (should_transfer)
-      transfer_navigation_handle_->Transfer();
-  }
-
   // If we are currently navigating cross-process to a pending RFH for a
   // different SiteInstance, we want to get back to normal and then navigate as
   // usual.  We will reuse the pending RFH below if it matches the destination
@@ -2490,24 +2360,7 @@
       DCHECK(transfer_navigation_handle_ &&
              transfer_navigation_handle_->GetGlobalRequestID() ==
                  transferred_request_id);
-    } else if (!pending_render_frame_host_->are_navigations_suspended()) {
-      // If the pending RFH hasn't already been suspended from a previous
-      // attempt to navigate it, then we need to wait for the beforeunload
-      // handler to run.  Suspend navigations in the pending RFH until we hear
-      // back from the old RFH's beforeunload handler (via OnBeforeUnloadACK or
-      // a timeout).  If the handler returns false, we'll have to cancel the
-      // request.
-      //
-      // Also make sure the old RenderFrame stops, in case a load is in
-      // progress.  (We don't want to do this for transfers, since it will
-      // interrupt the transfer with an unexpected DidStopLoading.)
-      render_frame_host_->Send(new FrameMsg_Stop(
-          render_frame_host_->GetRoutingID()));
-      pending_render_frame_host_->SetNavigationsSuspended(true,
-                                                          base::TimeTicks());
-      render_frame_host_->DispatchBeforeUnload(true, is_reload);
     }
-
     return pending_render_frame_host_.get();
   }
 

diff --git a/content/browser/frame_host/render_frame_host_manager.h b/content/browser/frame_host/render_frame_host_manager.h
index 598ba90..628c24c3 100644
--- a/content/browser/frame_host/render_frame_host_manager.h
+++ b/content/browser/frame_host/render_frame_host_manager.h

@@ -285,24 +285,11 @@
   // which one so we tell both.
   void SetIsLoading(bool is_loading);
 
-  // Confirms whether we should close the page or navigate away.  This is called
-  // before a cross-site request or before a tab/window is closed (as indicated
-  // by the first parameter) to allow the appropriate renderer to approve or
-  // deny the request.  |proceed| indicates whether the user chose to proceed.
+  // Confirms whether we should close the page. This is called before a
+  // tab/window is closed to allow the appropriate renderer to approve or deny
+  // the request.  |proceed| indicates whether the user chose to proceed.
   // |proceed_time| is the time when the request was allowed to proceed.
-  void OnBeforeUnloadACK(bool for_cross_site_transition,
-                         bool proceed,
-                         const base::TimeTicks& proceed_time);
-
-  // The |pending_render_frame_host| is ready to commit a page.  We should
-  // ensure that the old RenderFrameHost runs its unload handler first and
-  // determine whether a RenderFrameHost transfer is needed.
-  void OnCrossSiteResponse(RenderFrameHostImpl* pending_render_frame_host,
-                           const GlobalRequestID& global_request_id,
-                           const std::vector<GURL>& transfer_url_chain,
-                           const Referrer& referrer,
-                           ui::PageTransition page_transition,
-                           bool should_replace_current_entry);
+  void OnBeforeUnloadACK(bool proceed, const base::TimeTicks& proceed_time);
 
   // Determines whether a navigation to |dest_url| may be completed using an
   // existing RenderFrameHost, or whether transferring to a new RenderFrameHost

diff --git a/content/browser/frame_host/render_frame_host_manager_unittest.cc b/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 7b3a3ec..7e52bb8 100644
--- a/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_unittest.cc

@@ -1718,7 +1718,7 @@
   notifications.ListenFor(
       NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED,
       Source<RenderWidgetHost>(host2->render_view_host()->GetWidget()));
-  manager->OnBeforeUnloadACK(false, true, base::TimeTicks());
+  manager->OnBeforeUnloadACK(true, base::TimeTicks());
 
   EXPECT_TRUE(
       notifications.Check1AndReset(NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED));

diff --git a/content/browser/loader/mojo_async_resource_handler.cc b/content/browser/loader/mojo_async_resource_handler.cc
index 6a0c5e0..d24a3b5 100644
--- a/content/browser/loader/mojo_async_resource_handler.cc
+++ b/content/browser/loader/mojo_async_resource_handler.cc

@@ -97,10 +97,12 @@
     ResourceDispatcherHostImpl* rdh,
     mojom::URLLoaderRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client,
-    ResourceType resource_type)
+    ResourceType resource_type,
+    bool defer_on_response_started)
     : ResourceHandler(request),
       rdh_(rdh),
       binding_(this, std::move(mojo_request)),
+      defer_on_response_started_(defer_on_response_started),
       handle_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL),
       url_loader_client_(std::move(url_loader_client)),
       weak_factory_(this) {
@@ -193,6 +195,14 @@
         std::vector<uint8_t>(data, data + metadata->size()));
   }
 
+  if (defer_on_response_started_) {
+    did_defer_on_response_started_ = true;
+    DCHECK(!has_controller());
+    request()->LogBlockedBy("MojoAsyncResourceHandler");
+    HoldController(std::move(controller));
+    return;
+  }
+
   controller->Resume();
 }
 
@@ -366,6 +376,12 @@
   Resume();
 }
 
+void MojoAsyncResourceHandler::ProceedWithResponse() {
+  DCHECK(did_defer_on_response_started_);
+  request()->LogUnblocked();
+  Resume();
+}
+
 void MojoAsyncResourceHandler::SetPriority(net::RequestPriority priority,
                                            int32_t intra_priority_value) {
   ResourceDispatcherHostImpl::Get()->scheduler()->ReprioritizeRequest(

diff --git a/content/browser/loader/mojo_async_resource_handler.h b/content/browser/loader/mojo_async_resource_handler.h
index f9e92a74..a8e7282 100644
--- a/content/browser/loader/mojo_async_resource_handler.h
+++ b/content/browser/loader/mojo_async_resource_handler.h

@@ -55,7 +55,8 @@
                            ResourceDispatcherHostImpl* rdh,
                            mojom::URLLoaderRequest mojo_request,
                            mojom::URLLoaderClientPtr url_loader_client,
-                           ResourceType resource_type);
+                           ResourceType resource_type,
+                           bool defer_on_response_started);
   ~MojoAsyncResourceHandler() override;
 
   // ResourceHandler implementation:
@@ -80,6 +81,7 @@
 
   // mojom::URLLoader implementation:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
@@ -131,6 +133,8 @@
   ResourceDispatcherHostImpl* rdh_;
   mojo::Binding<mojom::URLLoader> binding_;
 
+  bool defer_on_response_started_;
+
   bool has_checked_for_sufficient_resources_ = false;
   bool sent_received_response_message_ = false;
   bool is_using_io_buffer_not_from_writer_ = false;
@@ -139,6 +143,7 @@
   bool did_defer_on_will_read_ = false;
   bool did_defer_on_writing_ = false;
   bool did_defer_on_redirect_ = false;
+  bool did_defer_on_response_started_ = false;
   base::TimeTicks response_started_ticks_;
   int64_t reported_total_received_bytes_ = 0;
   int64_t total_written_bytes_ = 0;

diff --git a/content/browser/loader/mojo_async_resource_handler_unittest.cc b/content/browser/loader/mojo_async_resource_handler_unittest.cc
index 068d71a..1dff2e2 100644
--- a/content/browser/loader/mojo_async_resource_handler_unittest.cc
+++ b/content/browser/loader/mojo_async_resource_handler_unittest.cc

@@ -17,6 +17,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
+#include "base/test/gtest_util.h"
 #include "base/test/test_simple_task_runner.h"
 #include "content/browser/loader/mock_resource_loader.h"
 #include "content/browser/loader/resource_controller.h"
@@ -204,12 +205,14 @@
       net::URLRequest* request,
       ResourceDispatcherHostImpl* rdh,
       mojom::URLLoaderRequest mojo_request,
-      mojom::URLLoaderClientPtr url_loader_client)
+      mojom::URLLoaderClientPtr url_loader_client,
+      bool defer_on_response_started)
       : MojoAsyncResourceHandler(request,
                                  rdh,
                                  std::move(mojo_request),
                                  std::move(url_loader_client),
-                                 RESOURCE_TYPE_MAIN_FRAME),
+                                 RESOURCE_TYPE_MAIN_FRAME,
+                                 defer_on_response_started),
         task_runner_(new base::TestSimpleTaskRunner) {}
   ~MojoAsyncResourceHandlerWithStubOperations() override {}
 
@@ -315,8 +318,9 @@
 
 class MojoAsyncResourceHandlerTestBase {
  public:
-  explicit MojoAsyncResourceHandlerTestBase(
-      std::unique_ptr<net::UploadDataStream> upload_stream)
+  MojoAsyncResourceHandlerTestBase(
+      std::unique_ptr<net::UploadDataStream> upload_stream,
+      bool defer_on_response_started)
       : thread_bundle_(TestBrowserThreadBundle::IO_MAINLOOP),
         browser_context_(new TestBrowserContext()) {
     MojoAsyncResourceHandler::SetAllocationSizeForTesting(32 * 1024);
@@ -361,7 +365,7 @@
 
     handler_.reset(new MojoAsyncResourceHandlerWithStubOperations(
         request_.get(), &rdh_, factory_impl->PassLoaderRequest(),
-        factory_impl->PassClientPtr()));
+        factory_impl->PassClientPtr(), defer_on_response_started));
     mock_loader_.reset(new MockResourceLoader(handler_.get()));
   }
 
@@ -429,7 +433,20 @@
 class MojoAsyncResourceHandlerTest : public MojoAsyncResourceHandlerTestBase,
                                      public ::testing::Test {
  protected:
-  MojoAsyncResourceHandlerTest() : MojoAsyncResourceHandlerTestBase(nullptr) {}
+  MojoAsyncResourceHandlerTest()
+      : MojoAsyncResourceHandlerTestBase(
+            nullptr,
+            false /* defer_on_response_started */) {}
+};
+
+class MojoAsyncResourceHandlerDeferOnResponseStartedTest
+    : public MojoAsyncResourceHandlerTestBase,
+      public ::testing::Test {
+ protected:
+  MojoAsyncResourceHandlerDeferOnResponseStartedTest()
+      : MojoAsyncResourceHandlerTestBase(nullptr,
+                                         true /* defer_on_response_started */) {
+  }
 };
 
 // This test class is parameterized with MojoAsyncResourceHandler's allocation
@@ -439,7 +456,9 @@
       public ::testing::TestWithParam<size_t> {
  protected:
   MojoAsyncResourceHandlerWithAllocationSizeTest()
-      : MojoAsyncResourceHandlerTestBase(nullptr) {
+      : MojoAsyncResourceHandlerTestBase(
+            nullptr,
+            false /* defer_on_response_started */) {
     MojoAsyncResourceHandler::SetAllocationSizeForTesting(GetParam());
   }
 };
@@ -450,7 +469,8 @@
  protected:
   MojoAsyncResourceHandlerUploadTest()
       : MojoAsyncResourceHandlerTestBase(
-            std::make_unique<DummyUploadDataStream>()) {}
+            std::make_unique<DummyUploadDataStream>(),
+            false /* defer_on_response_started */) {}
 };
 
 TEST_F(MojoAsyncResourceHandlerTest, InFlightRequests) {
@@ -1335,6 +1355,36 @@
   EXPECT_EQ("B", body);
 }
 
+TEST_F(MojoAsyncResourceHandlerDeferOnResponseStartedTest,
+       ProceedWithResponse) {
+  EXPECT_TRUE(CallOnWillStart());
+
+  // On response started, the MojoAsyncResourceHandler should stop loading,
+  // since |defer_on_response_started| is true.
+  {
+    MockResourceLoader::Status result = mock_loader_->OnResponseStarted(
+        base::MakeRefCounted<ResourceResponse>());
+    EXPECT_EQ(MockResourceLoader::Status::CALLBACK_PENDING, result);
+    std::unique_ptr<base::Value> request_state = request_->GetStateAsValue();
+    base::Value* delegate_blocked_by =
+        request_state->FindKey("delegate_blocked_by");
+    EXPECT_TRUE(delegate_blocked_by);
+    EXPECT_EQ("MojoAsyncResourceHandler", delegate_blocked_by->GetString());
+  }
+
+  // When ProceedWithResponse() is called, the MojoAsyncResourceHandler should
+  // resume its controller.
+  {
+    handler_->ProceedWithResponse();
+    mock_loader_->WaitUntilIdleOrCanceled();
+    EXPECT_EQ(MockResourceLoader::Status::IDLE, mock_loader_->status());
+    std::unique_ptr<base::Value> request_state = request_->GetStateAsValue();
+    base::Value* delegate_blocked_by =
+        request_state->FindKey("delegate_blocked_by");
+    EXPECT_FALSE(delegate_blocked_by);
+  }
+}
+
 INSTANTIATE_TEST_CASE_P(MojoAsyncResourceHandlerWithAllocationSizeTest,
                         MojoAsyncResourceHandlerWithAllocationSizeTest,
                         ::testing::Values(8, 32 * 2014));

diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index c34b6ee..466969f 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc

@@ -1475,7 +1475,8 @@
   if (mojo_request.is_pending()) {
     handler.reset(new MojoAsyncResourceHandler(
         request, this, std::move(mojo_request), std::move(url_loader_client),
-        resource_type));
+        resource_type,
+        false));  // defer_on_response_started.
   } else {
     handler.reset(new AsyncResourceHandler(request, this));
   }
@@ -2164,7 +2165,8 @@
   if (IsNavigationMojoResponseEnabled()) {
     handler = std::make_unique<MojoAsyncResourceHandler>(
         new_request.get(), this, std::move(url_loader_request),
-        std::move(url_loader_client), resource_type);
+        std::move(url_loader_client), resource_type,
+        true);  // defer_on_response_started.
   } else {
     StreamContext* stream_context =
         GetStreamContextForResourceContext(resource_context);

diff --git a/content/browser/renderer_host/browser_compositor_view_mac.h b/content/browser/renderer_host/browser_compositor_view_mac.h
index 251b94d..94b898df 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.h
+++ b/content/browser/renderer_host/browser_compositor_view_mac.h

@@ -115,10 +115,6 @@
   // Returns nullptr if no compositor is attached.
   ui::Compositor* CompositorForTesting() const;
 
-  // Forces a new LocalSurfaceId to be allocated. Called when properties that
-  // need to be synchronized between browser and renderer changes.
-  void AllocateNewLocalSurfaceId();
-
  private:
   // The state of |delegated_frame_host_| and |recyclable_compositor_| to
   // manage being visible, hidden, or occluded.

diff --git a/content/browser/renderer_host/browser_compositor_view_mac.mm b/content/browser/renderer_host/browser_compositor_view_mac.mm
index a77f75e..c21fe756 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.mm
+++ b/content/browser/renderer_host/browser_compositor_view_mac.mm

@@ -552,9 +552,4 @@
   return nullptr;
 }
 
-void BrowserCompositorMac::AllocateNewLocalSurfaceId() {
-  delegated_frame_host_surface_id_ =
-      parent_local_surface_id_allocator_.GenerateId();
-}
-
 }  // namespace content

diff --git a/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc b/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc
index b5ea6943c..81c7cc8 100644
--- a/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc
+++ b/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc

@@ -683,22 +683,60 @@
   DCHECK(state_.IsConnected());
 
   int net_result = net::ERR_FAILED;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("pepper_tcp_socket", R"(
+        semantics {
+          sender: "Pepper TCP Socket"
+          description:
+            "Pepper plugins use this API to send and receive data over the "
+            "network using TCP connections. This inteface is used by Flash and "
+            "PDF viewer, and Chrome Apps which use plugins to send/receive TCP "
+            "traffic (require Chrome Apps TCP socket permission)."
+          trigger:
+            "A request from a Pepper plugin."
+          data: "Any data that the plugin sends."
+          destination: OTHER
+          destination_other:
+            "Data can be sent to any destination."
+        }
+        policy {
+          cookies_allowed: NO
+          setting:
+            "These requests cannot be disabled, but will not happen if user "
+            "does not use Flash, internal PDF Viewer, or Chrome Apps that use "
+            "Pepper interface."
+          chrome_policy {
+            DefaultPluginsSetting {
+              DefaultPluginsSetting: 2
+            }
+          }
+          chrome_policy {
+            AlwaysOpenPdfExternally {
+              AlwaysOpenPdfExternally: true
+            }
+          }
+          chrome_policy {
+            ExtensionInstallBlacklist {
+              ExtensionInstallBlacklist: {
+                entries: '*'
+              }
+            }
+          }
+        })");
   if (socket_) {
     DCHECK_EQ(state_.state(), TCPSocketState::CONNECTED);
-    // TODO(crbug.com/656607): Add proper annotation.
     net_result = socket_->Write(
         write_buffer_.get(), write_buffer_->BytesRemaining(),
         base::Bind(&PepperTCPSocketMessageFilter::OnWriteCompleted,
                    base::Unretained(this), context),
-        NO_TRAFFIC_ANNOTATION_BUG_656607);
+        traffic_annotation);
   } else if (ssl_socket_) {
     DCHECK_EQ(state_.state(), TCPSocketState::SSL_CONNECTED);
     net_result = ssl_socket_->Write(
-        write_buffer_.get(),
-        write_buffer_->BytesRemaining(),
+        write_buffer_.get(), write_buffer_->BytesRemaining(),
         base::Bind(&PepperTCPSocketMessageFilter::OnWriteCompleted,
-                   base::Unretained(this),
-                   context));
+                   base::Unretained(this), context),
+        traffic_annotation);
   }
   if (net_result != net::ERR_IO_PENDING)
     OnWriteCompleted(context, net_result);

diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 509193bb..5f24ca9 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc

@@ -864,6 +864,18 @@
   }
 }
 
+void RenderWidgetHostViewAura::UpdateScreenInfo(gfx::NativeView view) {
+  RenderWidgetHostViewBase::UpdateScreenInfo(view);
+  if (!host_->auto_resize_enabled())
+    return;
+
+  window_->AllocateLocalSurfaceId();
+  host_->DidAllocateLocalSurfaceIdForAutoResize(
+      host_->last_auto_resize_request_number());
+  if (delegated_frame_host_)
+    delegated_frame_host_->WasResized();
+}
+
 gfx::Size RenderWidgetHostViewAura::GetRequestedRendererSize() const {
   return delegated_frame_host_
              ? delegated_frame_host_->GetRequestedRendererSize()
@@ -2466,14 +2478,4 @@
   }
 }
 
-void RenderWidgetHostViewAura::OnSynchronizedDisplayPropertiesChanged() {
-  window_->AllocateLocalSurfaceId();
-  if (delegated_frame_host_)
-    delegated_frame_host_->WasResized();
-  if (host_->auto_resize_enabled()) {
-    host_->DidAllocateLocalSurfaceIdForAutoResize(
-        host_->last_auto_resize_request_number());
-  }
-}
-
 }  // namespace content

diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index c088c8d..91fff1b4 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h

@@ -138,6 +138,7 @@
                          int error_code) override;
   void Destroy() override;
   void SetTooltipText(const base::string16& tooltip_text) override;
+  void UpdateScreenInfo(gfx::NativeView view) override;
   gfx::Size GetRequestedRendererSize() const override;
   bool IsSurfaceAvailableForCopy() const override;
   void CopyFromSurface(const gfx::Rect& src_rect,
@@ -203,7 +204,6 @@
   void ScheduleEmbed(ui::mojom::WindowTreeClientPtr client,
                      base::OnceCallback<void(const base::UnguessableToken&)>
                          callback) override;
-  void OnSynchronizedDisplayPropertiesChanged() override;
 
   // Overridden from ui::TextInputClient:
   void SetCompositionText(const ui::CompositionText& composition) override;

diff --git a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index c0a6799..2ec45c37 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc

@@ -2322,9 +2322,9 @@
   sink_->ClearMessages();
   aura_test_helper_->test_screen()->SetDeviceScaleFactor(2.0f);
 
-  EXPECT_EQ(1u, sink_->message_count());
+  EXPECT_EQ(2u, sink_->message_count());
   {
-    const IPC::Message* msg = sink_->GetMessageAt(0);
+    const IPC::Message* msg = sink_->GetMessageAt(1);
     EXPECT_EQ(static_cast<uint32_t>(ViewMsg_SetLocalSurfaceIdForAutoResize::ID),
               msg->type());
     ViewMsg_SetLocalSurfaceIdForAutoResize::Param params;
@@ -3081,7 +3081,6 @@
       view_->GetNativeView(), parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
 
-  view_->window_->layer()->SetShowSolidColorContent();
   EXPECT_FALSE(view_->HasPrimarySurface());
   ASSERT_TRUE(view_->delegated_frame_host_);
 
@@ -3108,6 +3107,7 @@
 
   // Prevent the DelegatedFrameHost from skipping frames.
   view_->DisableResizeLock();
+  EXPECT_FALSE(view_->HasPrimarySurface());
   ASSERT_TRUE(view_->delegated_frame_host_);
 
   view_->SetSize(gfx::Size(300, 300));
@@ -3143,6 +3143,7 @@
 
   // Prevent the DelegatedFrameHost from skipping frames.
   view_->DisableResizeLock();
+  EXPECT_FALSE(view_->HasPrimarySurface());
 
   view_->SetSize(gfx::Size(300, 300));
   ASSERT_TRUE(view_->HasPrimarySurface());

diff --git a/content/browser/renderer_host/render_widget_host_view_base.cc b/content/browser/renderer_host/render_widget_host_view_base.cc
index 287172c8..95c399e 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.cc
+++ b/content/browser/renderer_host/render_widget_host_view_base.cc

@@ -250,10 +250,8 @@
   if (impl && impl->delegate())
     impl->delegate()->SendScreenRects();
 
-  if (HasDisplayPropertyChanged(view) && impl) {
-    OnSynchronizedDisplayPropertiesChanged();
+  if (HasDisplayPropertyChanged(view) && impl)
     impl->NotifyScreenInfoChanged();
-  }
 }
 
 bool RenderWidgetHostViewBase::HasDisplayPropertyChanged(gfx::NativeView view) {

diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
index 4220d61..8e25605 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/content/browser/renderer_host/render_widget_host_view_base.h

@@ -155,7 +155,7 @@
   void DidReceiveRendererFrame();
 
   // Notification that a resize or move session ended on the native widget.
-  void UpdateScreenInfo(gfx::NativeView view);
+  virtual void UpdateScreenInfo(gfx::NativeView view);
 
   // Tells if the display property (work area/scale factor) has
   // changed since the last time.
@@ -555,12 +555,6 @@
                           const base::UnguessableToken& token);
 #endif
 
-  // Called when display properties that need to be synchronized with the
-  // renderer process changes. This method is called before notifying
-  // RenderWidgetHostImpl in order to allow the view to allocate a new
-  // LocalSurfaceId.
-  virtual void OnSynchronizedDisplayPropertiesChanged() {}
-
   gfx::Rect current_display_area_;
 
   uint32_t renderer_frame_number_;

diff --git a/content/browser/renderer_host/render_widget_host_view_mac.h b/content/browser/renderer_host/render_widget_host_view_mac.h
index 69d15e34..56d4f9d 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.h
+++ b/content/browser/renderer_host/render_widget_host_view_mac.h

@@ -310,6 +310,7 @@
                          int error_code) override;
   void Destroy() override;
   void SetTooltipText(const base::string16& tooltip_text) override;
+  void UpdateScreenInfo(gfx::NativeView view) override;
   bool IsSurfaceAvailableForCopy() const override;
   void CopyFromSurface(const gfx::Rect& src_rect,
                        const gfx::Size& output_size,
@@ -340,7 +341,6 @@
 
   bool HasAcceleratedSurface(const gfx::Size& desired_size) override;
   gfx::Rect GetBoundsInRootWindow() override;
-  void OnSynchronizedDisplayPropertiesChanged() override;
 
   bool LockMouse() override;
   void UnlockMouse() override;

diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index 54014f4..0574d766 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm

@@ -1086,17 +1086,15 @@
   }
 }
 
-void RenderWidgetHostViewMac::OnSynchronizedDisplayPropertiesChanged() {
-  if (!render_widget_host_)
+void RenderWidgetHostViewMac::UpdateScreenInfo(gfx::NativeView view) {
+  RenderWidgetHostViewBase::UpdateScreenInfo(view);
+
+  if (!render_widget_host_ || !render_widget_host_->auto_resize_enabled())
     return;
 
-  browser_compositor_->AllocateNewLocalSurfaceId();
+  render_widget_host_->DidAllocateLocalSurfaceIdForAutoResize(
+      render_widget_host_->last_auto_resize_request_number());
   browser_compositor_->WasResized();
-
-  if (render_widget_host_->auto_resize_enabled()) {
-    render_widget_host_->DidAllocateLocalSurfaceIdForAutoResize(
-        render_widget_host_->last_auto_resize_request_number());
-  }
 }
 
 bool RenderWidgetHostViewMac::SupportsSpeech() const {

diff --git a/content/browser/service_worker/service_worker_fetch_dispatcher.cc b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
index 1f8f966..3c048b41 100644
--- a/content/browser/service_worker/service_worker_fetch_dispatcher.cc
+++ b/content/browser/service_worker/service_worker_fetch_dispatcher.cc

@@ -55,6 +55,7 @@
   ~DelegatingURLLoader() override {}
 
   void FollowRedirect() override { loader_->FollowRedirect(); }
+  void ProceedWithResponse() override { NOTREACHED(); }
 
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override {

diff --git a/content/browser/service_worker/service_worker_provider_host.cc b/content/browser/service_worker/service_worker_provider_host.cc
index 3c0e08d7..50ae1fe 100644
--- a/content/browser/service_worker/service_worker_provider_host.cc
+++ b/content/browser/service_worker/service_worker_provider_host.cc

@@ -322,9 +322,15 @@
 }
 
 void ServiceWorkerProviderHost::SetTopmostFrameUrl(const GURL& url) {
+  DCHECK(IsProviderForClient());
   topmost_frame_url_ = url;
 }
 
+const GURL& ServiceWorkerProviderHost::topmost_frame_url() const {
+  DCHECK(IsProviderForClient());
+  return topmost_frame_url_;
+}
+
 void ServiceWorkerProviderHost::SetControllerVersionAttribute(
     ServiceWorkerVersion* version,
     bool notify_controllerchange) {
@@ -442,7 +448,8 @@
 
 bool ServiceWorkerProviderHost::AllowServiceWorker(const GURL& scope) {
   return GetContentClient()->browser()->AllowServiceWorker(
-      scope, topmost_frame_url(), dispatcher_host_->resource_context(),
+      scope, IsProviderForClient() ? topmost_frame_url() : document_url(),
+      dispatcher_host_->resource_context(),
       base::Bind(&WebContentsImpl::FromRenderFrameHostID, render_process_id_,
                  frame_id()));
 }

diff --git a/content/browser/service_worker/service_worker_provider_host.h b/content/browser/service_worker/service_worker_provider_host.h
index 0f559736..dbfca789 100644
--- a/content/browser/service_worker/service_worker_provider_host.h
+++ b/content/browser/service_worker/service_worker_provider_host.h

@@ -212,8 +212,11 @@
   void SetDocumentUrl(const GURL& url);
   const GURL& document_url() const { return document_url_; }
 
+  // For service worker clients. Sets the |topmost_frame_url|.
   void SetTopmostFrameUrl(const GURL& url);
-  const GURL& topmost_frame_url() const { return topmost_frame_url_; }
+  // For service worker clients, used for permission checks. Use document_url()
+  // instead if |this| is hosting a running service worker.
+  const GURL& topmost_frame_url() const;
 
   blink::mojom::ServiceWorkerProviderType provider_type() const {
     return info_.type;

diff --git a/content/browser/service_worker/service_worker_provider_host_unittest.cc b/content/browser/service_worker/service_worker_provider_host_unittest.cc
index 95817d7..06deddd8 100644
--- a/content/browser/service_worker/service_worker_provider_host_unittest.cc
+++ b/content/browser/service_worker/service_worker_provider_host_unittest.cc

@@ -48,14 +48,28 @@
 
 class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
  public:
+  struct AllowServiceWorkerCallLog {
+    AllowServiceWorkerCallLog(const GURL& scope, const GURL& first_party)
+        : scope(scope), first_party(first_party) {}
+    const GURL scope;
+    const GURL first_party;
+  };
+
   ServiceWorkerTestContentBrowserClient() {}
+
   bool AllowServiceWorker(
       const GURL& scope,
       const GURL& first_party,
       content::ResourceContext* context,
       const base::Callback<WebContents*(void)>& wc_getter) override {
+    logs_.emplace_back(scope, first_party);
     return false;
   }
+
+  const std::vector<AllowServiceWorkerCallLog>& logs() const { return logs_; }
+
+ private:
+  std::vector<AllowServiceWorkerCallLog> logs_;
 };
 
 }  // namespace
@@ -115,13 +129,27 @@
   ServiceWorkerRemoteProviderEndpoint PrepareServiceWorkerProviderHost(
       const GURL& document_url) {
     ServiceWorkerRemoteProviderEndpoint remote_endpoint;
-    CreateProviderHostInternal(document_url, &remote_endpoint);
+    GURL topmost_frame_url = document_url;
+    CreateProviderHostInternal(document_url, topmost_frame_url,
+                               &remote_endpoint);
+    return remote_endpoint;
+  }
+
+  ServiceWorkerRemoteProviderEndpoint
+  PrepareServiceWorkerProviderHostWithTopmostFrameUrl(
+      const GURL& document_url,
+      const GURL& topmost_frame_url) {
+    ServiceWorkerRemoteProviderEndpoint remote_endpoint;
+    CreateProviderHostInternal(document_url, topmost_frame_url,
+                               &remote_endpoint);
     return remote_endpoint;
   }
 
   ServiceWorkerProviderHost* CreateProviderHost(const GURL& document_url) {
+    GURL topmost_frame_url = document_url;
     remote_endpoints_.emplace_back();
-    return CreateProviderHostInternal(document_url, &remote_endpoints_.back());
+    return CreateProviderHostInternal(document_url, document_url,
+                                      &remote_endpoints_.back());
   }
 
   ServiceWorkerProviderHost* CreateProviderHostWithInsecureParentFrame(
@@ -219,6 +247,7 @@
  private:
   ServiceWorkerProviderHost* CreateProviderHostInternal(
       const GURL& document_url,
+      const GURL& topmost_frame_url,
       ServiceWorkerRemoteProviderEndpoint* remote_endpoint) {
     std::unique_ptr<ServiceWorkerProviderHost> host;
     if (IsBrowserSideNavigationEnabled()) {
@@ -246,6 +275,7 @@
 
     ServiceWorkerProviderHost* host_raw = host.get();
     host->SetDocumentUrl(document_url);
+    host->SetTopmostFrameUrl(topmost_frame_url);
     context_->AddProviderHost(std::move(host));
     return host_raw;
   }
@@ -584,17 +614,65 @@
       SetBrowserClientForTesting(&test_browser_client);
 
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
-      PrepareServiceWorkerProviderHost(GURL("https://www.example.com/foo"));
+      PrepareServiceWorkerProviderHostWithTopmostFrameUrl(
+          GURL("https://www.example.com/foo"),
+          GURL("https://www.example.com/top"));
 
   EXPECT_EQ(blink::mojom::ServiceWorkerErrorType::kDisabled,
             Register(remote_endpoint.host_ptr()->get(),
-                     GURL("https://www.example.com/"),
+                     GURL("https://www.example.com/scope"),
                      GURL("https://www.example.com/bar")));
+  ASSERT_EQ(1ul, test_browser_client.logs().size());
+  EXPECT_EQ(GURL("https://www.example.com/scope"),
+            test_browser_client.logs()[0].scope);
+  EXPECT_EQ(GURL("https://www.example.com/top"),
+            test_browser_client.logs()[0].first_party);
+
   EXPECT_EQ(blink::mojom::ServiceWorkerErrorType::kDisabled,
             GetRegistration(remote_endpoint.host_ptr()->get(),
                             GURL("https://www.example.com/")));
+  ASSERT_EQ(2ul, test_browser_client.logs().size());
+  EXPECT_EQ(GURL("https://www.example.com/foo"),
+            test_browser_client.logs()[1].scope);
+  EXPECT_EQ(GURL("https://www.example.com/top"),
+            test_browser_client.logs()[1].first_party);
+
   EXPECT_EQ(blink::mojom::ServiceWorkerErrorType::kDisabled,
             GetRegistrations(remote_endpoint.host_ptr()->get()));
+  ASSERT_EQ(3ul, test_browser_client.logs().size());
+  EXPECT_EQ(GURL("https://www.example.com/foo"),
+            test_browser_client.logs()[2].scope);
+  EXPECT_EQ(GURL("https://www.example.com/top"),
+            test_browser_client.logs()[2].first_party);
+
+  SetBrowserClientForTesting(old_browser_client);
+}
+
+TEST_F(ServiceWorkerProviderHostTest, AllowsServiceWorker) {
+  // Create an active version.
+  scoped_refptr<ServiceWorkerVersion> version =
+      base::MakeRefCounted<ServiceWorkerVersion>(
+          registration1_.get(), GURL("https://www.example.com/sw.js"),
+          1 /* version_id */, helper_->context()->AsWeakPtr());
+  registration1_->SetActiveVersion(version);
+
+  ServiceWorkerRemoteProviderEndpoint remote_endpoint;
+  std::unique_ptr<ServiceWorkerProviderHost> host =
+      CreateProviderHostForServiceWorkerContext(
+          helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
+          version.get(), helper_->context()->AsWeakPtr(), &remote_endpoint);
+
+  ServiceWorkerTestContentBrowserClient test_browser_client;
+  ContentBrowserClient* old_browser_client =
+      SetBrowserClientForTesting(&test_browser_client);
+
+  EXPECT_FALSE(host->AllowServiceWorker(GURL("https://www.example.com/scope")));
+
+  ASSERT_EQ(1ul, test_browser_client.logs().size());
+  EXPECT_EQ(GURL("https://www.example.com/scope"),
+            test_browser_client.logs()[0].scope);
+  EXPECT_EQ(GURL("https://www.example.com/sw.js"),
+            test_browser_client.logs()[0].first_party);
 
   SetBrowserClientForTesting(old_browser_client);
 }

diff --git a/content/browser/service_worker/service_worker_script_url_loader.cc b/content/browser/service_worker/service_worker_script_url_loader.cc
index 2a387214..1098c45f 100644
--- a/content/browser/service_worker/service_worker_script_url_loader.cc
+++ b/content/browser/service_worker/service_worker_script_url_loader.cc

@@ -109,6 +109,10 @@
   NOTREACHED();
 }
 
+void ServiceWorkerScriptURLLoader::ProceedWithResponse() {
+  NOTREACHED();
+}
+
 void ServiceWorkerScriptURLLoader::SetPriority(net::RequestPriority priority,
                                                int32_t intra_priority_value) {
   network_loader_->SetPriority(priority, intra_priority_value);

diff --git a/content/browser/service_worker/service_worker_script_url_loader.h b/content/browser/service_worker/service_worker_script_url_loader.h
index f7b9c60..43f5e7b 100644
--- a/content/browser/service_worker/service_worker_script_url_loader.h
+++ b/content/browser/service_worker/service_worker_script_url_loader.h

@@ -61,6 +61,7 @@
 
   // mojom::URLLoader:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/browser/service_worker/service_worker_url_loader_job.cc b/content/browser/service_worker/service_worker_url_loader_job.cc
index e97f116..34546e15 100644
--- a/content/browser/service_worker/service_worker_url_loader_job.cc
+++ b/content/browser/service_worker/service_worker_url_loader_job.cc

@@ -347,6 +347,12 @@
   NOTIMPLEMENTED();
 }
 
+void ServiceWorkerURLLoaderJob::ProceedWithResponse() {
+  // TODO(arthursonzogni): Implement this for navigation requests if the
+  // ServiceWorker service is enabled before the Network Service.
+  NOTREACHED();
+}
+
 void ServiceWorkerURLLoaderJob::SetPriority(net::RequestPriority priority,
                                             int32_t intra_priority_value) {
   NOTIMPLEMENTED();

diff --git a/content/browser/service_worker/service_worker_url_loader_job.h b/content/browser/service_worker/service_worker_url_loader_job.h
index 281960a4..45098788 100644
--- a/content/browser/service_worker/service_worker_url_loader_job.h
+++ b/content/browser/service_worker/service_worker_url_loader_job.h

@@ -132,6 +132,7 @@
 
   // mojom::URLLoader:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/browser/web_contents/web_contents_impl_unittest.cc b/content/browser/web_contents/web_contents_impl_unittest.cc
index 73d3095..4e3c31a 100644
--- a/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/content/browser/web_contents/web_contents_impl_unittest.cc

@@ -556,13 +556,6 @@
   pending_rfh->GetRenderViewHost()->set_delete_counter(
       &pending_rvh_delete_count);
 
-  // Navigations should be suspended in pending_rfh until BeforeUnloadACK.
-  if (!IsBrowserSideNavigationEnabled()) {
-    EXPECT_TRUE(pending_rfh->are_navigations_suspended());
-    orig_rfh->SendBeforeUnloadACK(true);
-    EXPECT_FALSE(pending_rfh->are_navigations_suspended());
-  }
-
   // DidNavigate from the pending page.
   contents()->TestDidNavigateWithSequenceNumber(
       pending_rfh, entry_id, true, url2, Referrer(), ui::PAGE_TRANSITION_TYPED,
@@ -595,13 +588,6 @@
   TestRenderFrameHost* goback_rfh = contents()->GetPendingMainFrame();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
 
-  // Navigations should be suspended in goback_rfh until BeforeUnloadACK.
-  if (!IsBrowserSideNavigationEnabled()) {
-    EXPECT_TRUE(goback_rfh->are_navigations_suspended());
-    pending_rfh->SendBeforeUnloadACK(true);
-    EXPECT_FALSE(goback_rfh->are_navigations_suspended());
-  }
-
   // DidNavigate from the back action.
   contents()->TestDidNavigateWithSequenceNumber(
       goback_rfh, entry_id, false, url2, Referrer(), ui::PAGE_TRANSITION_TYPED,
@@ -809,13 +795,6 @@
   pending_rfh->GetRenderViewHost()->set_delete_counter(
       &pending_rvh_delete_count);
 
-  // Navigations should be suspended in pending_rvh until BeforeUnloadACK.
-  if (!IsBrowserSideNavigationEnabled()) {
-    EXPECT_TRUE(pending_rfh->are_navigations_suspended());
-    orig_rfh->SendBeforeUnloadACK(true);
-    EXPECT_FALSE(pending_rfh->are_navigations_suspended());
-  }
-
   // DidNavigate from the pending page.
   contents()->TestDidNavigate(pending_rfh, entry_id, true, url2,
                               ui::PAGE_TRANSITION_TYPED);

diff --git a/content/browser/webauth/authenticator_impl_unittest.cc b/content/browser/webauth/authenticator_impl_unittest.cc
index ee6be79..0ae10bb 100644
--- a/content/browser/webauth/authenticator_impl_unittest.cc
+++ b/content/browser/webauth/authenticator_impl_unittest.cc

@@ -538,7 +538,7 @@
             response.first);
 }
 
-// Test that service returns NOT_SUPPORTED_ERROR if no parameters contain
+// Test that service returns NOT_IMPLEMENTED_ERROR if no parameters contain
 // a supported algorithm.
 TEST_F(AuthenticatorImplTest, MakeCredentialNoSupportedAlgorithm) {
   SimulateNavigation(GURL(kTestOrigin1));

diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index d561e8689..1e78ddc 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc

@@ -80,6 +80,10 @@
 #if !defined(OS_MACOSX)
   WebRuntimeFeatures::EnableNotificationContentImage(true);
 #endif
+
+#if defined(OS_ANDROID)
+  WebRuntimeFeatures::EnableDoubleTapToJumpOnVideo(true);
+#endif
 }
 
 void SetRuntimeFeaturesDefaultsAndUpdateFromArgs(

diff --git a/content/common/throttling_url_loader_unittest.cc b/content/common/throttling_url_loader_unittest.cc
index 1aea494..7cdbdb8 100644
--- a/content/common/throttling_url_loader_unittest.cc
+++ b/content/common/throttling_url_loader_unittest.cc

@@ -86,6 +86,7 @@
 
   // mojom::URLLoader implementation.
   void FollowRedirect() override {}
+  void ProceedWithResponse() override {}
 
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}

diff --git a/content/network/url_loader.cc b/content/network/url_loader.cc
index f9b6236..488bd13 100644
--- a/content/network/url_loader.cc
+++ b/content/network/url_loader.cc

@@ -304,6 +304,10 @@
   url_request_->FollowDeferredRedirect();
 }
 
+void URLLoader::ProceedWithResponse() {
+  NOTREACHED();
+}
+
 void URLLoader::SetPriority(net::RequestPriority priority,
                             int32_t intra_priority_value) {
   NOTIMPLEMENTED();

diff --git a/content/network/url_loader.h b/content/network/url_loader.h
index a182c2b..992d714e 100644
--- a/content/network/url_loader.h
+++ b/content/network/url_loader.h

@@ -51,6 +51,7 @@
 
   // mojom::URLLoader implementation:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java b/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java
index e36daa1..16c2aea 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/VideoRotateToFullscreenTest.java

@@ -5,6 +5,8 @@
 package org.chromium.content.browser;
 
 import android.content.pm.ActivityInfo;
+import android.provider.Settings;
+import android.support.test.filters.MediumTest;
 
 import org.junit.After;
 import org.junit.Assert;
@@ -13,9 +15,10 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import org.chromium.base.ContextUtils;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisabledTest;
+import org.chromium.base.test.util.Feature;
 import org.chromium.base.test.util.Restriction;
 import org.chromium.content.browser.test.ContentJUnit4ClassRunner;
 import org.chromium.content.browser.test.util.Criteria;
@@ -89,9 +92,8 @@
     }
 
     @Test
-    // @MediumTest
-    // @Feature({"VideoRotateToFullscreen"})
-    @DisabledTest(message = "crbug.com/726977")
+    @MediumTest
+    @Feature({"VideoRotateToFullscreen"})
     @Restriction({UiRestriction.RESTRICTION_TYPE_PHONE})
     public void testPortraitToLandscapeAndBack() throws Exception {
         // Start off in portrait screen orientation.
@@ -107,14 +109,19 @@
         mRule.getActivity().setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_LANDSCAPE);
         waitForScreenOrientation("\"landscape\"");
 
-        // Should enter fullscreen.
-        waitForContentsFullscreenState(true);
+        // Should enter fullscreen if there is no portrait system lock.
+        boolean autoRotateEnabled =
+                Settings.System.getInt(ContextUtils.getApplicationContext().getContentResolver(),
+                        Settings.System.ACCELEROMETER_ROTATION, 0)
+                == 1;
+        waitForContentsFullscreenState(autoRotateEnabled);
 
         // Rotate screen from landscape to portrait(?).
         mRule.getActivity().setRequestedOrientation(ActivityInfo.SCREEN_ORIENTATION_PORTRAIT);
         waitForScreenOrientation("\"portrait\"");
 
-        // Should exit fullscreen.
+        // Should no longer be fullscreen (either exitno longer be fullscreen
+        // (either exit or never went).
         waitForContentsFullscreenState(false);
     }
 }

diff --git a/content/public/common/simple_url_loader_unittest.cc b/content/public/common/simple_url_loader_unittest.cc
index 11494878..1715b7df 100644
--- a/content/public/common/simple_url_loader_unittest.cc
+++ b/content/public/common/simple_url_loader_unittest.cc

@@ -1128,6 +1128,7 @@
 
   // mojom::URLLoader implementation:
   void FollowRedirect() override {}
+  void ProceedWithResponse() override {}
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {
     NOTREACHED();

diff --git a/content/public/common/url_loader.mojom b/content/public/common/url_loader.mojom
index 26cf7e4f..120d2164 100644
--- a/content/public/common/url_loader.mojom
+++ b/content/public/common/url_loader.mojom

@@ -39,6 +39,14 @@
   // |FollowRedirect| may be called to load the URL indicated by the redirect.
   FollowRedirect();
 
+  // Resumes loading the response body if the URLLoader paused the request upon
+  // receiving the final response headers.
+  // Note: this is a configuration option for the URLLoader. By default, the
+  // loading isn't paused.
+  // TODO(arthursonzogni): This is a temporary feature. Remove this as soon as
+  // the InterceptingResourceHandler is removed. See https://crbug.com/791049.
+  ProceedWithResponse();
+
   // Sets the request priority.
   // |intra_priority_value| is a lesser priority which is used to prioritize
   // requests within a given priority level.

diff --git a/content/public/test/navigation_simulator.cc b/content/public/test/navigation_simulator.cc
index e7d6054f..f95b1ee 100644
--- a/content/public/test/navigation_simulator.cc
+++ b/content/public/test/navigation_simulator.cc

@@ -274,9 +274,7 @@
   if (IsRendererDebugURL(navigation_url_))
     return;
 
-  if (same_document_ ||
-      (IsBrowserSideNavigationEnabled() &&
-       !IsURLHandledByNetworkStack(navigation_url_)) ||
+  if (same_document_ || !IsURLHandledByNetworkStack(navigation_url_) ||
       navigation_url_.IsAboutBlank()) {
     CHECK_EQ(1, num_did_start_navigation_called_);
     return;
@@ -288,7 +286,7 @@
   if (GetLastThrottleCheckResult().action() == NavigationThrottle::PROCEED) {
     CHECK_EQ(1, num_will_start_request_called_);
   } else {
-    FailFromThrottleCheck(GetLastThrottleCheckResult());
+    state_ = FAILED;
   }
 }
 
@@ -313,31 +311,23 @@
       num_did_redirect_navigation_called_;
 
   PrepareCompleteCallbackOnHandle();
-  if (IsBrowserSideNavigationEnabled()) {
-    NavigationRequest* request =
-        render_frame_host_->frame_tree_node()->navigation_request();
-    TestNavigationURLLoader* url_loader =
-        static_cast<TestNavigationURLLoader*>(request->loader_for_testing());
-    CHECK(url_loader);
+  NavigationRequest* request =
+      render_frame_host_->frame_tree_node()->navigation_request();
+  TestNavigationURLLoader* url_loader =
+      static_cast<TestNavigationURLLoader*>(request->loader_for_testing());
+  CHECK(url_loader);
 
-    net::RedirectInfo redirect_info;
-    redirect_info.status_code = 302;
-    redirect_info.new_method = "GET";
-    redirect_info.new_url = new_url;
-    redirect_info.new_site_for_cookies = new_url;
-    redirect_info.new_referrer = referrer_.url.spec();
-    redirect_info.new_referrer_policy =
-        Referrer::ReferrerPolicyForUrlRequest(referrer_);
+  net::RedirectInfo redirect_info;
+  redirect_info.status_code = 302;
+  redirect_info.new_method = "GET";
+  redirect_info.new_url = new_url;
+  redirect_info.new_site_for_cookies = new_url;
+  redirect_info.new_referrer = referrer_.url.spec();
+  redirect_info.new_referrer_policy =
+      Referrer::ReferrerPolicyForUrlRequest(referrer_);
 
-    url_loader->CallOnRequestRedirected(
-        redirect_info, scoped_refptr<ResourceResponse>(new ResourceResponse));
-  } else {
-    handle_->WillRedirectRequest(
-        new_url, "GET", referrer_.url, false /* is_external_protocol */,
-        scoped_refptr<net::HttpResponseHeaders>(),
-        net::HttpResponseInfo::ConnectionInfo(), nullptr,
-        base::Callback<void(NavigationThrottle::ThrottleCheckResult)>());
-  }
+  url_loader->CallOnRequestRedirected(
+      redirect_info, scoped_refptr<ResourceResponse>(new ResourceResponse));
 
   WaitForThrottleChecksComplete();
 
@@ -347,7 +337,7 @@
     CHECK_EQ(previous_did_redirect_navigation_called + 1,
              num_did_redirect_navigation_called_);
   } else {
-    FailFromThrottleCheck(GetLastThrottleCheckResult());
+    state_ = FAILED;
   }
 }
 
@@ -365,55 +355,24 @@
       return;
   }
 
-  if (!IsBrowserSideNavigationEnabled() && same_document_) {
-    CommitSameDocument();
+  PrepareCompleteCallbackOnHandle();
+  if (frame_tree_node_->navigation_request()) {
+    static_cast<TestRenderFrameHost*>(frame_tree_node_->current_frame_host())
+        ->PrepareForCommitWithSocketAddress(socket_address_);
+  }
+
+  // Synchronous failure can cause the navigation to finish here.
+  if (!handle_) {
+    state_ = FAILED;
     return;
   }
 
-  PrepareCompleteCallbackOnHandle();
-  if (IsBrowserSideNavigationEnabled()) {
-    if (frame_tree_node_->navigation_request()) {
-      static_cast<TestRenderFrameHost*>(frame_tree_node_->current_frame_host())
-          ->PrepareForCommitWithSocketAddress(socket_address_);
-    }
-
-    // Synchronous failure can cause the navigation to finish here.
-    if (!handle_) {
-      state_ = FAILED;
-      return;
-    }
-  }
-
-  // Call NavigationHandle::WillProcessResponse if needed.
-  // Note that the handle's state can be CANCELING if a throttle cancelled it
-  // synchronously in PrepareForCommit.
-  if (handle_->state_for_testing() < NavigationHandleImpl::CANCELING) {
-    // This code path should only be executed when browser-side navigation isn't
-    // enabled. When browser-side navigation is enabled, WillProcessResponse
-    // gets invoked via the call to PrepareForCommit() above.
-    DCHECK(!IsBrowserSideNavigationEnabled());
-
-    // Start the request_ids at 1000 to avoid collisions with request ids from
-    // network resources (it should be rare to compare these in unit tests).
-    static int request_id = 1000;
-    GlobalRequestID global_id(render_frame_host_->GetProcess()->GetID(),
-                              ++request_id);
-    handle_->WillProcessResponse(
-        render_frame_host_, scoped_refptr<net::HttpResponseHeaders>(),
-        net::HttpResponseInfo::ConnectionInfo(), socket_address_,
-        net::SSLInfo(), global_id, false /* should_replace_current_entry */,
-        false /* is_download */, false /* is_stream */, base::Closure(),
-        base::Callback<void(NavigationThrottle::ThrottleCheckResult)>());
-  }
-
-  if (!same_document_ && !IsRendererDebugURL(navigation_url_) &&
-      !navigation_url_.IsAboutBlank() &&
-      (!IsBrowserSideNavigationEnabled() ||
-       IsURLHandledByNetworkStack(navigation_url_))) {
+  if (!same_document_ && !navigation_url_.IsAboutBlank() &&
+      IsURLHandledByNetworkStack(navigation_url_)) {
     WaitForThrottleChecksComplete();
 
     if (GetLastThrottleCheckResult().action() != NavigationThrottle::PROCEED) {
-      FailFromThrottleCheck(GetLastThrottleCheckResult());
+      state_ = FAILED;
       return;
     }
     CHECK_EQ(1, num_will_process_response_called_);
@@ -425,21 +384,8 @@
 
   // Update the RenderFrameHost now that we know which RenderFrameHost will
   // commit the navigation.
-  TestRenderFrameHost* new_render_frame_host =
+  render_frame_host_ =
       static_cast<TestRenderFrameHost*>(handle_->GetRenderFrameHost());
-  if (!IsBrowserSideNavigationEnabled() &&
-      new_render_frame_host != render_frame_host_) {
-    CHECK(handle_->is_transferring());
-    // Simulate the renderer transfer.
-    new_render_frame_host->OnMessageReceived(FrameHostMsg_DidStartLoading(
-        new_render_frame_host->GetRoutingID(), true));
-    new_render_frame_host->OnMessageReceived(
-        FrameHostMsg_DidStartProvisionalLoad(
-            new_render_frame_host->GetRoutingID(), navigation_url_,
-            std::vector<GURL>(), base::TimeTicks::Now()));
-    CHECK(!handle_->is_transferring());
-  }
-  render_frame_host_ = new_render_frame_host;
   state_ = READY_TO_COMMIT;
 }
 
@@ -514,6 +460,7 @@
   CHECK_EQ(0, num_did_finish_navigation_called_)
       << "NavigationSimulator::Fail cannot be called after the "
          "navigation has finished";
+  DCHECK(!IsRendererDebugURL(navigation_url_));
 
   if (state_ == INITIALIZATION)
     Start();
@@ -521,51 +468,33 @@
   state_ = FAILED;
 
   bool should_result_in_error_page = error_code != net::ERR_ABORTED;
-  if (IsBrowserSideNavigationEnabled()) {
-    PrepareCompleteCallbackOnHandle();
-    NavigationRequest* request = frame_tree_node_->navigation_request();
-    CHECK(request);
-    TestNavigationURLLoader* url_loader =
-        static_cast<TestNavigationURLLoader*>(request->loader_for_testing());
-    CHECK(url_loader);
-    url_loader->SimulateError(error_code);
-    if (error_code != net::ERR_ABORTED) {
-      DCHECK(!IsRendererDebugURL(navigation_url_));
-      WaitForThrottleChecksComplete();
-      NavigationThrottle::ThrottleCheckResult result =
-          GetLastThrottleCheckResult();
-      if (result.action() == NavigationThrottle::CANCEL ||
-          result.action() == NavigationThrottle::CANCEL_AND_IGNORE) {
-        should_result_in_error_page = false;
-      }
-    }
-  } else {
-    FrameHostMsg_DidFailProvisionalLoadWithError_Params error_params;
-    error_params.error_code = error_code;
-    error_params.url = navigation_url_;
-    render_frame_host_->OnMessageReceived(
-        FrameHostMsg_DidFailProvisionalLoadWithError(
-            render_frame_host_->GetRoutingID(), error_params));
-    if (!should_result_in_error_page) {
-      render_frame_host_->OnMessageReceived(
-          FrameHostMsg_DidStopLoading(render_frame_host_->GetRoutingID()));
+  PrepareCompleteCallbackOnHandle();
+  NavigationRequest* request = frame_tree_node_->navigation_request();
+  CHECK(request);
+  TestNavigationURLLoader* url_loader =
+      static_cast<TestNavigationURLLoader*>(request->loader_for_testing());
+  CHECK(url_loader);
+  url_loader->SimulateError(error_code);
+  if (error_code != net::ERR_ABORTED) {
+    WaitForThrottleChecksComplete();
+    NavigationThrottle::ThrottleCheckResult result =
+        GetLastThrottleCheckResult();
+    if (result.action() == NavigationThrottle::CANCEL ||
+        result.action() == NavigationThrottle::CANCEL_AND_IGNORE) {
+      should_result_in_error_page = false;
     }
   }
 
-  if (IsBrowserSideNavigationEnabled()) {
-    if (should_result_in_error_page) {
-      CHECK_EQ(1, num_ready_to_commit_called_);
-      // Update the RenderFrameHost now that we know which RenderFrameHost will
-      // commit the error page.
-      render_frame_host_ =
-          static_cast<TestRenderFrameHost*>(handle_->GetRenderFrameHost());
-    }
-  }
-
-  if (should_result_in_error_page)
+  if (should_result_in_error_page) {
+    CHECK_EQ(1, num_ready_to_commit_called_);
     CHECK_EQ(0, num_did_finish_navigation_called_);
-  else
+    // Update the RenderFrameHost now that we know which RenderFrameHost will
+    // commit the error page.
+    render_frame_host_ =
+        static_cast<TestRenderFrameHost*>(handle_->GetRenderFrameHost());
+  } else {
     CHECK_EQ(1, num_did_finish_navigation_called_);
+  }
 }
 
 void NavigationSimulator::CommitErrorPage() {
@@ -764,11 +693,6 @@
   if (handle->frame_tree_node() != frame_tree_node_)
     return;
 
-  if (!IsBrowserSideNavigationEnabled() &&
-      navigation_handle->GetURL() != navigation_url_) {
-    return;
-  }
-
   handle_ = handle;
 
   num_did_start_navigation_called_++;
@@ -846,33 +770,6 @@
   // Update it.
   navigation_url_ = web_contents_->GetController().GetPendingEntry()->GetURL();
 
-  if (!IsBrowserSideNavigationEnabled()) {
-    // Update the RenderFrameHost for navigation.
-    render_frame_host_ = static_cast<TestRenderFrameHost*>(
-        frame_tree_node_->render_manager()->pending_frame_host());
-    if (!render_frame_host_) {
-      render_frame_host_ =
-          static_cast<TestRenderFrameHost*>(web_contents_->GetMainFrame());
-    }
-    CHECK(render_frame_host_);
-
-    // Simulate the BeforeUnloadACK if needed.
-    if (web_contents_->GetMainFrame()->is_waiting_for_beforeunload_ack()) {
-      static_cast<TestRenderFrameHost*>(web_contents_->GetMainFrame())
-          ->SendBeforeUnloadACK(true /*proceed */);
-    }
-
-    // If this is a same-document navigation, there is no need to simulate
-    // anything else.
-    if (CheckIfSameDocument()) {
-      same_document_ = true;
-      return false;
-    }
-
-    // From there on, the calls are similar to a renderer-initiated navigation.
-    return SimulateRendererInitiatedStart();
-  }
-
   // Simulate the BeforeUnload ACK if needed.
   NavigationRequest* request = frame_tree_node_->navigation_request();
   if (request &&
@@ -914,57 +811,33 @@
 }
 
 bool NavigationSimulator::SimulateRendererInitiatedStart() {
-  if (IsBrowserSideNavigationEnabled()) {
-    mojom::BeginNavigationParamsPtr begin_params =
-        mojom::BeginNavigationParams::New(
-            std::string() /* headers */, net::LOAD_NORMAL,
-            false /* skip_service_worker */, REQUEST_CONTEXT_TYPE_HYPERLINK,
-            blink::WebMixedContentContextType::kBlockable,
-            false /* is_form_submission */, GURL() /* searchable_form_url */,
-            std::string() /* searchable_form_encoding */, url::Origin(),
-            GURL() /* client_side_redirect_url */);
-    CommonNavigationParams common_params;
-    common_params.url = navigation_url_;
-    common_params.referrer = referrer_;
-    common_params.transition = transition_;
-    common_params.navigation_type =
-        PageTransitionCoreTypeIs(transition_, ui::PAGE_TRANSITION_RELOAD)
-            ? FrameMsg_Navigate_Type::RELOAD
-            : FrameMsg_Navigate_Type::DIFFERENT_DOCUMENT;
-    common_params.has_user_gesture = has_user_gesture_;
-    render_frame_host_->frame_host_binding_for_testing()
-        .impl()
-        ->BeginNavigation(common_params, std::move(begin_params));
-    NavigationRequest* request =
-        render_frame_host_->frame_tree_node()->navigation_request();
+  mojom::BeginNavigationParamsPtr begin_params =
+      mojom::BeginNavigationParams::New(
+          std::string() /* headers */, net::LOAD_NORMAL,
+          false /* skip_service_worker */, REQUEST_CONTEXT_TYPE_HYPERLINK,
+          blink::WebMixedContentContextType::kBlockable,
+          false /* is_form_submission */, GURL() /* searchable_form_url */,
+          std::string() /* searchable_form_encoding */, url::Origin(),
+          GURL() /* client_side_redirect_url */);
+  CommonNavigationParams common_params;
+  common_params.url = navigation_url_;
+  common_params.referrer = referrer_;
+  common_params.transition = transition_;
+  common_params.navigation_type =
+      PageTransitionCoreTypeIs(transition_, ui::PAGE_TRANSITION_RELOAD)
+          ? FrameMsg_Navigate_Type::RELOAD
+          : FrameMsg_Navigate_Type::DIFFERENT_DOCUMENT;
+  common_params.has_user_gesture = has_user_gesture_;
+  render_frame_host_->frame_host_binding_for_testing().impl()->BeginNavigation(
+      common_params, std::move(begin_params));
+  NavigationRequest* request =
+      render_frame_host_->frame_tree_node()->navigation_request();
 
-    // The request failed synchronously.
-    if (!request)
-      return false;
+  // The request failed synchronously.
+  if (!request)
+    return false;
 
-    DCHECK_EQ(handle_, request->navigation_handle());
-    return true;
-  }
-
-  render_frame_host_->OnMessageReceived(
-      FrameHostMsg_DidStartLoading(render_frame_host_->GetRoutingID(), true));
-  render_frame_host_->OnMessageReceived(FrameHostMsg_DidStartProvisionalLoad(
-      render_frame_host_->GetRoutingID(), navigation_url_, std::vector<GURL>(),
-      base::TimeTicks::Now()));
-  if (IsRendererDebugURL(navigation_url_)) {
-    // DidStartNavigation was not fired in that case.
-    handle_ = render_frame_host_->navigation_handle();
-  }
-  DCHECK_EQ(handle_, render_frame_host_->navigation_handle());
-  // Note: When PlzNavigate is enabled, WillStartRequest will have been fired as
-  // part of the processing of BeginNavigation. When not enabled, simulate the
-  // ResourceRequest having been received on the IO thread.
-  handle_->WillStartRequest(
-      "GET", scoped_refptr<content::ResourceRequestBody>(), referrer_,
-      has_user_gesture_, transition_, false /* is_external_protocol */,
-      REQUEST_CONTEXT_TYPE_LOCATION,
-      blink::WebMixedContentContextType::kNotMixedContent,
-      base::Callback<void(NavigationThrottle::ThrottleCheckResult)>());
+  DCHECK_EQ(handle_, request->navigation_handle());
   return true;
 }
 
@@ -978,11 +851,9 @@
     throttle_checks_wait_closure_.Reset();
   }
 
-  if (IsBrowserSideNavigationEnabled()) {
-    // Run message loop once since NavigationRequest::OnStartChecksComplete
-    // posted a task.
-    base::RunLoop().RunUntilIdle();
-  }
+  // Run message loop once since NavigationRequest::OnStartChecksComplete posted
+  // a task.
+  base::RunLoop().RunUntilIdle();
 }
 
 void NavigationSimulator::OnThrottleChecksComplete(
@@ -1005,35 +876,6 @@
   return render_frame_host_;
 }
 
-void NavigationSimulator::FailFromThrottleCheck(
-    NavigationThrottle::ThrottleCheckResult result) {
-  DCHECK_NE(NavigationThrottle::PROCEED, result.action());
-  state_ = FAILED;
-
-  // Special failure logic only needed for non-PlzNavigate case.
-  if (IsBrowserSideNavigationEnabled())
-    return;
-  DCHECK_NE(NavigationThrottle::DEFER, result.action());
-  DCHECK_NE(NavigationThrottle::PROCEED, result.action());
-  DCHECK_NE(net::OK, result.net_error_code());
-
-  FrameHostMsg_DidFailProvisionalLoadWithError_Params error_params;
-  error_params.error_code = result.net_error_code();
-  error_params.url = navigation_url_;
-  render_frame_host_->OnMessageReceived(
-      FrameHostMsg_DidFailProvisionalLoadWithError(
-          render_frame_host_->GetRoutingID(), error_params));
-  bool should_result_in_error_page =
-      result.net_error_code() != net::ERR_ABORTED;
-  if (!should_result_in_error_page) {
-    render_frame_host_->OnMessageReceived(
-        FrameHostMsg_DidStopLoading(render_frame_host_->GetRoutingID()));
-    CHECK_EQ(1, num_did_finish_navigation_called_);
-  } else {
-    CHECK_EQ(0, num_did_finish_navigation_called_);
-  }
-}
-
 bool NavigationSimulator::CheckIfSameDocument() {
   // This approach to determining whether a navigation is to be treated as
   // same document is not robust, as it will not handle pushState type

diff --git a/content/public/test/navigation_simulator.h b/content/public/test/navigation_simulator.h
index 3f87130f..10e9b51 100644
--- a/content/public/test/navigation_simulator.h
+++ b/content/public/test/navigation_simulator.h

@@ -307,13 +307,8 @@
   // NavigationHandle.
   void PrepareCompleteCallbackOnHandle();
 
-  // Simulates the DidFailProvisionalLoad IPC following a NavigationThrottle
-  // cancelling the navigation.
-  // PlzNavigate: this is not needed.
-  void FailFromThrottleCheck(NavigationThrottle::ThrottleCheckResult result);
-
   // Check if the navigation corresponds to a same-document navigation.
-  // PlzNavigate: only use on renderer-initiated navigations.
+  // Only use on renderer-initiated navigations.
   bool CheckIfSameDocument();
 
   // Infers from internal parameters whether the navigation created a new

diff --git a/content/renderer/image_capture/image_capture_frame_grabber.cc b/content/renderer/image_capture/image_capture_frame_grabber.cc
index b4134879e..3a2ced3 100644
--- a/content/renderer/image_capture/image_capture_frame_grabber.cc
+++ b/content/renderer/image_capture/image_capture_frame_grabber.cc

@@ -58,7 +58,7 @@
     base::TimeTicks /* current_time */) {
   DCHECK(frame->format() == media::PIXEL_FORMAT_YV12 ||
          frame->format() == media::PIXEL_FORMAT_I420 ||
-         frame->format() == media::PIXEL_FORMAT_YV12A);
+         frame->format() == media::PIXEL_FORMAT_I420A);
 
   if (first_frame_received_)
     return;
@@ -94,7 +94,7 @@
                           pixmap.width() * 4, pixmap.width(), pixmap.height(),
                           destination_pixel_format);
 
-  if (frame->format() == media::PIXEL_FORMAT_YV12A) {
+  if (frame->format() == media::PIXEL_FORMAT_I420A) {
     DCHECK(!info.isOpaque());
     // This function copies any plane into the alpha channel of an ARGB image.
     libyuv::ARGBCopyYToAlpha(frame->visible_data(media::VideoFrame::kAPlane),

diff --git a/content/renderer/loader/cors_url_loader.cc b/content/renderer/loader/cors_url_loader.cc
index 5cc36f8..e76d61e6 100644
--- a/content/renderer/loader/cors_url_loader.cc
+++ b/content/renderer/loader/cors_url_loader.cc

@@ -87,6 +87,10 @@
   network_loader_->FollowRedirect();
 }
 
+void CORSURLLoader::ProceedWithResponse() {
+  NOTREACHED();
+}
+
 void CORSURLLoader::SetPriority(net::RequestPriority priority,
                                 int32_t intra_priority_value) {
   // TODO(toyoshim): Should not be called during the redirect decisions, but

diff --git a/content/renderer/loader/cors_url_loader.h b/content/renderer/loader/cors_url_loader.h
index 7683194..de89df24 100644
--- a/content/renderer/loader/cors_url_loader.h
+++ b/content/renderer/loader/cors_url_loader.h

@@ -36,6 +36,7 @@
 
   // mojom::URLLoader overrides:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/renderer/loader/resource_dispatcher.cc b/content/renderer/loader/resource_dispatcher.cc
index 22a89f4..1d6452d 100644
--- a/content/renderer/loader/resource_dispatcher.cc
+++ b/content/renderer/loader/resource_dispatcher.cc

@@ -409,6 +409,17 @@
   peer->OnCompletedRequest(renderer_status);
 }
 
+mojom::DownloadedTempFilePtr ResourceDispatcher::TakeDownloadedTempFile(
+    int request_id) {
+  PendingRequestMap::iterator it = pending_requests_.find(request_id);
+  if (it == pending_requests_.end())
+    return nullptr;
+  PendingRequestInfo* request_info = it->second.get();
+  if (!request_info->url_loader_client)
+    return nullptr;
+  return request_info->url_loader_client->TakeDownloadedTempFile();
+}
+
 bool ResourceDispatcher::RemovePendingRequest(int request_id) {
   PendingRequestMap::iterator it = pending_requests_.find(request_id);
   if (it == pending_requests_.end())
@@ -594,14 +605,16 @@
     SyncLoadResponse* response,
     blink::WebURLRequest::LoadingIPCType ipc_type,
     mojom::URLLoaderFactory* url_loader_factory,
-    std::vector<std::unique_ptr<URLLoaderThrottle>> throttles) {
+    std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
+    double timeout) {
   CheckSchemeForReferrerPolicy(*request);
 
   if (ipc_type == blink::WebURLRequest::LoadingIPCType::kMojo) {
     mojom::URLLoaderFactoryPtrInfo url_loader_factory_copy;
     url_loader_factory->Clone(mojo::MakeRequest(&url_loader_factory_copy));
-    base::WaitableEvent event(base::WaitableEvent::ResetPolicy::MANUAL,
-                              base::WaitableEvent::InitialState::NOT_SIGNALED);
+    base::WaitableEvent completed_event(
+        base::WaitableEvent::ResetPolicy::MANUAL,
+        base::WaitableEvent::InitialState::NOT_SIGNALED);
 
     // Prepare the configured throttles for use on a separate thread.
     for (const auto& throttle : throttles)
@@ -617,9 +630,10 @@
                        std::move(request), routing_id, frame_origin,
                        traffic_annotation, std::move(url_loader_factory_copy),
                        std::move(throttles), base::Unretained(response),
-                       base::Unretained(&event)));
+                       base::Unretained(&completed_event),
+                       base::Unretained(terminate_sync_load_event_), timeout));
 
-    event.Wait();
+    completed_event.Wait();
   } else {
     SyncLoadResult result;
     IPC::SyncMessage* msg = new ResourceHostMsg_SyncLoad(
@@ -633,18 +647,18 @@
 
     response->error_code = result.error_code;
     response->url = result.final_url;
-    response->headers = result.headers;
-    response->mime_type = result.mime_type;
-    response->charset = result.charset;
-    response->request_time = result.request_time;
-    response->response_time = result.response_time;
-    response->load_timing = result.load_timing;
-    response->devtools_info = result.devtools_info;
+    response->info.headers = result.headers;
+    response->info.mime_type = result.mime_type;
+    response->info.charset = result.charset;
+    response->info.request_time = result.request_time;
+    response->info.response_time = result.response_time;
+    response->info.load_timing = result.load_timing;
+    response->info.devtools_info = result.devtools_info;
     response->data.swap(result.data);
-    response->download_file_path = result.download_file_path;
-    response->socket_address = result.socket_address;
-    response->encoded_data_length = result.encoded_data_length;
-    response->encoded_body_length = result.encoded_body_length;
+    response->info.download_file_path = result.download_file_path;
+    response->info.socket_address = result.socket_address;
+    response->info.encoded_data_length = result.encoded_data_length;
+    response->info.encoded_body_length = result.encoded_body_length;
   }
 }
 

diff --git a/content/renderer/loader/resource_dispatcher.h b/content/renderer/loader/resource_dispatcher.h
index c0f96e9..ce4a7ccb 100644
--- a/content/renderer/loader/resource_dispatcher.h
+++ b/content/renderer/loader/resource_dispatcher.h

@@ -34,6 +34,10 @@
 #include "url/gurl.h"
 #include "url/origin.h"
 
+namespace base {
+class WaitableEvent;
+}
+
 namespace net {
 struct RedirectInfo;
 }
@@ -91,6 +95,7 @@
   //
   // |routing_id| is used to associated the bridge with a frame's network
   // context.
+  // |timeout| (in seconds) is used to abort the sync request on timeouts.
   virtual void StartSync(
       std::unique_ptr<ResourceRequest> request,
       int routing_id,
@@ -99,7 +104,8 @@
       SyncLoadResponse* response,
       blink::WebURLRequest::LoadingIPCType ipc_type,
       mojom::URLLoaderFactory* url_loader_factory,
-      std::vector<std::unique_ptr<URLLoaderThrottle>> throttles);
+      std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
+      double timeout);
 
   // Call this method to initiate the request. If this method succeeds, then
   // the peer's methods will be called asynchronously to report various events.
@@ -124,6 +130,8 @@
       std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
       mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints);
 
+  mojom::DownloadedTempFilePtr TakeDownloadedTempFile(int request_id);
+
   // Removes a request from the |pending_requests_| list, returning true if the
   // request was found and removed.
   bool RemovePendingRequest(int request_id);
@@ -171,6 +179,15 @@
 
   void OnTransferSizeUpdated(int request_id, int32_t transfer_size_diff);
 
+  // This is used only when |this| is created for a worker thread.
+  // Sets |terminate_sync_load_event_| which will be signaled from the main
+  // thread when the worker thread is being terminated so that the sync requests
+  // requested on the worker thread can be aborted.
+  void set_terminate_sync_load_event(
+      base::WaitableEvent* terminate_sync_load_event) {
+    terminate_sync_load_event_ = terminate_sync_load_event;
+  }
+
  private:
   friend class URLLoaderClientImpl;
   friend class URLResponseBodyConsumer;
@@ -296,6 +313,8 @@
   scoped_refptr<base::SingleThreadTaskRunner> thread_task_runner_;
   scoped_refptr<ResourceSchedulingFilter> resource_scheduling_filter_;
 
+  base::WaitableEvent* terminate_sync_load_event_ = nullptr;
+
   base::WeakPtrFactory<ResourceDispatcher> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ResourceDispatcher);

diff --git a/content/renderer/loader/sync_load_context.cc b/content/renderer/loader/sync_load_context.cc
index 898e358d..d3711f7e 100644
--- a/content/renderer/loader/sync_load_context.cc
+++ b/content/renderer/loader/sync_load_context.cc

@@ -25,9 +25,12 @@
     mojom::URLLoaderFactoryPtrInfo url_loader_factory_pipe,
     std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
     SyncLoadResponse* response,
-    base::WaitableEvent* event) {
-  auto* context = new SyncLoadContext(
-      request.get(), std::move(url_loader_factory_pipe), response, event);
+    base::WaitableEvent* completed_event,
+    base::WaitableEvent* abort_event,
+    double timeout) {
+  auto* context =
+      new SyncLoadContext(request.get(), std::move(url_loader_factory_pipe),
+                          response, completed_event, abort_event, timeout);
 
   context->request_id_ = context->resource_dispatcher_->StartAsync(
       std::move(request), routing_id, nullptr, frame_origin, traffic_annotation,
@@ -41,8 +44,19 @@
     ResourceRequest* request,
     mojom::URLLoaderFactoryPtrInfo url_loader_factory,
     SyncLoadResponse* response,
-    base::WaitableEvent* event)
-    : response_(response), event_(event) {
+    base::WaitableEvent* completed_event,
+    base::WaitableEvent* abort_event,
+    double timeout)
+    : response_(response), completed_event_(completed_event) {
+  if (abort_event) {
+    abort_watcher_.StartWatching(
+        abort_event,
+        base::BindOnce(&SyncLoadContext::OnAbort, base::Unretained(this)));
+  }
+  if (timeout) {
+    timeout_timer_.Start(FROM_HERE, base::TimeDelta::FromSecondsD(timeout),
+                         this, &SyncLoadContext::OnTimeout);
+  }
   url_loader_factory_.Bind(std::move(url_loader_factory));
 
   // Constructs a new ResourceDispatcher specifically for this request.
@@ -60,10 +74,13 @@
 
 bool SyncLoadContext::OnReceivedRedirect(const net::RedirectInfo& redirect_info,
                                          const ResourceResponseInfo& info) {
+  DCHECK(!Completed());
   if (redirect_info.new_url.GetOrigin() != response_->url.GetOrigin()) {
     LOG(ERROR) << "Cross origin redirect denied";
     response_->error_code = net::ERR_ABORTED;
-    event_->Signal();
+    completed_event_->Signal();
+
+    CompleteRequest(false /* remove_pending_request */);
 
     // Returning false here will cause the request to be cancelled and this
     // object deleted.
@@ -75,24 +92,17 @@
 }
 
 void SyncLoadContext::OnReceivedResponse(const ResourceResponseInfo& info) {
-  response_->headers = info.headers;
-  response_->mime_type = info.mime_type;
-  response_->charset = info.charset;
-  response_->request_time = info.request_time;
-  response_->response_time = info.response_time;
-  response_->load_timing = info.load_timing;
-  response_->devtools_info = info.devtools_info;
-  response_->download_file_path = info.download_file_path;
-  response_->socket_address = info.socket_address;
+  DCHECK(!Completed());
+  response_->info = info;
 }
 
 void SyncLoadContext::OnDownloadedData(int len, int encoded_data_length) {
-  // This method is only called when RequestInfo::download_to_file is true which
-  // is not allowed when processing a synchronous request.
-  NOTREACHED();
+  downloaded_file_length_ =
+      (downloaded_file_length_ ? *downloaded_file_length_ : 0) + len;
 }
 
 void SyncLoadContext::OnReceivedData(std::unique_ptr<ReceivedData> data) {
+  DCHECK(!Completed());
   response_->data.append(data->payload(), data->length());
 }
 
@@ -100,15 +110,54 @@
 
 void SyncLoadContext::OnCompletedRequest(
     const network::URLLoaderCompletionStatus& status) {
+  DCHECK(!Completed());
   response_->error_code = status.error_code;
   if (status.cors_error_status)
     response_->cors_error = status.cors_error_status->cors_error;
-  response_->encoded_data_length = status.encoded_data_length;
-  response_->encoded_body_length = status.encoded_body_length;
-  event_->Signal();
+  response_->info.encoded_data_length = status.encoded_data_length;
+  response_->info.encoded_body_length = status.encoded_body_length;
+  response_->downloaded_file_length = downloaded_file_length_;
+  // Need to pass |downloaded_tmp_file| to the caller thread. Otherwise the blob
+  // creation in ResourceResponse::SetDownloadedFilePath() fails.
+  response_->downloaded_tmp_file =
+      resource_dispatcher_->TakeDownloadedTempFile(request_id_);
+  DCHECK_EQ(!response_->downloaded_file_length,
+            !response_->downloaded_tmp_file);
+  CompleteRequest(true /* remove_pending_request */);
+}
 
-  // This will indirectly cause this object to be deleted.
-  resource_dispatcher_->RemovePendingRequest(request_id_);
+void SyncLoadContext::OnAbort(base::WaitableEvent* event) {
+  DCHECK(!Completed());
+  response_->error_code = net::ERR_ABORTED;
+  CompleteRequest(true /* remove_pending_request */);
+}
+
+void SyncLoadContext::OnTimeout() {
+  // OnTimeout() must not be called after CompleteRequest() was called, because
+  // the OneShotTimer must have been stopped.
+  DCHECK(!Completed());
+  response_->error_code = net::ERR_TIMED_OUT;
+  CompleteRequest(true /* remove_pending_request */);
+}
+
+void SyncLoadContext::CompleteRequest(bool remove_pending_request) {
+  abort_watcher_.StopWatching();
+  timeout_timer_.AbandonAndStop();
+
+  completed_event_->Signal();
+
+  completed_event_ = nullptr;
+  response_ = nullptr;
+
+  if (remove_pending_request) {
+    // This will indirectly cause this object to be deleted.
+    resource_dispatcher_->RemovePendingRequest(request_id_);
+  }
+}
+
+bool SyncLoadContext::Completed() const {
+  DCHECK_EQ(!completed_event_, !response_);
+  return !response_;
 }
 
 }  // namespace content

diff --git a/content/renderer/loader/sync_load_context.h b/content/renderer/loader/sync_load_context.h
index d02549e..91fb6d0 100644
--- a/content/renderer/loader/sync_load_context.h
+++ b/content/renderer/loader/sync_load_context.h

@@ -6,6 +6,9 @@
 #define CONTENT_RENDERER_LOADER_SYNC_LOAD_CONTEXT_H_
 
 #include "base/macros.h"
+#include "base/optional.h"
+#include "base/synchronization/waitable_event_watcher.h"
+#include "base/timer/timer.h"
 #include "content/public/common/url_loader_factory.mojom.h"
 #include "content/public/renderer/request_peer.h"
 #include "content/renderer/loader/resource_dispatcher.h"
@@ -29,8 +32,10 @@
 class SyncLoadContext : public RequestPeer {
  public:
   // Begins a new asynchronous request on whatever sequence this method is
-  // called on. |event| will be signalled when the request is complete and
-  // |response| will be populated with the response data.
+  // called on. |completed_event| will be signalled when the request is complete
+  // and |response| will be populated with the response data. |abort_event|
+  // will be signalled from the main thread to abort the sync request on a
+  // worker thread when the worker thread is being terminated.
   static void StartAsyncWithWaitableEvent(
       std::unique_ptr<ResourceRequest> request,
       int routing_id,
@@ -39,15 +44,19 @@
       mojom::URLLoaderFactoryPtrInfo url_loader_factory_pipe,
       std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
       SyncLoadResponse* response,
-      base::WaitableEvent* event);
+      base::WaitableEvent* completed_event,
+      base::WaitableEvent* abort_event,
+      double timeout);
 
-  SyncLoadContext(ResourceRequest* request,
-                  mojom::URLLoaderFactoryPtrInfo url_loader_factory,
-                  SyncLoadResponse* response,
-                  base::WaitableEvent* event);
   ~SyncLoadContext() override;
 
  private:
+  SyncLoadContext(ResourceRequest* request,
+                  mojom::URLLoaderFactoryPtrInfo url_loader_factory,
+                  SyncLoadResponse* response,
+                  base::WaitableEvent* completed_event,
+                  base::WaitableEvent* abort_event,
+                  double timeout);
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
@@ -59,12 +68,20 @@
   void OnCompletedRequest(
       const network::URLLoaderCompletionStatus& status) override;
 
+  void OnAbort(base::WaitableEvent* event);
+  void OnTimeout();
+
+  void CompleteRequest(bool remove_pending_request);
+  bool Completed() const;
+
   // This raw pointer will remain valid for the lifetime of this object because
   // it remains on the stack until |event_| is signaled.
+  // Set to null after CompleteRequest() is called.
   SyncLoadResponse* response_;
 
   // This event is signaled when the request is complete.
-  base::WaitableEvent* event_;
+  // Set to null after CompleteRequest() is called.
+  base::WaitableEvent* completed_event_;
 
   // State necessary to run a request on an independent thread.
   mojom::URLLoaderFactoryPtr url_loader_factory_;
@@ -72,6 +89,11 @@
 
   int request_id_;
 
+  base::Optional<int64_t> downloaded_file_length_;
+
+  base::WaitableEventWatcher abort_watcher_;
+  base::OneShotTimer timeout_timer_;
+
   DISALLOW_COPY_AND_ASSIGN(SyncLoadContext);
 };
 

diff --git a/content/renderer/loader/sync_load_response.cc b/content/renderer/loader/sync_load_response.cc
index a9e8ee12..f509c5a 100644
--- a/content/renderer/loader/sync_load_response.cc
+++ b/content/renderer/loader/sync_load_response.cc

@@ -8,6 +8,21 @@
 
 SyncLoadResponse::SyncLoadResponse() {}
 
+SyncLoadResponse::SyncLoadResponse(SyncLoadResponse&& other) {
+  *this = std::move(other);
+}
+
 SyncLoadResponse::~SyncLoadResponse() {}
 
+SyncLoadResponse& SyncLoadResponse::operator=(SyncLoadResponse&& other) {
+  this->info = other.info;
+  this->error_code = other.error_code;
+  this->cors_error = other.cors_error;
+  this->url = std::move(other.url);
+  this->data = std::move(other.data);
+  this->downloaded_file_length = other.downloaded_file_length;
+  this->downloaded_tmp_file = std::move(other.downloaded_tmp_file);
+  return *this;
+}
+
 }  // namespace content

diff --git a/content/renderer/loader/sync_load_response.h b/content/renderer/loader/sync_load_response.h
index 160d9bba2..202483b17 100644
--- a/content/renderer/loader/sync_load_response.h
+++ b/content/renderer/loader/sync_load_response.h

@@ -10,6 +10,7 @@
 #include "base/optional.h"
 #include "content/common/content_export.h"
 #include "content/public/common/resource_response_info.h"
+#include "content/public/common/url_loader.mojom.h"
 #include "services/network/public/interfaces/cors.mojom.h"
 #include "url/gurl.h"
 
@@ -17,12 +18,17 @@
 
 // See the SyncLoad method. (The name of this struct is not
 // suffixed with "Info" because it also contains the response data.)
-struct CONTENT_EXPORT SyncLoadResponse : ResourceResponseInfo {
+struct CONTENT_EXPORT SyncLoadResponse {
   SyncLoadResponse();
+  SyncLoadResponse(SyncLoadResponse&& other);
   ~SyncLoadResponse();
 
+  SyncLoadResponse& operator=(SyncLoadResponse&& other);
+
+  ResourceResponseInfo info;
+
   // The response error code.
-  int error_code = 0;
+  int error_code;
 
   // Optional CORS error details.
   base::Optional<network::mojom::CORSError> cors_error;
@@ -33,6 +39,10 @@
 
   // The response data.
   std::string data;
+
+  // Used for blob response type XMLHttpRequest.
+  base::Optional<int64_t> downloaded_file_length;
+  mojom::DownloadedTempFilePtr downloaded_tmp_file;
 };
 
 }  // namespace content

diff --git a/content/renderer/loader/url_loader_client_impl.cc b/content/renderer/loader/url_loader_client_impl.cc
index 5d756db..71f46ef 100644
--- a/content/renderer/loader/url_loader_client_impl.cc
+++ b/content/renderer/loader/url_loader_client_impl.cc

@@ -319,6 +319,10 @@
   body_consumer_->OnComplete(status);
 }
 
+mojom::DownloadedTempFilePtr URLLoaderClientImpl::TakeDownloadedTempFile() {
+  return std::move(downloaded_file_);
+}
+
 bool URLLoaderClientImpl::NeedsStoringMessage() const {
   return is_deferred_ || deferred_messages_.size() > 0;
 }

diff --git a/content/renderer/loader/url_loader_client_impl.h b/content/renderer/loader/url_loader_client_impl.h
index 26ce1d2..54625ce2 100644
--- a/content/renderer/loader/url_loader_client_impl.h
+++ b/content/renderer/loader/url_loader_client_impl.h

@@ -73,6 +73,9 @@
       mojo::ScopedDataPipeConsumerHandle body) override;
   void OnComplete(const network::URLLoaderCompletionStatus& status) override;
 
+  // Takes |downloaded_file_|.
+  mojom::DownloadedTempFilePtr TakeDownloadedTempFile();
+
  private:
   class DeferredMessage;
   class DeferredOnReceiveResponse;

diff --git a/content/renderer/loader/web_url_loader_impl.cc b/content/renderer/loader/web_url_loader_impl.cc
index 7d564b18..538a8e06 100644
--- a/content/renderer/loader/web_url_loader_impl.cc
+++ b/content/renderer/loader/web_url_loader_impl.cc

@@ -569,7 +569,7 @@
       // This is a sync load. Do the work now.
       sync_load_response->url = url_;
       sync_load_response->error_code =
-          GetInfoFromDataURL(sync_load_response->url, sync_load_response,
+          GetInfoFromDataURL(sync_load_response->url, &sync_load_response->info,
                              &sync_load_response->data);
     } else {
       task_runner_->PostTask(FROM_HERE,
@@ -693,7 +693,7 @@
         std::move(resource_request), request.RequestorID(),
         extra_data->frame_origin(), GetTrafficAnnotationTag(request),
         sync_load_response, request.GetLoadingIPCType(), url_loader_factory_,
-        extra_data->TakeURLLoaderThrottles());
+        extra_data->TakeURLLoaderThrottles(), request.TimeoutInterval());
     return;
   }
 
@@ -1242,12 +1242,14 @@
   }
 }
 
-void WebURLLoaderImpl::LoadSynchronously(const WebURLRequest& request,
-                                         WebURLResponse& response,
-                                         base::Optional<WebURLError>& error,
-                                         WebData& data,
-                                         int64_t& encoded_data_length,
-                                         int64_t& encoded_body_length) {
+void WebURLLoaderImpl::LoadSynchronously(
+    const WebURLRequest& request,
+    WebURLResponse& response,
+    base::Optional<WebURLError>& error,
+    WebData& data,
+    int64_t& encoded_data_length,
+    int64_t& encoded_body_length,
+    base::Optional<int64_t>& downloaded_file_length) {
   TRACE_EVENT0("loading", "WebURLLoaderImpl::loadSynchronously");
   SyncLoadResponse sync_load_response;
   context_->Start(request, &sync_load_response);
@@ -1276,10 +1278,11 @@
     return;
   }
 
-  PopulateURLResponse(final_url, sync_load_response, &response,
+  PopulateURLResponse(final_url, sync_load_response.info, &response,
                       request.ReportRawHeaders());
-  encoded_data_length = sync_load_response.encoded_data_length;
-  encoded_body_length = sync_load_response.encoded_body_length;
+  encoded_data_length = sync_load_response.info.encoded_data_length;
+  encoded_body_length = sync_load_response.info.encoded_body_length;
+  downloaded_file_length = sync_load_response.downloaded_file_length;
 
   data.Assign(sync_load_response.data.data(), sync_load_response.data.size());
 }

diff --git a/content/renderer/loader/web_url_loader_impl.h b/content/renderer/loader/web_url_loader_impl.h
index 3c049d6..530c2d7 100644
--- a/content/renderer/loader/web_url_loader_impl.h
+++ b/content/renderer/loader/web_url_loader_impl.h

@@ -91,12 +91,14 @@
                                   blink::WebURLResponse* response,
                                   bool report_security_info);
   // WebURLLoader methods:
-  void LoadSynchronously(const blink::WebURLRequest& request,
-                         blink::WebURLResponse& response,
-                         base::Optional<blink::WebURLError>& error,
-                         blink::WebData& data,
-                         int64_t& encoded_data_length,
-                         int64_t& encoded_body_length) override;
+  void LoadSynchronously(
+      const blink::WebURLRequest& request,
+      blink::WebURLResponse& response,
+      base::Optional<blink::WebURLError>& error,
+      blink::WebData& data,
+      int64_t& encoded_data_length,
+      int64_t& encoded_body_length,
+      base::Optional<int64_t>& downloaded_file_length) override;
   void LoadAsynchronously(const blink::WebURLRequest& request,
                           blink::WebURLLoaderClient* client) override;
   void Cancel() override;

diff --git a/content/renderer/loader/web_url_loader_impl_unittest.cc b/content/renderer/loader/web_url_loader_impl_unittest.cc
index f59565e79..07c4c1e8 100644
--- a/content/renderer/loader/web_url_loader_impl_unittest.cc
+++ b/content/renderer/loader/web_url_loader_impl_unittest.cc

@@ -73,16 +73,16 @@
 
   // TestDispatcher implementation:
 
-  void StartSync(
-      std::unique_ptr<ResourceRequest> request,
-      int routing_id,
-      const url::Origin& frame_origin,
-      const net::NetworkTrafficAnnotationTag& traffic_annotation,
-      SyncLoadResponse* response,
-      blink::WebURLRequest::LoadingIPCType ipc_type,
-      mojom::URLLoaderFactory* url_loader_factory,
-      std::vector<std::unique_ptr<URLLoaderThrottle>> throttles) override {
-    *response = sync_load_response_;
+  void StartSync(std::unique_ptr<ResourceRequest> request,
+                 int routing_id,
+                 const url::Origin& frame_origin,
+                 const net::NetworkTrafficAnnotationTag& traffic_annotation,
+                 SyncLoadResponse* response,
+                 blink::WebURLRequest::LoadingIPCType ipc_type,
+                 mojom::URLLoaderFactory* url_loader_factory,
+                 std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
+                 double timeout) override {
+    *response = std::move(sync_load_response_);
   }
 
   int StartAsync(
@@ -98,7 +98,7 @@
       std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
       mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints) override {
     EXPECT_FALSE(peer_);
-    if (sync_load_response_.encoded_body_length != -1)
+    if (sync_load_response_.info.encoded_body_length != -1)
       EXPECT_TRUE(is_sync);
     peer_ = std::move(peer);
     url_ = request->url;
@@ -123,8 +123,8 @@
   }
   bool defers_loading() const { return defers_loading_; }
 
-  void set_sync_load_response(const SyncLoadResponse& sync_load_response) {
-    sync_load_response_ = sync_load_response;
+  void set_sync_load_response(SyncLoadResponse&& sync_load_response) {
+    sync_load_response_ = std::move(sync_load_response);
   }
 
  private:
@@ -772,20 +772,23 @@
   sync_load_response.url = url;
   sync_load_response.data = kBodyData;
   ASSERT_EQ(17u, sync_load_response.data.size());
-  sync_load_response.encoded_body_length = kEncodedBodyLength;
-  sync_load_response.encoded_data_length = kEncodedDataLength;
-  dispatcher()->set_sync_load_response(sync_load_response);
+  sync_load_response.info.encoded_body_length = kEncodedBodyLength;
+  sync_load_response.info.encoded_data_length = kEncodedDataLength;
+  dispatcher()->set_sync_load_response(std::move(sync_load_response));
 
   blink::WebURLResponse response;
   base::Optional<blink::WebURLError> error;
   blink::WebData data;
   int64_t encoded_data_length = 0;
   int64_t encoded_body_length = 0;
+  base::Optional<int64_t> downloaded_file_length;
   client()->loader()->LoadSynchronously(
-      request, response, error, data, encoded_data_length, encoded_body_length);
+      request, response, error, data, encoded_data_length, encoded_body_length,
+      downloaded_file_length);
 
   EXPECT_EQ(kEncodedBodyLength, encoded_body_length);
   EXPECT_EQ(kEncodedDataLength, encoded_data_length);
+  EXPECT_FALSE(downloaded_file_length);
 }
 
 }  // namespace

diff --git a/content/renderer/media/audio_renderer_mixer_manager_unittest.cc b/content/renderer/media/audio_renderer_mixer_manager_unittest.cc
index 86c0c38c..396256bd 100644
--- a/content/renderer/media/audio_renderer_mixer_manager_unittest.cc
+++ b/content/renderer/media/audio_renderer_mixer_manager_unittest.cc

@@ -816,13 +816,8 @@
     EXPECT_EQ(44100, mixer->GetOutputParamsForTesting().sample_rate());
   }
 
-#if defined(OS_ANDROID)
-  // If hardware buffer size (128) is less than 1024, use 2048.
-  EXPECT_EQ(2048, mixer->GetOutputParamsForTesting().frames_per_buffer());
-#else
   // Expect hardware buffer size.
   EXPECT_EQ(128, mixer->GetOutputParamsForTesting().frames_per_buffer());
-#endif
 
   ReturnMixer(mixer);
 }

diff --git a/content/renderer/media/media_stream_video_renderer_sink_unittest.cc b/content/renderer/media/media_stream_video_renderer_sink_unittest.cc
index af99cc1a61..bf36bb1 100644
--- a/content/renderer/media/media_stream_video_renderer_sink_unittest.cc
+++ b/content/renderer/media/media_stream_video_renderer_sink_unittest.cc

@@ -214,7 +214,7 @@
   }
 
   void VerifyTransparentFrame(scoped_refptr<media::VideoFrame> frame) {
-    EXPECT_EQ(media::PIXEL_FORMAT_YV12A, frame->format());
+    EXPECT_EQ(media::PIXEL_FORMAT_I420A, frame->format());
   }
 };
 
@@ -226,7 +226,7 @@
   const gfx::Size kSize(10, 10);
   const base::TimeDelta kTimestamp = base::TimeDelta();
   const scoped_refptr<media::VideoFrame> video_frame =
-      media::VideoFrame::CreateFrame(media::PIXEL_FORMAT_YV12A, kSize,
+      media::VideoFrame::CreateFrame(media::PIXEL_FORMAT_I420A, kSize,
                                      gfx::Rect(kSize), kSize, kTimestamp);
   OnVideoFrame(video_frame);
   base::RunLoop().RunUntilIdle();

diff --git a/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc b/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
index 96068a8..82327d6 100644
--- a/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
+++ b/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc

@@ -216,10 +216,8 @@
   EXPECT_EQ(webaudio_device_->SampleRate(), kHardwareSampleRate);
   EXPECT_EQ(webaudio_device_->FramesPerBuffer(), playbackBufferSize);
 
-#if !defined(OS_ANDROID)
   EXPECT_GE(playbackBufferSize, balancedBufferSize);
   EXPECT_GE(balancedBufferSize, interactiveBufferSize);
-#endif
 }
 
 }  // namespace content

diff --git a/content/renderer/media/webmediaplayer_ms_compositor.cc b/content/renderer/media/webmediaplayer_ms_compositor.cc
index c76a9e5..cb0c743 100644
--- a/content/renderer/media/webmediaplayer_ms_compositor.cc
+++ b/content/renderer/media/webmediaplayer_ms_compositor.cc

@@ -88,12 +88,12 @@
   } else {
     DCHECK(frame->IsMappable());
     DCHECK(frame->format() == media::PIXEL_FORMAT_YV12 ||
-           frame->format() == media::PIXEL_FORMAT_YV12A ||
+           frame->format() == media::PIXEL_FORMAT_I420A ||
            frame->format() == media::PIXEL_FORMAT_I420);
     const gfx::Size& coded_size = frame->coded_size();
     new_frame = media::VideoFrame::CreateFrame(
         media::IsOpaque(frame->format()) ? media::PIXEL_FORMAT_I420
-                                         : media::PIXEL_FORMAT_YV12A,
+                                         : media::PIXEL_FORMAT_I420A,
         coded_size, frame->visible_rect(), frame->natural_size(),
         frame->timestamp());
     libyuv::I420Copy(frame->data(media::VideoFrame::kYPlane),
@@ -109,7 +109,7 @@
                      new_frame->data(media::VideoFrame::kVPlane),
                      new_frame->stride(media::VideoFrame::kVPlane),
                      coded_size.width(), coded_size.height());
-    if (frame->format() == media::PIXEL_FORMAT_YV12A) {
+    if (frame->format() == media::PIXEL_FORMAT_I420A) {
       libyuv::CopyPlane(frame->data(media::VideoFrame::kAPlane),
                         frame->stride(media::VideoFrame::kAPlane),
                         new_frame->data(media::VideoFrame::kAPlane),

diff --git a/content/renderer/media/webmediaplayer_ms_unittest.cc b/content/renderer/media/webmediaplayer_ms_unittest.cc
index eb3f386..f05227e 100644
--- a/content/renderer/media/webmediaplayer_ms_unittest.cc
+++ b/content/renderer/media/webmediaplayer_ms_unittest.cc

@@ -291,7 +291,7 @@
       }
 
       auto frame = media::VideoFrame::CreateZeroInitializedFrame(
-          opaque_frame ? media::PIXEL_FORMAT_YV12 : media::PIXEL_FORMAT_YV12A,
+          opaque_frame ? media::PIXEL_FORMAT_YV12 : media::PIXEL_FORMAT_I420A,
           frame_size, gfx::Rect(frame_size), frame_size,
           base::TimeDelta::FromMilliseconds(token));
 

diff --git a/content/renderer/media/webrtc/media_stream_remote_video_source.cc b/content/renderer/media/webrtc/media_stream_remote_video_source.cc
index ffdc31d..482f7b3 100644
--- a/content/renderer/media/webrtc/media_stream_remote_video_source.cc
+++ b/content/renderer/media/webrtc/media_stream_remote_video_source.cc

@@ -127,7 +127,7 @@
     if (has_alpha) {
       const webrtc::I420ABufferInterface* yuva_buffer = buffer->GetI420A();
       video_frame = media::VideoFrame::WrapExternalYuvaData(
-          media::PIXEL_FORMAT_YV12A, size, gfx::Rect(size), size,
+          media::PIXEL_FORMAT_I420A, size, gfx::Rect(size), size,
           yuva_buffer->StrideY(), yuva_buffer->StrideU(),
           yuva_buffer->StrideV(), yuva_buffer->StrideA(),
           const_cast<uint8_t*>(yuva_buffer->DataY()),

diff --git a/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc b/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc
index 9de5210..cbcbaa82 100644
--- a/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc
+++ b/content/renderer/media/webrtc/webrtc_video_capturer_adapter.cc

@@ -169,7 +169,7 @@
   if (!(input_frame->IsMappable() &&
         (input_frame->format() == media::PIXEL_FORMAT_I420 ||
          input_frame->format() == media::PIXEL_FORMAT_YV12 ||
-         input_frame->format() == media::PIXEL_FORMAT_YV12A)) &&
+         input_frame->format() == media::PIXEL_FORMAT_I420A)) &&
       !input_frame->HasTextures()) {
     // Since connecting sources and sinks do not check the format, we need to
     // just ignore formats that we can not handle.
@@ -243,10 +243,10 @@
   }
 
   // We need to scale the frame before we hand it over to webrtc.
-  const bool has_alpha = video_frame->format() == media::PIXEL_FORMAT_YV12A;
+  const bool has_alpha = video_frame->format() == media::PIXEL_FORMAT_I420A;
   scoped_refptr<media::VideoFrame> scaled_frame =
       scaled_frame_pool_.CreateFrame(
-          has_alpha ? media::PIXEL_FORMAT_YV12A : media::PIXEL_FORMAT_I420,
+          has_alpha ? media::PIXEL_FORMAT_I420A : media::PIXEL_FORMAT_I420,
           adapted_size, gfx::Rect(adapted_size), adapted_size,
           frame->timestamp());
   libyuv::I420Scale(video_frame->visible_data(media::VideoFrame::kYPlane),

diff --git a/content/renderer/media/webrtc/webrtc_video_frame_adapter.cc b/content/renderer/media/webrtc/webrtc_video_frame_adapter.cc
index f49629b..d625d84 100644
--- a/content/renderer/media/webrtc/webrtc_video_frame_adapter.cc
+++ b/content/renderer/media/webrtc/webrtc_video_frame_adapter.cc

@@ -73,7 +73,7 @@
       frame->visible_rect(), frame->natural_size()));
   DCHECK(media::PIXEL_FORMAT_I420 == frame->format() ||
          media::PIXEL_FORMAT_YV12 == frame->format() ||
-         media::PIXEL_FORMAT_YV12A == frame->format());
+         media::PIXEL_FORMAT_I420A == frame->format());
   CHECK(reinterpret_cast<void*>(frame->data(media::VideoFrame::kYPlane)));
   CHECK(reinterpret_cast<void*>(frame->data(media::VideoFrame::kUPlane)));
   CHECK(reinterpret_cast<void*>(frame->data(media::VideoFrame::kVPlane)));
@@ -122,7 +122,7 @@
   }
 
   IsValidFrame(frame_);
-  if (media::PIXEL_FORMAT_YV12A == frame_->format()) {
+  if (media::PIXEL_FORMAT_I420A == frame_->format()) {
     return new rtc::RefCountedObject<
         FrameAdapterWithA<webrtc::I420ABufferInterface>>(frame_);
   }

diff --git a/content/renderer/media_capture_from_element/canvas_capture_handler.cc b/content/renderer/media_capture_from_element/canvas_capture_handler.cc
index 8cbf497..5274cea 100644
--- a/content/renderer/media_capture_from_element/canvas_capture_handler.cc
+++ b/content/renderer/media_capture_from_element/canvas_capture_handler.cc

@@ -54,7 +54,7 @@
     formats.push_back(media::VideoCaptureFormat(size_, frame_rate_,
                                                 media::PIXEL_FORMAT_I420));
     formats.push_back(media::VideoCaptureFormat(size_, frame_rate_,
-                                                media::PIXEL_FORMAT_YV12A));
+                                                media::PIXEL_FORMAT_I420A));
     return formats;
   }
   void StartCapture(const media::VideoCaptureParams& params,
@@ -385,7 +385,7 @@
   TRACE_EVENT0("webrtc", "CanvasCaptureHandler::ConvertToYUVFrame");
 
   scoped_refptr<VideoFrame> video_frame = frame_pool_.CreateFrame(
-      is_opaque ? media::PIXEL_FORMAT_I420 : media::PIXEL_FORMAT_YV12A,
+      is_opaque ? media::PIXEL_FORMAT_I420 : media::PIXEL_FORMAT_I420A,
       image_size, gfx::Rect(image_size), image_size, base::TimeDelta());
   if (!video_frame) {
     DLOG(ERROR) << "Couldn't allocate video frame";

diff --git a/content/renderer/media_capture_from_element/canvas_capture_handler_unittest.cc b/content/renderer/media_capture_from_element/canvas_capture_handler_unittest.cc
index ef92120..1513dd8 100644
--- a/content/renderer/media_capture_from_element/canvas_capture_handler_unittest.cc
+++ b/content/renderer/media_capture_from_element/canvas_capture_handler_unittest.cc

@@ -96,7 +96,7 @@
     if (opaque)
       EXPECT_EQ(media::PIXEL_FORMAT_I420, video_frame->format());
     else
-      EXPECT_EQ(media::PIXEL_FORMAT_YV12A, video_frame->format());
+      EXPECT_EQ(media::PIXEL_FORMAT_I420A, video_frame->format());
 
     const gfx::Size& size = video_frame->visible_rect().size();
     EXPECT_EQ(expected_width, size.width());

diff --git a/content/renderer/media_recorder/video_track_recorder.cc b/content/renderer/media_recorder/video_track_recorder.cc
index da7f868..880b3cf 100644
--- a/content/renderer/media_recorder/video_track_recorder.cc
+++ b/content/renderer/media_recorder/video_track_recorder.cc

@@ -203,7 +203,7 @@
   if (!(video_frame->format() == media::PIXEL_FORMAT_I420 ||
         video_frame->format() == media::PIXEL_FORMAT_YV12 ||
         video_frame->format() == media::PIXEL_FORMAT_ARGB ||
-        video_frame->format() == media::PIXEL_FORMAT_YV12A ||
+        video_frame->format() == media::PIXEL_FORMAT_I420A ||
         video_frame->format() == media::PIXEL_FORMAT_NV12)) {
     NOTREACHED() << media::VideoPixelFormatToString(video_frame->format());
     return;
@@ -224,7 +224,7 @@
   scoped_refptr<media::VideoFrame> wrapped_frame;
   // Drop alpha channel if the encoder does not support it yet.
   if (!CanEncodeAlphaChannel() &&
-      video_frame->format() == media::PIXEL_FORMAT_YV12A) {
+      video_frame->format() == media::PIXEL_FORMAT_I420A) {
     wrapped_frame = media::WrapAsI420VideoFrame(video_frame);
   } else {
     wrapped_frame = media::VideoFrame::WrapVideoFrame(

diff --git a/content/renderer/media_recorder/vpx_encoder.cc b/content/renderer/media_recorder/vpx_encoder.cc
index dcfcc05..56a9751 100644
--- a/content/renderer/media_recorder/vpx_encoder.cc
+++ b/content/renderer/media_recorder/vpx_encoder.cc

@@ -78,7 +78,7 @@
     ConfigureEncoderOnEncodingTaskRunner(frame_size, &codec_config_, &encoder_);
   }
 
-  const bool frame_has_alpha = frame->format() == media::PIXEL_FORMAT_YV12A;
+  const bool frame_has_alpha = frame->format() == media::PIXEL_FORMAT_I420A;
   // Split the duration between two encoder instances if alpha is encoded.
   duration = frame_has_alpha ? duration / 2 : duration;
   if (frame_has_alpha && (!IsInitialized(alpha_codec_config_) ||

diff --git a/content/renderer/pepper/pepper_media_stream_video_track_host.cc b/content/renderer/pepper/pepper_media_stream_video_track_host.cc
index 1872e6c..b66b60c 100644
--- a/content/renderer/pepper/pepper_media_stream_video_track_host.cc
+++ b/content/renderer/pepper/pepper_media_stream_video_track_host.cc

@@ -369,7 +369,7 @@
   // TODO(penghuang): Check |frame->end_of_stream()| and close the track.
   scoped_refptr<media::VideoFrame> frame = video_frame;
   // Drop alpha channel since we do not support it yet.
-  if (frame->format() == media::PIXEL_FORMAT_YV12A)
+  if (frame->format() == media::PIXEL_FORMAT_I420A)
     frame = media::WrapAsI420VideoFrame(video_frame);
   PP_VideoFrame_Format ppformat = ToPpapiFormat(frame->format());
   if (ppformat == PP_VIDEOFRAME_FORMAT_UNKNOWN)

diff --git a/content/renderer/pepper/pepper_video_source_host.cc b/content/renderer/pepper/pepper_video_source_host.cc
index ea38aa9..c67401f 100644
--- a/content/renderer/pepper/pepper_video_source_host.cc
+++ b/content/renderer/pepper/pepper_video_source_host.cc

@@ -62,13 +62,13 @@
     return;
 
   if (!(video_frame->format() == media::PIXEL_FORMAT_I420 ||
-        video_frame->format() == media::PIXEL_FORMAT_YV12A)) {
+        video_frame->format() == media::PIXEL_FORMAT_I420A)) {
     NOTREACHED();
     return;
   }
   scoped_refptr<media::VideoFrame> frame = video_frame;
   // Drop alpha channel since we do not support it yet.
-  if (frame->format() == media::PIXEL_FORMAT_YV12A)
+  if (frame->format() == media::PIXEL_FORMAT_I420A)
     frame = media::WrapAsI420VideoFrame(video_frame);
 
   // Hold a reference to the new frame and release the previous.

diff --git a/content/renderer/pepper/video_decoder_shim.cc b/content/renderer/pepper/video_decoder_shim.cc
index d0310969..8cf16fb 100644
--- a/content/renderer/pepper/video_decoder_shim.cc
+++ b/content/renderer/pepper/video_decoder_shim.cc

@@ -411,7 +411,7 @@
 
     switch (frame->format()) {
       case media::PIXEL_FORMAT_YV12:  // 420
-      case media::PIXEL_FORMAT_YV12A:
+      case media::PIXEL_FORMAT_I420A:
       case media::PIXEL_FORMAT_I420:
         uv_height_divisor_ = 2;
         uv_width_divisor_ = 2;
@@ -465,7 +465,7 @@
                     format_, GL_UNSIGNED_BYTE,
                     frame->data(media::VideoFrame::kYPlane));
 
-    if (video_format_ == media::PIXEL_FORMAT_YV12A) {
+    if (video_format_ == media::PIXEL_FORMAT_I420A) {
       DCHECK_EQ(frame->stride(media::VideoFrame::kYPlane),
                 frame->stride(media::VideoFrame::kAPlane));
       gl_->ActiveTexture(GL_TEXTURE3);
@@ -505,7 +505,7 @@
                        GL_UNSIGNED_BYTE,
                        frame->data(media::VideoFrame::kYPlane));
 
-    if (video_format_ == media::PIXEL_FORMAT_YV12A) {
+    if (video_format_ == media::PIXEL_FORMAT_I420A) {
       DCHECK_EQ(frame->stride(media::VideoFrame::kYPlane),
                 frame->stride(media::VideoFrame::kAPlane));
       gl_->ActiveTexture(GL_TEXTURE3);

diff --git a/content/renderer/service_worker/service_worker_fetch_context_impl.cc b/content/renderer/service_worker/service_worker_fetch_context_impl.cc
index 2e0afc7..f22b82e 100644
--- a/content/renderer/service_worker/service_worker_fetch_context_impl.cc
+++ b/content/renderer/service_worker/service_worker_fetch_context_impl.cc

@@ -19,14 +19,24 @@
     : worker_script_url_(worker_script_url),
       url_loader_factory_getter_info_(
           std::move(url_loader_factory_getter_info)),
-      service_worker_provider_id_(service_worker_provider_id) {}
+      service_worker_provider_id_(service_worker_provider_id),
+      terminate_sync_load_event_(
+          base::WaitableEvent::ResetPolicy::MANUAL,
+          base::WaitableEvent::InitialState::NOT_SIGNALED) {}
 
 ServiceWorkerFetchContextImpl::~ServiceWorkerFetchContextImpl() {}
 
+base::WaitableEvent*
+ServiceWorkerFetchContextImpl::GetTerminateSyncLoadEvent() {
+  return &terminate_sync_load_event_;
+}
+
 void ServiceWorkerFetchContextImpl::InitializeOnWorkerThread(
     scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner) {
   resource_dispatcher_ = std::make_unique<ResourceDispatcher>(
       nullptr, std::move(loading_task_runner));
+  resource_dispatcher_->set_terminate_sync_load_event(
+      &terminate_sync_load_event_);
 
   url_loader_factory_getter_ = url_loader_factory_getter_info_.Bind();
 }

diff --git a/content/renderer/service_worker/service_worker_fetch_context_impl.h b/content/renderer/service_worker/service_worker_fetch_context_impl.h
index 58b9450..2a17cdb 100644
--- a/content/renderer/service_worker/service_worker_fetch_context_impl.h
+++ b/content/renderer/service_worker/service_worker_fetch_context_impl.h

@@ -26,6 +26,7 @@
   ~ServiceWorkerFetchContextImpl() override;
 
   // blink::WebWorkerFetchContext implementation:
+  base::WaitableEvent* GetTerminateSyncLoadEvent() override;
   void InitializeOnWorkerThread(
       scoped_refptr<base::SingleThreadTaskRunner>) override;
   std::unique_ptr<blink::WebURLLoaderFactory> CreateURLLoaderFactory() override;
@@ -42,6 +43,8 @@
   // Initialized on the worker thread when InitializeOnWorkerThread() is called.
   std::unique_ptr<ResourceDispatcher> resource_dispatcher_;
   scoped_refptr<ChildURLLoaderFactoryGetter> url_loader_factory_getter_;
+
+  base::WaitableEvent terminate_sync_load_event_;
 };
 
 }  // namespace content

diff --git a/content/renderer/service_worker/service_worker_subresource_loader.cc b/content/renderer/service_worker/service_worker_subresource_loader.cc
index a1512c0..bae87a0 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader.cc
+++ b/content/renderer/service_worker/service_worker_subresource_loader.cc

@@ -463,6 +463,10 @@
   StartRequest(resource_request_);
 }
 
+void ServiceWorkerSubresourceLoader::ProceedWithResponse() {
+  NOTREACHED();
+}
+
 void ServiceWorkerSubresourceLoader::SetPriority(net::RequestPriority priority,
                                                  int intra_priority_value) {
   // Not supported (do nothing).

diff --git a/content/renderer/service_worker/service_worker_subresource_loader.h b/content/renderer/service_worker/service_worker_subresource_loader.h
index 1e4f217b..8263e76a 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader.h
+++ b/content/renderer/service_worker/service_worker_subresource_loader.h

@@ -84,6 +84,7 @@
 
   // mojom::URLLoader overrides:
   void FollowRedirect() override;
+  void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;

diff --git a/content/renderer/service_worker/worker_fetch_context_impl.cc b/content/renderer/service_worker/worker_fetch_context_impl.cc
index 5ff6dc6..c42e3d1 100644
--- a/content/renderer/service_worker/worker_fetch_context_impl.cc
+++ b/content/renderer/service_worker/worker_fetch_context_impl.cc

@@ -103,7 +103,10 @@
           std::move(service_worker_container_host_info)),
       url_loader_factory_getter_info_(
           std::move(url_loader_factory_getter_info)),
-      thread_safe_sender_(ChildThreadImpl::current()->thread_safe_sender()) {
+      thread_safe_sender_(ChildThreadImpl::current()->thread_safe_sender()),
+      terminate_sync_load_event_(
+          base::WaitableEvent::ResetPolicy::MANUAL,
+          base::WaitableEvent::InitialState::NOT_SIGNALED) {
   if (ServiceWorkerUtils::IsServicificationEnabled()) {
     ChildThreadImpl::current()->GetConnector()->BindInterface(
         mojom::kBrowserServiceName,
@@ -113,6 +116,10 @@
 
 WorkerFetchContextImpl::~WorkerFetchContextImpl() {}
 
+base::WaitableEvent* WorkerFetchContextImpl::GetTerminateSyncLoadEvent() {
+  return &terminate_sync_load_event_;
+}
+
 void WorkerFetchContextImpl::InitializeOnWorkerThread(
     scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner) {
   DCHECK(loading_task_runner->RunsTasksInCurrentSequence());
@@ -120,6 +127,8 @@
   DCHECK(!binding_.is_bound());
   resource_dispatcher_ = std::make_unique<ResourceDispatcher>(
       nullptr, std::move(loading_task_runner));
+  resource_dispatcher_->set_terminate_sync_load_event(
+      &terminate_sync_load_event_);
 
   url_loader_factory_getter_ = url_loader_factory_getter_info_.Bind();
   if (service_worker_client_request_.is_pending())

diff --git a/content/renderer/service_worker/worker_fetch_context_impl.h b/content/renderer/service_worker/worker_fetch_context_impl.h
index 1464eba4..c57e4936 100644
--- a/content/renderer/service_worker/worker_fetch_context_impl.h
+++ b/content/renderer/service_worker/worker_fetch_context_impl.h

@@ -5,6 +5,7 @@
 #ifndef CONTENT_RENDERER_SERVICE_WORKER_WORKER_FETCH_CONTEXT_IMPL_H_
 #define CONTENT_RENDERER_SERVICE_WORKER_WORKER_FETCH_CONTEXT_IMPL_H_
 
+#include "base/synchronization/waitable_event.h"
 #include "content/common/service_worker/service_worker_provider.mojom.h"
 #include "content/common/service_worker/service_worker_types.h"
 #include "content/public/common/service_worker_modes.h"
@@ -46,6 +47,7 @@
   ~WorkerFetchContextImpl() override;
 
   // blink::WebWorkerFetchContext implementation:
+  base::WaitableEvent* GetTerminateSyncLoadEvent() override;
   void InitializeOnWorkerThread(
       scoped_refptr<base::SingleThreadTaskRunner>) override;
   std::unique_ptr<blink::WebURLLoaderFactory> CreateURLLoaderFactory() override;
@@ -134,6 +136,8 @@
   GURL origin_url_;
   int appcache_host_id_ = blink::WebApplicationCacheHost::kAppCacheNoHostId;
 
+  base::WaitableEvent terminate_sync_load_event_;
+
   // A weak ptr to blink::WebURLLoaderFactory which was created and passed to
   // Blink by CreateURLLoaderFactory().
   base::WeakPtr<URLLoaderFactoryImpl> url_loader_factory_;

diff --git a/content/shell/renderer/layout_test/blink_test_runner.cc b/content/shell/renderer/layout_test/blink_test_runner.cc
index 193908c6..d49cf323 100644
--- a/content/shell/renderer/layout_test/blink_test_runner.cc
+++ b/content/shell/renderer/layout_test/blink_test_runner.cc

@@ -73,7 +73,6 @@
 #include "third_party/WebKit/public/platform/WebSize.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebThread.h"
-#include "third_party/WebKit/public/platform/WebTraceLocation.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/platform/WebURLError.h"
 #include "third_party/WebKit/public/platform/WebURLRequest.h"
@@ -116,7 +115,6 @@
 using blink::WebURLError;
 using blink::WebURLRequest;
 using blink::WebTestingSupport;
-using blink::WebTraceLocation;
 using blink::WebThread;
 using blink::WebVector;
 using blink::WebView;

diff --git a/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc b/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc
index 96b3648..0891b64 100644
--- a/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc
+++ b/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc

@@ -24,7 +24,6 @@
 #include "content/shell/renderer/layout_test/layout_test_render_thread_observer.h"
 #include "content/shell/renderer/layout_test/test_media_stream_renderer_factory.h"
 #include "content/shell/renderer/shell_render_view_observer.h"
-#include "content/shell/test_runner/mock_credential_manager_client.h"
 #include "content/shell/test_runner/web_frame_test_proxy.h"
 #include "content/shell/test_runner/web_test_interfaces.h"
 #include "content/shell/test_runner/web_test_runner.h"
@@ -166,11 +165,6 @@
 
   BlinkTestRunner* test_runner = BlinkTestRunner::Get(render_view);
   test_runner->Reset(false /* for_new_test */);
-
-  LayoutTestRenderThreadObserver::GetInstance()
-      ->test_interfaces()
-      ->TestRunner()
-      ->InitializeWebViewWithMocks(render_view->GetWebView());
 }
 
 std::unique_ptr<WebMIDIAccessor>

diff --git a/content/shell/test_runner/BUILD.gn b/content/shell/test_runner/BUILD.gn
index e319dda..5bb641e3 100644
--- a/content/shell/test_runner/BUILD.gn
+++ b/content/shell/test_runner/BUILD.gn

@@ -32,8 +32,6 @@
     "layout_test_runtime_flags.h",
     "mock_content_settings_client.cc",
     "mock_content_settings_client.h",
-    "mock_credential_manager_client.cc",
-    "mock_credential_manager_client.h",
     "mock_grammar_check.cc",
     "mock_grammar_check.h",
     "mock_screen_orientation_client.cc",

diff --git a/content/shell/test_runner/mock_credential_manager_client.cc b/content/shell/test_runner/mock_credential_manager_client.cc
deleted file mode 100644
index 329c73e..0000000
--- a/content/shell/test_runner/mock_credential_manager_client.cc
+++ /dev/null

@@ -1,60 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/shell/test_runner/mock_credential_manager_client.h"
-
-#include <memory>
-#include <utility>
-
-#include "third_party/WebKit/public/platform/WebCredential.h"
-
-namespace test_runner {
-
-MockCredentialManagerClient::MockCredentialManagerClient()
-    : error_(blink::kWebCredentialManagerNoError) {}
-
-MockCredentialManagerClient::~MockCredentialManagerClient() {}
-
-void MockCredentialManagerClient::SetResponse(
-    blink::WebCredential* credential) {
-  credential_.reset(credential);
-}
-
-void MockCredentialManagerClient::SetError(const std::string& error) {
-  if (error == "pending")
-    error_ = blink::kWebCredentialManagerPendingRequestError;
-  if (error == "disabled")
-    error_ = blink::kWebCredentialManagerDisabledError;
-  if (error == "unknown")
-    error_ = blink::kWebCredentialManagerUnknownError;
-  if (error.empty())
-    error_ = blink::kWebCredentialManagerNoError;
-}
-
-void MockCredentialManagerClient::DispatchStore(
-    const blink::WebCredential&,
-    blink::WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  callbacks->OnSuccess();
-  delete callbacks;
-}
-
-void MockCredentialManagerClient::DispatchPreventSilentAccess(
-    NotificationCallbacks* callbacks) {
-  callbacks->OnSuccess();
-  delete callbacks;
-}
-
-void MockCredentialManagerClient::DispatchGet(
-    blink::WebCredentialMediationRequirement mediation,
-    bool include_passwords,
-    const blink::WebVector<blink::WebURL>& federations,
-    RequestCallbacks* callbacks) {
-  if (error_ != blink::kWebCredentialManagerNoError)
-    callbacks->OnError(error_);
-  else
-    callbacks->OnSuccess(std::move(credential_));
-  delete callbacks;
-}
-
-}  // namespace test_runner

diff --git a/content/shell/test_runner/mock_credential_manager_client.h b/content/shell/test_runner/mock_credential_manager_client.h
deleted file mode 100644
index f843616..0000000
--- a/content/shell/test_runner/mock_credential_manager_client.h
+++ /dev/null

@@ -1,49 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_SHELL_TEST_RUNNER_MOCK_CREDENTIAL_MANAGER_CLIENT_H_
-#define CONTENT_SHELL_TEST_RUNNER_MOCK_CREDENTIAL_MANAGER_CLIENT_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerClient.h"
-#include "third_party/WebKit/public/platform/WebCredentialManagerError.h"
-#include "third_party/WebKit/public/platform/WebCredentialMediationRequirement.h"
-#include "third_party/WebKit/public/platform/WebVector.h"
-
-namespace blink {
-class WebURL;
-}
-
-namespace test_runner {
-
-class MockCredentialManagerClient : public blink::WebCredentialManagerClient {
- public:
-  MockCredentialManagerClient();
-  ~MockCredentialManagerClient() override;
-
-  // We take ownership of the |credential|.
-  void SetResponse(blink::WebCredential* credential);
-  void SetError(const std::string& error);
-
-  // blink::WebCredentialManager:
-  void DispatchStore(const blink::WebCredential& credential,
-                     NotificationCallbacks* callbacks) override;
-  void DispatchPreventSilentAccess(NotificationCallbacks* callbacks) override;
-  void DispatchGet(blink::WebCredentialMediationRequirement mediation,
-                   bool include_passwords,
-                   const blink::WebVector<blink::WebURL>& federations,
-                   RequestCallbacks* callbacks) override;
-
- private:
-  std::unique_ptr<blink::WebCredential> credential_;
-  blink::WebCredentialManagerError error_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockCredentialManagerClient);
-};
-
-}  // namespace test_runner
-
-#endif  // CONTENT_SHELL_TEST_RUNNER_MOCK_CREDENTIAL_MANAGER_CLIENT_H_

diff --git a/content/shell/test_runner/test_plugin.cc b/content/shell/test_runner/test_plugin.cc
index c0556f3..ae91b930 100644
--- a/content/shell/test_runner/test_plugin.cc
+++ b/content/shell/test_runner/test_plugin.cc

@@ -29,7 +29,6 @@
 #include "third_party/WebKit/public/platform/WebThread.h"
 #include "third_party/WebKit/public/platform/WebTouchEvent.h"
 #include "third_party/WebKit/public/platform/WebTouchPoint.h"
-#include "third_party/WebKit/public/platform/WebTraceLocation.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebPluginParams.h"

diff --git a/content/shell/test_runner/test_runner.cc b/content/shell/test_runner/test_runner.cc
index 9c5b4e9..b1dcb52 100644
--- a/content/shell/test_runner/test_runner.cc
+++ b/content/shell/test_runner/test_runner.cc

@@ -21,7 +21,6 @@
 #include "content/shell/test_runner/layout_and_paint_async_then.h"
 #include "content/shell/test_runner/layout_dump.h"
 #include "content/shell/test_runner/mock_content_settings_client.h"
-#include "content/shell/test_runner/mock_credential_manager_client.h"
 #include "content/shell/test_runner/mock_screen_orientation_client.h"
 #include "content/shell/test_runner/mock_web_document_subresource_filter.h"
 #include "content/shell/test_runner/mock_web_speech_recognizer.h"
@@ -42,7 +41,6 @@
 #include "gin/wrappable.h"
 #include "third_party/WebKit/public/platform/WebCanvas.h"
 #include "third_party/WebKit/public/platform/WebData.h"
-#include "third_party/WebKit/public/platform/WebPasswordCredential.h"
 #include "third_party/WebKit/public/platform/WebPoint.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistration.h"
@@ -260,12 +258,6 @@
   void WaitForPolicyDelegate();
   void WaitUntilDone();
   void WaitUntilExternalURLLoad();
-  void SetMockCredentialManagerError(const std::string& error);
-  void SetMockCredentialManagerResponse(const std::string& id,
-                                        const std::string& name,
-                                        const std::string& avatar,
-                                        const std::string& password);
-  void ClearMockCredentialManagerResponse();
   bool CallShouldCloseOnWebView();
   bool DisableAutoResizeMode(int new_width, int new_height);
   bool EnableAutoResizeMode(int min_width,
@@ -365,12 +357,6 @@
   return gin::Wrappable<TestRunnerBindings>::GetObjectTemplateBuilder(isolate)
       .SetMethod("abortModal", &TestRunnerBindings::NotImplemented)
       .SetMethod("addDisallowedURL", &TestRunnerBindings::NotImplemented)
-      .SetMethod("setMockCredentialManagerError",
-                 &TestRunnerBindings::SetMockCredentialManagerError)
-      .SetMethod("setMockCredentialManagerResponse",
-                 &TestRunnerBindings::SetMockCredentialManagerResponse)
-      .SetMethod("clearMockCredentialManagerResponse",
-                 &TestRunnerBindings::ClearMockCredentialManagerResponse)
       .SetMethod("addMockSpeechRecognitionResult",
                  &TestRunnerBindings::AddMockSpeechRecognitionResult)
       .SetMethod("addOriginAccessWhitelistEntry",
@@ -1434,26 +1420,6 @@
     runner_->SetMockSpeechRecognitionError(error, message);
 }
 
-void TestRunnerBindings::SetMockCredentialManagerResponse(
-    const std::string& id,
-    const std::string& name,
-    const std::string& avatar,
-    const std::string& password) {
-  if (runner_)
-    runner_->SetMockCredentialManagerResponse(id, name, avatar, password);
-}
-
-void TestRunnerBindings::ClearMockCredentialManagerResponse() {
-  if (runner_)
-    runner_->ClearMockCredentialManagerResponse();
-}
-
-void TestRunnerBindings::SetMockCredentialManagerError(
-    const std::string& error) {
-  if (runner_)
-    runner_->SetMockCredentialManagerError(error);
-}
-
 void TestRunnerBindings::AddWebPageOverlay() {
   if (view_runner_)
     view_runner_->AddWebPageOverlay();
@@ -1634,7 +1600,6 @@
       main_view_(nullptr),
       mock_content_settings_client_(
           new MockContentSettingsClient(&layout_test_runtime_flags_)),
-      credential_manager_client_(new MockCredentialManagerClient),
       mock_screen_orientation_client_(new MockScreenOrientationClient),
       spellcheck_(new SpellCheckClient(this)),
       chooser_count_(0),
@@ -1905,10 +1870,6 @@
   return spellcheck_.get();
 }
 
-void TestRunner::InitializeWebViewWithMocks(blink::WebView* web_view) {
-  web_view->SetCredentialManagerClient(credential_manager_client_.get());
-}
-
 bool TestRunner::shouldDumpSpellCheckCallbacks() const {
   return layout_test_runtime_flags_.dump_spell_check_callbacks();
 }
@@ -2778,23 +2739,6 @@
                                          WebString::FromUTF8(message));
 }
 
-void TestRunner::SetMockCredentialManagerResponse(const std::string& id,
-                                                  const std::string& name,
-                                                  const std::string& avatar,
-                                                  const std::string& password) {
-  credential_manager_client_->SetResponse(new WebPasswordCredential(
-      WebString::FromUTF8(id), WebString::FromUTF8(password),
-      WebString::FromUTF8(name), WebURL(GURL(avatar))));
-}
-
-void TestRunner::ClearMockCredentialManagerResponse() {
-  credential_manager_client_->SetResponse(nullptr);
-}
-
-void TestRunner::SetMockCredentialManagerError(const std::string& error) {
-  credential_manager_client_->SetError(error);
-}
-
 void TestRunner::OnLayoutTestRuntimeFlagsChanged() {
   if (layout_test_runtime_flags_.tracked_dictionary().changed_values().empty())
     return;

diff --git a/content/shell/test_runner/test_runner.h b/content/shell/test_runner/test_runner.h
index 5dcb20b8..2a24b3d 100644
--- a/content/shell/test_runner/test_runner.h
+++ b/content/shell/test_runner/test_runner.h

@@ -44,7 +44,6 @@
 namespace test_runner {
 
 class MockContentSettingsClient;
-class MockCredentialManagerClient;
 class MockScreenOrientationClient;
 class MockWebSpeechRecognizer;
 class SpellCheckClient;
@@ -98,7 +97,6 @@
   bool ShouldDumpBackForwardList() const override;
   blink::WebContentSettingsClient* GetWebContentSettings() const override;
   blink::WebTextCheckClient* GetWebTextCheckClient() const override;
-  void InitializeWebViewWithMocks(blink::WebView* web_view) override;
   void SetFocus(blink::WebView* web_view, bool focus) override;
 
   // Methods used by WebViewTestClient and WebFrameTestClient.
@@ -538,16 +536,6 @@
   void SetMockSpeechRecognitionError(const std::string& error,
                                      const std::string& message);
 
-  // Credential Manager mock functions
-  // TODO(mkwst): Support FederatedCredential.
-  void SetMockCredentialManagerResponse(const std::string& id,
-                                        const std::string& name,
-                                        const std::string& avatar,
-                                        const std::string& password);
-  void ClearMockCredentialManagerResponse();
-
-  void SetMockCredentialManagerError(const std::string& error);
-
   // Takes care of notifying the delegate after a change to layout test runtime
   // flags.
   void OnLayoutTestRuntimeFlagsChanged();
@@ -620,7 +608,6 @@
 
   bool use_mock_theme_;
 
-  std::unique_ptr<MockCredentialManagerClient> credential_manager_client_;
   std::unique_ptr<MockScreenOrientationClient> mock_screen_orientation_client_;
   std::unique_ptr<MockWebSpeechRecognizer> speech_recognizer_;
   std::unique_ptr<SpellCheckClient> spellcheck_;

diff --git a/content/shell/test_runner/test_runner_for_specific_view.cc b/content/shell/test_runner/test_runner_for_specific_view.cc
index 800dfd2..169e768 100644
--- a/content/shell/test_runner/test_runner_for_specific_view.cc
+++ b/content/shell/test_runner/test_runner_for_specific_view.cc

@@ -16,7 +16,6 @@
 #include "content/shell/test_runner/layout_and_paint_async_then.h"
 #include "content/shell/test_runner/layout_dump.h"
 #include "content/shell/test_runner/mock_content_settings_client.h"
-#include "content/shell/test_runner/mock_credential_manager_client.h"
 #include "content/shell/test_runner/mock_screen_orientation_client.h"
 #include "content/shell/test_runner/mock_web_speech_recognizer.h"
 #include "content/shell/test_runner/pixel_dump.h"
@@ -37,7 +36,6 @@
 #include "third_party/WebKit/common/page/page_visibility_state.mojom.h"
 #include "third_party/WebKit/public/platform/WebCanvas.h"
 #include "third_party/WebKit/public/platform/WebData.h"
-#include "third_party/WebKit/public/platform/WebPasswordCredential.h"
 #include "third_party/WebKit/public/platform/WebPoint.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerRegistration.h"

diff --git a/content/shell/test_runner/web_test_runner.h b/content/shell/test_runner/web_test_runner.h
index 6efaec3..0648c15 100644
--- a/content/shell/test_runner/web_test_runner.h
+++ b/content/shell/test_runner/web_test_runner.h

@@ -78,13 +78,6 @@
   // capturing text results.
   virtual bool ShouldGeneratePixelResults() = 0;
 
-  // Sets various interfaces consumed by WebView to implementations providing
-  // test behavior.  This method covers interfaces that are not exposed via
-  // WebViewClient (and are covered by WebViewTestClient) - for example this
-  // method covers blink::WebCredentialManagerClient and
-  // blink::WebSpellCheckClient.
-  virtual void InitializeWebViewWithMocks(blink::WebView* web_view) = 0;
-
   // Sets focus on the given view.  Internally tracks currently focused view,
   // to aid in defocusing previously focused views at the right time.
   virtual void SetFocus(blink::WebView* web_view, bool focus) = 0;

diff --git a/docs/layout_tests_linux.md b/docs/layout_tests_linux.md
index f3dc85d..5b62e043 100644
--- a/docs/layout_tests_linux.md
+++ b/docs/layout_tests_linux.md

@@ -22,15 +22,12 @@
 
 ## Fonts
 
-1.  Make sure you have all the necessary fonts installed.
+1.  Make sure you have all the dependencies installed by running
 
 ```shell
-sudo apt-get install apache2 wdiff php5-cgi \
-   msttcorefonts fonts-ipafont ttf-thai-tlwg
+build/install-build-deps.sh
 ```
 
-You can also just run `build/install-build-deps.sh` again.
-
 2.  Double check that
 
 ```shell

diff --git a/ios/build/bots/OWNERS b/ios/build/bots/OWNERS
index bab986314..38ef20ff 100644
--- a/ios/build/bots/OWNERS
+++ b/ios/build/bots/OWNERS

@@ -1,7 +1,10 @@
 baxley@chromium.org
+huangml@chromium.org
+justincohen@chromium.org
 kkhorimoto@chromium.org
 rohitrao@chromium.org
 sdefresne@chromium.org
+sergeyberezin@chromium.org
 smut@google.com
 
 # TEAM: ios-directory-owners@chromium.org

diff --git a/ios/chrome/browser/about_flags.mm b/ios/chrome/browser/about_flags.mm
index aebbe8e..f38d8d6 100644
--- a/ios/chrome/browser/about_flags.mm
+++ b/ios/chrome/browser/about_flags.mm

@@ -20,7 +20,6 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/sys_info.h"
-#include "base/task_scheduler/switches.h"
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/dom_distiller/core/dom_distiller_switches.h"
 #include "components/feature_engagement/public/feature_constants.h"
@@ -110,10 +109,6 @@
 //
 // When adding a new choice, add it to the end of the list.
 const flags_ui::FeatureEntry kFeatureEntries[] = {
-    {"browser-task-scheduler", flag_descriptions::kBrowserTaskScheduler,
-     flag_descriptions::kBrowserTaskSchedulerDescription, flags_ui::kOsIos,
-     ENABLE_DISABLE_VALUE_TYPE(switches::kEnableBrowserTaskScheduler,
-                               switches::kDisableBrowserTaskScheduler)},
     {"mark-non-secure-as", flag_descriptions::kMarkHttpAsName,
      flag_descriptions::kMarkHttpAsDescription, flags_ui::kOsIos,
      MULTI_VALUE_TYPE(kMarkHttpAsChoices)},
@@ -301,10 +296,10 @@
 
 void ConvertFlagsToSwitches(flags_ui::FlagsStorage* flags_storage,
                             base::CommandLine* command_line) {
+  AppendSwitchesFromExperimentalSettings(command_line);
   FlagsStateSingleton::GetFlagsState()->ConvertFlagsToSwitches(
       flags_storage, command_line, flags_ui::kAddSentinels,
       switches::kEnableFeatures, switches::kDisableFeatures);
-  AppendSwitchesFromExperimentalSettings(command_line);
 }
 
 std::vector<std::string> RegisterAllFeatureVariationParameters(

diff --git a/ios/chrome/browser/passwords/credential_manager.mm b/ios/chrome/browser/passwords/credential_manager.mm
index 79863a0..7c7bd86 100644
--- a/ios/chrome/browser/passwords/credential_manager.mm
+++ b/ios/chrome/browser/passwords/credential_manager.mm

@@ -129,12 +129,7 @@
     case CredentialManagerError::SUCCESS:
       ResolveCredentialPromiseWithCredentialInfo(web_state_, promise_id, info);
       break;
-    case CredentialManagerError::DISABLED:
-      RejectCredentialPromiseWithInvalidStateError(
-          web_state_, promise_id,
-          base::ASCIIToUTF16("Credential Manager is disabled."));
-      break;
-    case CredentialManagerError::PENDINGREQUEST:
+    case CredentialManagerError::PENDING_REQUEST:
       RejectCredentialPromiseWithInvalidStateError(
           web_state_, promise_id,
           base::ASCIIToUTF16("Pending 'get()' request."));

diff --git a/ios/chrome/browser/signin/BUILD.gn b/ios/chrome/browser/signin/BUILD.gn
index 795b5ef..76caed6 100644
--- a/ios/chrome/browser/signin/BUILD.gn
+++ b/ios/chrome/browser/signin/BUILD.gn

@@ -30,6 +30,8 @@
     "gaia_auth_fetcher_ios_private.h",
     "gaia_cookie_manager_service_factory.cc",
     "gaia_cookie_manager_service_factory.h",
+    "identity_manager_factory.cc",
+    "identity_manager_factory.h",
     "identity_service_creator.cc",
     "identity_service_creator.h",
     "ios_chrome_signin_client.h",
@@ -77,6 +79,7 @@
     "//ios/web",
     "//net",
     "//services/identity:lib",
+    "//services/identity/public/cpp",
     "//services/identity/public/interfaces",
     "//url",
   ]

diff --git a/ios/chrome/browser/signin/identity_manager_factory.cc b/ios/chrome/browser/signin/identity_manager_factory.cc
new file mode 100644
index 0000000..63a19b7
--- /dev/null
+++ b/ios/chrome/browser/signin/identity_manager_factory.cc

@@ -0,0 +1,61 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ios/chrome/browser/signin/identity_manager_factory.h"
+
+#include "base/memory/ptr_util.h"
+#include "components/keyed_service/core/keyed_service.h"
+#include "components/keyed_service/ios/browser_state_dependency_manager.h"
+#include "components/signin/core/browser/signin_manager.h"
+#include "ios/chrome/browser/browser_state/chrome_browser_state.h"
+#include "ios/chrome/browser/signin/oauth2_token_service_factory.h"
+#include "ios/chrome/browser/signin/signin_manager_factory.h"
+#include "services/identity/public/cpp/identity_manager.h"
+
+// Class that wraps IdentityManager in a KeyedService (as IdentityManager is a
+// client-side library intended for use by any process, it would be a layering
+// violation for IdentityManager itself to have direct knowledge of
+// KeyedService).
+class IdentityManagerHolder : public KeyedService {
+ public:
+  explicit IdentityManagerHolder(ios::ChromeBrowserState* browser_state)
+      : identity_manager_(
+            ios::SigninManagerFactory::GetForBrowserState(browser_state),
+            OAuth2TokenServiceFactory::GetForBrowserState(browser_state)) {}
+
+  identity::IdentityManager* identity_manager() { return &identity_manager_; }
+
+ private:
+  identity::IdentityManager identity_manager_;
+};
+
+IdentityManagerFactory::IdentityManagerFactory()
+    : BrowserStateKeyedServiceFactory(
+          "IdentityManager",
+          BrowserStateDependencyManager::GetInstance()) {
+  DependsOn(OAuth2TokenServiceFactory::GetInstance());
+  DependsOn(ios::SigninManagerFactory::GetInstance());
+}
+
+IdentityManagerFactory::~IdentityManagerFactory() {}
+
+// static
+identity::IdentityManager* IdentityManagerFactory::GetForBrowserState(
+    ios::ChromeBrowserState* browser_state) {
+  IdentityManagerHolder* holder = static_cast<IdentityManagerHolder*>(
+      GetInstance()->GetServiceForBrowserState(browser_state, true));
+
+  return holder->identity_manager();
+}
+
+// static
+IdentityManagerFactory* IdentityManagerFactory::GetInstance() {
+  return base::Singleton<IdentityManagerFactory>::get();
+}
+
+std::unique_ptr<KeyedService> IdentityManagerFactory::BuildServiceInstanceFor(
+    web::BrowserState* browser_state) const {
+  return base::MakeUnique<IdentityManagerHolder>(
+      ios::ChromeBrowserState::FromBrowserState(browser_state));
+}

diff --git a/ios/chrome/browser/signin/identity_manager_factory.h b/ios/chrome/browser/signin/identity_manager_factory.h
new file mode 100644
index 0000000..b4b6916
--- /dev/null
+++ b/ios/chrome/browser/signin/identity_manager_factory.h

@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_SIGNIN_IDENTITY_MANAGER_FACTORY_H_
+#define IOS_CHROME_BROWSER_SIGNIN_IDENTITY_MANAGER_FACTORY_H_
+
+#include "base/memory/singleton.h"
+#include "components/keyed_service/ios/browser_state_keyed_service_factory.h"
+
+namespace identity {
+class IdentityManager;
+}
+
+namespace ios {
+class ChromeBrowserState;
+}
+
+// Singleton that owns all IdentityManager instances and associates them with
+// BrowserStates.
+class IdentityManagerFactory : public BrowserStateKeyedServiceFactory {
+ public:
+  static identity::IdentityManager* GetForBrowserState(
+      ios::ChromeBrowserState* browser_state);
+
+  // Returns an instance of the IdentityManagerFactory singleton.
+  static IdentityManagerFactory* GetInstance();
+
+ private:
+  friend struct base::DefaultSingletonTraits<IdentityManagerFactory>;
+
+  IdentityManagerFactory();
+  ~IdentityManagerFactory() override;
+
+  // BrowserStateKeyedServiceFactory:
+  std::unique_ptr<KeyedService> BuildServiceInstanceFor(
+      web::BrowserState* browser_state) const override;
+
+  DISALLOW_COPY_AND_ASSIGN(IdentityManagerFactory);
+};
+
+#endif  // IOS_CHROME_BROWSER_SIGNIN_IDENTITY_MANAGER_FACTORY_H_

diff --git a/ios/chrome/browser/ui/bookmarks/bookmarks_egtest.mm b/ios/chrome/browser/ui/bookmarks/bookmarks_egtest.mm
index 91ff1039..56c32713 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmarks_egtest.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmarks_egtest.mm

@@ -1201,7 +1201,8 @@
 // Tests the tapping on the secondary button of sign-in promo view in a warm
 // state makes the sign-in sheet appear, and the promo still appears after
 // dismissing the sheet.
-- (void)testSignInPromoWithWarmStateUsingSecondaryButton {
+// TODO(crbug.com/796618): Reenable this test.
+- (void)DISABLED_testSignInPromoWithWarmStateUsingSecondaryButton {
   base::test::ScopedFeatureList scoped_feature_list;
   scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
 

diff --git a/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm b/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm
index 4a9f0e6..0993d7e 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm

@@ -1981,7 +1981,8 @@
 // Tests the tapping on the primary button of sign-in promo view in a warm
 // state makes the confirmaiton sheet appear, and the promo still appears after
 // dismissing the sheet.
-- (void)testSignInPromoWithWarmStateUsingPrimaryButton {
+// TODO(crbug.com/796618): Reenable this test.
+- (void)DISABLED_testSignInPromoWithWarmStateUsingPrimaryButton {
   base::test::ScopedFeatureList scoped_feature_list;
   scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
@@ -2025,7 +2026,8 @@
 // Tests the tapping on the secondary button of sign-in promo view in a warm
 // state makes the sign-in sheet appear, and the promo still appears after
 // dismissing the sheet.
-- (void)testSignInPromoWithWarmStateUsingSecondaryButton {
+// TODO(crbug.com/796618): Reenable this test.
+- (void)DISABLED_testSignInPromoWithWarmStateUsingSecondaryButton {
   base::test::ScopedFeatureList scoped_feature_list;
   scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 

diff --git a/ios/chrome/browser/ui/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view_controller.mm
index 7c9819f6..ff076193 100644
--- a/ios/chrome/browser/ui/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view_controller.mm

@@ -2134,11 +2134,13 @@
     [self.view insertSubview:infoBarContainerView aboveSubview:_contentArea];
 
   // Place the toolbar controller above the infobar container and adds the
-  // omnibox layout guide.
+  // layout guides.
   if (initialLayout) {
     [[self view] insertSubview:_toolbarCoordinator.toolbarViewController.view
                   aboveSubview:infoBarContainerView];
     AddNamedGuide(kOmniboxGuide, self.view);
+    AddNamedGuide(kBackButtonGuide, self.view);
+    AddNamedGuide(kForwardButtonGuide, self.view);
   }
   minY += CGRectGetHeight(toolbarFrame);
   if (initialLayout)

diff --git a/ios/chrome/browser/ui/history_popup/BUILD.gn b/ios/chrome/browser/ui/history_popup/BUILD.gn
index 431164a..4bf6e372 100644
--- a/ios/chrome/browser/ui/history_popup/BUILD.gn
+++ b/ios/chrome/browser/ui/history_popup/BUILD.gn

@@ -37,9 +37,12 @@
     "//base",
     "//ios/chrome/browser",
     "//ios/chrome/browser/tabs",
+    "//ios/chrome/browser/ui:ui_util",
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/coordinators:chrome_coordinators",
     "//ios/chrome/browser/ui/history_popup/requirements",
+    "//ios/chrome/browser/ui/toolbar/public:toolbar_base_feature",
+    "//ios/chrome/browser/ui/util",
   ]
 }
 

diff --git a/ios/chrome/browser/ui/history_popup/requirements/tab_history_positioner.h b/ios/chrome/browser/ui/history_popup/requirements/tab_history_positioner.h
index 3a6aa0afd..3977f8f 100644
--- a/ios/chrome/browser/ui/history_popup/requirements/tab_history_positioner.h
+++ b/ios/chrome/browser/ui/history_popup/requirements/tab_history_positioner.h

@@ -7,6 +7,8 @@
 
 #import "ios/chrome/browser/ui/history_popup/requirements/tab_history_constants.h"
 
+// TODO(crbug.com/788705): Once the clean toolbar (kCleanToolbar) is enabled,
+// this protocol can be removed.
 @protocol TabHistoryPositioner
 // CGPoint which the Tab History Popup will be presented from.
 - (CGPoint)originPointForToolbarButton:(ToolbarButtonType)toolbarButton;

diff --git a/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm b/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm
index b8bf371..c323d2f6 100644
--- a/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm
+++ b/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm

@@ -15,6 +15,9 @@
 #import "ios/chrome/browser/ui/history_popup/requirements/tab_history_presentation.h"
 #import "ios/chrome/browser/ui/history_popup/requirements/tab_history_ui_updater.h"
 #import "ios/chrome/browser/ui/history_popup/tab_history_popup_controller.h"
+#include "ios/chrome/browser/ui/rtl_geometry.h"
+#import "ios/chrome/browser/ui/toolbar/public/toolbar_controller_base_feature.h"
+#import "ios/chrome/browser/ui/util/named_guide.h"
 #include "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
 
@@ -64,11 +67,16 @@
   Tab* tab = [self.tabModel currentTab];
   web::NavigationItemList backwardItems =
       [tab navigationManager]->GetBackwardItems();
-  CGPoint origin = [
-      [self.presentationProvider viewForTabHistoryPresentation].window
-      convertPoint:[self.positionProvider
-                       originPointForToolbarButton:ToolbarButtonTypeBack]
-            toView:[self.presentationProvider viewForTabHistoryPresentation]];
+
+  CGPoint origin = CGPointZero;
+  if (base::FeatureList::IsEnabled(kCleanToolbar)) {
+    origin = [self popupOriginForNamedGuide:kBackButtonGuide];
+  } else {
+    origin = [[self.presentationProvider viewForTabHistoryPresentation].window
+        convertPoint:[self.positionProvider
+                         originPointForToolbarButton:ToolbarButtonTypeBack]
+              toView:[self.presentationProvider viewForTabHistoryPresentation]];
+  }
 
   [self.tabHistoryUIUpdater
       updateUIForTabHistoryPresentationFrom:ToolbarButtonTypeBack];
@@ -79,11 +87,16 @@
   Tab* tab = [self.tabModel currentTab];
   web::NavigationItemList forwardItems =
       [tab navigationManager]->GetForwardItems();
-  CGPoint origin = [
-      [self.presentationProvider viewForTabHistoryPresentation].window
-      convertPoint:[self.positionProvider
-                       originPointForToolbarButton:ToolbarButtonTypeForward]
-            toView:[self.presentationProvider viewForTabHistoryPresentation]];
+
+  CGPoint origin = CGPointZero;
+  if (base::FeatureList::IsEnabled(kCleanToolbar)) {
+    origin = [self popupOriginForNamedGuide:kForwardButtonGuide];
+  } else {
+    origin = [[self.presentationProvider viewForTabHistoryPresentation].window
+        convertPoint:[self.positionProvider
+                         originPointForToolbarButton:ToolbarButtonTypeForward]
+              toView:[self.presentationProvider viewForTabHistoryPresentation]];
+  }
 
   [self.tabHistoryUIUpdater
       updateUIForTabHistoryPresentationFrom:ToolbarButtonTypeForward];
@@ -97,6 +110,19 @@
 
 #pragma mark - Helper Methods
 
+// Returns the origin point of the popup for the |guideName|.
+- (CGPoint)popupOriginForNamedGuide:(GuideName*)guideName {
+  UILayoutGuide* guide = FindNamedGuide(
+      guideName, [self.presentationProvider viewForTabHistoryPresentation]);
+  DCHECK(guide);
+  CGPoint leadingBottomCorner =
+      CGPointMake(CGRectGetLeadingEdge(guide.layoutFrame),
+                  CGRectGetMaxY(guide.layoutFrame));
+  return [guide.owningView
+      convertPoint:leadingBottomCorner
+            toView:[self.presentationProvider viewForTabHistoryPresentation]];
+}
+
 // Present a Tab History Popup that displays |items|, and its view is presented
 // from |origin|.
 - (void)presentTabHistoryPopupWithItems:(const web::NavigationItemList&)items

diff --git a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_egtest.mm b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_egtest.mm
index 4557dae..2e8c47b5 100644
--- a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_egtest.mm
+++ b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_egtest.mm

@@ -47,28 +47,15 @@
   [ChromeEarlGreyUI tapToolsMenuButton:RecentTabsMenuButton()];
 }
 
-// Closes the recent tabs panel, on iPhone.
-void CloseRecentTabsPanelOnIphone() {
-  DCHECK(!IsIPadIdiom());
-
-  id<GREYMatcher> exit_button_matcher = grey_accessibilityID(@"Exit");
-  [[EarlGrey selectElementWithMatcher:exit_button_matcher]
-      performAction:grey_tap()];
-}
-
 // Returns the matcher for the entry of the page in the recent tabs panel.
 id<GREYMatcher> TitleOfTestPage() {
   return grey_allOf(
+      grey_ancestor(grey_accessibilityID(
+          kRecentTabsTableViewControllerAccessibilityIdentifier)),
       chrome_test_util::StaticTextWithAccessibilityLabel(kTitleOfTestPage),
       grey_sufficientlyVisible(), nil);
 }
 
-// Returns the matcher for the Recently closed label.
-id<GREYMatcher> RecentlyClosedLabelMatcher() {
-  return chrome_test_util::StaticTextWithAccessibilityLabelId(
-      IDS_IOS_RECENT_TABS_RECENTLY_CLOSED);
-}
-
 }  // namespace
 
 // Earl grey integration tests for Recent Tabs Panel Controller.
@@ -88,48 +75,18 @@
                                           forKey:kCollapsedSectionsKey];
 }
 
-- (void)tearDown {
-  if (IsIPadIdiom()) {
-    chrome_test_util::OpenNewTab();
-    NSError* error = nil;
-    [[EarlGrey selectElementWithMatcher:RecentlyClosedLabelMatcher()]
-        assertWithMatcher:grey_notNil()
-                    error:&error];
-    // If the Recent Tabs panel is shown, then switch back to the Most Visited
-    // panel so that tabs opened in other tests will show the Most Visited panel
-    // instead of the Recent Tabs panel.
-    if (!error) {
-      [[EarlGrey selectElementWithMatcher:RecentlyClosedLabelMatcher()]
-          performAction:grey_swipeFastInDirection(kGREYDirectionRight)];
-    }
-    chrome_test_util::CloseCurrentTab();
-  }
-}
-
+// Closes the recent tabs panel.
 - (void)closeRecentTabs {
-  // Get rid of the Recent Tabs Panel.
-  if (IsIPadIdiom()) {
-    // On iPad, the Recent Tabs panel is a new page in the navigation history.
-    // Go back to the previous page to restore the test page.
-    [[EarlGrey selectElementWithMatcher:chrome_test_util::BackButton()]
-        performAction:grey_tap()];
-    [ChromeEarlGrey waitForPageToFinishLoading];
-  } else {
-    // On iPhone, the Recent Tabs panel is shown in a modal view.
-    // Close that modal.
-    CloseRecentTabsPanelOnIphone();
-    // Wait until the recent tabs panel is dismissed.
-    [[GREYUIThreadExecutor sharedInstance] drainUntilIdle];
-  }
+  id<GREYMatcher> exit_button_matcher = grey_accessibilityID(@"Exit");
+  [[EarlGrey selectElementWithMatcher:exit_button_matcher]
+      performAction:grey_tap()];
+  // Wait until the recent tabs panel is dismissed.
+  [[GREYUIThreadExecutor sharedInstance] drainUntilIdle];
 }
 
 // Tests that a closed tab appears in the Recent Tabs panel, and that tapping
 // the entry in the Recent Tabs panel re-opens the closed tab.
 - (void)testClosedTabAppearsInRecentTabsPanel {
-  // TODO(crbug.com/782551): Rewrite this egtest for the new bookmark.
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
-
   const GURL testPageURL = web::test::HttpServer::MakeUrl(kURLOfTestPage);
 
   // Open the test page in a new tab.
@@ -166,10 +123,6 @@
 
 // Tests that tapping "Show Full History" open the history.
 - (void)testOpenHistory {
-  // TODO(crbug.com/782551): Rewrite this egtest for the new bookmark.
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
-
   OpenRecentTabsPanel();
 
   // Tap "Show Full History"
@@ -198,10 +151,6 @@
 
 // Tests that the sign-in promo can be reloaded correctly.
 - (void)testRecentTabSigninPromoReloaded {
-  // TODO(crbug.com/782551): Rewrite this egtest for the new bookmark.
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
-
   OpenRecentTabsPanel();
   // Sign-in promo should be visible with cold state.
   [SigninEarlGreyUtils
@@ -222,10 +171,6 @@
 // Tests that the sign-in promo can be reloaded correctly while being hidden.
 // crbug.com/776939
 - (void)testRecentTabSigninPromoReloadedWhileHidden {
-  // TODO(crbug.com/782551): Rewrite this egtest for the new bookmark.
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
-
   OpenRecentTabsPanel();
   [SigninEarlGreyUtils
       checkSigninPromoVisibleWithMode:SigninPromoViewModeColdState

diff --git a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.h b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.h
index 347f5e8..05f131e 100644
--- a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.h
+++ b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.h

@@ -23,6 +23,8 @@
 
 // Key for saving collapsed session state in the UserDefaults.
 extern NSString* const kCollapsedSectionsKey;
+// Accessibility identifier for the main view.
+extern NSString* const kRecentTabsTableViewControllerAccessibilityIdentifier;
 
 @protocol RecentTabsTableViewControllerDelegate<NSObject>
 // Tells the delegate when the table view content scrolled or changed size.

diff --git a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.mm b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.mm
index a5f1ede..20a65f9 100644
--- a/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.mm
+++ b/ios/chrome/browser/ui/ntp/recent_tabs/recent_tabs_table_view_controller.mm

@@ -55,6 +55,9 @@
 
 // Key for saving collapsed session state in the UserDefaults.
 NSString* const kCollapsedSectionsKey = @"ChromeRecentTabsCollapsedSections";
+// Accessibility identifier for the main view.
+NSString* const kRecentTabsTableViewControllerAccessibilityIdentifier =
+    @"recent_tabs_view_controller";
 
 namespace {
 
@@ -196,7 +199,8 @@
 
 - (void)viewDidLoad {
   [super viewDidLoad];
-  self.view.accessibilityIdentifier = @"recent_tabs_view_controller";
+  self.view.accessibilityIdentifier =
+      kRecentTabsTableViewControllerAccessibilityIdentifier;
   self.tableView.rowHeight = UITableViewAutomaticDimension;
   self.tableView.estimatedRowHeight =
       [SessionTabDataView desiredHeightInUITableViewCell];

diff --git a/ios/chrome/browser/ui/signin_interaction/signin_interaction_controller_egtest.mm b/ios/chrome/browser/ui/signin_interaction/signin_interaction_controller_egtest.mm
index 948bfed7..c29d246 100644
--- a/ios/chrome/browser/ui/signin_interaction/signin_interaction_controller_egtest.mm
+++ b/ios/chrome/browser/ui/signin_interaction/signin_interaction_controller_egtest.mm

@@ -174,7 +174,8 @@
 
 // Tests that switching from a managed account to a non-managed account works
 // correctly and displays the expected warnings.
-- (void)testSignInSwitchManagedAccount {
+// TODO(crbug.com/796842): Reenable this test.
+- (void)DISABLED_testSignInSwitchManagedAccount {
   // Set up the fake identities.
   ios::FakeChromeIdentityService* identity_service =
       ios::FakeChromeIdentityService::GetInstanceFromChromeProvider();
@@ -254,7 +255,8 @@
 
 // Tests that signing out of a managed account from the Settings works
 // correctly.
-- (void)testSignInDisconnectFromChromeManaged {
+// TODO(crbug.com/796842): Reenable this test.
+- (void)DISABLED_testSignInDisconnectFromChromeManaged {
   ChromeIdentity* identity = [SigninEarlGreyUtils fakeManagedIdentity];
   ios::FakeChromeIdentityService::GetInstanceFromChromeProvider()->AddIdentity(
       identity);
@@ -401,7 +403,8 @@
 // Starts an authentication flow and cancel it by opening a new tab. Ensures
 // that the authentication flow is correctly canceled and dismissed.
 // crbug.com/462202
-- (void)testSignInCancelAuthenticationFlow {
+// TODO(crbug.com/796842): Reenable this test.
+- (void)DISABLED_testSignInCancelAuthenticationFlow {
   // Set up the fake identities.
   ios::FakeChromeIdentityService* identity_service =
       ios::FakeChromeIdentityService::GetInstanceFromChromeProvider();

diff --git a/ios/chrome/browser/ui/toolbar/clean/toolbar_view_controller.mm b/ios/chrome/browser/ui/toolbar/clean/toolbar_view_controller.mm
index 7e91505..c8b1a60 100644
--- a/ios/chrome/browser/ui/toolbar/clean/toolbar_view_controller.mm
+++ b/ios/chrome/browser/ui/toolbar/clean/toolbar_view_controller.mm

@@ -827,6 +827,11 @@
 - (void)didMoveToParentViewController:(UIViewController*)parent {
   UILayoutGuide* omniboxPopupGuide = FindNamedGuide(kOmniboxGuide, self.view);
   AddSameConstraints(self.locationBarContainer, omniboxPopupGuide);
+  UILayoutGuide* backButtonGuide = FindNamedGuide(kBackButtonGuide, self.view);
+  AddSameConstraints(self.backButton.imageView, backButtonGuide);
+  UILayoutGuide* forwardButtonGuide =
+      FindNamedGuide(kForwardButtonGuide, self.view);
+  AddSameConstraints(self.forwardButton.imageView, forwardButtonGuide);
 }
 
 #pragma mark - Trait Collection Changes

diff --git a/ios/chrome/browser/ui/util/named_guide.h b/ios/chrome/browser/ui/util/named_guide.h
index c303998..67316d9 100644
--- a/ios/chrome/browser/ui/util/named_guide.h
+++ b/ios/chrome/browser/ui/util/named_guide.h

@@ -15,6 +15,10 @@
 
 // A guide that is constrained to match the frame of the omnibox.
 extern GuideName* const kOmniboxGuide;
+// A guide that is constrained to match the frame of the back button's image.
+extern GuideName* const kBackButtonGuide;
+// A guide that is constrained to match the frame of the forward button's image.
+extern GuideName* const kForwardButtonGuide;
 
 //
 //////////////////////////////////////////

diff --git a/ios/chrome/browser/ui/util/named_guide.mm b/ios/chrome/browser/ui/util/named_guide.mm
index e811ae8c1..5a3107a 100644
--- a/ios/chrome/browser/ui/util/named_guide.mm
+++ b/ios/chrome/browser/ui/util/named_guide.mm

@@ -12,6 +12,8 @@
 
 // Named guide constants.
 GuideName* const kOmniboxGuide = @"kOmniboxGuide";
+GuideName* const kBackButtonGuide = @"kBackButtonGuide";
+GuideName* const kForwardButtonGuide = @"kForwardButtonGuide";
 
 UILayoutGuide* FindNamedGuide(GuideName* name, UIView* view) {
   while (view) {

diff --git a/ios/chrome/test/earl_grey/chrome_earl_grey_ui.mm b/ios/chrome/test/earl_grey/chrome_earl_grey_ui.mm
index 9e32139..f872a29 100644
--- a/ios/chrome/test/earl_grey/chrome_earl_grey_ui.mm
+++ b/ios/chrome/test/earl_grey/chrome_earl_grey_ui.mm

@@ -167,6 +167,7 @@
       performAction:grey_tap()];
   [[EarlGrey selectElementWithMatcher:AccountConsistencySetupSigninButton()]
       performAction:grey_tap()];
+  [[GREYUIThreadExecutor sharedInstance] drainUntilIdle];
 }
 
 + (void)confirmSigninConfirmationDialog {

diff --git a/ios/third_party/material_components_ios/BUILD.gn b/ios/third_party/material_components_ios/BUILD.gn
index 0b9a080..6bbed7a 100644
--- a/ios/third_party/material_components_ios/BUILD.gn
+++ b/ios/third_party/material_components_ios/BUILD.gn

@@ -42,9 +42,16 @@
 
 source_set("material_components_ios") {
   sources = [
+    "src/components/ActivityIndicator/src/ColorThemer/MDCActivityIndicatorColorThemer.h",
+    "src/components/ActivityIndicator/src/ColorThemer/MDCActivityIndicatorColorThemer.m",
     "src/components/ActivityIndicator/src/MDCActivityIndicator.h",
     "src/components/ActivityIndicator/src/MDCActivityIndicator.m",
     "src/components/ActivityIndicator/src/MaterialActivityIndicator.h",
+    "src/components/ActivityIndicator/src/private/MDCActivityIndicator+Private.h",
+    "src/components/ActivityIndicator/src/private/MDCActivityIndicatorMotionSpec.h",
+    "src/components/ActivityIndicator/src/private/MDCActivityIndicatorMotionSpec.m",
+    "src/components/ActivityIndicator/src/private/MaterialActivityIndicatorStrings.h",
+    "src/components/ActivityIndicator/src/private/MaterialActivityIndicatorStrings_table.h",
     "src/components/AnimationTiming/src/CAMediaTimingFunction+MDCAnimationTiming.h",
     "src/components/AnimationTiming/src/CAMediaTimingFunction+MDCAnimationTiming.m",
     "src/components/AnimationTiming/src/MaterialAnimationTiming.h",
@@ -59,14 +66,17 @@
     "src/components/BottomSheet/src/MDCBottomSheetController.m",
     "src/components/BottomSheet/src/MDCBottomSheetPresentationController.h",
     "src/components/BottomSheet/src/MDCBottomSheetPresentationController.m",
+    "src/components/BottomSheet/src/MDCBottomSheetTransition.h",
+    "src/components/BottomSheet/src/MDCBottomSheetTransition.m",
     "src/components/BottomSheet/src/MDCBottomSheetTransitionController.h",
     "src/components/BottomSheet/src/MDCBottomSheetTransitionController.m",
+    "src/components/BottomSheet/src/MaterialBottomSheet.h",
     "src/components/BottomSheet/src/UIViewController+MaterialBottomSheet.h",
     "src/components/BottomSheet/src/UIViewController+MaterialBottomSheet.m",
+    "src/components/BottomSheet/src/private/MDCBottomSheetMotionSpec.h",
+    "src/components/BottomSheet/src/private/MDCBottomSheetMotionSpec.m",
     "src/components/BottomSheet/src/private/MDCDraggableView.h",
     "src/components/BottomSheet/src/private/MDCDraggableView.m",
-    "src/components/BottomSheet/src/private/MDCSheetBehavior.h",
-    "src/components/BottomSheet/src/private/MDCSheetBehavior.m",
     "src/components/BottomSheet/src/private/MDCSheetContainerView.h",
     "src/components/BottomSheet/src/private/MDCSheetContainerView.m",
     "src/components/ButtonBar/src/MDCButtonBar.h",
@@ -119,11 +129,19 @@
     "src/components/Dialogs/src/MDCAlertController.m",
     "src/components/Dialogs/src/MDCDialogPresentationController.h",
     "src/components/Dialogs/src/MDCDialogPresentationController.m",
+    "src/components/Dialogs/src/MDCDialogTransition.h",
+    "src/components/Dialogs/src/MDCDialogTransition.m",
     "src/components/Dialogs/src/MDCDialogTransitionController.h",
     "src/components/Dialogs/src/MDCDialogTransitionController.m",
     "src/components/Dialogs/src/MaterialDialogs.h",
+    "src/components/Dialogs/src/UIViewController+MaterialDialogs.h",
+    "src/components/Dialogs/src/UIViewController+MaterialDialogs.m",
     "src/components/Dialogs/src/private/MDCDialogShadowedView.h",
     "src/components/Dialogs/src/private/MDCDialogShadowedView.m",
+    "src/components/Dialogs/src/private/MDCDialogTransitionMotionSpec.h",
+    "src/components/Dialogs/src/private/MDCDialogTransitionMotionSpec.m",
+    "src/components/Dialogs/src/private/MaterialDialogsStrings.h",
+    "src/components/Dialogs/src/private/MaterialDialogsStrings_table.h",
     "src/components/FlexibleHeader/src/MDCFlexibleHeaderContainerViewController.h",
     "src/components/FlexibleHeader/src/MDCFlexibleHeaderContainerViewController.m",
     "src/components/FlexibleHeader/src/MDCFlexibleHeaderView.h",
@@ -136,6 +154,8 @@
     "src/components/HeaderStackView/src/MDCHeaderStackView.h",
     "src/components/HeaderStackView/src/MDCHeaderStackView.m",
     "src/components/HeaderStackView/src/MaterialHeaderStackView.h",
+    "src/components/Ink/src/ColorThemer/MDCInkColorThemer.h",
+    "src/components/Ink/src/ColorThemer/MDCInkColorThemer.m",
     "src/components/Ink/src/MDCInkGestureRecognizer.h",
     "src/components/Ink/src/MDCInkGestureRecognizer.m",
     "src/components/Ink/src/MDCInkTouchController.h",
@@ -145,6 +165,9 @@
     "src/components/Ink/src/MaterialInk.h",
     "src/components/Ink/src/private/MDCInkLayer.h",
     "src/components/Ink/src/private/MDCInkLayer.m",
+    "src/components/Ink/src/private/MDCLegacyInkLayer+Testing.h",
+    "src/components/Ink/src/private/MDCLegacyInkLayer.h",
+    "src/components/Ink/src/private/MDCLegacyInkLayer.m",
     "src/components/NavigationBar/src/MDCNavigationBar.h",
     "src/components/NavigationBar/src/MDCNavigationBar.m",
     "src/components/NavigationBar/src/MaterialNavigationBar.h",
@@ -158,9 +181,13 @@
     "src/components/Palettes/src/private/MDCPaletteExpansions.m",
     "src/components/Palettes/src/private/MDCPaletteNames.h",
     "src/components/Palettes/src/private/MDCPaletteNames.m",
+    "src/components/ProgressView/src/ColorThemer/MDCProgressViewColorThemer.h",
+    "src/components/ProgressView/src/ColorThemer/MDCProgressViewColorThemer.m",
     "src/components/ProgressView/src/MDCProgressView.h",
     "src/components/ProgressView/src/MDCProgressView.m",
     "src/components/ProgressView/src/MaterialProgressView.h",
+    "src/components/ProgressView/src/private/MDCProgressViewMotionSpec.h",
+    "src/components/ProgressView/src/private/MDCProgressViewMotionSpec.m",
     "src/components/ShadowElevations/src/MDCShadowElevations.h",
     "src/components/ShadowElevations/src/MDCShadowElevations.m",
     "src/components/ShadowElevations/src/MaterialShadowElevations.h",
@@ -270,6 +297,13 @@
     ":material_component_ic_arrow_back_bundle",
     "//ios/third_party/material_internationalization_ios",
     "//ios/third_party/material_text_accessibility_ios",
+    "//ios/third_party/motion_animator_objc",
+    "//ios/third_party/motion_transitioning_objc",
+  ]
+
+  public_deps = [
+    "//ios/third_party/motion_animator_objc",
+    "//ios/third_party/motion_transitioning_objc",
   ]
 
   foreach(icon_name, _icon_names) {

diff --git a/ios/third_party/material_internationalization_ios/BUILD.gn b/ios/third_party/material_internationalization_ios/BUILD.gn
index 9e52ad5..a2e44ee 100644
--- a/ios/third_party/material_internationalization_ios/BUILD.gn
+++ b/ios/third_party/material_internationalization_ios/BUILD.gn

@@ -2,14 +2,15 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("//build/config/ios/ios_sdk.gni")
-import("//build/config/ios/rules.gni")
-import("//ios/build/chrome_build.gni")
+import("//build/config/compiler/compiler.gni")
 
 config("config") {
+  include_dirs = [ "forwarding_headers" ]
+}
+
+config("private_config") {
   include_dirs = [ "src/Sources" ]
   visibility = [ ":material_internationalization_ios" ]
-  defines = [ "IS_BAZEL_BUILD" ]
 }
 
 source_set("material_internationalization_ios") {
@@ -33,15 +34,14 @@
     "CoreImage.framework",
     "UIKit.framework",
   ]
-  public_configs = [ ":config" ]
-  configs -= [
-    "//build/config/gcc:symbol_visibility_hidden",
-    "//build/config/compiler:chromium_code",
-  ]
-  configs += [
+  public_configs = [
     ":config",
+    "//build/config/compiler:default_include_dirs",
+  ]
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [
+    ":private_config",
     "//build/config/compiler:enable_arc",
     "//build/config/compiler:no_chromium_code",
-    "//build/config/gcc:symbol_visibility_default",
   ]
 }

diff --git a/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFInternationalization.h b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFInternationalization.h
new file mode 100644
index 0000000..1db5ab2
--- /dev/null
+++ b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFInternationalization.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/material_internationalization_ios/src/Sources/MDFInternationalization.h"

diff --git a/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFRTL.h b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFRTL.h
new file mode 100644
index 0000000..7d42193
--- /dev/null
+++ b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/MDFRTL.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/material_internationalization_ios/src/Sources/MDFRTL.h"

diff --git a/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIImage+MaterialRTL.h b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIImage+MaterialRTL.h
new file mode 100644
index 0000000..f4f8c63
--- /dev/null
+++ b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIImage+MaterialRTL.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/material_internationalization_ios/src/Sources/UIImage+MaterialRTL.h"

diff --git a/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIView+MaterialRTL.h b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIView+MaterialRTL.h
new file mode 100644
index 0000000..f61bba4c1
--- /dev/null
+++ b/ios/third_party/material_internationalization_ios/forwarding_headers/MDFInternationalization/UIView+MaterialRTL.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/material_internationalization_ios/src/Sources/UIView+MaterialRTL.h"

diff --git a/ios/third_party/material_text_accessibility_ios/BUILD.gn b/ios/third_party/material_text_accessibility_ios/BUILD.gn
index c23b777..697ba9d 100644
--- a/ios/third_party/material_text_accessibility_ios/BUILD.gn
+++ b/ios/third_party/material_text_accessibility_ios/BUILD.gn

@@ -2,7 +2,11 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-config("material_text_accessibility_ios_config") {
+config("config") {
+  include_dirs = [ "forwarding_headers" ]
+}
+
+config("private_config") {
   include_dirs = [ "src/src" ]
   visibility = [ ":material_text_accessibility_ios" ]
 }
@@ -19,10 +23,10 @@
     "src/src/private/NSArray+MDFUtils.h",
     "src/src/private/NSArray+MDFUtils.m",
   ]
-  public_configs = [ ":material_text_accessibility_ios_config" ]
+  public_configs = [ ":config" ]
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [
-    ":material_text_accessibility_ios_config",
+    ":private_config",
     "//build/config/compiler:enable_arc",
     "//build/config/compiler:no_chromium_code",
   ]

diff --git a/ios/third_party/material_text_accessibility_ios/forwarding_headers/MDFTextAccessibility/MDFTextAccessibility.h b/ios/third_party/material_text_accessibility_ios/forwarding_headers/MDFTextAccessibility/MDFTextAccessibility.h
new file mode 100644
index 0000000..321d42f
--- /dev/null
+++ b/ios/third_party/material_text_accessibility_ios/forwarding_headers/MDFTextAccessibility/MDFTextAccessibility.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/material_text_accessibility_ios/src/src/MDFTextAccessibility.h"

diff --git a/ios/third_party/motion_animator_objc/BUILD.gn b/ios/third_party/motion_animator_objc/BUILD.gn
index d4013998..e35bf4b 100644
--- a/ios/third_party/motion_animator_objc/BUILD.gn
+++ b/ios/third_party/motion_animator_objc/BUILD.gn

@@ -2,14 +2,21 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-import("//build/config/ios/ios_sdk.gni")
-import("//build/config/ios/rules.gni")
-import("//ios/build/chrome_build.gni")
-
 config("config") {
+  include_dirs = [ "forwarding_headers" ]
+}
+
+config("private_config") {
   include_dirs = [ "src/src" ]
   visibility = [ ":motion_animator_objc" ]
-  defines = [ "IS_BAZEL_BUILD" ]
+}
+
+# TODO(crbug.com/796159): Remove when the issue is fixed in a Motion Animator
+# release. The bug is fixed already on their trunk:
+# https://github.com/material-motion/motion-animator-objc/pull/103
+config("workaround_config") {
+  include_dirs = [ "../motion_interchange_objc/src/src" ]
+  visibility = [ ":motion_animator_objc" ]
 }
 
 source_set("motion_animator_objc") {
@@ -26,10 +33,14 @@
     "src/src/private/CABasicAnimation+MotionAnimator.m",
     "src/src/private/CAMediaTimingFunction+MotionAnimator.h",
     "src/src/private/CAMediaTimingFunction+MotionAnimator.m",
+    "src/src/private/MDMAnimationRegistrar.h",
+    "src/src/private/MDMAnimationRegistrar.m",
     "src/src/private/MDMBlockAnimations.h",
     "src/src/private/MDMBlockAnimations.m",
     "src/src/private/MDMDragCoefficient.h",
     "src/src/private/MDMDragCoefficient.m",
+    "src/src/private/MDMRegisteredAnimation.h",
+    "src/src/private/MDMRegisteredAnimation.m",
     "src/src/private/MDMUIKitValueCoercion.h",
     "src/src/private/MDMUIKitValueCoercion.m",
   ]
@@ -49,7 +60,8 @@
   ]
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [
-    ":config",
+    ":private_config",
+    ":workaround_config",
     "//build/config/compiler:enable_arc",
     "//build/config/compiler:no_chromium_code",
   ]

diff --git a/ios/third_party/motion_animator_objc/forwarding_headers/MotionAnimator/MotionAnimator.h b/ios/third_party/motion_animator_objc/forwarding_headers/MotionAnimator/MotionAnimator.h
new file mode 100644
index 0000000..7640fd1
--- /dev/null
+++ b/ios/third_party/motion_animator_objc/forwarding_headers/MotionAnimator/MotionAnimator.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/motion_animator_objc/src/src/MotionAnimator.h"

diff --git a/ios/third_party/motion_interchange_objc/BUILD.gn b/ios/third_party/motion_interchange_objc/BUILD.gn
index 1520955d6..5bfe480 100644
--- a/ios/third_party/motion_interchange_objc/BUILD.gn
+++ b/ios/third_party/motion_interchange_objc/BUILD.gn

@@ -3,22 +3,50 @@
 # found in the LICENSE file.
 
 config("config") {
+  include_dirs = [ "forwarding_headers" ]
+}
+
+config("private_config") {
   include_dirs = [ "src/src" ]
   visibility = [ ":motion_interchange_objc" ]
 }
 
 source_set("motion_interchange_objc") {
   sources = [
+    "src/src/CAMediaTimingFunction+MDMTimingCurve.h",
+    "src/src/CAMediaTimingFunction+MDMTimingCurve.m",
+    "src/src/MDMAnimationTraits.h",
+    "src/src/MDMAnimationTraits.m",
     "src/src/MDMMotionCurve.h",
     "src/src/MDMMotionCurve.m",
     "src/src/MDMMotionRepetition.h",
     "src/src/MDMMotionTiming.h",
+    "src/src/MDMRepetition.h",
+    "src/src/MDMRepetition.m",
+    "src/src/MDMRepetitionOverTime.h",
+    "src/src/MDMRepetitionOverTime.m",
+    "src/src/MDMRepetitionTraits.h",
+    "src/src/MDMSpringTimingCurve.h",
+    "src/src/MDMSpringTimingCurve.m",
+    "src/src/MDMSpringTimingCurveGenerator.h",
+    "src/src/MDMSpringTimingCurveGenerator.m",
+    "src/src/MDMSubclassingRestricted.h",
+    "src/src/MDMTimingCurve.h",
     "src/src/MotionInterchange.h",
   ]
   public = [
+    "src/src/CAMediaTimingFunction+MDMTimingCurve.h",
+    "src/src/MDMAnimationTraits.h",
     "src/src/MDMMotionCurve.h",
     "src/src/MDMMotionRepetition.h",
     "src/src/MDMMotionTiming.h",
+    "src/src/MDMRepetition.h",
+    "src/src/MDMRepetitionOverTime.h",
+    "src/src/MDMRepetitionTraits.h",
+    "src/src/MDMSpringTimingCurve.h",
+    "src/src/MDMSpringTimingCurveGenerator.h",
+    "src/src/MDMSubclassingRestricted.h",
+    "src/src/MDMTimingCurve.h",
     "src/src/MotionInterchange.h",
   ]
 
@@ -26,10 +54,11 @@
     "CoreGraphics.framework",
     "Foundation.framework",
     "QuartzCore.framework",
+    "UIKit.framework",
   ]
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [
-    ":config",
+    ":private_config",
     "//build/config/compiler:enable_arc",
     "//build/config/compiler:no_chromium_code",
   ]

diff --git a/ios/third_party/motion_interchange_objc/forwarding_headers/MotionInterchange/MotionInterchange.h b/ios/third_party/motion_interchange_objc/forwarding_headers/MotionInterchange/MotionInterchange.h
new file mode 100644
index 0000000..229d8d16
--- /dev/null
+++ b/ios/third_party/motion_interchange_objc/forwarding_headers/MotionInterchange/MotionInterchange.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/motion_interchange_objc/src/src/MotionInterchange.h"

diff --git a/ios/third_party/motion_transitioning_objc/BUILD.gn b/ios/third_party/motion_transitioning_objc/BUILD.gn
index a20aba6..80aa775 100644
--- a/ios/third_party/motion_transitioning_objc/BUILD.gn
+++ b/ios/third_party/motion_transitioning_objc/BUILD.gn

@@ -3,6 +3,10 @@
 # found in the LICENSE file.
 
 config("config") {
+  include_dirs = [ "forwarding_headers" ]
+}
+
+config("private_config") {
   include_dirs = [ "src/src" ]
   visibility = [ ":motion_transitioning_objc" ]
 }
@@ -11,6 +15,7 @@
   sources = [
     "src/src/MDMTransition.h",
     "src/src/MDMTransitionContext.h",
+    "src/src/MDMTransitionController.h",
     "src/src/MDMTransitionNavigationControllerDelegate.h",
     "src/src/MDMTransitionNavigationControllerDelegate.m",
     "src/src/MDMTransitionPresentationController.h",
@@ -28,6 +33,7 @@
   public = [
     "src/src/MDMTransition.h",
     "src/src/MDMTransitionContext.h",
+    "src/src/MDMTransitionController.h",
     "src/src/MDMTransitionNavigationControllerDelegate.h",
     "src/src/MDMTransitionPresentationController.h",
     "src/src/MDMTransitionViewSnapshotter.h",
@@ -41,7 +47,7 @@
   ]
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [
-    ":config",
+    ":private_config",
     "//build/config/compiler:enable_arc",
     "//build/config/compiler:no_chromium_code",
   ]

diff --git a/ios/third_party/motion_transitioning_objc/forwarding_headers/MotionTransitioning/MotionTransitioning.h b/ios/third_party/motion_transitioning_objc/forwarding_headers/MotionTransitioning/MotionTransitioning.h
new file mode 100644
index 0000000..98f8c37
--- /dev/null
+++ b/ios/third_party/motion_transitioning_objc/forwarding_headers/MotionTransitioning/MotionTransitioning.h

@@ -0,0 +1,9 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This forwarding header allows to import the file using import directives
+// assuming the code is build as a framework bundle while building it as a
+// source set. This is required as multiple third-party dependencies disagree on
+// that point.
+#import "ios/third_party/motion_transitioning_objc/src/src/MotionTransitioning.h"

diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index c412f61..ebfbcf9 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm

@@ -1317,7 +1317,13 @@
       _pendingNavigationInfo
           ? [_pendingNavigationInfo HTTPMethod]
           : [self currentBackForwardListItemHolder]->http_method();
-  return [HTTPMethod isEqual:@"POST"] || self.currentNavItem->HasPostData();
+  if ([HTTPMethod isEqual:@"POST"]) {
+    return YES;
+  }
+  if (!self.currentNavItem) {
+    return NO;
+  }
+  return self.currentNavItem->HasPostData();
 }
 
 - (BOOL)isCurrentNavigationBackForward {

diff --git a/media/base/audio_latency.cc b/media/base/audio_latency.cc
index 1def7dc..5816ad0 100644
--- a/media/base/audio_latency.cc
+++ b/media/base/audio_latency.cc

@@ -131,24 +131,9 @@
 // static
 int AudioLatency::GetInteractiveBufferSize(int hardware_buffer_size) {
 #if defined(OS_ANDROID)
-  // The optimum low-latency hardware buffer size is usually too small on
-  // Android for WebAudio to render without glitching. So, if it is small, use
-  // a larger size.
-  //
-  // Since WebAudio renders in 128-frame blocks, the small buffer sizes (144 for
-  // a Galaxy Nexus), cause significant processing jitter. Sometimes multiple
-  // blocks will processed, but other times will not be since the WebAudio can't
-  // satisfy the request. By using a larger render buffer size, we smooth out
-  // the jitter.
-  const int kSmallBufferSize = 1024;
-  const int kDefaultCallbackBufferSize = 2048;
-
+  // Always log this because it's relatively hard to get this
+  // information out.
   LOG(INFO) << "audioHardwareBufferSize = " << hardware_buffer_size;
-
-  if (hardware_buffer_size <= kSmallBufferSize)
-    hardware_buffer_size = kDefaultCallbackBufferSize;
-
-  LOG(INFO) << "callbackBufferSize      = " << hardware_buffer_size;
 #endif
 
   return hardware_buffer_size;
@@ -159,30 +144,50 @@
                                      int hardware_buffer_size) {
   DCHECK_NE(0, hardware_buffer_size);
 
-// Other platforms do not currently support custom buffer sizes.
-#if !defined(OS_MACOSX) && !defined(USE_CRAS)
-  return hardware_buffer_size;
-#else
-  const double requested_buffer_size = duration.InSecondsF() * sample_rate;
-  int minimum_buffer_size = hardware_buffer_size;
+  const int requested_buffer_size = duration.InSecondsF() * sample_rate;
 
 // On OSX and CRAS the preferred buffer size is larger than the minimum,
 // however we allow values down to the minimum if requested explicitly.
 #if defined(OS_MACOSX)
-  minimum_buffer_size =
+  const int minimum_buffer_size =
       GetMinAudioBufferSizeMacOS(limits::kMinAudioBufferSize, sample_rate);
+  if (requested_buffer_size > limits::kMaxAudioBufferSize) {
+    // Mac OS is currently the only platform with a max buffer size less than
+    // kMaxWebAudioBufferSize. Since Mac OS audio hardware can run at
+    // kMaxAudioBufferSize (currently 4096) and it only makes sense for Web
+    // Audio to run at multiples of the hardware buffer size, tell Web Audio to
+    // just use web audio max (8192) if the user requests >4096.
+    static_assert(
+        limits::kMaxWebAudioBufferSize % limits::kMaxAudioBufferSize == 0,
+        "Returning kMaxWebAudioBufferSize here assumes it's a multiple of the "
+        "hardware buffer size.");
+    return limits::kMaxWebAudioBufferSize;
+  }
 #elif defined(USE_CRAS)
-  minimum_buffer_size = limits::kMinAudioBufferSize;
+  const int minimum_buffer_size = limits::kMinAudioBufferSize;
+  static_assert(limits::kMaxAudioBufferSize >= limits::kMaxWebAudioBufferSize,
+                "Algorithm needs refactoring if kMaxAudioBufferSize for CRAS "
+                "is lowered.");
+#else
+  const int minimum_buffer_size = hardware_buffer_size;
 #endif
 
-  // Round the requested size to the nearest multiple of the hardware size
-  const int buffer_size =
-      std::round(std::max(requested_buffer_size, 1.0) / hardware_buffer_size) *
-      hardware_buffer_size;
+  // Round requested size up to next multiple of the minimum hardware size. The
+  // minimum hardware size is one that we know is allowed by the platform audio
+  // layer and may be smaller than its preferred buffer size (the
+  // hardware_buffer_size). For platforms where this is supported we know that
+  // using a buffer size that is a multiple of this minimum is safe.
+  const int buffer_size = std::ceil(std::max(requested_buffer_size, 1) /
+                                    static_cast<double>(minimum_buffer_size)) *
+                          minimum_buffer_size;
 
-  return std::min(static_cast<int>(limits::kMaxAudioBufferSize),
+  // The maximum must also be a multiple of the minimum hardware buffer size in
+  // case the clamping below is required.
+  const int maximum_buffer_size =
+      (limits::kMaxWebAudioBufferSize / minimum_buffer_size) *
+      minimum_buffer_size;
+
+  return std::min(maximum_buffer_size,
                   std::max(buffer_size, minimum_buffer_size));
-#endif
 }
-
 }  // namespace media

diff --git a/media/base/audio_latency_unittest.cc b/media/base/audio_latency_unittest.cc
index 98bb341..e638958 100644
--- a/media/base/audio_latency_unittest.cc
+++ b/media/base/audio_latency_unittest.cc

@@ -7,7 +7,9 @@
 #include <stdint.h>
 
 #include "base/logging.h"
+#include "base/time/time.h"
 #include "build/build_config.h"
+#include "media/base/limits.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace media {
@@ -27,16 +29,8 @@
 }
 
 TEST(AudioLatency, InteractiveBufferSizes) {
-#if defined(OS_ANDROID)
-  int i = 6400;
-  for (; i <= 102400; i *= 2)
-    EXPECT_EQ(2048, AudioLatency::GetInteractiveBufferSize(i / 100));
-  for (; i <= 204800; i *= 2)
-    EXPECT_EQ(i / 100, AudioLatency::GetInteractiveBufferSize(i / 100));
-#else
   for (int i = 6400; i <= 204800; i *= 2)
     EXPECT_EQ(i / 100, AudioLatency::GetInteractiveBufferSize(i / 100));
-#endif  // defined(OS_ANDROID)
 }
 
 TEST(AudioLatency, RtcBufferSizes) {
@@ -52,4 +46,69 @@
 #endif  // defined(OS_WIN)
   }
 }
+
+TEST(AudioLatency, ExactBufferSizes) {
+  const int hardware_buffer_size = 256;
+  const int hardware_sample_rate = 44100;
+  const int max_webaudio_buffer_size = 8192;
+
+#if defined(OS_MACOSX) || defined(USE_CRAS)
+  const int minimum_buffer_size = limits::kMinAudioBufferSize;
+#else
+  const int minimum_buffer_size = hardware_buffer_size;
+#endif
+
+  EXPECT_EQ(minimum_buffer_size,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(0.0), hardware_sample_rate,
+                hardware_buffer_size));
+  EXPECT_EQ(
+      minimum_buffer_size,
+      media::AudioLatency::GetExactBufferSize(
+          base::TimeDelta::FromSecondsD(
+              minimum_buffer_size / static_cast<double>(hardware_sample_rate)),
+          hardware_sample_rate, hardware_buffer_size));
+  EXPECT_EQ(minimum_buffer_size * 2,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(
+                    (minimum_buffer_size * 2) /
+                    static_cast<double>(hardware_sample_rate)),
+                hardware_sample_rate, hardware_buffer_size));
+  EXPECT_EQ(minimum_buffer_size * 2,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(
+                    (minimum_buffer_size * 1.1) /
+                    static_cast<double>(hardware_sample_rate)),
+                hardware_sample_rate, hardware_buffer_size));
+  EXPECT_EQ(max_webaudio_buffer_size,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(10.0), hardware_sample_rate,
+                hardware_buffer_size));
+
+#if defined(OS_MACOSX)
+  EXPECT_EQ(limits::kMaxAudioBufferSize,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(
+                    limits::kMaxAudioBufferSize /
+                    static_cast<double>(hardware_sample_rate)),
+                hardware_sample_rate, hardware_buffer_size));
+  EXPECT_EQ(max_webaudio_buffer_size,
+            media::AudioLatency::GetExactBufferSize(
+                base::TimeDelta::FromSecondsD(
+                    (limits::kMaxAudioBufferSize * 1.1) /
+                    static_cast<double>(hardware_sample_rate)),
+                hardware_sample_rate, hardware_buffer_size));
+#endif
+
+  int previous_buffer_size = 0;
+  for (int i = 0; i < 1000; i++) {
+    int buffer_size = media::AudioLatency::GetExactBufferSize(
+        base::TimeDelta::FromSecondsD(i / 1000.0), hardware_sample_rate,
+        hardware_buffer_size);
+    EXPECT_GE(buffer_size, previous_buffer_size);
+    EXPECT_EQ(buffer_size,
+              buffer_size / minimum_buffer_size * minimum_buffer_size);
+    previous_buffer_size = buffer_size;
+  }
+}
 }  // namespace media

diff --git a/media/base/limits.h b/media/base/limits.h
index 2a73c59..5b2cdad 100644
--- a/media/base/limits.h
+++ b/media/base/limits.h

@@ -71,6 +71,9 @@
   kMinAudioBufferSize = 256,
   kMaxAudioBufferSize = 8192,
 #endif
+
+  // Maximum buffer size supported by Web Audio.
+  kMaxWebAudioBufferSize = 8192,
 };
 
 }  // namespace limits

diff --git a/media/base/mac/audio_latency_mac.cc b/media/base/mac/audio_latency_mac.cc
index 223e3ad..a4e9bd59 100644
--- a/media/base/mac/audio_latency_mac.cc
+++ b/media/base/mac/audio_latency_mac.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "media/base/mac/audio_latency_mac.h"
+#include "base/logging.h"
 #include "media/base/limits.h"
 
 namespace media {
@@ -17,6 +18,7 @@
     else if (sample_rate <= 192000)
       buffer_size = 4 * limits::kMinAudioBufferSize;
   }
+  DCHECK_EQ(limits::kMaxWebAudioBufferSize % buffer_size, 0);
   return buffer_size;
 }
 

diff --git a/media/base/mac/video_frame_mac_unittests.cc b/media/base/mac/video_frame_mac_unittests.cc
index c1ebafea..86ecdf5 100644
--- a/media/base/mac/video_frame_mac_unittests.cc
+++ b/media/base/mac/video_frame_mac_unittests.cc

@@ -68,7 +68,7 @@
       {PIXEL_FORMAT_I420, kCVPixelFormatType_420YpCbCr8Planar},
       {PIXEL_FORMAT_YV12, 0},
       {PIXEL_FORMAT_I422, 0},
-      {PIXEL_FORMAT_YV12A, 0},
+      {PIXEL_FORMAT_I420A, 0},
       {PIXEL_FORMAT_I444, 0},
   };
 

diff --git a/media/base/video_frame.cc b/media/base/video_frame.cc
index c53f31b..f13f8ce 100644
--- a/media/base/video_frame.cc
+++ b/media/base/video_frame.cc

@@ -98,7 +98,7 @@
 
   // It is possible to add other planar to planar format conversions here if the
   // use case is there.
-  return source_format == PIXEL_FORMAT_YV12A &&
+  return source_format == PIXEL_FORMAT_I420A &&
          target_format == PIXEL_FORMAT_I420;
 }
 
@@ -130,7 +130,7 @@
     case PIXEL_FORMAT_YUV420P12:
     case PIXEL_FORMAT_YUV422P12:
     case PIXEL_FORMAT_YUV444P12:
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
     case PIXEL_FORMAT_UYVY:
       return true;
     case PIXEL_FORMAT_UNKNOWN:
@@ -501,7 +501,7 @@
   const uint8_t kTransparentA = 0x00;
   const base::TimeDelta kZero;
   scoped_refptr<VideoFrame> frame =
-      CreateFrame(PIXEL_FORMAT_YV12A, size, gfx::Rect(size), size, kZero);
+      CreateFrame(PIXEL_FORMAT_I420A, size, gfx::Rect(size), size, kZero);
   FillYUVA(frame.get(), kBlackY, kBlackUV, kBlackUV, kTransparentA);
   return frame;
 }
@@ -536,7 +536,7 @@
     case PIXEL_FORMAT_YUV422P12:
     case PIXEL_FORMAT_YUV444P12:
       return 3;
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
       return 4;
     case PIXEL_FORMAT_UNKNOWN:
       break;
@@ -834,7 +834,7 @@
     case media::PIXEL_FORMAT_I420:
     case media::PIXEL_FORMAT_YV12:
     case media::PIXEL_FORMAT_I422:
-    case media::PIXEL_FORMAT_YV12A:
+    case media::PIXEL_FORMAT_I420A:
     case media::PIXEL_FORMAT_I444:
     case media::PIXEL_FORMAT_NV12:
     case media::PIXEL_FORMAT_NV21:
@@ -1105,7 +1105,7 @@
 
         case PIXEL_FORMAT_YV12:
         case PIXEL_FORMAT_I420:
-        case PIXEL_FORMAT_YV12A:
+        case PIXEL_FORMAT_I420A:
         case PIXEL_FORMAT_NV12:
         case PIXEL_FORMAT_NV21:
         case PIXEL_FORMAT_MT21:
@@ -1162,7 +1162,7 @@
     case PIXEL_FORMAT_YV12:
     case PIXEL_FORMAT_I420:
     case PIXEL_FORMAT_I422:
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
     case PIXEL_FORMAT_I444:
       return 1;
     case PIXEL_FORMAT_MJPEG:

diff --git a/media/base/video_frame_pool_unittest.cc b/media/base/video_frame_pool_unittest.cc
index 4ce5702..548ece9 100644
--- a/media/base/video_frame_pool_unittest.cc
+++ b/media/base/video_frame_pool_unittest.cc

@@ -89,7 +89,7 @@
 
   // Verify that requesting a frame with a different format causes the pool
   // to get drained.
-  scoped_refptr<VideoFrame> new_frame = CreateFrame(PIXEL_FORMAT_YV12A, 10);
+  scoped_refptr<VideoFrame> new_frame = CreateFrame(PIXEL_FORMAT_I420A, 10);
   CheckPoolSize(0u);
 }
 

diff --git a/media/base/video_frame_unittest.cc b/media/base/video_frame_unittest.cc
index 1e6b1102..b601756 100644
--- a/media/base/video_frame_unittest.cc
+++ b/media/base/video_frame_unittest.cc

@@ -480,7 +480,7 @@
         break;
       case PIXEL_FORMAT_ARGB:
       case PIXEL_FORMAT_XRGB:
-      case PIXEL_FORMAT_YV12A:
+      case PIXEL_FORMAT_I420A:
       case PIXEL_FORMAT_RGB32:
         EXPECT_EQ(60u, VideoFrame::AllocationSize(format, size))
             << VideoPixelFormatToString(format);

diff --git a/media/base/video_types.cc b/media/base/video_types.cc
index b7762fa1..69afe553 100644
--- a/media/base/video_types.cc
+++ b/media/base/video_types.cc

@@ -18,8 +18,8 @@
       return "PIXEL_FORMAT_YV12";
     case PIXEL_FORMAT_I422:
       return "PIXEL_FORMAT_I422";
-    case PIXEL_FORMAT_YV12A:
-      return "PIXEL_FORMAT_YV12A";
+    case PIXEL_FORMAT_I420A:
+      return "PIXEL_FORMAT_I420A";
     case PIXEL_FORMAT_I444:
       return "PIXEL_FORMAT_I444";
     case PIXEL_FORMAT_NV12:
@@ -72,7 +72,7 @@
     case PIXEL_FORMAT_YV12:
     case PIXEL_FORMAT_I420:
     case PIXEL_FORMAT_I422:
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
     case PIXEL_FORMAT_I444:
     case PIXEL_FORMAT_NV12:
     case PIXEL_FORMAT_NV21:
@@ -128,7 +128,7 @@
     case PIXEL_FORMAT_YUV444P12:
     case PIXEL_FORMAT_Y16:
       return true;
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
     case PIXEL_FORMAT_ARGB:
     case PIXEL_FORMAT_RGB32:
       break;

diff --git a/media/base/video_types.h b/media/base/video_types.h
index 8a28a998..793d9ff6 100644
--- a/media/base/video_types.h
+++ b/media/base/video_types.h

@@ -26,7 +26,7 @@
   PIXEL_FORMAT_YV12 = 2,  // 12bpp YVU planar 1x1 Y, 2x2 VU samples.
 
   PIXEL_FORMAT_I422 = 3,   // 16bpp YUV planar 1x1 Y, 2x1 UV samples.
-  PIXEL_FORMAT_YV12A = 4,  // 20bpp YUVA planar 1x1 Y, 2x2 UV, 1x1 A samples.
+  PIXEL_FORMAT_I420A = 4,  // 20bpp YUVA planar 1x1 Y, 2x2 UV, 1x1 A samples.
   PIXEL_FORMAT_I444 = 5,   // 24bpp YUV planar, no subsampling.
   PIXEL_FORMAT_NV12 =
       6,  // 12bpp with Y plane followed by a 2x2 interleaved UV plane.

diff --git a/media/base/video_util.cc b/media/base/video_util.cc
index 8c01dbb5..4f1f396 100644
--- a/media/base/video_util.cc
+++ b/media/base/video_util.cc

@@ -395,7 +395,7 @@
 scoped_refptr<VideoFrame> WrapAsI420VideoFrame(
     const scoped_refptr<VideoFrame>& frame) {
   DCHECK_EQ(VideoFrame::STORAGE_OWNED_MEMORY, frame->storage_type());
-  DCHECK_EQ(PIXEL_FORMAT_YV12A, frame->format());
+  DCHECK_EQ(PIXEL_FORMAT_I420A, frame->format());
 
   scoped_refptr<media::VideoFrame> wrapped_frame =
       media::VideoFrame::WrapVideoFrame(frame, PIXEL_FORMAT_I420,

diff --git a/media/ffmpeg/ffmpeg_common.cc b/media/ffmpeg/ffmpeg_common.cc
index 25285c52..2ae56120 100644
--- a/media/ffmpeg/ffmpeg_common.cc
+++ b/media/ffmpeg/ffmpeg_common.cc

@@ -524,7 +524,7 @@
   AVDictionaryEntry* webm_alpha =
       av_dict_get(stream->metadata, "alpha_mode", nullptr, 0);
   if (webm_alpha && !strcmp(webm_alpha->value, "1")) {
-    format = PIXEL_FORMAT_YV12A;
+    format = PIXEL_FORMAT_I420A;
   }
 
   VideoRotation video_rotation = VIDEO_ROTATION_0;
@@ -703,7 +703,7 @@
       return PIXEL_FORMAT_I422;
 
     case AV_PIX_FMT_YUVA420P:
-      return PIXEL_FORMAT_YV12A;
+      return PIXEL_FORMAT_I420A;
 
     case AV_PIX_FMT_YUV420P9LE:
       return PIXEL_FORMAT_YUV420P9;
@@ -741,7 +741,7 @@
 
     case PIXEL_FORMAT_I422:
       return AV_PIX_FMT_YUV422P;
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
       return AV_PIX_FMT_YUVA420P;
     case PIXEL_FORMAT_I444:
       return AV_PIX_FMT_YUV444P;

diff --git a/media/filters/gpu_video_decoder.cc b/media/filters/gpu_video_decoder.cc
index 22331c9b..02243a6d 100644
--- a/media/filters/gpu_video_decoder.cc
+++ b/media/filters/gpu_video_decoder.cc

@@ -177,7 +177,7 @@
 
   // TODO(sandersd): This should be moved to capabilities if we ever have a
   // hardware decoder which supports alpha formats.
-  if (config.format() == PIXEL_FORMAT_YV12A) {
+  if (config.format() == PIXEL_FORMAT_I420A) {
     DVLOG(1) << "Alpha transparency formats are not supported.";
     bound_init_cb.Run(false);
     return;

diff --git a/media/filters/vpx_video_decoder.cc b/media/filters/vpx_video_decoder.cc
index fddbefe6..40d0ebdc 100644
--- a/media/filters/vpx_video_decoder.cc
+++ b/media/filters/vpx_video_decoder.cc

@@ -238,15 +238,15 @@
   // These are the combinations of codec-pixel format supported in principle.
   DCHECK(
       (config.codec() == kCodecVP8 && config.format() == PIXEL_FORMAT_YV12) ||
-      (config.codec() == kCodecVP8 && config.format() == PIXEL_FORMAT_YV12A) ||
+      (config.codec() == kCodecVP8 && config.format() == PIXEL_FORMAT_I420A) ||
       (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_YV12) ||
-      (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_YV12A) ||
+      (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_I420A) ||
       (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_I444));
 
 #if !defined(DISABLE_FFMPEG_VIDEO_DECODERS)
   // When FFmpegVideoDecoder is available it handles VP8 that doesn't have
   // alpha, and VpxVideoDecoder will handle VP8 with alpha.
-  if (config.codec() == kCodecVP8 && config.format() != PIXEL_FORMAT_YV12A)
+  if (config.codec() == kCodecVP8 && config.format() != PIXEL_FORMAT_I420A)
     return false;
 #endif
 
@@ -274,7 +274,7 @@
     }
   }
 
-  if (config.format() != PIXEL_FORMAT_YV12A)
+  if (config.format() != PIXEL_FORMAT_I420A)
     return true;
 
   DCHECK(!vpx_codec_alpha_);
@@ -506,7 +506,7 @@
   VideoPixelFormat codec_format;
   switch (vpx_image->fmt) {
     case VPX_IMG_FMT_I420:
-      codec_format = vpx_image_alpha ? PIXEL_FORMAT_YV12A : PIXEL_FORMAT_YV12;
+      codec_format = vpx_image_alpha ? PIXEL_FORMAT_I420A : PIXEL_FORMAT_YV12;
       break;
 
     case VPX_IMG_FMT_I444:
@@ -602,7 +602,7 @@
   }
 
   DCHECK(codec_format == PIXEL_FORMAT_YV12 ||
-         codec_format == PIXEL_FORMAT_YV12A);
+         codec_format == PIXEL_FORMAT_I420A);
 
   *video_frame = frame_pool_.CreateFrame(codec_format, visible_size,
                                          gfx::Rect(visible_size),

diff --git a/media/filters/vpx_video_decoder_fuzzertest.cc b/media/filters/vpx_video_decoder_fuzzertest.cc
index d0fe8c01..c56df666a 100644
--- a/media/filters/vpx_video_decoder_fuzzertest.cc
+++ b/media/filters/vpx_video_decoder_fuzzertest.cc

@@ -62,7 +62,7 @@
   if (rng() & 1) {
     codec = kCodecVP8;
     // PIXEL_FORMAT_YV12 disabled for kCodecVP8 on Linux.
-    pixel_format = PIXEL_FORMAT_YV12A;
+    pixel_format = PIXEL_FORMAT_I420A;
   } else {
     codec = kCodecVP9;
     switch (rng() % 3) {
@@ -70,7 +70,7 @@
         pixel_format = PIXEL_FORMAT_YV12;
         break;
       case 1:
-        pixel_format = PIXEL_FORMAT_YV12A;
+        pixel_format = PIXEL_FORMAT_I420A;
         break;
       case 2:
         pixel_format = PIXEL_FORMAT_I444;

diff --git a/media/formats/webm/webm_video_client.cc b/media/formats/webm/webm_video_client.cc
index bcd420a..faeb6a7 100644
--- a/media/formats/webm/webm_video_client.cc
+++ b/media/formats/webm/webm_video_client.cc

@@ -78,7 +78,7 @@
   }
 
   VideoPixelFormat format =
-      (alpha_mode_ == 1) ? PIXEL_FORMAT_YV12A : PIXEL_FORMAT_YV12;
+      (alpha_mode_ == 1) ? PIXEL_FORMAT_I420A : PIXEL_FORMAT_YV12;
 
   if (pixel_width_ <= 0 || pixel_height_ <= 0)
     return false;

diff --git a/media/gpu/vaapi/vaapi_drm_picture.cc b/media/gpu/vaapi/vaapi_drm_picture.cc
index 609e932..7bf98222 100644
--- a/media/gpu/vaapi/vaapi_drm_picture.cc
+++ b/media/gpu/vaapi/vaapi_drm_picture.cc

@@ -8,6 +8,7 @@
 #include "media/gpu/vaapi/va_surface.h"
 #include "media/gpu/vaapi/vaapi_wrapper.h"
 #include "ui/gfx/gpu_memory_buffer.h"
+#include "ui/gfx/linux/native_pixmap_dmabuf.h"
 #include "ui/gfx/native_pixmap.h"
 #include "ui/gl/gl_bindings.h"
 #include "ui/gl/gl_image_native_pixmap.h"
@@ -74,12 +75,15 @@
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(pixmap_);
 
+  // Create a |va_surface_| from dmabuf fds (pixmap->GetDmaBufFd)
   va_surface_ = vaapi_wrapper_->CreateVASurfaceForPixmap(pixmap_);
   if (!va_surface_) {
     LOG(ERROR) << "Failed creating VASurface for NativePixmap";
     return false;
   }
 
+#if defined(USE_OZONE)
+  // Import dmabuf fds into the output gl texture through EGLImage.
   if (texture_id_ != 0 && !make_context_current_cb_.is_null()) {
     if (!make_context_current_cb_.Run())
       return false;
@@ -100,6 +104,11 @@
       return false;
     }
   }
+#else
+  // On non-ozone, no need to import dmabuf fds into output the gl texture
+  // because the dmabuf fds have been made from it.
+  DCHECK(pixmap_->AreDmaBufFdsValid());
+#endif
 
   if (client_texture_id_ != 0 && !bind_image_cb_.is_null()) {
     if (!bind_image_cb_.Run(client_texture_id_, texture_target_, gl_image_,
@@ -114,14 +123,56 @@
 
 bool VaapiDrmPicture::Allocate(gfx::BufferFormat format) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+// The goal of this method (ozone and non-ozone) is to allocate the
+// |pixmap_| which is a gl::GLImageNativePixmap.
 #if defined(USE_OZONE)
   ui::OzonePlatform* platform = ui::OzonePlatform::GetInstance();
   ui::SurfaceFactoryOzone* factory = platform->GetSurfaceFactoryOzone();
   pixmap_ = factory->CreateNativePixmap(gfx::kNullAcceleratedWidget, size_,
                                         format, gfx::BufferUsage::SCANOUT);
 #else
-  // TODO(jisorce): Implement non-ozone case, see https://crbug.com/785201.
-  NOTIMPLEMENTED();
+  // Export the gl texture as dmabuf.
+  if (texture_id_ != 0 && !make_context_current_cb_.is_null()) {
+    if (!make_context_current_cb_.Run())
+      return false;
+
+    scoped_refptr<gl::GLImageNativePixmap> image(new gl::GLImageNativePixmap(
+        size_, BufferFormatToInternalFormat(format)));
+
+    // Create an EGLImage from a gl texture
+    if (!image->InitializeFromTexture(texture_id_)) {
+      DLOG(ERROR) << "Failed to initialize eglimage from texture id: "
+                  << texture_id_;
+      return false;
+    }
+
+    // Export the EGLImage as dmabuf.
+    gfx::NativePixmapHandle native_pixmap_handle = image->ExportHandle();
+    if (!native_pixmap_handle.planes.size()) {
+      DLOG(ERROR) << "Failed to export EGLImage as dmabuf fds";
+      return false;
+    }
+
+    // Convert NativePixmapHandle to NativePixmapDmaBuf.
+    scoped_refptr<gfx::NativePixmap> native_pixmap_dmabuf(
+        new gfx::NativePixmapDmaBuf(size_, format, native_pixmap_handle));
+    if (!native_pixmap_dmabuf->AreDmaBufFdsValid()) {
+      DLOG(ERROR) << "Invalid dmabuf fds";
+      return false;
+    }
+
+    if (!image->BindTexImage(texture_target_)) {
+      DLOG(ERROR) << "Failed to bind texture to GLImage";
+      return false;
+    }
+
+    // The |pixmap_| takes ownership of the dmabuf fds. So the only reason to
+    // to keep a reference on the image is because the GPU service needs to
+    // track this image as it will be attached to a client texture.
+    pixmap_ = native_pixmap_dmabuf;
+    gl_image_ = image;
+  }
 #endif  // USE_OZONE
 
   if (!pixmap_) {

diff --git a/media/remoting/proto_enum_utils.cc b/media/remoting/proto_enum_utils.cc
index 0eb93d5..452fb3f 100644
--- a/media/remoting/proto_enum_utils.cc
+++ b/media/remoting/proto_enum_utils.cc

@@ -328,7 +328,7 @@
     CASE_RETURN_OTHER(PIXEL_FORMAT_I420);
     CASE_RETURN_OTHER(PIXEL_FORMAT_YV12);
     CASE_RETURN_OTHER(PIXEL_FORMAT_I422);
-    CASE_RETURN_OTHER(PIXEL_FORMAT_YV12A);
+    CASE_RETURN_OTHER(PIXEL_FORMAT_I420A);
     CASE_RETURN_OTHER(PIXEL_FORMAT_I444);
     CASE_RETURN_OTHER(PIXEL_FORMAT_NV12);
     CASE_RETURN_OTHER(PIXEL_FORMAT_NV21);
@@ -366,7 +366,7 @@
     CASE_RETURN_OTHER(PIXEL_FORMAT_I420);
     CASE_RETURN_OTHER(PIXEL_FORMAT_YV12);
     CASE_RETURN_OTHER(PIXEL_FORMAT_I422);
-    CASE_RETURN_OTHER(PIXEL_FORMAT_YV12A);
+    CASE_RETURN_OTHER(PIXEL_FORMAT_I420A);
     CASE_RETURN_OTHER(PIXEL_FORMAT_I444);
     CASE_RETURN_OTHER(PIXEL_FORMAT_NV12);
     CASE_RETURN_OTHER(PIXEL_FORMAT_NV21);

diff --git a/media/remoting/rpc.proto b/media/remoting/rpc.proto
index 4baecb3..c5691be 100644
--- a/media/remoting/rpc.proto
+++ b/media/remoting/rpc.proto

@@ -193,7 +193,7 @@
     PIXEL_FORMAT_I420 = 1;
     PIXEL_FORMAT_YV12 = 2;
     PIXEL_FORMAT_I422 = 3;
-    PIXEL_FORMAT_YV12A = 4;
+    PIXEL_FORMAT_I420A = 4;
     PIXEL_FORMAT_I444 = 5;
     PIXEL_FORMAT_NV12 = 6;
     PIXEL_FORMAT_NV21 = 7;

diff --git a/media/renderers/paint_canvas_video_renderer.cc b/media/renderers/paint_canvas_video_renderer.cc
index 8a6afd0..6d00c59c 100644
--- a/media/renderers/paint_canvas_video_renderer.cc
+++ b/media/renderers/paint_canvas_video_renderer.cc

@@ -261,7 +261,7 @@
         // TODO(rileya): Skia currently doesn't support YUVA conversion. Remove
         // this case once it does. As-is we will fall back on the pure-software
         // path in this case.
-        frame_->format() == PIXEL_FORMAT_YV12A) {
+        frame_->format() == PIXEL_FORMAT_I420A) {
       return false;
     }
 
@@ -294,7 +294,7 @@
     DCHECK_EQ(frame_index, 0u);
 
     media::VideoPixelFormat format = frame_->format();
-    DCHECK(media::IsYuvPlanar(format) && format != PIXEL_FORMAT_YV12A);
+    DCHECK(media::IsYuvPlanar(format) && format != PIXEL_FORMAT_I420A);
 
     for (int plane = VideoFrame::kYPlane; plane <= VideoFrame::kVPlane;
          ++plane) {
@@ -743,7 +743,7 @@
                           video_frame->visible_rect().height());
       break;
 
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
       LIBYUV_I420ALPHA_TO_ARGB(
           video_frame->visible_data(VideoFrame::kYPlane),
           video_frame->stride(VideoFrame::kYPlane),

diff --git a/media/renderers/video_renderer_impl_unittest.cc b/media/renderers/video_renderer_impl_unittest.cc
index 8013ead..db092e8 100644
--- a/media/renderers/video_renderer_impl_unittest.cc
+++ b/media/renderers/video_renderer_impl_unittest.cc

@@ -1407,7 +1407,7 @@
 
   gfx::Size frame_size(8, 8);
   VideoPixelFormat opaque_format = PIXEL_FORMAT_YV12;
-  VideoPixelFormat non_opaque_format = PIXEL_FORMAT_YV12A;
+  VideoPixelFormat non_opaque_format = PIXEL_FORMAT_I420A;
 
   QueueFrame(DecodeStatus::OK,
              VideoFrame::CreateFrame(non_opaque_format, frame_size,

diff --git a/media/test/pipeline_integration_test.cc b/media/test/pipeline_integration_test.cc
index 56fb2d54..0637865 100644
--- a/media/test/pipeline_integration_test.cc
+++ b/media/test/pipeline_integration_test.cc

@@ -2525,7 +2525,7 @@
   ASSERT_EQ(PIPELINE_OK, Start("bear-vp8a.webm"));
   Play();
   ASSERT_TRUE(WaitUntilOnEnded());
-  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_YV12A);
+  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_I420A);
 }
 
 // Verify that VP8A video with odd width/height can be played back.
@@ -2533,7 +2533,7 @@
   ASSERT_EQ(PIPELINE_OK, Start("bear-vp8a-odd-dimensions.webm"));
   Play();
   ASSERT_TRUE(WaitUntilOnEnded());
-  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_YV12A);
+  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_I420A);
 }
 
 // Verify that VP9 video with odd width/height can be played back.
@@ -2548,7 +2548,7 @@
   ASSERT_EQ(PIPELINE_OK, Start("bear-vp9a.webm"));
   Play();
   ASSERT_TRUE(WaitUntilOnEnded());
-  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_YV12A);
+  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_I420A);
 }
 
 // Verify that VP9A video with odd width/height can be played back.
@@ -2556,7 +2556,7 @@
   ASSERT_EQ(PIPELINE_OK, Start("bear-vp9a-odd-dimensions.webm"));
   Play();
   ASSERT_TRUE(WaitUntilOnEnded());
-  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_YV12A);
+  EXPECT_VIDEO_FORMAT_EQ(last_video_frame_format_, PIXEL_FORMAT_I420A);
 }
 
 // Verify that VP8 video with inband text track can be played back.

diff --git a/media/video/gpu_memory_buffer_video_frame_pool.cc b/media/video/gpu_memory_buffer_video_frame_pool.cc
index 1dc71a0..e3cc8a6 100644
--- a/media/video/gpu_memory_buffer_video_frame_pool.cc
+++ b/media/video/gpu_memory_buffer_video_frame_pool.cc

@@ -435,7 +435,7 @@
     case PIXEL_FORMAT_I420:
       break;
     // Unsupported cases.
-    case PIXEL_FORMAT_YV12A:
+    case PIXEL_FORMAT_I420A:
     case PIXEL_FORMAT_I422:
     case PIXEL_FORMAT_I444:
     case PIXEL_FORMAT_NV12:

diff --git a/net/dns/dns_transaction_unittest.cc b/net/dns/dns_transaction_unittest.cc
index faf2faa..1a966e1 100644
--- a/net/dns/dns_transaction_unittest.cc
+++ b/net/dns/dns_transaction_unittest.cc

@@ -12,11 +12,11 @@
 #include "base/bind.h"
 #include "base/containers/circular_deque.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/rand_util.h"
 #include "base/run_loop.h"
 #include "base/sys_byteorder.h"
-#include "base/test/test_timeouts.h"
+#include "base/test/scoped_task_environment.h"
+#include "base/time/time.h"
 #include "net/base/ip_address.h"
 #include "net/dns/dns_protocol.h"
 #include "net/dns/dns_query.h"
@@ -27,6 +27,7 @@
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_test_util.h"
 #include "net/test/gtest_util.h"
+#include "net/test/net_test_suite.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -38,6 +39,8 @@
 
 namespace {
 
+base::TimeDelta kTimeout = base::TimeDelta::FromSeconds(1);
+
 std::string DomainFromDot(const base::StringPiece& dotted) {
   std::string out;
   EXPECT_TRUE(DNSDomainFromDot(dotted, &out));
@@ -239,7 +242,6 @@
         qtype_(qtype),
         expected_answer_count_(expected_answer_count),
         cancel_in_callback_(false),
-        quit_in_callback_(false),
         completed_(false) {}
 
   // Mark that the transaction shall be destroyed immediately upon callback.
@@ -247,11 +249,6 @@
     cancel_in_callback_ = true;
   }
 
-  // Mark to call MessageLoop::QuitWhenIdle() upon callback.
-  void set_quit_in_callback() {
-    quit_in_callback_ = true;
-  }
-
   void StartTransaction(DnsTransactionFactory* factory) {
     EXPECT_EQ(NULL, transaction_.get());
     transaction_ = factory->CreateTransaction(
@@ -281,10 +278,6 @@
       return;
     }
 
-    // Tell MessageLoop to quit now, in case any ASSERT_* fails.
-    if (quit_in_callback_)
-      base::RunLoop::QuitCurrentWhenIdleDeprecated();
-
     if (expected_answer_count_ >= 0) {
       ASSERT_THAT(rv, IsOk());
       ASSERT_TRUE(response != NULL);
@@ -314,11 +307,16 @@
     return has_completed();
   }
 
-  // Use when some of the responses are timeouts.
-  bool RunUntilDone(DnsTransactionFactory* factory) {
-    set_quit_in_callback();
-    StartTransaction(factory);
-    base::RunLoop().Run();
+  bool FastForwardByTimeout(DnsSession* session,
+                            unsigned server_index,
+                            int attempt) {
+    NetTestSuite::GetScopedTaskEnvironment()->FastForwardBy(
+        session->NextTimeout(server_index, attempt));
+    return has_completed();
+  }
+
+  bool FastForwardAll() {
+    NetTestSuite::GetScopedTaskEnvironment()->FastForwardUntilNoTasksRemain();
     return has_completed();
   }
 
@@ -328,7 +326,6 @@
   std::unique_ptr<DnsTransaction> transaction_;
   int expected_answer_count_;
   bool cancel_in_callback_;
-  bool quit_in_callback_;
 
   bool completed_;
 };
@@ -449,12 +446,14 @@
   }
 
   void SetUp() override {
+    NetTestSuite::SetScopedTaskEnvironment(
+        base::test::ScopedTaskEnvironment::MainThreadType::MOCK_TIME);
     // By default set one server,
     ConfigureNumServers(1);
     // and no retransmissions,
     config_.attempts = 1;
-    // but long enough timeout for memory tests.
-    config_.timeout = TestTimeouts::action_timeout();
+    // and an arbitrary timeout.
+    config_.timeout = kTimeout;
     ConfigureFactory();
   }
 
@@ -463,6 +462,8 @@
     for (size_t i = 0; i < socket_data_.size(); ++i) {
       EXPECT_TRUE(socket_data_[i]->GetProvider()->AllWriteDataConsumed()) << i;
     }
+    NetTestSuite::SetScopedTaskEnvironment(
+        base::test::ScopedTaskEnvironment::MainThreadType::IO);
   }
 
  protected:
@@ -594,7 +595,6 @@
 
 TEST_F(DnsTransactionTest, MismatchedResponseSync) {
   config_.attempts = 2;
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   // Attempt receives mismatched response followed by valid response.
@@ -607,12 +607,11 @@
   AddSocketData(std::move(data));
 
   TransactionHelper helper0(kT0HostName, kT0Qtype, kT0RecordCount);
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
+  EXPECT_TRUE(helper0.Run(transaction_factory_.get()));
 }
 
 TEST_F(DnsTransactionTest, MismatchedResponseAsync) {
   config_.attempts = 2;
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   // First attempt receives mismatched response followed by valid response.
@@ -627,11 +626,10 @@
   AddQueryAndTimeout(kT0HostName, kT0Qtype);
 
   TransactionHelper helper0(kT0HostName, kT0Qtype, kT0RecordCount);
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
+  EXPECT_TRUE(helper0.Run(transaction_factory_.get()));
 }
 
 TEST_F(DnsTransactionTest, MismatchedResponseFail) {
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   // Attempt receives mismatched response but times out because only one attempt
@@ -640,12 +638,12 @@
                            kT0ResponseDatagram, arraysize(kT0ResponseDatagram));
 
   TransactionHelper helper0(kT0HostName, kT0Qtype, ERR_DNS_TIMED_OUT);
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
+  EXPECT_FALSE(helper0.Run(transaction_factory_.get()));
+  EXPECT_TRUE(helper0.FastForwardByTimeout(session_.get(), 0, 0));
 }
 
 TEST_F(DnsTransactionTest, MismatchedResponseNxdomain) {
   config_.attempts = 2;
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   // First attempt receives mismatched response followed by valid NXDOMAIN
@@ -679,8 +677,6 @@
 
 TEST_F(DnsTransactionTest, Timeout) {
   config_.attempts = 3;
-  // Use short timeout to speed up the test.
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   AddQueryAndTimeout(kT0HostName, kT0Qtype);
@@ -688,8 +684,12 @@
   AddQueryAndTimeout(kT0HostName, kT0Qtype);
 
   TransactionHelper helper0(kT0HostName, kT0Qtype, ERR_DNS_TIMED_OUT);
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
-  EXPECT_TRUE(base::MessageLoop::current()->IsIdleForTesting());
+
+  // Finish when the third attempt times out.
+  EXPECT_FALSE(helper0.Run(transaction_factory_.get()));
+  EXPECT_FALSE(helper0.FastForwardByTimeout(session_.get(), 0, 0));
+  EXPECT_FALSE(helper0.FastForwardByTimeout(session_.get(), 0, 1));
+  EXPECT_TRUE(helper0.FastForwardByTimeout(session_.get(), 0, 2));
 }
 
 TEST_F(DnsTransactionTest, ServerFallbackAndRotate) {
@@ -698,8 +698,6 @@
   // The next request should start from the next server.
   config_.rotate = true;
   ConfigureNumServers(3);
-  // Use short timeout to speed up the test.
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   // Responses for first request.
@@ -716,7 +714,8 @@
   TransactionHelper helper0(kT0HostName, kT0Qtype, ERR_NAME_NOT_RESOLVED);
   TransactionHelper helper1(kT1HostName, kT1Qtype, ERR_NAME_NOT_RESOLVED);
 
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
+  EXPECT_FALSE(helper0.Run(transaction_factory_.get()));
+  EXPECT_TRUE(helper0.FastForwardAll());
   EXPECT_TRUE(helper1.Run(transaction_factory_.get()));
 
   unsigned kOrder[] = {
@@ -982,7 +981,6 @@
 }
 
 TEST_F(DnsTransactionTest, TCPTimeout) {
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
   AddAsyncQueryAndRcode(kT0HostName, kT0Qtype,
                         dns_protocol::kRcodeNOERROR | dns_protocol::kFlagTC);
@@ -990,7 +988,8 @@
                                                 kT0Qtype, ASYNC, true));
 
   TransactionHelper helper0(kT0HostName, kT0Qtype, ERR_DNS_TIMED_OUT);
-  EXPECT_TRUE(helper0.RunUntilDone(transaction_factory_.get()));
+  EXPECT_FALSE(helper0.Run(transaction_factory_.get()));
+  EXPECT_TRUE(helper0.FastForwardAll());
 }
 
 TEST_F(DnsTransactionTest, TCPReadReturnsZeroAsync) {
@@ -1057,7 +1056,6 @@
 
 TEST_F(DnsTransactionTest, MismatchedThenNxdomainThenTCP) {
   config_.attempts = 2;
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
   std::unique_ptr<DnsSocketData> data(
       new DnsSocketData(0 /* id */, kT0HostName, kT0Qtype, SYNCHRONOUS, false));
@@ -1080,7 +1078,6 @@
 
 TEST_F(DnsTransactionTest, MismatchedThenOkThenTCP) {
   config_.attempts = 2;
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
   std::unique_ptr<DnsSocketData> data(
       new DnsSocketData(0 /* id */, kT0HostName, kT0Qtype, SYNCHRONOUS, false));
@@ -1104,7 +1101,6 @@
 }
 
 TEST_F(DnsTransactionTest, InvalidQuery) {
-  config_.timeout = TestTimeouts::tiny_timeout();
   ConfigureFactory();
 
   TransactionHelper helper0(".", dns_protocol::kTypeA, ERR_INVALID_ARGUMENT);

diff --git a/remoting/ios/session/BUILD.gn b/remoting/ios/session/BUILD.gn
index 97f3f19..03131b5 100644
--- a/remoting/ios/session/BUILD.gn
+++ b/remoting/ios/session/BUILD.gn

@@ -16,6 +16,7 @@
 
   deps = [
     "//base",
+    "//ios/third_party/material_components_ios",
     "//remoting/client",
     "//remoting/client/display",
     "//remoting/client/ui",

diff --git a/services/identity/public/cpp/primary_account_access_token_fetcher.cc b/services/identity/public/cpp/primary_account_access_token_fetcher.cc
index 31763c7..27676f9 100644
--- a/services/identity/public/cpp/primary_account_access_token_fetcher.cc
+++ b/services/identity/public/cpp/primary_account_access_token_fetcher.cc

@@ -8,6 +8,8 @@
 
 #include "base/logging.h"
 
+namespace identity {
+
 PrimaryAccountAccessTokenFetcher::PrimaryAccountAccessTokenFetcher(
     const std::string& oauth_consumer_name,
     SigninManagerBase* signin_manager,
@@ -167,3 +169,5 @@
 
   std::move(callback_).Run(error, std::string());
 }
+
+}  // namespace identity

diff --git a/services/identity/public/cpp/primary_account_access_token_fetcher.h b/services/identity/public/cpp/primary_account_access_token_fetcher.h
index ed91da98..88a95f20 100644
--- a/services/identity/public/cpp/primary_account_access_token_fetcher.h
+++ b/services/identity/public/cpp/primary_account_access_token_fetcher.h

@@ -14,6 +14,8 @@
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "google_apis/gaia/oauth2_token_service.h"
 
+namespace identity {
+
 // Helper class to ease the task of obtaining an OAuth2 access token for the
 // authenticated account. This handles various special cases, e.g. when the
 // refresh token isn't loaded yet (during startup), or when there is some
@@ -82,4 +84,6 @@
   DISALLOW_COPY_AND_ASSIGN(PrimaryAccountAccessTokenFetcher);
 };
 
+}  // namespace identity
+
 #endif  // SERVICES_IDENTITY_PUBLIC_CPP_PRIMARY_ACCOUNT_ACCESS_TOKEN_FETCHER_H_

diff --git a/services/identity/public/cpp/primary_account_access_token_fetcher_unittest.cc b/services/identity/public/cpp/primary_account_access_token_fetcher_unittest.cc
index cc90529..749e707 100644
--- a/services/identity/public/cpp/primary_account_access_token_fetcher_unittest.cc
+++ b/services/identity/public/cpp/primary_account_access_token_fetcher_unittest.cc

@@ -36,6 +36,8 @@
 using SigninManagerForTest = FakeSigninManager;
 #endif  // OS_CHROMEOS
 
+namespace identity {
+
 class PrimaryAccountAccessTokenFetcherTest : public testing::Test {
  public:
   using TestTokenCallback =
@@ -399,3 +401,5 @@
       "account",
       GoogleServiceAuthError(GoogleServiceAuthError::SERVICE_UNAVAILABLE));
 }
+
+}  // namespace identity

diff --git a/services/ui/public/cpp/gpu/gpu.cc b/services/ui/public/cpp/gpu/gpu.cc
index bbcc1f21..e3e366f 100644
--- a/services/ui/public/cpp/gpu/gpu.cc
+++ b/services/ui/public/cpp/gpu/gpu.cc

@@ -32,6 +32,66 @@
 
 }  // namespace
 
+// Encapsulates a mojom::GpuPtr object that will be used on the IO thread. This
+// is required because we can't install an error handler on a
+// mojom::GpuThreadSafePtr to detect if the message pipe was closed. Only the
+// constructor can be called on the main thread.
+class Gpu::GpuPtrIO {
+ public:
+  GpuPtrIO() { DETACH_FROM_THREAD(thread_checker_); }
+  ~GpuPtrIO() { DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); }
+
+  void Initialize(mojom::GpuPtrInfo ptr_info) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+    gpu_ptr_.Bind(std::move(ptr_info));
+    gpu_ptr_.set_connection_error_handler(
+        base::BindOnce(&GpuPtrIO::ConnectionError, base::Unretained(this)));
+  }
+
+  void EstablishGpuChannel(scoped_refptr<EstablishRequest> establish_request) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    DCHECK(!establish_request_);
+    establish_request_ = std::move(establish_request);
+
+    if (gpu_ptr_.encountered_error()) {
+      ConnectionError();
+    } else {
+      gpu_ptr_->EstablishGpuChannel(base::BindRepeating(
+          &GpuPtrIO::OnEstablishedGpuChannel, base::Unretained(this)));
+    }
+  }
+
+  void CreateJpegDecodeAccelerator(
+      media::mojom::JpegDecodeAcceleratorRequest request) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    gpu_ptr_->CreateJpegDecodeAccelerator(std::move(request));
+  }
+
+  void CreateVideoEncodeAcceleratorProvider(
+      media::mojom::VideoEncodeAcceleratorProviderRequest request) {
+    DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+    gpu_ptr_->CreateVideoEncodeAcceleratorProvider(std::move(request));
+  }
+
+ private:
+  void ConnectionError();
+  void OnEstablishedGpuChannel(int client_id,
+                               mojo::ScopedMessagePipeHandle channel_handle,
+                               const gpu::GPUInfo& gpu_info,
+                               const gpu::GpuFeatureInfo& gpu_feature_info);
+
+  ui::mojom::GpuPtr gpu_ptr_;
+
+  // This will point to a request that is waiting for the result of
+  // EstablishGpuChannel(). |establish_request_| will be notified when the IPC
+  // callback fires or if an interface connection error occurs.
+  scoped_refptr<EstablishRequest> establish_request_;
+  THREAD_CHECKER(thread_checker_);
+
+  DISALLOW_COPY_AND_ASSIGN(GpuPtrIO);
+};
+
 // Encapsulates a single request to establish a GPU channel.
 class Gpu::EstablishRequest
     : public base::RefCountedThreadSafe<Gpu::EstablishRequest> {
@@ -46,15 +106,15 @@
 
   // Sends EstablishGpuChannel() request using |gpu|. This must be called from
   // the IO thread so that the response is handled on the IO thread.
-  void SendRequest(mojom::ThreadSafeGpuPtr* gpu) {
+  void SendRequest(GpuPtrIO* gpu) {
     DCHECK(!main_task_runner_->BelongsToCurrentThread());
-    base::AutoLock lock(lock_);
+    {
+      base::AutoLock lock(lock_);
+      if (finished_)
+        return;
+    }
 
-    if (finished_)
-      return;
-
-    (*gpu)->EstablishGpuChannel(
-        base::Bind(&EstablishRequest::OnEstablishedGpuChannel, this));
+    gpu->EstablishGpuChannel(this);
   }
 
   // Sets a WaitableEvent so the main thread can block for a synchronous
@@ -101,11 +161,6 @@
     parent_->OnEstablishedGpuChannel();
   }
 
- protected:
-  friend class base::RefCountedThreadSafe<Gpu::EstablishRequest>;
-
-  virtual ~EstablishRequest() = default;
-
   void OnEstablishedGpuChannel(int client_id,
                                mojo::ScopedMessagePipeHandle channel_handle,
                                const gpu::GPUInfo& gpu_info,
@@ -134,6 +189,11 @@
     }
   }
 
+ private:
+  friend class base::RefCountedThreadSafe<Gpu::EstablishRequest>;
+
+  virtual ~EstablishRequest() = default;
+
   Gpu* const parent_;
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
   base::WaitableEvent* establish_event_ = nullptr;
@@ -147,16 +207,52 @@
   DISALLOW_COPY_AND_ASSIGN(EstablishRequest);
 };
 
+void Gpu::GpuPtrIO::ConnectionError() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  if (!establish_request_)
+    return;
+
+  // Make sure |establish_request_| fails so the main thread doesn't block
+  // forever after calling Gpu::EstablishGpuChannelSync().
+  establish_request_->OnEstablishedGpuChannel(
+      0, mojo::ScopedMessagePipeHandle(), gpu::GPUInfo(),
+      gpu::GpuFeatureInfo());
+  establish_request_ = nullptr;
+}
+
+void Gpu::GpuPtrIO::OnEstablishedGpuChannel(
+    int client_id,
+    mojo::ScopedMessagePipeHandle channel_handle,
+    const gpu::GPUInfo& gpu_info,
+    const gpu::GpuFeatureInfo& gpu_feature_info) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(establish_request_);
+
+  establish_request_->OnEstablishedGpuChannel(
+      client_id, std::move(channel_handle), std::move(gpu_info),
+      std::move(gpu_feature_info));
+  establish_request_ = nullptr;
+}
+
 Gpu::Gpu(GpuPtrFactory factory,
          scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : main_task_runner_(base::ThreadTaskRunnerHandle::Get()),
       io_task_runner_(std::move(task_runner)),
       gpu_memory_buffer_manager_(
           std::make_unique<ClientGpuMemoryBufferManager>(factory.Run())),
-      gpu_(mojom::ThreadSafeGpuPtr::Create(factory.Run().PassInterface(),
-                                           io_task_runner_)) {
+      gpu_(new GpuPtrIO(), base::OnTaskRunnerDeleter(io_task_runner_)) {
   DCHECK(main_task_runner_);
   DCHECK(io_task_runner_);
+
+  // Initialize mojom::GpuPtr on the IO thread. |gpu_| can only be used on the
+  // IO thread after this point. It is safe to use base::Unretained with |gpu_|
+  // for IO thread tasks as |gpu_| is destroyed by an IO thread task posted from
+  // the destructor.
+  io_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&GpuPtrIO::Initialize, base::Unretained(gpu_.get()),
+                     base::Passed(factory.Run().PassInterface())));
 }
 
 Gpu::~Gpu() {
@@ -165,7 +261,7 @@
     pending_request_->Cancel();
     pending_request_ = nullptr;
   }
-  gpu_ = nullptr;
+
   if (gpu_channel_)
     gpu_channel_->DestroyChannel();
 }
@@ -208,14 +304,19 @@
 void Gpu::CreateJpegDecodeAccelerator(
     media::mojom::JpegDecodeAcceleratorRequest jda_request) {
   DCHECK(main_task_runner_->BelongsToCurrentThread());
-  (*gpu_)->CreateJpegDecodeAccelerator(std::move(jda_request));
+  io_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&GpuPtrIO::CreateJpegDecodeAccelerator,
+                     base::Unretained(gpu_.get()), base::Passed(&jda_request)));
 }
 
 void Gpu::CreateVideoEncodeAcceleratorProvider(
     media::mojom::VideoEncodeAcceleratorProviderRequest vea_provider_request) {
   DCHECK(main_task_runner_->BelongsToCurrentThread());
-  (*gpu_)->CreateVideoEncodeAcceleratorProvider(
-      std::move(vea_provider_request));
+  io_task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&GpuPtrIO::CreateVideoEncodeAcceleratorProvider,
+                                base::Unretained(gpu_.get()),
+                                base::Passed(&vea_provider_request)));
 }
 
 void Gpu::EstablishGpuChannel(gpu::GpuChannelEstablishedCallback callback) {
@@ -277,8 +378,9 @@
   pending_request_ =
       base::MakeRefCounted<EstablishRequest>(this, main_task_runner_);
   io_task_runner_->PostTask(
-      FROM_HERE, base::Bind(&EstablishRequest::SendRequest, pending_request_,
-                            base::RetainedRef(gpu_)));
+      FROM_HERE,
+      base::BindOnce(&EstablishRequest::SendRequest, pending_request_,
+                     base::Unretained(gpu_.get())));
 }
 
 void Gpu::OnEstablishedGpuChannel() {

diff --git a/services/ui/public/cpp/gpu/gpu.h b/services/ui/public/cpp/gpu/gpu.h
index 5772e29..1e2f1c55 100644
--- a/services/ui/public/cpp/gpu/gpu.h
+++ b/services/ui/public/cpp/gpu/gpu.h

@@ -57,7 +57,9 @@
  private:
   friend class GpuTest;
 
+  class GpuPtrIO;
   class EstablishRequest;
+
   using GpuPtrFactory = base::RepeatingCallback<mojom::GpuPtr(void)>;
 
   Gpu(GpuPtrFactory factory,
@@ -75,7 +77,7 @@
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
   std::unique_ptr<ClientGpuMemoryBufferManager> gpu_memory_buffer_manager_;
 
-  scoped_refptr<ui::mojom::ThreadSafeGpuPtr> gpu_;
+  std::unique_ptr<GpuPtrIO, base::OnTaskRunnerDeleter> gpu_;
   scoped_refptr<EstablishRequest> pending_request_;
   scoped_refptr<gpu::GpuChannelHost> gpu_channel_;
   std::vector<gpu::GpuChannelEstablishedCallback> establish_callbacks_;

diff --git a/services/ui/public/cpp/tests/gpu_unittest.cc b/services/ui/public/cpp/tests/gpu_unittest.cc
index 26bb946c..df059f9 100644
--- a/services/ui/public/cpp/tests/gpu_unittest.cc
+++ b/services/ui/public/cpp/tests/gpu_unittest.cc

@@ -28,6 +28,8 @@
     request_will_succeed_ = request_will_succeed;
   }
 
+  void CloseBindingOnRequest() { close_binding_on_request_ = true; }
+
   void BindRequest(mojom::GpuRequest request) {
     bindings_.AddBinding(this, std::move(request));
   }
@@ -35,6 +37,12 @@
   // ui::mojom::Gpu overrides:
   void EstablishGpuChannel(
       const EstablishGpuChannelCallback& callback) override {
+    if (close_binding_on_request_) {
+      // Don't run |callback| and trigger a connection error on the other end.
+      bindings_.CloseAllBindings();
+      return;
+    }
+
     constexpr int client_id = 1;
     mojo::ScopedMessagePipeHandle handle;
     if (request_will_succeed_) {
@@ -65,6 +73,7 @@
 
  private:
   bool request_will_succeed_ = true;
+  bool close_binding_on_request_ = false;
   mojo::BindingSet<mojom::Gpu> bindings_;
 
   // Closing this handle will result in GpuChannelHost being lost.
@@ -259,6 +268,47 @@
   EXPECT_TRUE(host);
 }
 
+// Tests that Gpu::EstablishGpuChannelSync() returns even if a connection error
+// occurs. The implementation of mojom::Gpu never runs the callback for
+// mojom::Gpu::EstablishGpuChannel() due to the connection error.
+TEST_F(GpuTest, SyncConnectionError) {
+  gpu_impl()->CloseBindingOnRequest();
+
+  scoped_refptr<gpu::GpuChannelHost> channel = gpu()->EstablishGpuChannelSync();
+  EXPECT_FALSE(channel);
+
+  // Subsequent calls should also return.
+  channel = gpu()->EstablishGpuChannelSync();
+  EXPECT_FALSE(channel);
+}
+
+// Tests that Gpu::EstablishGpuChannel() callbacks are run even if a connection
+// error occurs. The implementation of mojom::Gpu never runs the callback for
+// mojom::Gpu::EstablishGpuChannel() due to the connection error.
+TEST_F(GpuTest, AsyncConnectionError) {
+  gpu_impl()->CloseBindingOnRequest();
+
+  int counter = 2;
+  base::RunLoop run_loop;
+  // A callback that decrements the counter, and runs the callback when the
+  // counter reaches 0.
+  auto callback = base::BindRepeating(
+      [](int* counter, const base::RepeatingClosure& callback,
+         scoped_refptr<gpu::GpuChannelHost> channel) {
+        EXPECT_FALSE(channel);
+        --(*counter);
+        if (*counter == 0)
+          callback.Run();
+      },
+      &counter, run_loop.QuitClosure());
+
+  gpu()->EstablishGpuChannel(callback);
+  gpu()->EstablishGpuChannel(callback);
+  EXPECT_EQ(2, counter);
+  run_loop.Run();
+  EXPECT_EQ(0, counter);
+}
+
 // Tests that if EstablishGpuChannelSync() is called after a request for
 // EstablishGpuChannel() has returned that request is used immediately.
 TEST_F(GpuTest, EstablishRequestAsyncThenSyncWithResponse) {

diff --git a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
index a2fda30..60156e2 100644
--- a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter

@@ -854,5 +854,44 @@
 -ContinueWhereILeftOffTest.SessionCookies
 -RestartTest.SessionCookies
 
-# Fails on debug waterfall bot but not locally or on release or trybots.
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65822%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FNoSessionRestoreTest.PRE_CookiesClearedOnExit%2F0
+-NoSessionRestoreTest.PRE_CookiesClearedOnExit
+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65817%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FRestartTest.CookiesClearedOnExit%2F0

+-RestartTest.CookiesClearedOnExit
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69105%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FPopupsOnlyUiDelegateTest.ManyPopupNotifications%2F0
 -PopupsOnlyUiDelegateTest.ManyPopupNotifications
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69117%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FCaptivePortalBrowserTest.SSLCertErrorLogin%2F0
+-CaptivePortalBrowserTest.SSLCertErrorLogin
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69108%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FCaptivePortalBrowserTest.ShowCaptivePortalInterstitialOnCertError%2F0
+-CaptivePortalBrowserTest.ShowCaptivePortalInterstitialOnCertError
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69112%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FCaptivePortalBrowserTest.InterstitialTimerNavigateAwayWhileLoading%2F0
+-CaptivePortalBrowserTest.InterstitialTimerNavigateAwayWhileLoading
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69110%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FCaptivePortalBrowserTest.InterstitialTimerNavigateWhileLoading_EndWithCaptivePortalInterstitial%2F0
+-CaptivePortalBrowserTest.InterstitialTimerNavigateWhileLoading_EndWithCaptivePortalInterstitial
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65814%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FDeclarativeContentApiTest.NotBookmarkedRulesEvaluatedOnBookmarkEvents%2F0
+-DeclarativeContentApiTest.NotBookmarkedRulesEvaluatedOnBookmarkEvents

+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65815%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FDeclarativeContentApiTest.RulesAddedFromManifest%2F0

+-DeclarativeContentApiTest.RulesAddedFromManifest

+

+#Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65829%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FDeclarativeContentApiTest.RulesPersistence%2F0

+-DeclarativeContentApiTest.RulesPersistence

+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65817%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FDeclarativeContentApiTest.IsBookmarkedRulesEvaluatedOnBookmarkEvents%2F0

+-DeclarativeContentApiTest.IsBookmarkedRulesEvaluatedOnBookmarkEvents

+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65816%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FPushMessagingBrowserTest.PushEventWithoutPayload%2F0

+-PushMessagingBrowserTest.PushEventWithoutPayload

+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65816%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FNoStatePrefetchBrowserTest__x2f_NoStatePrefetchBrowserTest.ServiceWorkerIntercept__x2f_0%2F0

+-NoStatePrefetchBrowserTest/NoStatePrefetchBrowserTest.ServiceWorkerIntercept/*

+

+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests%2F65816%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_browser_tests%2F0%2Flogs%2FDeclarativeContentApiTest.IsBookmarkedRulesEvaluatedOnBookmarkEvents%2F0

+-DeclarativeContentApiTest.IsBookmarkedRulesEvaluatedOnBookmarkEvents


diff --git a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
index 9fac2015..abeb56a4 100644
--- a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter

@@ -129,3 +129,6 @@
 -CrossSiteDocumentBlockingTest.BlockDocuments
 -CrossSiteDocumentBlockingIsolatedOriginTest.BlockDocumentsFromIsolatedOrigin
 -CrossSiteDocumentBlockingTest.RangeRequest
+
+# Flakes https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.linux%2FLinux_Tests__dbg__1_%2F69105%2F%2B%2Frecipes%2Fsteps%2Fnetwork_service_content_browsertests%2F0%2Flogs%2FWebContentsImplBrowserTest.DownloadImage_Allow_FileImage%2F0
+-WebContentsImplBrowserTest.DownloadImage_Allow_FileImage


diff --git a/testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc b/testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc
index 5dd3a67b..f54b6fb2 100644
--- a/testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc
+++ b/testing/libfuzzer/fuzzers/convert_woff2ttf_fuzzer.cc

@@ -5,7 +5,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "third_party/woff2/src/woff2_dec.h"
+#include <woff2/decode.h>
 
 // Entry point for LibFuzzer.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 9a155ba..acc2fe4 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -9234,685 +9234,7 @@
 crbug.com/591099 virtual/scroll_customization/fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
 crbug.com/591099 virtual/service-worker-script-streaming/ [ Skip ]
 crbug.com/591099 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html [ Failure Pass ]
-crbug.com/591099 virtual/spv175/compositing/animation/state-at-end-event-transform-layer.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/background-color/view-blending-base-background.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/child-transform-layer-requires-box.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/clip-path-with-composited-descendent.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/color-matching/image-color-matching.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/composited-descendant-grandparent-border-radius-mask.html [ Pass ]
-crbug.com/714962 virtual/spv175/compositing/composited-descendant-requiring-border-radius-mask.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/compositing-visible-descendant.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/contents-opaque/body-background-painted.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/contents-opaque/body-background-skipped.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/direct-image-compositing.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/draws-content/canvas-background-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/draws-content/webgl-background-layer.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/flex-composited-animated-table-row-background.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/framesets/composited-frame-alignment.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/generated-content.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/abs-position-inside-opacity.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/bounds-ignores-hidden-dynamic.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/bounds-ignores-hidden.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/clipping-foreground.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/composited-html-size.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/composited-in-columns.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-in-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-position-composited-page-scale-down.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-position-composited-page-scale.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-position-transform-composited-page-scale-down.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-position-transform-composited-page-scale.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/fixed-position.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/foreground-layer.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/layer-due-to-layer-children-deep.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/layer-due-to-layer-children.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/outline-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/partial-layout-update.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/repaint-foreground-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/root-layer-update.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/transformed-abs-position-inside-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/transfrom-origin-on-zero-size-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/video-fixed-scrolling.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/geometry/video-opacity-overlay.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-composite.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-noncomposite.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe-composited.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe-scrolled.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-iframe.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scroll-clip.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scrolled.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change-2.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-composite.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-noncomposite.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-1-overflow-div.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-composited-inner.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-composited-outer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner-late-composite.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer-late-composite.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-iframe.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-inner.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-outer.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-inner.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-outer.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-inner.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-outer.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-2-overflow-div.html [ Crash ]
-crbug.com/591099 virtual/spv175/compositing/gestures/gesture-tapHighlight-img-and-text-2.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-img-and-text.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-img.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-invisible-inline-squashing.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-invisible-inline.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-on-promoted-overflow-div-scrolled.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-pixel-rotated-link.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-pixel-transparent.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-shadow-tree.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-cancel.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-cancel2.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-margin.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-multi-line.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-navigate.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-nested.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-scaled-document.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-scaledX.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-scaledY.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple-window-scroll.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-simple.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-with-box-shadow.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/gestures/gesture-tapHighlight-with-squashing.html [ Crash ]
-crbug.com/591099 virtual/spv175/compositing/iframes/composited-iframe-alignment.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/iframes/floating-self-painting-frame.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/iframes/iframe-copy-on-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/iframes/iframe-in-composited-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/iframes/layout-on-compositing-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/iframes/nested-iframe-scrolling.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/images/direct-image-background-color.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/images/direct-image-dynamic-border-radius.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/images/direct-svg-image.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/img-layer-object-fit.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/layer-creation/fixed-position-nonscrollable-iframes-in-scrollable-page.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/layer-creation/overlap-transformed-layer-with-transform-body.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/layer-creation/rotate3d-overlap.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/layers-inside-overflow-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/direct-image-mask.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/mask-with-added-filters.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/mask-with-removed-filters.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/masked-ancestor.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/multiple-masks.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/masks/simple-composited-mask.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/overflow/accelerated-scrolling-with-clip-reference.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/overflow/ancestor-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-above-composited-subframe.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-composited-subframe.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-on-grandparent-composited-grandchild.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-on-parent-composited-grandchild.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-on-two-ancestors-composited-grandchild.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/border-radius-styles-with-composited-child.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/clip-parent-reset.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/composited-layer-under-border-radius-under-composited-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html [ Crash ]
-crbug.com/591099 virtual/spv175/compositing/overflow/fixed-position-ancestor-clip.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/get-transform-from-non-box-container.html [ Crash ]
-crbug.com/591099 virtual/spv175/compositing/overflow/grandchild-composited-with-border-radius-ancestor.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/grandchild-with-border-radius-ancestor.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/overflow/image-load-overflow-scrollbars.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/mask-with-small-content-rect.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/nested-border-radius-clipping.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/nested-scrolling.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/overflow-compositing-descendant.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/overflow-positioning.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/overflow-scroll-with-local-image-background.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/overflow-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/overflow-with-negative-z-index-child.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/parent-overflow.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/overflow/relpos-under-abspos-border-radius.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/overflow/remove-overflow-crash2.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/overflow/rtl-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/scaled-mask.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/scroll-ancestor-update.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/scrollbar-painting.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/scrolling-content-clip-to-viewport.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/siblings-composited-with-border-radius-ancestor-one-clipped.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/siblings-composited-with-border-radius-ancestor.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/siblings-with-border-radius-ancestor.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/textarea-scroll-touch.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/theme-affects-visual-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/tiled-mask.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overflow/universal-accelerated-overflow-scroll.html [ Failure Pass Timeout ]
-crbug.com/591099 virtual/spv175/compositing/overflow/update-widget-positions-on-nested-frames-and-scrollers.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overlap-blending/children-opacity-huge.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overlap-blending/children-opacity-no-overlap.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/overlap-blending/reflection-opacity-huge.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/compositing-change-inside-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/deeply-nested-reflections.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/load-video-in-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/masked-reflection-on-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-mask-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-on-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-opacity.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-size-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-transformed.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection-transformed2.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/nested-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-in-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-on-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-opacity.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-ordering.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-positioning.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/reflection-positioning2.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/remove-add-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/simple-composited-reflections.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/reflections/transform-inside-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/render-surface-alpha-blending.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-absolute-overflow-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-absolute-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-absolute.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-and-writing-mode-scrolling.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-fixed-overflow-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-fixed-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-fixed.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-absolute-overflow-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-absolute-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-absolute.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-fixed-overflow-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-fixed-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-iframe-fixed.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-overflow-invalidation.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/rtl/rtl-overflow-scrolling.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/self-painting-layers.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/shadows/shadow-drawing.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/sibling-positioning.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/squashing/add-remove-squashed-layers.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/squashing/selection-repaint-with-gaps.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/compositing/squashing/squash-onto-distant-relative.html [ Crash ]
-crbug.com/714962 virtual/spv175/compositing/squashing/squash-with-ancestor-reflection.html [ Pass ]
-crbug.com/591099 virtual/spv175/compositing/squashing/vertical-writing-mode-squashed.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/text-on-large-layer.html [ Failure ]
-crbug.com/714962 virtual/spv175/compositing/transitions/transform-on-large-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/video-frame-size-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/video/video-controls-layer-creation.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/webgl/webgl-background-color.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/webgl/webgl-nonpremultiplied-blend.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/webgl/webgl-reflection.html [ Failure ]
-crbug.com/591099 virtual/spv175/compositing/z-order/collect-layers-does-not-initialize-pos-z-order-list.html [ Crash ]
-crbug.com/591099 virtual/spv175/fast/borders/bidi-002.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/bidi-012.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/block-mask-overlay-image.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-antialiasing.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-image-border-radius.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-image-fill-inline-no-border.html [ Failure Pass ]
-crbug.com/591099 virtual/spv175/fast/borders/border-image-outset-split-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-image-scaled.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-inner-bleed.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-inline-flow.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas-all.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas-border.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas-padding.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas-with-mask.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas-with-shadow.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-canvas.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-video-ratio.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-video-shadow.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-mask-video.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-percent.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-radius-split-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/border-styles-split.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusArcs01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusDouble01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusDouble02.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusDouble03.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusGroove01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusGroove02.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusInset01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusInvalidColor.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusOutset01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusRidge01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusSolid01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusSolid02.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusSolid03.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/borderRadiusSolid04.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/dashed-1px-with-border-radius.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/different-color-borders.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/outline-alpha-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/rtl-border-01.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/rtl-border-02.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/rtl-border-03.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/rtl-border-04.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/rtl-border-05.html [ Failure ]
-crbug.com/591099 virtual/spv175/fast/borders/table-borders.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/filters/clip-filter-overflow-clip.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/float/float-text-clip.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/frames/frameset-with-stacking-context-and-not-stacking-context-children.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/frames/frameset-with-stacking-contexts.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/high-contrast-mode/image-filter-all/text-on-backgrounds.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/inline/floating-inline.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/inline/focus-ring-under-absolute-with-relative-continuation.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/inline/outline-offset.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/4774354.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/4776765.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/background/background-image-paint-invalidation-large-abspos-div.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/background/backgroundSizeRepaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/background/view-background-from-body-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/block-layout-inline-children-replaced.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/block-no-inflow-children.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/block-shift-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/border-radius-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/border-repaint-glitch.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/box-inline-resize.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/box-shadow-dynamic.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/hover-pseudo-borders.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/box/invalidate-box-shadow-currentColor.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/bugzilla-3509.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/bugzilla-5699.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/bugzilla-6278.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/bugzilla-6473.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/bugzilla-7235.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/caret-ancestor-clip-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/clip-unclip-and-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/clip-with-layout-delta.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/clip-with-transform-resize.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/clipped-relative.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/control-clip.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/intermediate-layout-position-clip.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/outline-clip-change.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/clip/repaint-subsequence-on-ancestor-clip-change-complex.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/repaint-tile-clipped.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/clip/replaced-clipped-positioned-not-wrong-incremental-repainting.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/become-overlay-composited-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/column-span-under-composited-column-child.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/composited-document-element.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/compositing/composited-inline-change-text-data-keep-geometry.html [ Crash ]
-crbug.com/714962 virtual/spv175/paint/invalidation/compositing/composited-non-stacking-context-not-invalidation-container.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/fixed-pos-with-abs-pos-child-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/iframe-clip-removed.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/iframe-inside-squashed-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/layer-repaint-rects.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/layer-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/multi-subsequence-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/opacity-between-absolute.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/opacity-between-absolute2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/overlap-test-with-filter.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/remove-squashed-layer-plus-move.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/should-not-clip-composited-overflow-scrolling-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/should-not-clip-composited-viewport-scrolling-layer.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/text-color-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/text-match-highlight.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/compositing/updating-scrolling-container-and-content.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/crbug-371640-4.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/crbug-371640.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/create-layer-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/css-grid-layout/grid-element-change-columns-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/css-grid-layout/grid-element-change-rows-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/css-grid-layout/grid-item-change-column-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/css-grid-layout/grid-item-change-row-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/css-grid-layout/grid-item-z-index-change-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/delete-into-nested-block.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/details-open-repaint.html [ Crash ]
-crbug.com/714962 virtual/spv175/paint/invalidation/first-line-inline-child.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-content-change-keeping-geometry.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-content-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-content-distribution-change-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-items-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-self-change-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-self-change-keeping-geometry-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-self-change-keeping-geometry.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/align-self-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-content-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-content-distribution-change-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-items-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-items-legacy-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-self-change-keeping-geometry.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/justify-self-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/remove-inline-block-descendant-of-flex.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-column-reverse.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-during-resize-no-flex.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-on-layout.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-on-margin-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-opacity-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint-rtl-column.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/flexbox/scrollbars-changed.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/float-move-during-layout.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/button-reset-focus-by-mouse-then-keydown.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/checkbox-focus-by-mouse-then-keydown.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/radio-focus-by-mouse-then-keydown.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/range-focus-by-mouse-then-keydown.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/select-option-background-color.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/slider-thumb-drag-release.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/slider-thumb-float.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/submit-focus-by-mouse-then-keydown.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/forms/textarea-caret.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/gradients-em-stops-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/iframe-display-block-to-display-none.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/iframe-display-none-to-display-block.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/image/percent-size-image-resize-container.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/inline-block-resize.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/inline-color-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/inline-reflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/insert-frame.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/invalidation-after-opacity-change-subtree.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/invalidation-with-zero-size-object.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/invisible-objects.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-1.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-10.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-3.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-4.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-5.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-6.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-7.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-8.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/line-flow-with-floats-9.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/lines-with-layout-delta.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/list-marker-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/list-marker.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/make-children-non-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/mix-blend-mode-separate-stacking-context.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/column-rule-change.html [ Pass ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/column-rules-fixed-height.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-as-paint-container.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-nested.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-relpos-with-abspos.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-rule-actual-columns-change.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-abspos-in-relpos.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-abspos.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-block.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-relpos.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/multicol/multicol-with-text.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/non-text-link-invalidation-optimization.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/offset-change-wrong-invalidation-with-float.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/continuation-after-outline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-continuations.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-enable-continuations.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-layers.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-ring-on-continuation-move.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-ring-on-inline-continuation-move.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/focus-ring.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/inline-focus.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/inline-outline-repaint-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/inline-outline-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/layer-child-outline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/layer-outline-horizontal.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/layer-outline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-change-continuations.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-change-invalidation.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-change-vertical-rl.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-containing-image-in-non-standard-mode.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-continuations.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-inset.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-repaint-glitch.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/outline/outline-shrinking.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/align-items-overflow-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/align-self-overflow-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/flexible-box-overflow-horizontal.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/flexible-box-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/float-overflow-right.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/float-overflow.html [ Crash Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/inline-block-overflow-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/inline-block-overflow.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/inline-box-overflow-repaint.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/inline-overflow.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/inline-vertical-lr-overflow.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/inline-vertical-rl-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/justify-items-overflow-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/justify-self-overflow-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/line-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/negative-text-indent-with-overflow-hidden.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/overflow-hidden-to-visible.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/overflow/overflow-outline-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/repaint-resized-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/vertical-overflow-parent.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/overflow/vertical-overflow-same.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/paint-invalidation-with-reparent-across-frame-boundaries.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/absolute-layer-specified-left-or-right-auto-width-moved-vertically.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/absolute-margin-change-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/absolute-position-change-containing-block.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/abspos-shift-image-incorrect-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/align-content-position-change-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/block-layout-inline-children-float-positioned.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/containing-block-position-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/fixed-position-layer-moved.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/fixed-to-relative-position-with-absolute-child.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/inline-relative-positioned.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/intermediate-layout-position.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/justify-content-position-change-grid.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/justify-content-position-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/layout-state-relative.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/layoutstate-invalid-invalidation-inline-relative-positioned.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/positioned-document-element.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/positioned-great-grandparent-change-location.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/positioned-list-offset-change-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/relative-inline-positioned-movement-repaint.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/relayout-fixed-position-after-scale.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/shift-relative-positioned-container-with-image-addition.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/shift-relative-positioned-container-with-image-removal.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/static-to-positioned.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/text-in-relative-positioned-inline.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/position/transform-absolute-in-positioned-container.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/push-block-with-first-line.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/quotes.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/reflection/reflection-redraw.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/reflection/reflection-with-rotation.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/remove-block-after-layout.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/remove-inline-after-layout.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/remove-inline-layer-after-layout.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/renderer-destruction-by-invalidateSelection-crash.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/repaint-across-writing-mode-boundary.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/repaint-descandant-on-ancestor-layer-move.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/repaint-overlay/layers-overlay.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/resize-iframe-text.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/ruby-flipped-blocks.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/caret-with-composited-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/fixed-child-of-transformed-move-after-scroll.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/fixed-under-composited-absolute-scrolled.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/fixed-with-border-under-composited-absolute-scrolled.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/iframe-scroll-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/inline-style-change-in-scrolled-view.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/invalidate-after-composited-scroll-of-window.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/layout-state-scrolloffset.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/layout-state-scrolloffset2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/layout-state-scrolloffset3.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/line-in-scrolled-clipped-block.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/outline-change-in-scrollers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/overflow-scroll-body-appear.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/overflow-scroll-delete.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/repaint-during-scroll-with-zoom.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/repaint-during-scroll.html [ Timeout ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/resize-scrollable-div.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/resize-scrollable-iframe.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/scroll-descendant-with-cached-cliprects.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/scrollbar-invalidation-on-resize-with-border.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/scrollbar-invalidation-on-resize.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/scroll/scrolled-iframe-scrollbar-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/block-selection-gap-stale-cache-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/block-selection-gap-stale-cache.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/invalidation-rect-includes-newline-for-rtl.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/invalidation-rect-includes-newline-for-vertical-lr.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/invalidation-rect-includes-newline-for-vertical-rl.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/invalidation-rect-includes-newline.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/invalidation-rect-with-br-includes-newline.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/japanese-rl-selection-clear.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/japanese-rl-selection-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selected-replaced.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-after-delete.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-after-remove.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/selection/selection-and-text-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-change-in-iframe-with-relative-parent.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-clear.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/selection/selection-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-rl.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/selection-within-composited-scroller.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/text-selection-rect-in-overflow-2.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/selection/text-selection-rect-in-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/shadow-multiple.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/stacked-diacritics.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/stacking-context-lost.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/subtree-root-skipped.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/add-background-property-on-root.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/add-outline-property-on-root.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/animated-path-inside-transformed-html.xhtml [ Failure Pass ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-1.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/embedded-svg-size-changes-no-layout-triggers.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/svg/hit-test-with-br.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/nested-embedded-svg-size-changes-no-layout-triggers-1.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/nested-embedded-svg-size-changes-no-layout-triggers-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/object-sizing-no-width-height-change-content-box-size.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/overflow-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-content-with-resources.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-content.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-deep-shadow-tree-content.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-image.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-inner-svg.xhtml [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-shadow-tree-content-with-symbol.xhtml [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-shadow-tree-content.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-use-on-symbol.xhtml [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/relative-sized-use-without-attributes-on-symbol.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/remove-background-property-on-root.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/remove-outline-property-on-root.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/resize-svg-invalidate-children-2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/resize-svg-invalidate-children.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/scroll-hit-test.xhtml [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/scrolling-embedded-svg-file-image-repaint-problem.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/svg-background-partial-redraw.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/svg-image-change-content-size.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/text-rescale.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/svg/text-xy-updates-SVGList.xhtml [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/use-instanceRoot-event-bubbling.xhtml [ Crash Pass Timeout ]
-crbug.com/591099 virtual/spv175/paint/invalidation/svg/use-setAttribute-crash.svg [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/add-table-overpaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/block-selection-gap-in-table-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/border-collapse-change-collapse-to-separate.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/border-collapse-change-separate-to-collapse.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-cell-append.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-cell-border-color.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-cell-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-cell-sl-border-color.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-col-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-colgroup-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-row-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-table-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/cached-change-tbody-border-width.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/caret-contenteditable-content-after.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/collapsed-border-cell-resize.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/collapsed-border-cell-visibility.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/collapsed-border-change-rowspan.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/table/collapsed-border-current-color.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-col-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-col-span-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-col-span.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-col.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-colgroup-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-colgroup.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-composited-row-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-composited-row.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-section-composited-row-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-section-composited-row.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-section-initial-empty.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background-section.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-background.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/composited-table-row.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/dynamic-table-vertical-alignment-change.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/fixed-table-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/fixed-table-overflow-zindex.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/fixed-table-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/invalidate-cell-in-row-with-offset.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/repaint-table-row-in-composited-document.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/resize-table-repaint-percent-size-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/resize-table-repaint-vertical-align-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/resize-table-row-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/scroll-inside-table-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/scroll-relative-table-inside-table-cell.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/single-line-cells-repeating-thead-break-inside-on-thead-only.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/table/table-cell-become-visible-using-row-background.html [ Crash ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-cell-collapsed-border.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-cell-move.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-cell-vertical-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-collapsed-border.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-extra-bottom-grow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-outer-border.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-overflow-auto-in-overflow-auto-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-overflow-scroll-in-overflow-scroll-scrolled.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-row.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-section-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-section-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-shrink-row-repaint.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-two-pass-layout-overpaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-writing-modes-h.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/table/table-writing-modes-v.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-append-dirty-lines.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-decoration-invalidation.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-emphasis-h.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-emphasis-v.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-match-document-change.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/text-match-pre-wrapped-text.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/text-match-transparent-text.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/invalidation/text-match.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-shadow-horizontal.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/text-shadow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/transform/change-transform.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/transform/transform-inline-layered-child.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/transform/transform-layout-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/vertical-align-length1.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/vertical-align-length2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/vertical-align1.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/vertical-align2.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/vertical-rl-as-paint-container.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/video-mute-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/video-unmute-repaint.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/window-resize/window-resize-centered-inline-under-fixed-pos.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/invalidation/window-resize/window-resize-vertical-writing-mode.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/active-suggestion-marker-basic.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/active-suggestion-marker-split.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/composition-marker-basic.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/composition-marker-split.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-ltr-text-in-ltr-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-ltr-text-in-rtl-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-mixed-text-in-ltr-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-mixed-text-in-rtl-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-rtl-text-in-ltr-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/ellipsis-rtl-text-in-rtl-flow-with-markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/inline-spelling-markers-hidpi-composited.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/inline-spelling-markers-hidpi.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/inline_spelling_markers.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/marker-early-break-bug.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/suggestion-marker-basic.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/markers/suggestion-marker-split.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/overflow/composited-rounded-clip-floating-element.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/overflow/fixed-background-scroll-window.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/overflow/non-composited-fixed-position-descendant.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/pagination/composited-paginated-inline.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/printing/print-text-shadow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/roundedrects/circle-with-shadow.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/selection/text-selection-drag.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-inline-block-rtl.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-inline-block.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-across-blocks-line-beginning-end.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-across-blocks.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-br.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-clipped-by-overflow.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-mixed-ltr-rtl.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-rtl-double-linebreak.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-rtl.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-span-across-line.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-span.html [ Crash Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-vertical-lr.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline-vertical-rl.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/selection/text-selection-newline.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/selection/text-selection-update-style.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/tables/collapsed-border-corner-conflict.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/tables/composited-collapsed-table-borders.html [ Failure ]
-crbug.com/591099 virtual/spv175/paint/text/selection-no-clip-text.html [ Failure ]
-crbug.com/714962 virtual/spv175/paint/text/text-match-highlights-big-line-height.html [ Failure ]
+crbug.com/591099 virtual/spv175/ [ Skip ]
 crbug.com/591099 virtual/spv2/compositing/framesets/composited-frame-alignment.html [ Failure ]
 crbug.com/591099 virtual/spv2/compositing/geometry/outline-change.html [ Failure ]
 crbug.com/591099 virtual/spv2/paint/invalidation/box/margin.html [ Failure Pass ]

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index b40c1f9..abbfdde8 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -111,6 +111,9 @@
 # Scanlines off by 1, but code path should be the same
 crbug.com/644433 virtual/gpu/fast/canvas/OffscreenCanvas-2d-pattern-in-worker.html [ Failure ]
 
+# TODO(xlai): Update the exception in webkit platform tests and turn the test on.
+crbug.com/796202 external/wpt/offscreen-canvas/the-offscreen-canvas/offscreencanvas.convert.to.blob.html [ Failure ]
+
 crbug.com/702006 paint/invalidation/compositing/scrolling-neg-z-index-descendants-should-cause-repaint.html [ Failure ]
 crbug.com/702006 virtual/spv175/paint/invalidation/compositing/scrolling-neg-z-index-descendants-should-cause-repaint.html [ Skip ]
 
@@ -3727,3 +3730,7 @@
 
 # Does not work on Mac
 crbug.com/793771 [ Mac ] virtual/modern-media-controls/media/controls/modern/scrubbing.html [ Skip ]
+
+# Slight Skia rendering change - drawing zero length line with round caps as circle
+crbug.com/796913 virtual/gpu/fast/canvas/canvas-zero-length-lineCap.html [ NeedsManualRebaseline ]
+

diff --git a/third_party/WebKit/LayoutTests/accessibility/aom-computed-accessible-node.html b/third_party/WebKit/LayoutTests/accessibility/aom-computed-accessible-node.html
new file mode 100644
index 0000000..6f04686
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/accessibility/aom-computed-accessible-node.html

@@ -0,0 +1,77 @@
+<!DOCTYPE HTML>
+<script src="../resources/gc.js"></script>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+
+<!--
+
+Accessibility Object Model
+Explainer: https://github.com/WICG/aom/blob/master/explainer.md
+Spec: https://wicg.github.io/aom/spec/
+
+-->
+
+<p id="button1" role="button">Click</p>
+
+<script>
+
+test(function(t) {
+    assert_true(internals.runtimeFlags.accessibilityObjectModelEnabled);
+}, "Make sure that Accessibility Object Model is enabled");
+
+promise_test(() => {
+    var element = document.getElementById("button1");
+    return window.getComputedAccessibleNode(element).then(computedAXNode => {
+      assert_true(computedAXNode != null);
+    });
+}, 'Ensure that a non null value is returned from getComputedAccessibleNode');
+
+promise_test(() => {
+    var element = document.getElementById("button1");
+    return window.getComputedAccessibleNode(element).then(computedAXNode => {
+      assert_equals(computedAXNode.role, "button");
+    });
+}, "ComputedAccessibleNode.role");
+
+promise_test(() => {
+    var element = document.getElementById("button1");
+    return window.getComputedAccessibleNode(element).then(computedAXNode => {
+      assert_equals(computedAXNode.name, "Click");
+    });
+}, "ComputedAccessibleNode.name");
+
+</script>
+
+<p id="button2" role="button" aria-label="axButton">Click</p>
+
+<script>
+
+promise_test(() => {
+    var element = document.getElementById("button2");
+    return window.getComputedAccessibleNode(element).then(computedAXNode => {
+      assert_equals(computedAXNode.name, "axButton");
+    });
+}, "ComputedAccessibleNode.name set through ARIA.");
+
+promise_test(() => {
+    var element = document.getElementById("button2");
+    return window.getComputedAccessibleNode(element).then(computedAXNode1 => {
+      window.getComputedAccessibleNode(element).then(computedAXNode2 => {
+        assert_true(computedAXNode1 === computedAXNode2);
+      });
+    });
+}, "Multiple calls to getComputedAccessibleNode will return the same node.");
+
+// This tests the current behaviour where the returned ComputedAccessibleNode
+// always contains the most up to date state of the Element it corresponds to.
+// This behaviour may change in future as the API is further developed.
+promise_test(() => {
+    var element = document.getElementById("button2");
+    return window.getComputedAccessibleNode(element).then(computedAXNode => {
+      assert_equals(computedAXNode.name, "axButton");
+      element.accessibleNode.label = "new-accessible-label";
+      assert_equals(computedAXNode.name, "new-accessible-label");
+    });
+}, "ComputedAccessibleNode always returns the current accessible name of an element.")
+
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index 57edd3b..1d747bc 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json

@@ -88696,6 +88696,42 @@
      ],
      {}
     ]
+   ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html": [
+    [
+     "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html",
+     [
+      [
+       "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html": [
+    [
+     "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html",
+     [
+      [
+       "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html": [
+    [
+     "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html",
+     [
+      [
+       "/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
    ]
   },
   "reftest_node": {
@@ -127502,11 +127538,6 @@
      {}
     ]
    ],
-   "fetch/api/request/request-keepalive-quota-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "fetch/api/request/request-structure-expected.txt": [
     [
      {}
@@ -138487,6 +138518,11 @@
      {}
     ]
    ],
+   "html/semantics/scripting-1/the-script-element/defer.js": [
+    [
+     {}
+    ]
+   ],
    "html/semantics/scripting-1/the-script-element/execution-timing/028-expected.txt": [
     [
      {}
@@ -151057,26 +151093,11 @@
      {}
     ]
    ],
-   "webvtt/api/VTTCue/constructor-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "webvtt/api/VTTCue/getCueAsHTML-expected.txt": [
     [
      {}
     ]
    ],
-   "webvtt/api/VTTCue/lineAlign-expected.txt": [
-    [
-     {}
-    ]
-   ],
-   "webvtt/api/VTTCue/positionAlign-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "webvtt/api/VTTCue/region-expected.txt": [
     [
      {}
@@ -151087,11 +151108,6 @@
      {}
     ]
    ],
-   "webvtt/api/interfaces-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "webvtt/categories.json": [
     [
      {}
@@ -151412,11 +151428,6 @@
      {}
     ]
    ],
-   "webvtt/parsing/file-parsing/tests/settings-position-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "webvtt/parsing/file-parsing/tests/support/arrows.vtt": [
     [
      {}
@@ -153142,6 +153153,21 @@
      {}
     ]
    ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html": [
+    [
+     {}
+    ]
+   ],
    "webvtt/tools/categorize_results.py": [
     [
      {}
@@ -166479,7 +166505,9 @@
    "css/css-color/color-resolving-hsl.html": [
     [
      "/css/css-color/color-resolving-hsl.html",
-     {}
+     {
+      "timeout": "long"
+     }
     ]
    ],
    "css/css-color/color-resolving-keywords.html": [
@@ -186936,6 +186964,12 @@
      {}
     ]
    ],
+   "html/semantics/scripting-1/the-script-element/script-defer.html": [
+    [
+     "/html/semantics/scripting-1/the-script-element/script-defer.html",
+     {}
+    ]
+   ],
    "html/semantics/scripting-1/the-script-element/script-for-event-xhtml.xhtml": [
     [
      "/html/semantics/scripting-1/the-script-element/script-for-event-xhtml.xhtml",
@@ -254210,7 +254244,7 @@
    "reftest"
   ],
   "css/css-color/color-resolving-hsl.html": [
-   "75cabcabb03a525dbf9d90ba2510c4b33b58d849",
+   "672137820a0289306d53b3866ffa1f00daacc019",
    "testharness"
   ],
   "css/css-color/color-resolving-keywords.html": [
@@ -302109,12 +302143,8 @@
    "d8e34b014a45f1cf61cfd557dfe5cf398207718a",
    "support"
   ],
-  "fetch/api/request/request-keepalive-quota-expected.txt": [
-   "8933429003b97cfbe10e693df73d50607bdaa122",
-   "support"
-  ],
   "fetch/api/request/request-keepalive-quota.html": [
-   "d839fec1d761688db807be2dfddf6b8b6932c46b",
+   "9064b1c51be636b57b5184d5cd2d990b73b2e786",
    "testharness"
   ],
   "fetch/api/request/request-keepalive.html": [
@@ -307682,7 +307712,7 @@
    "testharness"
   ],
   "html/dom/usvstring-reflection.html": [
-   "0e32e0e6d338d12f2a2a6f4887aae603db5426b0",
+   "f12c4ee1c2b07b2cc559b672436450c349ef8498",
    "testharness"
   ],
   "html/editing/.gitkeep": [
@@ -317733,6 +317763,10 @@
    "1fe7fe27c3680b24fbbb9c09c849ecb007637d3f",
    "testharness"
   ],
+  "html/semantics/scripting-1/the-script-element/defer.js": [
+   "a3a0ec93c287c9925d8da6303ae99af3953f81b8",
+   "support"
+  ],
   "html/semantics/scripting-1/the-script-element/execution-timing/001.html": [
    "d23ee4e0c5c00c5d7d4391ebb346536706667759",
    "testharness"
@@ -319413,6 +319447,10 @@
    "e3209904d340a7f9803af6828cd830f2bd26cbc5",
    "testharness"
   ],
+  "html/semantics/scripting-1/the-script-element/script-defer.html": [
+   "c9e0e3a71a522a42be3b3da51999c9762d06e3e6",
+   "testharness"
+  ],
   "html/semantics/scripting-1/the-script-element/script-for-event-xhtml.xhtml": [
    "e7de020976ea907ce3a0460f0ad3ba6ad322b5ed",
    "testharness"
@@ -348162,7 +348200,7 @@
    "support"
   ],
   "webrtc/RTCPeerConnection-createOffer-offerToReceive.html": [
-   "58a538ee388b7a196ab53c409552164688b9f6dc",
+   "91905d7efc95500ebba085ca4b1fc682a496e228",
    "testharness"
   ],
   "webrtc/RTCPeerConnection-createOffer.html": [
@@ -350013,10 +350051,6 @@
    "e88f3e9ddc5a5d4d9597403e8f7ef01d1daa339a",
    "support"
   ],
-  "webvtt/api/VTTCue/constructor-expected.txt": [
-   "819a91cca558b243d9e84d4ee557f61b52801df7",
-   "support"
-  ],
   "webvtt/api/VTTCue/constructor.html": [
    "c844f513868cbf4053c70f37bbb630b53a763a2a",
    "testharness"
@@ -350033,10 +350067,6 @@
    "456e481bc10ca23bdce440d883fd02f9178bfa03",
    "testharness"
   ],
-  "webvtt/api/VTTCue/lineAlign-expected.txt": [
-   "c7f81b0d309b52f40f4dc85822d267e593f45501",
-   "support"
-  ],
   "webvtt/api/VTTCue/lineAlign.html": [
    "886331a73977fe6025ad406a5124d150c01d174f",
    "testharness"
@@ -350045,10 +350075,6 @@
    "a6fcf0cef9f76dff923d8da848e6609ffd2a5976",
    "testharness"
   ],
-  "webvtt/api/VTTCue/positionAlign-expected.txt": [
-   "5adb7397284eab9a5fdb42053298ef71602b24b3",
-   "support"
-  ],
   "webvtt/api/VTTCue/positionAlign.html": [
    "16ae7ffaf8fd9a37b0b207d19351ca0a24b7134e",
    "testharness"
@@ -350121,10 +350147,6 @@
    "9a45972a29621122da23404a7adc4d237fd7c093",
    "testharness"
   ],
-  "webvtt/api/interfaces-expected.txt": [
-   "1133577a88754a0ca62af78e2ecf7134a0561367",
-   "support"
-  ],
   "webvtt/api/interfaces.html": [
    "3b4f42db6f608d1e89d2a3fab575e05da8a3d005",
    "testharness"
@@ -350481,10 +350503,6 @@
    "0f35b3c2dbe4074b95201353eb5f318cf8e9a36c",
    "testharness"
   ],
-  "webvtt/parsing/file-parsing/tests/settings-position-expected.txt": [
-   "bc8f6b67652a73c6ff2eb3d40184e7d034f457f1",
-   "support"
-  ],
   "webvtt/parsing/file-parsing/tests/settings-position.html": [
    "5f7e3c5b64e3fd7e741ba739998647a9edb65879",
    "testharness"
@@ -352837,6 +352855,30 @@
    "f2372a492268a1b17763a42a808351128128fd89",
    "reftest"
   ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html": [
+   "1b9fc8a0086673fc5021c873c58b920c718a3d6f",
+   "support"
+  ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html": [
+   "3ed80bf703c919ce5774208a6bc947bf1f37e6ce",
+   "reftest"
+  ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html": [
+   "79e0c0df8f6262ced630c78206b2115be9e02df0",
+   "support"
+  ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html": [
+   "88864a2cb30622b3566f4f1b402cbd1b6b5fb33f",
+   "reftest"
+  ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html": [
+   "c756d183319554a551482692b0e265165894995d",
+   "support"
+  ],
+  "webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html": [
+   "e0945f78441ab2676e652d6bc2ca13d0bb2b98b3",
+   "reftest"
+  ],
   "webvtt/tools/categorize_results.py": [
    "339f3f5f0e968076031f4a7c4361f9dba14d485d",
    "support"

diff --git a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/send-sync-response-event-order-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/send-sync-response-event-order-expected.txt
deleted file mode 100644
index 855a866..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/send-sync-response-event-order-expected.txt
+++ /dev/null

@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL XMLHttpRequest: The send() method: event order when synchronous flag is set assert_equals: expected "load(12,12,true)" but got "load(12,0,false)"
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/credential-management/federatedcredential-framed-get.sub.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/credential-management/federatedcredential-framed-get.sub.https-expected.txt
new file mode 100644
index 0000000..7aaa808
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/credential-management/federatedcredential-framed-get.sub.https-expected.txt

@@ -0,0 +1,9 @@
+This is a testharness.js-based test.
+FAIL Same-origin IFrame does not throw. assert_equals: expected "resolved" but got "rejected"
+PASS Cross-origin IFrame throws 'NotAllowedError'.
+FAIL Same-origin IFrame in same-origin IFrame does not throw. assert_equals: expected "resolved" but got "rejected"
+PASS Same-origin IFrame in same-origin IFrame throws 'NotAllowedError'.
+PASS Cross-origin IFrame in same-origin IFrame throws 'NotAllowedError'.
+PASS Cross-origin IFrame in same-cross-origin throws 'NotAllowedError'.
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/credential-management/passwordcredential-framed-get.sub.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/credential-management/passwordcredential-framed-get.sub.https-expected.txt
new file mode 100644
index 0000000..b603d72
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/credential-management/passwordcredential-framed-get.sub.https-expected.txt

@@ -0,0 +1,9 @@
+This is a testharness.js-based test.
+FAIL Same-origin IFrame does not throw. assert_equals: expected "resolved" but got "rejected"
+PASS Cross-origin IFrame throws 'NotAllowedError'.
+FAIL Same-origin IFrame in same-origin IFrame does not throw. assert_equals: expected "resolved" but got "rejected"
+PASS Same-origin IFrame in same-origin IFrame throws.
+PASS Cross-origin IFrame in same-origin IFrame throws.
+PASS Cross-origin IFrame in same-cross-origin throws.
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt
deleted file mode 100644
index 4370d6b0..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt
+++ /dev/null

@@ -1,9 +0,0 @@
-This is a testharness.js-based test.
-PASS A Keep-Alive fetch() with a small body should succeed.
-PASS A Keep-Alive fetch() with a body at the Quota Limit should succeed.
-FAIL A Keep-Alive fetch() with a body over the Quota Limit should reject. assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS A Keep-Alive fetch() should return it's allocated Quota upon promise resolution.
-PASS A Keep-Alive fetch() should return only it's allocated Quota upon promise resolution.
-FAIL A Keep-Alive fetch() should not be allowed if the Quota is used up. assert_unreached: Should have rejected: undefined Reached unreachable code
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota.html b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota.html
index dacc638..079346b1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/request/request-keepalive-quota.html

@@ -12,81 +12,79 @@
     </head>
     <body>
         <script>
-            "use strict";
+            'use strict';
 
             // We want to ensure that our keepalive requests hang slightly before completing so we can validate
             // the effects of a rolling quota. To do this we will utilize trickle.py with a 1s delay. This should
             // prevent any of the Fetch's from finishing in this window.
-            var trickleURL = "../resources/trickle.py?count=1&ms=";
-            var standardDelay = 1000;
+            const trickleURL = '../resources/trickle.py?count=1&ms=';
+            const noDelay = 0;
+            const standardDelay = 1000;
+            function wait(ms) {
+                return new Promise(resolve => step_timeout(resolve, ms));
+            }
 
             // We should expect 64KiB of rolling quota for any type of keep-alive request sent.
-            var expectedQuota = 65536;
+            const expectedQuota = 65536;
 
-            function CreateKeepAliveRequest(delay, bodySize) {
+            function fetchKeepAliveRequest(delay, bodySize) {
                 // Create a body of the specified size that's filled with *'s
-                var requestBody = "*".repeat(bodySize);
-                return new Request(trickleURL+delay, {keepalive: true, body: requestBody, method: "POST"});
+                const body = '*'.repeat(bodySize);
+                return fetch(trickleURL + delay, {keepalive: true, body, method: 'POST'}).then(res => {
+                    return res.text();
+                }).then(() => {
+                    return wait(1);
+                });
             }
 
             // Test 1 Byte
             promise_test(function(test) {
-                return fetch(CreateKeepAliveRequest(0 /* delay */, 1 /* bodySize */));
-            }, "A Keep-Alive fetch() with a small body should succeed.");
+                return fetchKeepAliveRequest(noDelay, 1 /* bodySize */);
+            }, 'A Keep-Alive fetch() with a small body should succeed.');
 
             // Test Quota full limit
             promise_test(function(test) {
-                return fetch(CreateKeepAliveRequest(0 /* delay */, expectedQuota));
-            }, "A Keep-Alive fetch() with a body at the Quota Limit should succeed.");
+                return fetchKeepAliveRequest(noDelay, expectedQuota /* bodySize */);
+            }, 'A Keep-Alive fetch() with a body at the Quota Limit should succeed.');
 
             // Test Quota + 1 Byte
             promise_test(function(test) {
-                return promise_rejects(test, new TypeError(), fetch(CreateKeepAliveRequest(0 /* delay */, expectedQuota + 1)));
-            }, "A Keep-Alive fetch() with a body over the Quota Limit should reject.");
+                return promise_rejects(test, TypeError(), fetchKeepAliveRequest(noDelay, expectedQuota + 1));
+            }, 'A Keep-Alive fetch() with a body over the Quota Limit should reject.');
 
             // Test the Quota becomes available upon promise completion.
             promise_test(function (test) {
                 // Fill our Quota then try to send a second fetch.
-                var firstFetch = fetch(CreateKeepAliveRequest(standardDelay, expectedQuota)).then(function(response) {
+                return fetchKeepAliveRequest(standardDelay, expectedQuota).then(() => {
                     // Now validate that we can send another Keep-Alive fetch for the full size of the quota.
-                    return fetch(CreateKeepAliveRequest(0 /* delay */, expectedQuota));
+                    return fetchKeepAliveRequest(noDelay, expectedQuota);
                 });
-
-                return firstFetch;
-            }, "A Keep-Alive fetch() should return it's allocated Quota upon promise resolution.");
+            }, 'A Keep-Alive fetch() should return its allocated Quota upon promise resolution.');
 
             // Ensure only the correct amount of Quota becomes available when a fetch completes.
             promise_test(function(test) {
-                var lastFetchSucceeded = false;
                 // Create a fetch that uses all but 1 Byte of the Quota and runs for 2x as long as the other requests.
-                var firstFetch = fetch(CreateKeepAliveRequest(standardDelay * 2, expectedQuota - 1)).then(function(response) {
-                    // This should be our last completing fetch(). We need to validate that the last fetch we sent out actually
-                    // completed.
-                    assert_true(lastFetchSucceeded, "Out last fetch after gaining Quota back should have succeeded.");
-                });
+                var first = fetchKeepAliveRequest(standardDelay * 2, expectedQuota - 1);
 
                 // Now create a single Byte request that will complete quicker.
-                fetch(CreateKeepAliveRequest(standardDelay, 1 /* bodySize */)).then(function(response) {
+                let second = fetchKeepAliveRequest(standardDelay, 1 /* bodySize */).then(() => {
                     // We shouldn't be able to create a 2 Byte request right now as only 1 Byte should have freed up.
-                    assert_throws(new TypeError(), fetch(CreateKeepAliveRequest(0 /* delay */, 2 /* bodySize */)), "Only 1 Byte of Quota should be available right now.");
-
+                    return promise_rejects(test, TypeError(), fetchKeepAliveRequest(noDelay, 2 /* bodySize */));
+                }).then(() => {
                     // Now validate that we can send another Keep-Alive fetch for just 1 Byte.
-                    fetch(CreateKeepAliveRequest(0 /* delay */, 1 /* bodySize */)).then(function(response) {
-                        // Flag we got a response from this request.
-                        lastFetchSucceeded = true;
-                    });
+                    return fetchKeepAliveRequest(noDelay, 1 /* bodySize */);
                 });
 
-                return firstFetch;
-            }, "A Keep-Alive fetch() should return only it's allocated Quota upon promise resolution.");
+                return Promise.all([first, second]);
+            }, 'A Keep-Alive fetch() should return only its allocated Quota upon promise resolution.');
 
             // Test rejecting a fetch() after the quota is used up.
             promise_test(function (test) {
                 // Fill our Quota then try to send a second fetch.
-                fetch(CreateKeepAliveRequest(standardDelay, expectedQuota));
+                fetchKeepAliveRequest(standardDelay, expectedQuota);
 
-                return promise_rejects(test, new TypeError(), fetch(CreateKeepAliveRequest(0 /* delay */, 1 /* bodySize */)));
-            }, "A Keep-Alive fetch() should not be allowed if the Quota is used up.");
+                return promise_rejects(test, TypeError(), fetchKeepAliveRequest(noDelay, 1 /* bodySize */));
+            }, 'A Keep-Alive fetch() should not be allowed if the Quota is used up.');
 
         </script>
     </body>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/defer.js b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/defer.js
new file mode 100644
index 0000000..c4449ca
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/defer.js

@@ -0,0 +1,4 @@
+t.step(() => {
+  assert_equals(script_run_status, "deferred", "the script run status");
+});
+t.done();

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/script-defer.html b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/script-defer.html
new file mode 100644
index 0000000..80eb98dc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/script-defer.html

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>HTML Test: HTMLScriptElement - defer</title>
+<link rel="author" title="Intel" href="http://www.intel.com/">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script>
+
+let script_run_status = "inline";
+let t = async_test("the defer script run later");
+
+</script>
+
+<script type="text/javascript" src="defer.js" defer></script>
+
+<script>
+
+t.step(() => {
+  assert_equals(script_run_status, "inline", "the script run status");
+  script_run_status = "deferred";
+});
+
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-createOffer-offerToReceive.html b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-createOffer-offerToReceive.html
index aaa44b6..c599b1c0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-createOffer-offerToReceive.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-createOffer-offerToReceive.html

@@ -8,15 +8,15 @@
 <script>
   'use strict';
 
-  // Run some tests for both audio and video types
-  ['audio', 'video'].forEach((type) => {
-    const capsType = type[0].toUpperCase() + type.slice(1);
+  // Run some tests for both audio and video kinds
+  ['audio', 'video'].forEach((kind) => {
+    const capsKind = kind[0].toUpperCase() + kind.slice(1);
 
     const offerToReceiveTrue = {};
-    offerToReceiveTrue[`offerToReceive${capsType}`] = true;
+    offerToReceiveTrue[`offerToReceive${capsKind}`] = true;
 
     const offerToReceiveFalse = {};
-    offerToReceiveFalse[`offerToReceive${capsType}`] = false;
+    offerToReceiveFalse[`offerToReceive${capsKind}`] = false;
 
     // Start testing
     promise_test(t => {
@@ -28,7 +28,7 @@
         assert_equals(pc.getTransceivers().length, 0,
           'Expect pc to have no transceivers');
       });
-    }, `createOffer() with offerToReceive${capsType} set to false should not create a transceiver`);
+    }, `createOffer() with offerToReceive${capsKind} set to false should not create a transceiver`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
@@ -42,7 +42,7 @@
         assert_equals(transceiver.direction, 'recvonly',
           'Expect transceiver to have "recvonly" direction');
       });
-    }, `createOffer() with offerToReceive${capsType} should create a "recvonly" transceiver`);
+    }, `createOffer() with offerToReceive${capsKind} should create a "recvonly" transceiver`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
@@ -62,12 +62,12 @@
           'Expect pc to still have only one transceiver');
       })
       ;
-    }, `offerToReceive${capsType} option should be ignored if a non-stopped "recvonly" transceiver exists`);
+    }, `offerToReceive${capsKind} option should be ignored if a non-stopped "recvonly" transceiver exists`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
 
-      return getTrackFromUserMedia(type)
+      return getTrackFromUserMedia(kind)
       .then(([track, stream]) => {
         pc.addTrack(track, stream);
         return pc.createOffer();
@@ -86,12 +86,12 @@
           'Expect pc to still have only one transceiver');
       })
       ;
-    }, `offerToReceive${capsType} option should be ignored if a non-stopped "sendrecv" transceiver exists`);
+    }, `offerToReceive${capsKind} option should be ignored if a non-stopped "sendrecv" transceiver exists`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
 
-      return getTrackFromUserMedia(type)
+      return getTrackFromUserMedia(kind)
       .then(([track, stream]) => {
         pc.addTrack(track, stream);
         return pc.createOffer(offerToReceiveFalse);
@@ -105,12 +105,12 @@
           'Expect transceiver to have "sendonly" direction');
       })
       ;
-    }, `offerToReceive${capsType} set to false with a track should create a "sendonly" transceiver`);
+    }, `offerToReceive${capsKind} set to false with a track should create a "sendonly" transceiver`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
 
-      pc.addTransceiver(type, {direction: 'recvonly'});
+      pc.addTransceiver(kind, {direction: 'recvonly'});
 
       return pc.createOffer(offerToReceiveFalse)
       .then(() => {
@@ -122,13 +122,13 @@
           'Expect transceiver to have "inactive" direction');
       })
       ;
-    }, `offerToReceive${capsType} set to false with a "recvonly" transceiver should change the direction to "inactive"`);
+    }, `offerToReceive${capsKind} set to false with a "recvonly" transceiver should change the direction to "inactive"`);
 
     promise_test(t => {
       const pc = new RTCPeerConnection();
       const pc2 = new RTCPeerConnection();
 
-      return getTrackFromUserMedia(type)
+      return getTrackFromUserMedia(kind)
       .then(([track, stream]) => {
         pc.addTrack(track, stream);
         return pc.createOffer();
@@ -148,7 +148,7 @@
           'Expect transceiver to have "sendonly" direction');
       })
       ;
-    }, `subsequent offerToReceive${capsType} set to false with a track should change the direction to "sendonly"`);
+    }, `subsequent offerToReceive${capsKind} set to false with a track should change the direction to "sendonly"`);
   });
 
   promise_test(t => {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/constructor-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/constructor-expected.txt
deleted file mode 100644
index 087efc5..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/constructor-expected.txt
+++ /dev/null

@@ -1,7 +0,0 @@
-This is a testharness.js-based test.
-FAIL VTTCue(), initial values assert_equals: expected (string) "start" but got (undefined) undefined
-PASS VTTCue(), bad start time
-PASS VTTCue(), bad end time
-PASS VTTCue(), text formatting
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/lineAlign-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/lineAlign-expected.txt
deleted file mode 100644
index e3cb95f..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/lineAlign-expected.txt
+++ /dev/null

@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL VTTCue.lineAlign, script-created cue assert_true: lineAlign is not supported expected true got false
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/positionAlign-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/positionAlign-expected.txt
deleted file mode 100644
index 83c37d8..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/VTTCue/positionAlign-expected.txt
+++ /dev/null

@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL VTTCue.positionAlign, script-created cue assert_true: positionAlign is not supported expected true got false
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/interfaces-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/interfaces-expected.txt
deleted file mode 100644
index 8c1f604c..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/webvtt/api/interfaces-expected.txt
+++ /dev/null

@@ -1,56 +0,0 @@
-This is a testharness.js-based test.
-Found 52 tests; 48 PASS, 4 FAIL, 0 TIMEOUT, 0 NOTRUN.
-PASS VTTCue interface: existence and properties of interface object
-PASS VTTCue interface object length
-PASS VTTCue interface object name
-PASS VTTCue interface: existence and properties of interface prototype object
-PASS VTTCue interface: existence and properties of interface prototype object's "constructor" property
-PASS VTTCue interface: attribute region
-PASS VTTCue interface: attribute vertical
-PASS VTTCue interface: attribute snapToLines
-PASS VTTCue interface: attribute line
-FAIL VTTCue interface: attribute lineAlign assert_true: The prototype object must have a property "lineAlign" expected true got false
-PASS VTTCue interface: attribute position
-FAIL VTTCue interface: attribute positionAlign assert_true: The prototype object must have a property "positionAlign" expected true got false
-PASS VTTCue interface: attribute size
-PASS VTTCue interface: attribute align
-PASS VTTCue interface: attribute text
-PASS VTTCue interface: operation getCueAsHTML()
-PASS VTTCue must be primary interface of new VTTCue(0, 0, "")
-PASS Stringification of new VTTCue(0, 0, "")
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "region" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "vertical" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "snapToLines" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "line" with the proper type
-FAIL VTTCue interface: new VTTCue(0, 0, "") must inherit property "lineAlign" with the proper type assert_inherits: property "lineAlign" not found in prototype chain
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "position" with the proper type
-FAIL VTTCue interface: new VTTCue(0, 0, "") must inherit property "positionAlign" with the proper type assert_inherits: property "positionAlign" not found in prototype chain
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "size" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "align" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "text" with the proper type
-PASS VTTCue interface: new VTTCue(0, 0, "") must inherit property "getCueAsHTML()" with the proper type
-PASS VTTRegion interface: existence and properties of interface object
-PASS VTTRegion interface object length
-PASS VTTRegion interface object name
-PASS VTTRegion interface: existence and properties of interface prototype object
-PASS VTTRegion interface: existence and properties of interface prototype object's "constructor" property
-PASS VTTRegion interface: attribute id
-PASS VTTRegion interface: attribute width
-PASS VTTRegion interface: attribute lines
-PASS VTTRegion interface: attribute regionAnchorX
-PASS VTTRegion interface: attribute regionAnchorY
-PASS VTTRegion interface: attribute viewportAnchorX
-PASS VTTRegion interface: attribute viewportAnchorY
-PASS VTTRegion interface: attribute scroll
-PASS VTTRegion must be primary interface of new VTTRegion()
-PASS Stringification of new VTTRegion()
-PASS VTTRegion interface: new VTTRegion() must inherit property "id" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "width" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "lines" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "regionAnchorX" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "regionAnchorY" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "viewportAnchorX" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "viewportAnchorY" with the proper type
-PASS VTTRegion interface: new VTTRegion() must inherit property "scroll" with the proper type
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/parsing/file-parsing/tests/settings-position-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webvtt/parsing/file-parsing/tests/settings-position-expected.txt
deleted file mode 100644
index 124ce22..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/webvtt/parsing/file-parsing/tests/settings-position-expected.txt
+++ /dev/null

@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL settings, position assert_equals: Failed with cue 0 expected (string) "auto" but got (undefined) undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html
new file mode 100644
index 0000000..29cb32a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center-ref.html

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<style>
+.container {
+    position: relative;
+    display: inline-block;
+    width: 320px;
+    height: 240px;
+}
+.cue {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    overflow: hidden;
+}
+.cue.center {
+    text-align: center;
+}
+.cue > span {
+    font-family: sans-serif;
+    background: green;
+    color: green;
+    font-size: 50px;
+    padding: 2px;
+}
+</style>
+<div class="container">
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+    <source src="/media/white.webm" type="video/webm">
+    <source src="/media/white.mp4" type="video/mp4">
+</video>
+<div class="cue center"><span>&#x5d0;&#x5d1;&#x5d2;</span></div>
+</div>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html
new file mode 100644
index 0000000..05f4244d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-center.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<link rel="match" href="track-cue-rendering-position-align-rtl-center-ref.html">
+<script>
+function addTrackWithRtlCueData(video, cueData) {
+  var track = video.addTextTrack('subtitles');
+  var cue = new VTTCue(0, 10, '\u05d0\u05d1\u05d2');
+  for (var prop in cueData)
+    cue[prop] = cueData[prop];
+  track.addCue(cue);
+  track.mode = 'showing';
+}
+</script>
+<style>
+video::cue {
+  font-size: 50px;
+  color: green;
+  background-color: green;
+}
+</style>
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+  <source src="/media/white.webm" type="video/webm">
+  <source src="/media/white.mp4" type="video/mp4">
+  <script>
+  var video = document.currentScript.parentNode;
+  addTrackWithRtlCueData(video, { position: 50, positionAlign: 'center', align: 'center', size: 50, line: 0 });
+  </script>
+</video>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html
new file mode 100644
index 0000000..42ae433
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left-ref.html

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<style>
+.container {
+    position: relative;
+    display: inline-block;
+    width: 320px;
+    height: 240px;
+}
+.cue {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    overflow: hidden;
+}
+.cue.start {
+    text-align: end;
+}
+.cue > span {
+    font-family: sans-serif;
+    background: green;
+    color: green;
+    font-size: 50px;
+    padding: 2px;
+}
+</style>
+<div class="container">
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+    <source src="/media/white.webm" type="video/webm">
+    <source src="/media/white.mp4" type="video/mp4">
+</video>
+<div class="cue start"><span>&#x5d0;&#x5d1;&#x5d2;</span></div>
+</div>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html
new file mode 100644
index 0000000..7433d9f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-left.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<link rel="match" href="track-cue-rendering-position-align-rtl-line-left-ref.html">
+<script>
+function addTrackWithRtlCueData(video, cueData) {
+  var track = video.addTextTrack('subtitles');
+  var cue = new VTTCue(0, 10, '\u05d0\u05d1\u05d2');
+  for (var prop in cueData)
+    cue[prop] = cueData[prop];
+  track.addCue(cue);
+  track.mode = 'showing';
+}
+</script>
+<style>
+video::cue {
+  font-size: 50px;
+  color: green;
+  background-color: green;
+}
+</style>
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+  <source src="/media/white.webm" type="video/webm">
+  <source src="/media/white.mp4" type="video/mp4">
+  <script>
+  var video = document.currentScript.parentNode;
+  addTrackWithRtlCueData(video, { position: 50, positionAlign: 'line-left', align: 'start', size: 50, line: 0 });
+  </script>
+</video>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html
new file mode 100644
index 0000000..374cbdf0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right-ref.html

@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<style>
+.container {
+    position: relative;
+    display: inline-block;
+    width: 320px;
+    height: 240px;
+}
+.cue {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    overflow: hidden;
+}
+.cue.end {
+    text-align: start;
+}
+.cue > span {
+    font-family: sans-serif;
+    background: green;
+    color: green;
+    font-size: 50px;
+    padding: 2px;
+}
+</style>
+<div class="container">
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+    <source src="/media/white.webm" type="video/webm">
+    <source src="/media/white.mp4" type="video/mp4">
+</video>
+<div class="cue end"><span>&#x5d0;&#x5d1;&#x5d2;</span></div>
+</div>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html
new file mode 100644
index 0000000..b0a0d74
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webvtt/rendering/cues-with-video/processing-model/track-cue-rendering-position-align-rtl-line-right.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script src="/common/reftest-wait.js"></script>
+<link rel="match" href="track-cue-rendering-position-align-rtl-line-right-ref.html">
+<script>
+function addTrackWithRtlCueData(video, cueData) {
+  var track = video.addTextTrack('subtitles');
+  var cue = new VTTCue(0, 10, '\u05d0\u05d1\u05d2');
+  for (var prop in cueData)
+    cue[prop] = cueData[prop];
+  track.addCue(cue);
+  track.mode = 'showing';
+}
+</script>
+<style>
+video::cue {
+  font-size: 50px;
+  color: green;
+  background-color: green;
+}
+</style>
+<video width="320" height="240" autoplay onplaying="this.onplaying = null; this.pause(); takeScreenshot();">
+  <source src="/media/white.webm" type="video/webm">
+  <source src="/media/white.mp4" type="video/mp4">
+  <script>
+  var video = document.currentScript.parentNode;
+  addTrackWithRtlCueData(video, { position: 50, positionAlign: 'line-right', align: 'end', size: 50, line: 0 });
+  </script>
+</video>
+</html>

diff --git a/third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-exceptions.html b/third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-failures.html
similarity index 63%
rename from third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-exceptions.html
rename to third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-failures.html
index 8ce169d..2e34188 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-exceptions.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas-api/OffscreenCanvas-convertToBlob-failures.html

@@ -27,35 +27,25 @@
 
 async_test(function(t) {
     var offscreenCanvas = new OffscreenCanvas(0, 0);
-    offscreenCanvas.convertToBlob().then(t.step_func_done(function() {
-        assert_false("convertToBlob didn't throw, but should be");
+    offscreenCanvas.convertToBlob().then(t.step_func_done(function(blob) {
+        assert_equals(null, blob, "convertToBlob should return null as result blob.");
     }), t.step_func_done(function(e) {
-        assert_true(e instanceof DOMException);
-        assert_equals(e.name, "IndexSizeError");
+        assert_false("convertToBlob should not throw exception.");
     }));
 }, "Test that call convertToBlob on an OffscreenCanvas with size 0 throws exception");
 
 async_test(function(t) {
-    var webp_max_dimension = 16383; // Based on WEBPImageEncoder.cpp?l=52
+    // Based on third_party/libwebp/src/webp/encode.h:WEBP_MAX_DIMENSION
+    var webp_max_dimension = 16383;
+    // This test simulates the encoding failure.
     var offscreenCanvas = new OffscreenCanvas(10, webp_max_dimension + 1);
     var ctx = offscreenCanvas.getContext("2d");
-    offscreenCanvas.convertToBlob({type: "image/webp"}).then(t.step_func_done(function() {
-        assert_false("convertToBlob didn't throw, but should be");
+    offscreenCanvas.convertToBlob({type: "image/webp"}).then(t.step_func_done(function(blob) {
+        assert_equals(null, blob, "convertToBlob should return null as result blob.");
     }), t.step_func_done(function(e) {
-        assert_true(e instanceof DOMException);
-        assert_equals(e.name, "EncodingError");
+        assert_false("convertToBlob should not throw exception.");
     }));
 }, "Test that call convertToBlob throws EncodingError exception when encoding fails");
 
-async_test(function(t) {
-    var offscreenCanvas = new OffscreenCanvas(10, 10);
-    offscreenCanvas.convertToBlob().then(t.step_func_done(function() {
-        assert_false("convertToBlob didn't throw, but should be");
-    }), t.step_func_done(function(e) {
-        assert_true(e instanceof DOMException);
-        assert_equals(e.name, "InvalidStateError");
-    }));
-}, "Test that call convertToBlob on an OffscreenCanvas without contexts throws exception");
-
 </script>
 

diff --git a/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-zero-size-readback.html b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-zero-size-readback.html
index c9acf3a..e0b2cb5 100644
--- a/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-zero-size-readback.html
+++ b/third_party/WebKit/LayoutTests/fast/canvas/OffscreenCanvas-zero-size-readback.html

@@ -59,6 +59,8 @@
     assert_equals(imgdata.height, 1);
   }
 
-  return promise_rejects(t, new DOMException('', 'IndexSizeError'), offscreen.convertToBlob());
+  return offscreen.convertToBlob().then(function(resultBlob) {
+    assert_equals(null, resultBlob);
+  });
 }
-</script>
\ No newline at end of file
+</script>

diff --git a/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-many.html b/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-many.html
index 95ca91e7..abbfaa4b1 100644
--- a/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-many.html
+++ b/third_party/WebKit/LayoutTests/fast/peerconnection/RTCPeerConnection-many.html

@@ -13,7 +13,7 @@
 // - 850 on Windows
 // - 1700 on Linux
 
-const limit = 500;
+const limit = internals.peerConnectionCountLimit;
 
 test(function() {
   for (let count = 0; count < limit; count++) {
@@ -21,6 +21,15 @@
   }
 }, 'We can create ' + limit + ' peerconnections without crashing');
 
+test(function() {
+  while (internals.peerConnectionCount() < internals.peerConnectionCountLimit) {
+    pc = new RTCPeerConnection();
+  }
+  assert_throws("UnknownError",
+                function() {pc = new RTCPeerConnection()},
+                'Creating too many PeerConnections gives UnknownError');
+}, 'Creating too many peerconnections returns the right error');
+
 </script>
 </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-create-basics.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-create-basics.html
index d9afee3..9c9e84cf 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-create-basics.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-create-basics.html

@@ -3,8 +3,9 @@
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
 <script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
-<script src="resources/authenticator-helpers.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
 
 // Common mock values for the mockAuthenticator.
@@ -73,13 +74,6 @@
 
 promise_test(t => {
     mockAuthenticator.setAuthenticatorStatus(
-      webauth.mojom.AuthenticatorStatus.CANCELLED);
-    return promise_rejects(t, "NotAllowedError",
-        navigator.credentials.create({ publicKey }));
-}, "Verify that cancelled error returned by mock is properly handled.");
-
-promise_test(t => {
-    mockAuthenticator.setAuthenticatorStatus(
       webauth.mojom.AuthenticatorStatus.PENDING_REQUEST);
     return promise_rejects(t, "InvalidStateError",
         navigator.credentials.create({ publicKey }));
@@ -107,19 +101,6 @@
 }, "Verify that not supported error returned by mock is properly handled.");
 
 promise_test(t => {
-    mockAuthenticator.setAuthenticatorStatus(
-        webauth.mojom.AuthenticatorStatus.SECURITY_ERROR);
-    return promise_rejects(t, "SecurityError",
-        navigator.credentials.create({ publicKey }));
-}, "Verify that security error returned by mock is properly handled.");
-
-promise_test(t => {
- mockAuthenticator.setAuthenticatorStatus(webauth.mojom.AuthenticatorStatus.NOT_IMPLEMENTED);
-   return promise_rejects(t, "NotAllowedError",
-      navigator.credentials.create({ publicKey }));
-}, 'Verify that not implemented error returned by mock is properly handled.');
-
-promise_test(t => {
     var publicKey = {
         // No challenge.
         rp: public_key_rp,

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-basics.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-basics.html
index a286c812..6089e97 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-basics.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-basics.html

@@ -1,12 +1,15 @@
-<!DOCTYPE html>
+<!doctype html>
 <title>Credential Manager: get() basics.</title>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
 
 add_completion_callback(() => {
-    if (window.testRunner)
-        window.testRunner.clearMockCredentialManagerResponse();
+  mockCredentialManager.reset();
 });
 
 promise_test(_ => {
@@ -93,8 +96,7 @@
   var name = "name";
   var icon = "http://example.com/";
 
-  if (window.testRunner)
-    testRunner.setMockCredentialManagerResponse(id, name, icon, password);
+  mockCredentialManager.setResponse(id, password, name, icon);
 
   return navigator.credentials.get({
     password: true

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-errors.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-errors.html
index 02c2e47..0216e0b 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-errors.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-get-errors.html

@@ -1,32 +1,27 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
+
 add_completion_callback(() => {
-    if (window.testRunner) {
-        // Clear the error value by passing an empty string.
-        testRunner.setMockCredentialManagerError("");
-    }
+  mockCredentialManager.reset();
 });
 
 promise_test(function (t) {
-    if (window.testRunner)
-        testRunner.setMockCredentialManagerError("pending");
-    return promise_rejects(t, "InvalidStateError", navigator.credentials.get({ password: true }));
+  mockCredentialManager.setError(passwordManager.mojom.CredentialManagerError.PENDING_REQUEST);
+  return promise_rejects(t, "InvalidStateError", navigator.credentials.get({ password: true }));
 });
 promise_test(function (t) {
-    if (window.testRunner)
-        testRunner.setMockCredentialManagerError("disabled");
-    return promise_rejects(t, "InvalidStateError", navigator.credentials.get({ password: true }));
+  mockCredentialManager.setError(passwordManager.mojom.CredentialManagerError.UNKNOWN);
+  return promise_rejects(t, "NotReadableError", navigator.credentials.get({ password: true }));
 });
 promise_test(function (t) {
-    if (window.testRunner)
-        testRunner.setMockCredentialManagerError("unknown");
-    return promise_rejects(t, "NotReadableError", navigator.credentials.get({ password: true }));
-});
-promise_test(function (t) {
-    return promise_rejects(t, new TypeError(), navigator.credentials.get({
-        mediation: "invalid"
-    }));
+  return promise_rejects(t, new TypeError(), navigator.credentials.get({
+      mediation: "invalid"
+  }));
 });
 </script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-preventsilentaccess-basics.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-preventsilentaccess-basics.html
index 337d958..bcaaaed 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-preventsilentaccess-basics.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-preventsilentaccess-basics.html

@@ -2,6 +2,10 @@
 <title>Credential Manager: preventSilentAccess() basics.</title>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
 
 promise_test(_ => {

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-store-basics.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-store-basics.html
index a7b8f9e..89b1162 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-store-basics.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/credentialscontainer-store-basics.html

@@ -2,8 +2,17 @@
 <title>Credential Manager: store() basics.</title>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
 
+add_completion_callback(() => {
+  mockCredentialManager.reset();
+});
+
+
 function CreatePasswordCredentialWithIconURL(url) {
   return new PasswordCredential({
       id: 'id',

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/mock-authenticator.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/mock-authenticator.html
index d9401a9..47bd04f 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/mock-authenticator.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/mock-authenticator.html

@@ -2,13 +2,15 @@
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom.js"></script>
 <script src="/gen/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom.js"></script>
-<script src="resources/authenticator-helpers.js"></script>
+<script src="resources/credential-helpers.js"></script>
 <script>
 
 'use strict';
 
 test(function(t) {
-	assert_true(mockAuthenticator instanceof Object);
+  assert_true(mockAuthenticator instanceof Object);
+  assert_true(mockCredentialManager instanceof Object);
 }, "Authenticator Mojo bindings and mock interfaces are available to tests.")
 </script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/authenticator-helpers.js b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/authenticator-helpers.js
deleted file mode 100644
index 78b545b..0000000
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/authenticator-helpers.js
+++ /dev/null

@@ -1,86 +0,0 @@
-'use strict';
-
-// Class that mocks Authenticator interface defined in authenticator.mojom.
-class MockAuthenticator {
-  constructor() {
-    this.reset();
-
-    this.binding_ = new mojo.Binding(webauth.mojom.Authenticator, this);
-    this.interceptor_ = new MojoInterfaceInterceptor(
-        webauth.mojom.Authenticator.name);
-    this.interceptor_.oninterfacerequest = e => {
-      this.binding_.bind(e.handle);
-    };
-    this.interceptor_.start();
-  }
-
-  // Returns a PublicKeyCredentialInfo to the client.
-  async makeCredential(options) {
-    var info = null;
-    if (this.status_ == webauth.mojom.AuthenticatorStatus.SUCCESS) {
-      let response = new webauth.mojom.AuthenticatorResponse(
-          { attestationObject: this.attestationObject_,
-            authenticatorData: this.authenticatorData_,
-            signature: this.signature_,
-            userHandle: this.userHandle_
-          });
-      info = new webauth.mojom.PublicKeyCredentialInfo(
-          { id: this.id_,
-            rawId: this.rawId_,
-            clientDataJson: this.clientDataJson_,
-            response: response
-          });
-    }
-    let status = this.status_;
-    this.reset();
-    return {status, credential: info};
-  }
-
-  // Mock functions
-
-  // Resets state of mock Authenticator.
-  reset() {
-    this.status_ = webauth.mojom.AuthenticatorStatus.UNKNOWN_ERROR;
-    this.id_ = null;
-    this.rawId_ = new Uint8Array(0);
-    this.clientDataJson_ = new Uint8Array(0);
-    this.attestationObject_ = new Uint8Array(0);
-    this.authenticatorData_ = new Uint8Array(0);
-    this.signature_ = new Uint8Array(0);
-    this.userHandle = new Uint8Array(0);
-  }
-
-  setAuthenticatorStatus(status) {
-    this.status_ = status;
-  }
-
-  setId(id) {
-    this.id_ = id;
-  }
-
-  setRawId(rawId) {
-    this.rawId_ = rawId;
-  }
-
-  setClientDataJson(clientDataJson) {
-    this.clientDataJson_ = clientDataJson;
-  }
-
-  setAttestationObject(attestationObject) {
-    this.attestationObject_ = attestationObject;
-  }
-
-  setAuthenticatorData(authenticatorData) {
-    this.authenticatorData_ = authenticatorData;
-  }
-
-  setSignature(signature) {
-    this.signature_ = signature;
-  }
-
-  setUserHandle(userHandle) {
-    this.userHandle = userHandle;
-  }
-}
-
-let mockAuthenticator = new MockAuthenticator();

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/credential-helpers.js b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/credential-helpers.js
new file mode 100644
index 0000000..8d28842f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/credential-helpers.js

@@ -0,0 +1,149 @@
+'use strict';
+
+// Mocks the CredentialManager interface defined in credential_manager.mojom.
+class MockCredentialManager {
+  constructor() {
+    this.reset();
+
+    this.binding_ = new mojo.Binding(passwordManager.mojom.CredentialManager, this);
+    this.interceptor_ = new MojoInterfaceInterceptor(
+        passwordManager.mojom.CredentialManager.name);
+    this.interceptor_.oninterfacerequest = e => {
+      this.binding_.bind(e.handle);
+    };
+    this.interceptor_.start();
+  }
+
+  constructCredentialInfo_(type, id, password, name, icon) {
+    return new passwordManager.mojom.CredentialInfo({
+      type: type,
+      id: id,
+      name: name,
+      icon: new url.mojom.Url({url: icon}),
+      password: password,
+      federation: new url.mojom.Origin(
+          {scheme: '', host: '', port: 0, suborigin: '', unique: true})
+    });
+  }
+
+  // Mock functions:
+
+  async get(mediation, includePasswords, federations) {
+    console.log(passwordManager.mojom.CredentialType.PASSWORD);
+    if (this.error_ == passwordManager.mojom.CredentialManagerError.SUCCESS) {
+      return {error: this.error_, credential: this.credentialInfo_};
+    } else {
+      return {error: this.error_, credential: null};
+    }
+  }
+
+  async store(credential) {
+    return {};
+  }
+
+  async preventSilentAccess() {
+    return {};
+  }
+
+  // Resets state of mock CredentialManager.
+  reset() {
+    this.error_ = passwordManager.mojom.CredentialManagerError.SUCCESS;
+    this.credentialInfo_ = this.constructCredentialInfo_(
+        passwordManager.mojom.CredentialType.EMPTY, '', '', '', '');
+  }
+
+  setResponse(id, password, name, icon) {
+    this.credentialInfo_ = this.constructCredentialInfo_(
+        passwordManager.mojom.CredentialType.PASSWORD, id, password, name,
+        icon);
+  }
+
+  setError(error) {
+    this.error_ = error;
+  }
+}
+
+// Class that mocks Authenticator interface defined in authenticator.mojom.
+class MockAuthenticator {
+  constructor() {
+    this.reset();
+
+    this.binding_ = new mojo.Binding(webauth.mojom.Authenticator, this);
+    this.interceptor_ = new MojoInterfaceInterceptor(
+        webauth.mojom.Authenticator.name);
+    this.interceptor_.oninterfacerequest = e => {
+      this.binding_.bind(e.handle);
+    };
+    this.interceptor_.start();
+  }
+
+  // Mock functions:
+
+  async makeCredential(options) {
+    var info = null;
+    if (this.status_ == webauth.mojom.AuthenticatorStatus.SUCCESS) {
+      let response = new webauth.mojom.AuthenticatorResponse(
+          { attestationObject: this.attestationObject_,
+            authenticatorData: this.authenticatorData_,
+            signature: this.signature_,
+            userHandle: this.userHandle_
+          });
+      info = new webauth.mojom.PublicKeyCredentialInfo(
+          { id: this.id_,
+            rawId: this.rawId_,
+            clientDataJson: this.clientDataJson_,
+            response: response
+          });
+    }
+    let status = this.status_;
+    this.reset();
+    return {status, credential: info};
+  }
+
+  // Resets state of mock Authenticator.
+  reset() {
+    this.status_ = webauth.mojom.AuthenticatorStatus.UNKNOWN_ERROR;
+    this.id_ = null;
+    this.rawId_ = new Uint8Array(0);
+    this.clientDataJson_ = new Uint8Array(0);
+    this.attestationObject_ = new Uint8Array(0);
+    this.authenticatorData_ = new Uint8Array(0);
+    this.signature_ = new Uint8Array(0);
+    this.userHandle = new Uint8Array(0);
+  }
+
+  setAuthenticatorStatus(status) {
+    this.status_ = status;
+  }
+
+  setId(id) {
+    this.id_ = id;
+  }
+
+  setRawId(rawId) {
+    this.rawId_ = rawId;
+  }
+
+  setClientDataJson(clientDataJson) {
+    this.clientDataJson_ = clientDataJson;
+  }
+
+  setAttestationObject(attestationObject) {
+    this.attestationObject_ = attestationObject;
+  }
+
+  setAuthenticatorData(authenticatorData) {
+    this.authenticatorData_ = authenticatorData;
+  }
+
+  setSignature(signature) {
+    this.signature_ = signature;
+  }
+
+  setUserHandle(userHandle) {
+    this.userHandle = userHandle;
+  }
+}
+
+var mockAuthenticator = new MockAuthenticator();
+var mockCredentialManager = new MockCredentialManager();

diff --git a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/iframed-credentialscontainer.html b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/iframed-credentialscontainer.html
index bc8dbdd..b3a7a12 100644
--- a/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/iframed-credentialscontainer.html
+++ b/third_party/WebKit/LayoutTests/http/tests/credentialmanager/resources/iframed-credentialscontainer.html

@@ -1,7 +1,5 @@
 <!DOCTYPE html>
 <script>
-if (window.testRunner)
-    testRunner.setMockCredentialManagerResponse("id", "name", "", "password");
 
 navigator.credentials.get({ 'password': true })
     .then(c => {

diff --git a/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple-expected.txt b/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple-expected.txt
index 2351d41..c6c9460f 100644
--- a/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple-expected.txt

@@ -1,4 +1,4 @@
-CONSOLE ERROR: Failed to load http://localhost:8000/xmlhttprequest/resources/access-control-basic-get-fail-non-simple.cgi: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:8000' is therefore not allowed access. The response had HTTP status code 403.
+CONSOLE ERROR: line 37: Failed to load http://localhost:8000/xmlhttprequest/resources/access-control-basic-get-fail-non-simple.cgi: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:8000' is therefore not allowed access. The response had HTTP status code 403.
 GET should not trigger a preflight request from a worker unless it has non-simple headers.
 
 PASS: Cross-domain access allowed for simple get.

diff --git a/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url-expected.txt b/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url-expected.txt
index e4a0621..8bd184cc 100644
--- a/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url-expected.txt

@@ -1,14 +1,14 @@
-CONSOLE ERROR: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
-CONSOLE ERROR: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load ftp://127.0.0.1/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
-CONSOLE ERROR: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
-CONSOLE ERROR: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load localhost:8080/: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
-CONSOLE ERROR: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
-CONSOLE ERROR: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
+CONSOLE ERROR: line 20: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 CONSOLE ERROR: line 1: Failed to load tel:1234: Cross origin requests are only supported for protocol schemes: http, data, chrome, https.
 [Worker] Test cross-origin XHRs to CORS-unsupported protocol schemes in the URL.
 

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt
new file mode 100644
index 0000000..7c3bace
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt

@@ -0,0 +1,7 @@
+Test passes if the fallback font selected for the Unicode Private Use Area test text matches known last resort fonts on each platform.
+󰀀󺪪󿿿􀀀􊪪􏿿
+#pua_test_run:
+"DejaVu Sans" : 11
+
+PASS
+

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort.js b/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort.js
new file mode 100644
index 0000000..f41eb23e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/layout-fonts/fallback-pua-last-resort.js

@@ -0,0 +1,24 @@
+(async function(testRunner) {
+  var page = await testRunner.createPage();
+  await page.loadHTML(`
+    <html>
+    <meta charset="UTF-8">
+    <body>
+        <div class="test">
+            <!-- Private use area Ranges: U+E000..U+F8FF, U+F0000..U+FFFFF, U+100000..U+10FFFF -->
+            <div id="pua_test_run">&#xE000;&#xE401;&#xE402;&#xE403;&#xF8FF;&#xF0000;&#xFAAAA;&#xFFFFF;&#x100000;&#x10AAAA;&#x10FFFF;</div>
+        </div>
+    </body>
+    </html>
+  `);
+  var session = await page.createSession();
+  testRunner.log(`Test passes if the fallback font selected for the Unicode Private Use Area test text matches known last resort fonts on each platform.`);
+
+  var helper = await testRunner.loadScript('./resources/layout-font-test.js');
+  var results = await helper(testRunner, session);
+
+  var pua_used_fonts = results.find(x => x.selector === '#pua_test_run').usedFonts;
+  var passed = pua_used_fonts.length === 1 && /^(Times New Roman|Times|DejaVu Sans|Arial)$/.test(pua_used_fonts[0].familyName) && pua_used_fonts[0].glyphCount == 11;
+  testRunner.log(passed ? 'PASS' : 'FAIL');
+  testRunner.completeTest();
+})

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-metrics-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-metrics-expected.txt
index d9feb28..770c5e9 100644
--- a/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-metrics-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-metrics-expected.txt

@@ -16,6 +16,7 @@
 	V8PerContextDatas
 	WorkerGlobalScopes
 	UACSSResources
+	RTCPeerConnections
 	LayoutCount
 	RecalcStyleCount
 	LayoutDuration
@@ -43,6 +44,7 @@
 	V8PerContextDatas
 	WorkerGlobalScopes
 	UACSSResources
+	RTCPeerConnections
 	LayoutCount
 	RecalcStyleCount
 	LayoutDuration

diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-push-metrics-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-push-metrics-expected.txt
index f7a6fe47..b97763fa 100644
--- a/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-push-metrics-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/performance/perf-push-metrics-expected.txt

@@ -15,6 +15,7 @@
 	V8PerContextDatas
 	WorkerGlobalScopes
 	UACSSResources
+	RTCPeerConnections
 	LayoutCount
 	RecalcStyleCount
 	LayoutDuration
@@ -42,6 +43,7 @@
 	V8PerContextDatas
 	WorkerGlobalScopes
 	UACSSResources
+	RTCPeerConnections
 	LayoutCount
 	RecalcStyleCount
 	LayoutDuration
@@ -69,6 +71,7 @@
 	V8PerContextDatas
 	WorkerGlobalScopes
 	UACSSResources
+	RTCPeerConnections
 	LayoutCount
 	RecalcStyleCount
 	LayoutDuration

diff --git a/third_party/WebKit/LayoutTests/media/track/captions-webvtt/captions-snap-to-lines-not-set.vtt b/third_party/WebKit/LayoutTests/media/track/captions-webvtt/captions-snap-to-lines-not-set.vtt
index 0abadb47..473c92c1 100644
--- a/third_party/WebKit/LayoutTests/media/track/captions-webvtt/captions-snap-to-lines-not-set.vtt
+++ b/third_party/WebKit/LayoutTests/media/track/captions-webvtt/captions-snap-to-lines-not-set.vtt

@@ -1,61 +1,61 @@
 WEBVTT FILE
 
 1
-00:00:00.000 --> 00:00:00.500 line:100% position:50%
+00:00:00.000 --> 00:00:00.500 line:100% position:50%,center
 This is a demo track to illustrate positioning features of cues.
 
 2
-00:00:00.500 --> 00:00:01.000 line:50% position:50%
+00:00:00.500 --> 00:00:01.000 line:50% position:50%,center
 Using HTML5 captions, you can position the cues anywhere.
 
 3
-00:00:01.000 --> 00:00:01.500 line:0% position:0% align:start
+00:00:01.000 --> 00:00:01.500 line:0% position:0%,line-left align:start
 For example, here is a cue on the top left-corner.
 
 4
-00:00:01.500 --> 00:00:02.000 line:0% position:100% align:end
+00:00:01.500 --> 00:00:02.000 line:0% position:100%,line-right align:end
 Or on the top-right corner.
 
 5
-00:00:02.000 --> 00:00:02.500 line:100% position:100% align:right
+00:00:02.000 --> 00:00:02.500 line:100% position:100%,line-right align:right
 Bottom-right corner.
 
 6
-00:00:02.500 --> 00:00:03.000 line:100% position:0% align:left
+00:00:02.500 --> 00:00:03.000 line:100% position:0%,line-left align:left
 And, as you might expect, the bottom-left one.
 
 7
-00:00:03.000 --> 00:00:03.500 line:50% position:50%
+00:00:03.000 --> 00:00:03.500 line:50% position:50%,center
 Cues are implicitly displayed within the viewport area.
 
 8
-00:00:03.500 --> 00:00:04.000 line:100% position:50% align:middle
+00:00:03.500 --> 00:00:04.000 line:100% position:50%,center align:center
 And always on top of the controls, if these are visible.
 
 9
-00:00:04.000 --> 00:00:05.000 line:50% position:50%
+00:00:04.000 --> 00:00:05.000 line:50% position:50%,center
 You may even have multiple cues in the same time.
 
 10
-00:00:04.000 --> 00:00:05.000 line:0% position:0% align:start
+00:00:04.000 --> 00:00:05.000 line:0% position:0%,line-left align:start
 Top-left cue.
 
 11
-00:00:04.000 --> 00:00:05.000 line:0% position:100% align:end
+00:00:04.000 --> 00:00:05.000 line:0% position:100%,line-right align:end
 Top-right cue.
 
 12
-00:00:04.000 --> 00:00:05.000 line:100% position:50%
+00:00:04.000 --> 00:00:05.000 line:100% position:50%,center
 Bottom cue.
 
 13
-00:00:04.000 --> 00:00:05.000 line:25% position:100% align:end
+00:00:04.000 --> 00:00:05.000 line:25% position:100%,line-right align:end
 Random cue 1.
 
 14
-00:00:04.000 --> 00:00:05.000 line:33% position:44% align:start
+00:00:04.000 --> 00:00:05.000 line:33% position:44%,line-left align:start
 Random cue 2.
 
 15
-00:00:04.000 --> 00:00:05.000 line:55% position:23% align:start
+00:00:04.000 --> 00:00:05.000 line:55% position:23%,line-left align:start
 Random cue 3.

diff --git a/third_party/WebKit/LayoutTests/media/track/track-cue-rendering-position-auto-rtl-expected.html b/third_party/WebKit/LayoutTests/media/track/track-cue-rendering-position-auto-rtl-expected.html
index 3971674..10e55e5 100644
--- a/third_party/WebKit/LayoutTests/media/track/track-cue-rendering-position-auto-rtl-expected.html
+++ b/third_party/WebKit/LayoutTests/media/track/track-cue-rendering-position-auto-rtl-expected.html

@@ -18,14 +18,14 @@
     overflow: hidden;
 }
 .cue.start {
-    right: 50%;
+    right: 25%;
     text-align: end;
 }
 .cue.middle {
     text-align: center;
 }
 .cue.end {
-    left: 50%;
+    left: 25%;
     text-align: start;
 }
 .cue > span {

diff --git a/third_party/WebKit/LayoutTests/platform/mac/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt
new file mode 100644
index 0000000..34900e5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt

@@ -0,0 +1,7 @@
+Test passes if the fallback font selected for the Unicode Private Use Area test text matches known last resort fonts on each platform.
+󰀀󺪪󿿿􀀀􊪪􏿿
+#pua_test_run:
+"Times" : 11
+
+PASS
+

diff --git a/third_party/WebKit/LayoutTests/platform/win7/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt b/third_party/WebKit/LayoutTests/platform/win7/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt
index 59dd5dac..a4f1254 100644
--- a/third_party/WebKit/LayoutTests/platform/win7/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win7/external/wpt/fetch/api/request/request-keepalive-quota-expected.txt

@@ -2,8 +2,8 @@
 PASS A Keep-Alive fetch() with a small body should succeed.
 FAIL A Keep-Alive fetch() with a body at the Quota Limit should succeed. promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
 PASS A Keep-Alive fetch() with a body over the Quota Limit should reject.
-FAIL A Keep-Alive fetch() should return it's allocated Quota upon promise resolution. promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
-FAIL A Keep-Alive fetch() should return only it's allocated Quota upon promise resolution. promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
-FAIL A Keep-Alive fetch() should not be allowed if the Quota is used up. assert_unreached: Should have rejected: undefined Reached unreachable code
+FAIL A Keep-Alive fetch() should return its allocated Quota upon promise resolution. promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
+FAIL A Keep-Alive fetch() should return only its allocated Quota upon promise resolution. promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
+PASS A Keep-Alive fetch() should not be allowed if the Quota is used up.
 Harness: the test ran to completion.
 

diff --git a/third_party/WebKit/LayoutTests/platform/win7/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt b/third_party/WebKit/LayoutTests/platform/win7/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt
new file mode 100644
index 0000000..be7b176
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win7/inspector-protocol/layout-fonts/fallback-pua-last-resort-expected.txt

@@ -0,0 +1,7 @@
+Test passes if the fallback font selected for the Unicode Private Use Area test text matches known last resort fonts on each platform.
+󰀀󺪪󿿿􀀀􊪪􏿿
+#pua_test_run:
+"Arial" : 11
+
+PASS
+

diff --git a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
index 5e8931fa..1835841e 100644
--- a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt

@@ -6200,7 +6200,9 @@
     attribute @@toStringTag
     getter align
     getter line
+    getter lineAlign
     getter position
+    getter positionAlign
     getter size
     getter snapToLines
     getter text
@@ -6209,7 +6211,9 @@
     method getCueAsHTML
     setter align
     setter line
+    setter lineAlign
     setter position
+    setter positionAlign
     setter size
     setter snapToLines
     setter text

diff --git a/third_party/WebKit/LayoutTests/webaudio/AudioContext/audiocontextoptions.html b/third_party/WebKit/LayoutTests/webaudio/AudioContext/audiocontextoptions.html
index 492beee7..e77ed92c 100644
--- a/third_party/WebKit/LayoutTests/webaudio/AudioContext/audiocontextoptions.html
+++ b/third_party/WebKit/LayoutTests/webaudio/AudioContext/audiocontextoptions.html

@@ -31,6 +31,9 @@
               context = new AudioContext()
             }, 'context = new AudioContext()').notThrow();
 
+            should(context.sampleRate,
+              `context.sampleRate (${context.sampleRate} Hz)`).beGreaterThan(0);
+
             defaultLatency = context.baseLatency;
             should(defaultLatency, 'default baseLatency').beGreaterThan(0);
 
@@ -96,7 +99,7 @@
                     'interactiveLatency/2})')
                 .notThrow();
             should(context.baseLatency, 'double-constructor baseLatency small')
-                .beEqualTo(interactiveLatency);
+                .beLessThanOrEqualTo(interactiveLatency);
             closingPromises.push(context.close());
 
             // Verify that exact latency in range works as expected
@@ -126,6 +129,8 @@
             }, 'creating two high latency contexts').notThrow();
             should(context1.baseLatency, 'high latency context baseLatency')
                 .beEqualTo(context2.baseLatency);
+            should(context1.baseLatency, 'high latency context baseLatency')
+                .beGreaterThan(interactiveLatency);
             closingPromises.push(context1.close());
             closingPromises.push(context2.close());
 

diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 28bb3e66..04eb616 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt

@@ -1051,6 +1051,11 @@
     getter data
     method constructor
     method initCompositionEvent
+interface ComputedAccessibleNode
+    attribute @@toStringTag
+    getter name
+    getter role
+    method constructor
 interface ConstantSourceNode : AudioScheduledSourceNode
     attribute @@toStringTag
     getter offset
@@ -7269,7 +7274,9 @@
     attribute @@toStringTag
     getter align
     getter line
+    getter lineAlign
     getter position
+    getter positionAlign
     getter region
     getter size
     getter snapToLines
@@ -7279,7 +7286,9 @@
     method getCueAsHTML
     setter align
     setter line
+    setter lineAlign
     setter position
+    setter positionAlign
     setter region
     setter size
     setter snapToLines
@@ -9345,6 +9354,7 @@
     method find
     method focus
     method gc
+    method getComputedAccessibleNode
     method getComputedStyle
     method getSelection
     method matchMedia

diff --git a/third_party/WebKit/Source/bindings/core/v8/ReferrerScriptInfo.h b/third_party/WebKit/Source/bindings/core/v8/ReferrerScriptInfo.h
index 65bb1d14..c270f07b 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ReferrerScriptInfo.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ReferrerScriptInfo.h

@@ -58,6 +58,10 @@
  private:
   // Spec: "referencing script's base URL"
   // https://html.spec.whatwg.org/multipage/webappapis.html#concept-script-base-url
+  //
+  // If base_url_.IsNull(), refer to ScriptOrigin::ResourceName() instead.
+  // Note: This improves the chance of getting into the fast path in
+  //       ToV8HostDefinedOptions().
   const KURL base_url_;
 
   // Spec: "referencing script's credentials mode"

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index 70153d8..c4e7f6a 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

@@ -105,6 +105,7 @@
 v8::Local<v8::Value> ScriptController::ExecuteScriptAndReturnValue(
     v8::Local<v8::Context> context,
     const ScriptSourceCode& source,
+    const KURL& base_url,
     const ScriptFetchOptions& fetch_options,
     AccessControlStatus access_control_status) {
   TRACE_EVENT1(
@@ -125,9 +126,11 @@
     v8::TryCatch try_catch(GetIsolate());
     try_catch.SetVerbose(true);
 
-    // TODO(kouhei): plumb the correct base url to here.
-    const KURL& wrong_base_url = source.Url();
-    const ReferrerScriptInfo referrer_info(wrong_base_url, fetch_options);
+    // Omit storing base URL if it is same as source URL.
+    // Note: This improves chance of getting into a fast path in
+    //       ReferrerScriptInfo::ToV8HostDefinedOptions.
+    KURL stored_base_url = (base_url == source.Url()) ? KURL() : base_url;
+    const ReferrerScriptInfo referrer_info(stored_base_url, fetch_options);
 
     v8::Local<v8::Script> script;
 
@@ -249,12 +252,15 @@
   v8::HandleScope handle_scope(GetIsolate());
 
   // https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate
+  // Step 12.8 "Let base URL be settings object's API base URL." [spec text]
+  KURL base_url = owner_document->BaseURL();
+
   // Step 12.9 "Let script be result of creating a classic script given script
   // source, settings, base URL, and the default classic script fetch options."
   // [spec text]
   v8::Local<v8::Value> result = EvaluateScriptInMainWorld(
       ScriptSourceCode(script_source, ScriptSourceLocationType::kJavascriptUrl),
-      ScriptFetchOptions(), kNotSharableCrossOrigin,
+      base_url, ScriptFetchOptions(), kNotSharableCrossOrigin,
       kDoNotExecuteScriptWhenScriptsDisabled);
 
   // If executing script caused this frame to be removed from the page, we
@@ -286,29 +292,33 @@
     ExecuteScriptPolicy policy) {
   v8::HandleScope handle_scope(GetIsolate());
   EvaluateScriptInMainWorld(ScriptSourceCode(script, source_location_type),
-                            ScriptFetchOptions(), kNotSharableCrossOrigin,
-                            policy);
+                            KURL(), ScriptFetchOptions(),
+                            kNotSharableCrossOrigin, policy);
 }
 
 void ScriptController::ExecuteScriptInMainWorld(
     const ScriptSourceCode& source_code,
+    const KURL& base_url,
     const ScriptFetchOptions& fetch_options,
     AccessControlStatus access_control_status) {
   v8::HandleScope handle_scope(GetIsolate());
-  EvaluateScriptInMainWorld(source_code, fetch_options, access_control_status,
+  EvaluateScriptInMainWorld(source_code, base_url, fetch_options,
+                            access_control_status,
                             kDoNotExecuteScriptWhenScriptsDisabled);
 }
 
 v8::Local<v8::Value> ScriptController::ExecuteScriptInMainWorldAndReturnValue(
     const ScriptSourceCode& source_code,
+    const KURL& base_url,
     const ScriptFetchOptions& fetch_options,
     ExecuteScriptPolicy policy) {
-  return EvaluateScriptInMainWorld(source_code, fetch_options,
+  return EvaluateScriptInMainWorld(source_code, base_url, fetch_options,
                                    kNotSharableCrossOrigin, policy);
 }
 
 v8::Local<v8::Value> ScriptController::EvaluateScriptInMainWorld(
     const ScriptSourceCode& source_code,
+    const KURL& base_url,
     const ScriptFetchOptions& fetch_options,
     AccessControlStatus access_control_status,
     ExecuteScriptPolicy policy) {
@@ -327,9 +337,9 @@
   if (GetFrame()->Loader().StateMachine()->IsDisplayingInitialEmptyDocument())
     GetFrame()->Loader().DidAccessInitialDocument();
 
-  v8::Local<v8::Value> object =
-      ExecuteScriptAndReturnValue(script_state->GetContext(), source_code,
-                                  fetch_options, access_control_status);
+  v8::Local<v8::Value> object = ExecuteScriptAndReturnValue(
+      script_state->GetContext(), source_code, base_url, fetch_options,
+      access_control_status);
 
   if (object.IsEmpty())
     return v8::Local<v8::Value>();

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.h b/third_party/WebKit/Source/bindings/core/v8/ScriptController.h
index b1dd8e7..65f94a43 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.h

@@ -90,15 +90,18 @@
       ExecuteScriptPolicy = kDoNotExecuteScriptWhenScriptsDisabled);
   void ExecuteScriptInMainWorld(
       const ScriptSourceCode&,
+      const KURL& base_url = KURL(),
       const ScriptFetchOptions& = ScriptFetchOptions(),
       AccessControlStatus = kNotSharableCrossOrigin);
   v8::Local<v8::Value> ExecuteScriptInMainWorldAndReturnValue(
       const ScriptSourceCode&,
+      const KURL& base_url = KURL(),
       const ScriptFetchOptions& = ScriptFetchOptions(),
       ExecuteScriptPolicy = kDoNotExecuteScriptWhenScriptsDisabled);
   v8::Local<v8::Value> ExecuteScriptAndReturnValue(
       v8::Local<v8::Context>,
       const ScriptSourceCode&,
+      const KURL& base_url = KURL(),
       const ScriptFetchOptions& = ScriptFetchOptions(),
       AccessControlStatus = kNotSharableCrossOrigin);
 
@@ -156,6 +159,7 @@
   void EnableEval();
 
   v8::Local<v8::Value> EvaluateScriptInMainWorld(const ScriptSourceCode&,
+                                                 const KURL& base_url,
                                                  const ScriptFetchOptions&,
                                                  AccessControlStatus,
                                                  ExecuteScriptPolicy);

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h b/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h
index 36b301b..1abc1d7 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptSourceCode.h

@@ -85,7 +85,14 @@
   const String source_;
   Member<CachedMetadataHandler> cache_handler_;
   Member<ScriptStreamer> streamer_;
+
+  // The URL of the source code, which is primarily intended for DevTools
+  // javascript debugger.
+  //
+  // Note that this can be different from the resulting script's base URL
+  // (#concept-script-base-url) for inline classic scripts.
   const KURL url_;
+
   const String source_map_url_;
   const TextPosition start_position_;
   const ScriptSourceLocationType source_location_type_;

diff --git a/third_party/WebKit/Source/core/CoreInitializer.h b/third_party/WebKit/Source/core/CoreInitializer.h
index ed32849..dc5a7186 100644
--- a/third_party/WebKit/Source/core/CoreInitializer.h
+++ b/third_party/WebKit/Source/core/CoreInitializer.h

@@ -48,7 +48,6 @@
 class Page;
 class Settings;
 class ShadowRoot;
-class WebCredentialManagerClient;
 class WebFrameClient;
 class WebLayerTreeView;
 class WebMediaPlayer;
@@ -110,10 +109,6 @@
   virtual WebRemotePlaybackClient* CreateWebRemotePlaybackClient(
       HTMLMediaElement&) const = 0;
 
-  virtual void ProvideCredentialManagerClient(
-      Page&,
-      WebCredentialManagerClient*) const = 0;
-
   virtual void ProvideModulesToPage(Page&, WebViewClient*) const = 0;
   virtual void ForceNextWebGLContextCreationToFail() const = 0;
 

diff --git a/third_party/WebKit/Source/core/DEPS b/third_party/WebKit/Source/core/DEPS
index 7e05d30..7caee088 100644
--- a/third_party/WebKit/Source/core/DEPS
+++ b/third_party/WebKit/Source/core/DEPS

@@ -1,6 +1,7 @@
 include_rules = [
     "+base/atomic_sequence_num.h",
     "+base/memory/scoped_refptr.h",
+    "+base/synchronization/waitable_event.h",
     "+base/unguessable_token.h",
     "+bindings/core",
     "-bindings/modules",

diff --git a/third_party/WebKit/Source/core/core_idl_files.gni b/third_party/WebKit/Source/core/core_idl_files.gni
index f820344d..d7678ba 100644
--- a/third_party/WebKit/Source/core/core_idl_files.gni
+++ b/third_party/WebKit/Source/core/core_idl_files.gni

@@ -104,6 +104,7 @@
                     "dom/CDATASection.idl",
                     "dom/CharacterData.idl",
                     "dom/Comment.idl",
+                    "dom/ComputedAccessibleNode.idl",
                     "dom/DOMException.idl",
                     "dom/DOMImplementation.idl",
                     "dom/DOMStringList.idl",

diff --git a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
index 53a807a..7106cae8 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSSelectorParser.cpp

@@ -937,13 +937,77 @@
           break;
         case CSSSelector::kPseudoWebKitCustomElement:
           if (context_->Mode() != kUASheetMode) {
-            if (current->Value() ==
-                "-internal-media-controls-overlay-cast-button") {
+            if (current->Value() == "cue") {
+              feature = WebFeature::kCSSSelectorCue;
+            } else if (current->Value() ==
+                       "-internal-media-controls-overlay-cast-button") {
               feature = WebFeature::
                   kCSSSelectorInternalMediaControlsOverlayCastButton;
+            } else if (current->Value() ==
+                       "-webkit-calendar-picker-indicator") {
+              feature = WebFeature::kCSSSelectorWebkitCalendarPickerIndicator;
+            } else if (current->Value() == "-webkit-clear-button") {
+              feature = WebFeature::kCSSSelectorWebkitClearButton;
+            } else if (current->Value() == "-webkit-color-swatch") {
+              feature = WebFeature::kCSSSelectorWebkitColorSwatch;
+            } else if (current->Value() == "-webkit-color-swatch-wrapper") {
+              feature = WebFeature::kCSSSelectorWebkitColorSwatchWrapper;
+            } else if (current->Value() == "-webkit-date-and-time-value") {
+              feature = WebFeature::kCSSSelectorWebkitDateAndTimeValue;
+            } else if (current->Value() == "-webkit-datetime-edit") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEdit;
+            } else if (current->Value() == "-webkit-datetime-edit-ampm-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditAmpmField;
+            } else if (current->Value() == "-webkit-datetime-edit-day-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditDayField;
+            } else if (current->Value() ==
+                       "-webkit-datetime-edit-fields-wrapper") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditFieldsWrapper;
+            } else if (current->Value() == "-webkit-datetime-edit-hour-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditHourField;
+            } else if (current->Value() ==
+                       "-webkit-datetime-edit-millisecond-field") {
+              feature =
+                  WebFeature::kCSSSelectorWebkitDatetimeEditMillisecondField;
+            } else if (current->Value() ==
+                       "-webkit-datetime-edit-minute-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditMinuteField;
+            } else if (current->Value() ==
+                       "-webkit-datetime-edit-month-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditMonthField;
+            } else if (current->Value() ==
+                       "-webkit-datetime-edit-second-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditSecondField;
+            } else if (current->Value() == "-webkit-datetime-edit-text") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditText;
+            } else if (current->Value() == "-webkit-datetime-edit-week-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditWeekField;
+            } else if (current->Value() == "-webkit-datetime-edit-year-field") {
+              feature = WebFeature::kCSSSelectorWebkitDatetimeEditYearField;
+            } else if (current->Value() == "-webkit-details-marker") {
+              feature = WebFeature::kCSSSelectorWebkitDetailsMarker;
+            } else if (current->Value() == "-webkit-file-upload-button") {
+              feature = WebFeature::kCSSSelectorWebkitFileUploadButton;
+            } else if (current->Value() == "-webkit-inner-spin-button") {
+              feature = WebFeature::kCSSSelectorWebkitInnerSpinButton;
+            } else if (current->Value() == "-webkit-input-placeholder") {
+              feature = WebFeature::kCSSSelectorWebkitInputPlaceholder;
             } else if (current->Value() == "-webkit-media-controls") {
               feature = WebFeature::kCSSSelectorWebkitMediaControls;
             } else if (current->Value() ==
+                       "-webkit-media-controls-current-time-display") {
+              feature =
+                  WebFeature::kCSSSelectorWebkitMediaControlsCurrentTimeDisplay;
+            } else if (current->Value() == "-webkit-media-controls-enclosure") {
+              feature = WebFeature::kCSSSelectorWebkitMediaControlsEnclosure;
+            } else if (current->Value() ==
+                       "-webkit-media-controls-fullscreen-button") {
+              feature =
+                  WebFeature::kCSSSelectorWebkitMediaControlsFullscreenButton;
+            } else if (current->Value() ==
+                       "-webkit-media-controls-mute-button") {
+              feature = WebFeature::kCSSSelectorWebkitMediaControlsMuteButton;
+            } else if (current->Value() ==
                        "-webkit-media-controls-overlay-enclosure") {
               feature =
                   WebFeature::kCSSSelectorWebkitMediaControlsOverlayEnclosure;
@@ -951,41 +1015,75 @@
                        "-webkit-media-controls-overlay-play-button") {
               feature =
                   WebFeature::kCSSSelectorWebkitMediaControlsOverlayPlayButton;
-            } else if (current->Value() == "-webkit-media-controls-enclosure") {
-              feature = WebFeature::kCSSSelectorWebkitMediaControlsEnclosure;
             } else if (current->Value() == "-webkit-media-controls-panel") {
               feature = WebFeature::kCSSSelectorWebkitMediaControlsPanel;
             } else if (current->Value() ==
                        "-webkit-media-controls-play-button") {
               feature = WebFeature::kCSSSelectorWebkitMediaControlsPlayButton;
-            } else if (current->Value() ==
-                       "-webkit-media-controls-current-time-display") {
-              feature =
-                  WebFeature::kCSSSelectorWebkitMediaControlsCurrentTimeDisplay;
-            } else if (current->Value() ==
-                       "-webkit-media-controls-time-remaining-display") {
-              feature = WebFeature::
-                  kCSSSelectorWebkitMediaControlsTimeRemainingDisplay;
             } else if (current->Value() == "-webkit-media-controls-timeline") {
               feature = WebFeature::kCSSSelectorWebkitMediaControlsTimeline;
             } else if (current->Value() ==
                        "-webkit-media-controls-timeline-container") {
+              // Note: This feature is no longer implemented in Blink.
               feature =
                   WebFeature::kCSSSelectorWebkitMediaControlsTimelineContainer;
             } else if (current->Value() ==
-                       "-webkit-media-controls-mute-button") {
-              feature = WebFeature::kCSSSelectorWebkitMediaControlsMuteButton;
-            } else if (current->Value() ==
-                       "-webkit-media-controls-volume-slider") {
-              feature = WebFeature::kCSSSelectorWebkitMediaControlsVolumeSlider;
-            } else if (current->Value() ==
-                       "-webkit-media-controls-fullscreen-button") {
-              feature =
-                  WebFeature::kCSSSelectorWebkitMediaControlsFullscreenButton;
+                       "-webkit-media-controls-time-remaining-display") {
+              feature = WebFeature::
+                  kCSSSelectorWebkitMediaControlsTimeRemainingDisplay;
             } else if (current->Value() ==
                        "-webkit-media-controls-toggle-closed-captions-button") {
               feature = WebFeature::
                   kCSSSelectorWebkitMediaControlsToggleClosedCaptionsButton;
+            } else if (current->Value() ==
+                       "-webkit-media-controls-volume-slider") {
+              feature = WebFeature::kCSSSelectorWebkitMediaControlsVolumeSlider;
+            } else if (current->Value() == "-webkit-media-slider-container") {
+              feature = WebFeature::kCSSSelectorWebkitMediaSliderContainer;
+            } else if (current->Value() == "-webkit-media-slider-thumb") {
+              feature = WebFeature::kCSSSelectorWebkitMediaSliderThumb;
+            } else if (current->Value() ==
+                       "-webkit-media-text-track-container") {
+              feature = WebFeature::kCSSSelectorWebkitMediaTextTrackContainer;
+            } else if (current->Value() == "-webkit-media-text-track-display") {
+              feature = WebFeature::kCSSSelectorWebkitMediaTextTrackDisplay;
+            } else if (current->Value() == "-webkit-media-text-track-region") {
+              feature = WebFeature::kCSSSelectorWebkitMediaTextTrackRegion;
+            } else if (current->Value() ==
+                       "-webkit-media-text-track-region-container") {
+              feature =
+                  WebFeature::kCSSSelectorWebkitMediaTextTrackRegionContainer;
+            } else if (current->Value() == "-webkit-meter-bar") {
+              feature = WebFeature::kCSSSelectorWebkitMeterBar;
+            } else if (current->Value() ==
+                       "-webkit-meter-even-less-good-value") {
+              feature = WebFeature::kCSSSelectorWebkitMeterEvenLessGoodValue;
+            } else if (current->Value() == "-webkit-meter-inner-element") {
+              feature = WebFeature::kCSSSelectorWebkitMeterInnerElement;
+            } else if (current->Value() == "-webkit-meter-optimum-value") {
+              feature = WebFeature::kCSSSelectorWebkitMeterOptimumValue;
+            } else if (current->Value() == "-webkit-meter-suboptimum-value") {
+              feature = WebFeature::kCSSSelectorWebkitMeterSuboptimumValue;
+            } else if (current->Value() == "-webkit-progress-bar") {
+              feature = WebFeature::kCSSSelectorWebkitProgressBar;
+            } else if (current->Value() == "-webkit-progress-inner-element") {
+              feature = WebFeature::kCSSSelectorWebkitProgressInnerElement;
+            } else if (current->Value() == "-webkit-progress-value") {
+              feature = WebFeature::kCSSSelectorWebkitProgressValue;
+            } else if (current->Value() == "-webkit-search-cancel-button") {
+              feature = WebFeature::kCSSSelectorWebkitSearchCancelButton;
+            } else if (current->Value() == "-webkit-slider-container") {
+              feature = WebFeature::kCSSSelectorWebkitSliderContainer;
+            } else if (current->Value() == "-webkit-slider-runnable-track") {
+              feature = WebFeature::kCSSSelectorWebkitSliderRunnableTrack;
+            } else if (current->Value() == "-webkit-slider-thumb") {
+              feature = WebFeature::kCSSSelectorWebkitSliderThumb;
+            } else if (current->Value() ==
+                       "-webkit-textfield-decoration-container") {
+              feature =
+                  WebFeature::kCSSSelectorWebkitTextfieldDecorationContainer;
+            } else {
+              feature = WebFeature::kCSSSelectorWebkitUnknownPseudo;
             }
           }
           break;

diff --git a/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp b/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
index 7614f42..dd6f105 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSSelectorParserTest.cpp

@@ -8,6 +8,8 @@
 #include "core/css/StyleSheetContents.h"
 #include "core/css/parser/CSSParserContext.h"
 #include "core/css/parser/CSSTokenizer.h"
+#include "core/frame/UseCounter.h"
+#include "core/testing/DummyPageHolder.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ -495,4 +497,140 @@
   }
 }
 
+TEST(CSSSelectorParserTest, UseCountShadowPseudo) {
+  std::unique_ptr<DummyPageHolder> dummy_holder =
+      DummyPageHolder::Create(IntSize(500, 500));
+  Document* doc = &dummy_holder->GetDocument();
+  CSSParserContext* context = CSSParserContext::Create(
+      kHTMLStandardMode, SecureContextMode::kSecureContext,
+      CSSParserContext::kDynamicProfile, doc);
+  StyleSheetContents* sheet = StyleSheetContents::Create(context);
+
+  auto ExpectCount = [doc, context, sheet](const char* selector,
+                                           WebFeature feature) {
+    EXPECT_FALSE(UseCounter::IsCounted(*doc, feature));
+
+    CSSTokenizer tokenizer(selector);
+    const auto tokens = tokenizer.TokenizeToEOF();
+    CSSParserTokenRange range(tokens);
+    CSSSelectorParser::ParseSelector(range, context, sheet);
+
+    EXPECT_TRUE(UseCounter::IsCounted(*doc, feature));
+  };
+
+  ExpectCount("::cue", WebFeature::kCSSSelectorCue);
+  ExpectCount("::-internal-media-controls-overlay-cast-button",
+              WebFeature::kCSSSelectorInternalMediaControlsOverlayCastButton);
+  ExpectCount("::-webkit-calendar-picker-indicator",
+              WebFeature::kCSSSelectorWebkitCalendarPickerIndicator);
+  ExpectCount("::-webkit-clear-button",
+              WebFeature::kCSSSelectorWebkitClearButton);
+  ExpectCount("::-webkit-color-swatch",
+              WebFeature::kCSSSelectorWebkitColorSwatch);
+  ExpectCount("::-webkit-color-swatch-wrapper",
+              WebFeature::kCSSSelectorWebkitColorSwatchWrapper);
+  ExpectCount("::-webkit-date-and-time-value",
+              WebFeature::kCSSSelectorWebkitDateAndTimeValue);
+  ExpectCount("::-webkit-datetime-edit",
+              WebFeature::kCSSSelectorWebkitDatetimeEdit);
+  ExpectCount("::-webkit-datetime-edit-ampm-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditAmpmField);
+  ExpectCount("::-webkit-datetime-edit-day-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditDayField);
+  ExpectCount("::-webkit-datetime-edit-fields-wrapper",
+              WebFeature::kCSSSelectorWebkitDatetimeEditFieldsWrapper);
+  ExpectCount("::-webkit-datetime-edit-hour-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditHourField);
+  ExpectCount("::-webkit-datetime-edit-millisecond-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditMillisecondField);
+  ExpectCount("::-webkit-datetime-edit-minute-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditMinuteField);
+  ExpectCount("::-webkit-datetime-edit-month-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditMonthField);
+  ExpectCount("::-webkit-datetime-edit-second-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditSecondField);
+  ExpectCount("::-webkit-datetime-edit-text",
+              WebFeature::kCSSSelectorWebkitDatetimeEditText);
+  ExpectCount("::-webkit-datetime-edit-week-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditWeekField);
+  ExpectCount("::-webkit-datetime-edit-year-field",
+              WebFeature::kCSSSelectorWebkitDatetimeEditYearField);
+  ExpectCount("::-webkit-details-marker",
+              WebFeature::kCSSSelectorWebkitDetailsMarker);
+  ExpectCount("::-webkit-file-upload-button",
+              WebFeature::kCSSSelectorWebkitFileUploadButton);
+  ExpectCount("::-webkit-inner-spin-button",
+              WebFeature::kCSSSelectorWebkitInnerSpinButton);
+  ExpectCount("::-webkit-input-placeholder",
+              WebFeature::kCSSSelectorWebkitInputPlaceholder);
+  ExpectCount("::-webkit-media-controls",
+              WebFeature::kCSSSelectorWebkitMediaControls);
+  ExpectCount("::-webkit-media-controls-current-time-display",
+              WebFeature::kCSSSelectorWebkitMediaControlsCurrentTimeDisplay);
+  ExpectCount("::-webkit-media-controls-enclosure",
+              WebFeature::kCSSSelectorWebkitMediaControlsEnclosure);
+  ExpectCount("::-webkit-media-controls-fullscreen-button",
+              WebFeature::kCSSSelectorWebkitMediaControlsFullscreenButton);
+  ExpectCount("::-webkit-media-controls-mute-button",
+              WebFeature::kCSSSelectorWebkitMediaControlsMuteButton);
+  ExpectCount("::-webkit-media-controls-overlay-enclosure",
+              WebFeature::kCSSSelectorWebkitMediaControlsOverlayEnclosure);
+  ExpectCount("::-webkit-media-controls-overlay-play-button",
+              WebFeature::kCSSSelectorWebkitMediaControlsOverlayPlayButton);
+  ExpectCount("::-webkit-media-controls-panel",
+              WebFeature::kCSSSelectorWebkitMediaControlsPanel);
+  ExpectCount("::-webkit-media-controls-play-button",
+              WebFeature::kCSSSelectorWebkitMediaControlsPlayButton);
+  ExpectCount("::-webkit-media-controls-timeline",
+              WebFeature::kCSSSelectorWebkitMediaControlsTimeline);
+  ExpectCount("::-webkit-media-controls-timeline-container",
+              WebFeature::kCSSSelectorWebkitMediaControlsTimelineContainer);
+  ExpectCount("::-webkit-media-controls-time-remaining-display",
+              WebFeature::kCSSSelectorWebkitMediaControlsTimeRemainingDisplay);
+  ExpectCount(
+      "::-webkit-media-controls-toggle-closed-captions-button",
+      WebFeature::kCSSSelectorWebkitMediaControlsToggleClosedCaptionsButton);
+  ExpectCount("::-webkit-media-controls-volume-slider",
+              WebFeature::kCSSSelectorWebkitMediaControlsVolumeSlider);
+  ExpectCount("::-webkit-media-slider-container",
+              WebFeature::kCSSSelectorWebkitMediaSliderContainer);
+  ExpectCount("::-webkit-media-slider-thumb",
+              WebFeature::kCSSSelectorWebkitMediaSliderThumb);
+  ExpectCount("::-webkit-media-text-track-container",
+              WebFeature::kCSSSelectorWebkitMediaTextTrackContainer);
+  ExpectCount("::-webkit-media-text-track-display",
+              WebFeature::kCSSSelectorWebkitMediaTextTrackDisplay);
+  ExpectCount("::-webkit-media-text-track-region",
+              WebFeature::kCSSSelectorWebkitMediaTextTrackRegion);
+  ExpectCount("::-webkit-media-text-track-region-container",
+              WebFeature::kCSSSelectorWebkitMediaTextTrackRegionContainer);
+  ExpectCount("::-webkit-meter-bar", WebFeature::kCSSSelectorWebkitMeterBar);
+  ExpectCount("::-webkit-meter-even-less-good-value",
+              WebFeature::kCSSSelectorWebkitMeterEvenLessGoodValue);
+  ExpectCount("::-webkit-meter-inner-element",
+              WebFeature::kCSSSelectorWebkitMeterInnerElement);
+  ExpectCount("::-webkit-meter-optimum-value",
+              WebFeature::kCSSSelectorWebkitMeterOptimumValue);
+  ExpectCount("::-webkit-meter-suboptimum-value",
+              WebFeature::kCSSSelectorWebkitMeterSuboptimumValue);
+  ExpectCount("::-webkit-progress-bar",
+              WebFeature::kCSSSelectorWebkitProgressBar);
+  ExpectCount("::-webkit-progress-inner-element",
+              WebFeature::kCSSSelectorWebkitProgressInnerElement);
+  ExpectCount("::-webkit-progress-value",
+              WebFeature::kCSSSelectorWebkitProgressValue);
+  ExpectCount("::-webkit-search-cancel-button",
+              WebFeature::kCSSSelectorWebkitSearchCancelButton);
+  ExpectCount("::-webkit-slider-container",
+              WebFeature::kCSSSelectorWebkitSliderContainer);
+  ExpectCount("::-webkit-slider-runnable-track",
+              WebFeature::kCSSSelectorWebkitSliderRunnableTrack);
+  ExpectCount("::-webkit-slider-thumb",
+              WebFeature::kCSSSelectorWebkitSliderThumb);
+  ExpectCount("::-webkit-textfield-decoration-container",
+              WebFeature::kCSSSelectorWebkitTextfieldDecorationContainer);
+  ExpectCount("::-webkit-unrecognized",
+              WebFeature::kCSSSelectorWebkitUnknownPseudo);
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/BUILD.gn b/third_party/WebKit/Source/core/dom/BUILD.gn
index d6da73aa..db902c6 100644
--- a/third_party/WebKit/Source/core/dom/BUILD.gn
+++ b/third_party/WebKit/Source/core/dom/BUILD.gn

@@ -38,6 +38,8 @@
     "CollectionIndexCache.h",
     "Comment.cpp",
     "Comment.h",
+    "ComputedAccessibleNode.cpp",
+    "ComputedAccessibleNode.h",
     "ContainerNode.cpp",
     "ContainerNode.h",
     "ContextFeatures.cpp",

diff --git a/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.cpp b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.cpp
new file mode 100644
index 0000000..ee6fd66
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.cpp

@@ -0,0 +1,49 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/dom/ComputedAccessibleNode.h"
+#include "bindings/core/v8/ScriptPromise.h"
+#include "core/dom/Element.h"
+#include "platform/bindings/ScriptState.h"
+
+namespace blink {
+
+ComputedAccessibleNode* ComputedAccessibleNode::Create(Element* element) {
+  return new ComputedAccessibleNode(element);
+}
+
+ComputedAccessibleNode::ComputedAccessibleNode(Element* element)
+    : element_(element) {
+  DCHECK(RuntimeEnabledFeatures::AccessibilityObjectModelEnabled());
+}
+
+ComputedAccessibleNode::~ComputedAccessibleNode() {}
+
+ScriptPromise ComputedAccessibleNode::ComputePromiseProperty(
+    ScriptState* script_state) {
+  if (!computed_property_) {
+    computed_property_ =
+        new ComputedPromiseProperty(ExecutionContext::From(script_state), this,
+                                    ComputedPromiseProperty::kReady);
+    computed_property_->Resolve(this);
+  }
+
+  return computed_property_->Promise(script_state->World());
+}
+
+const AtomicString& ComputedAccessibleNode::role() const {
+  return element_->computedRole();
+}
+
+const String ComputedAccessibleNode::name() const {
+  return element_->computedName();
+}
+
+void ComputedAccessibleNode::Trace(blink::Visitor* visitor) {
+  ScriptWrappable::Trace(visitor);
+  visitor->Trace(computed_property_);
+  visitor->Trace(element_);
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.h b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.h
new file mode 100644
index 0000000..0f4eb6d
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.h

@@ -0,0 +1,52 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ComputedAccessibleNode_h
+#define ComputedAccessibleNode_h
+
+#include "bindings/core/v8/ScriptPromiseProperty.h"
+#include "core/dom/DOMException.h"
+#include "core/dom/events/EventTarget.h"
+#include "platform/bindings/ScriptWrappable.h"
+#include "platform/wtf/text/AtomicString.h"
+
+class ScriptPromise;
+class ScriptState;
+
+namespace blink {
+
+class ComputedAccessibleNode : public ScriptWrappable {
+  DEFINE_WRAPPERTYPEINFO();
+
+ public:
+  static ComputedAccessibleNode* Create(Element*);
+  virtual ~ComputedAccessibleNode();
+
+  // Start compution of the accessibility properties of the stored element and
+  // return a promise.
+  ScriptPromise ComputePromiseProperty(ScriptState*);
+
+  void Trace(blink::Visitor*);
+
+  const AtomicString& role() const;
+  const String name() const;
+
+ private:
+  using ComputedPromiseProperty =
+      ScriptPromiseProperty<Member<ComputedAccessibleNode>,
+                            Member<ComputedAccessibleNode>,
+                            Member<DOMException>>;
+
+  explicit ComputedAccessibleNode(Element*);
+
+  Member<ComputedPromiseProperty> computed_property_;
+  Member<Element> element_;
+
+  // TODO(meredithl): This should eventually create AXTree and subscribe to
+  // accessibility updates from the Document.
+};
+
+}  // namespace blink
+
+#endif  // ComputedAccessibleNode_h

diff --git a/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.idl b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.idl
new file mode 100644
index 0000000..75a7b82
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/ComputedAccessibleNode.idl

@@ -0,0 +1,13 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Computed Accessibility node
+// Explainer: https://github.com/WICG/aom/blob/master/explainer.md
+// Spec: https://wicg.github.io/aom/spec/
+[
+    RuntimeEnabled=AccessibilityObjectModel
+] interface ComputedAccessibleNode {
+    readonly attribute DOMString? name;
+    readonly attribute DOMString? role;
+};

diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 85a046b..157e2670 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp

@@ -51,6 +51,7 @@
 #include "core/css/resolver/StyleResolverStats.h"
 #include "core/dom/AXObjectCache.h"
 #include "core/dom/Attr.h"
+#include "core/dom/ComputedAccessibleNode.h"
 #include "core/dom/DOMTokenList.h"
 #include "core/dom/DatasetDOMStringMap.h"
 #include "core/dom/Document.h"
@@ -1278,6 +1279,14 @@
   return rare_data.EnsureAccessibleNode(this);
 }
 
+ComputedAccessibleNode* Element::ComputedAccessibleNode() {
+  if (!RuntimeEnabledFeatures::AccessibilityObjectModelEnabled())
+    return nullptr;
+
+  ElementRareData& rare_data = EnsureElementRareData();
+  return rare_data.EnsureComputedAccessibleNode(this);
+}
+
 const AtomicString& Element::getAttribute(
     const AtomicString& local_name) const {
   if (!GetElementData())

diff --git a/third_party/WebKit/Source/core/dom/Element.h b/third_party/WebKit/Source/core/dom/Element.h
index ba5075c..8e00159 100644
--- a/third_party/WebKit/Source/core/dom/Element.h
+++ b/third_party/WebKit/Source/core/dom/Element.h

@@ -44,6 +44,7 @@
 class AccessibleNode;
 class Attr;
 class Attribute;
+class ComputedAccessibleNode;
 class CSSStyleDeclaration;
 class CustomElementDefinition;
 class DOMRect;
@@ -294,6 +295,8 @@
   AccessibleNode* ExistingAccessibleNode() const;
   AccessibleNode* accessibleNode();
 
+  ComputedAccessibleNode* ComputedAccessibleNode();
+
   void DidMoveToNewDocument(Document&) override;
 
   void removeAttribute(const AtomicString& name);

diff --git a/third_party/WebKit/Source/core/dom/ElementRareData.cpp b/third_party/WebKit/Source/core/dom/ElementRareData.cpp
index fe000440..7d0522d5 100644
--- a/third_party/WebKit/Source/core/dom/ElementRareData.cpp
+++ b/third_party/WebKit/Source/core/dom/ElementRareData.cpp

@@ -41,7 +41,7 @@
   IntSize scroll_offset;
   AtomicString nonce;
   void* pointers[1];
-  Member<void*> members[14];
+  Member<void*> members[15];
 };
 
 ElementRareData::ElementRareData(NodeRenderingData* node_layout_data)
@@ -120,6 +120,7 @@
   visitor->TraceWrappers(shadow_);
   visitor->TraceWrappers(class_list_);
   visitor->TraceWrappers(attribute_map_);
+  visitor->TraceWrappers(computed_accessible_node_);
   visitor->TraceWrappers(accessible_node_);
   visitor->TraceWrappers(intersection_observer_data_);
   if (resize_observer_data_) {

diff --git a/third_party/WebKit/Source/core/dom/ElementRareData.h b/third_party/WebKit/Source/core/dom/ElementRareData.h
index 915c939d..6339fe0ea 100644
--- a/third_party/WebKit/Source/core/dom/ElementRareData.h
+++ b/third_party/WebKit/Source/core/dom/ElementRareData.h

@@ -27,6 +27,7 @@
 #include "core/css/cssom/InlineStylePropertyMap.h"
 #include "core/dom/AccessibleNode.h"
 #include "core/dom/Attr.h"
+#include "core/dom/ComputedAccessibleNode.h"
 #include "core/dom/DOMTokenList.h"
 #include "core/dom/DatasetDOMStringMap.h"
 #include "core/dom/ElementShadow.h"
@@ -140,6 +141,13 @@
     return accessible_node_;
   }
 
+  ComputedAccessibleNode* EnsureComputedAccessibleNode(Element* owner_element) {
+    if (!computed_accessible_node_) {
+      computed_accessible_node_ = ComputedAccessibleNode::Create(owner_element);
+    }
+    return computed_accessible_node_;
+  }
+
   AttrNodeList& EnsureAttrNodeList();
   AttrNodeList* GetAttrNodeList() { return attr_node_list_.Get(); }
   void RemoveAttrNodeList() { attr_node_list_.Clear(); }
@@ -196,6 +204,7 @@
   Member<PseudoElementData> pseudo_element_data_;
 
   TraceWrapperMember<AccessibleNode> accessible_node_;
+  TraceWrapperMember<ComputedAccessibleNode> computed_accessible_node_;
 
   explicit ElementRareData(NodeRenderingData*);
 };

diff --git a/third_party/WebKit/Source/core/exported/WebFrameTest.cpp b/third_party/WebKit/Source/core/exported/WebFrameTest.cpp
index 96030837..8e94749 100644
--- a/third_party/WebKit/Source/core/exported/WebFrameTest.cpp
+++ b/third_party/WebKit/Source/core/exported/WebFrameTest.cpp

@@ -87,6 +87,7 @@
 #include "core/loader/DocumentThreadableLoaderClient.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/ThreadableLoader.h"
+#include "core/loader/ThreadableLoadingContext.h"
 #include "core/page/ChromeClient.h"
 #include "core/page/Page.h"
 #include "core/page/ScopedPagePauser.h"
@@ -9887,14 +9888,16 @@
   request.SetFetchRequestMode(network::mojom::FetchRequestMode::kCORS);
   ResourceLoaderOptions resource_loader_options;
   DocumentThreadableLoader::LoadResourceSynchronously(
-      *frame->GetDocument(), request, client, options, resource_loader_options);
+      *ThreadableLoadingContext::Create(*frame->GetDocument()), request, client,
+      options, resource_loader_options);
   EXPECT_TRUE(client.Failed());
 
   client.Reset();
   // Try to load the request with cross origin access. Should succeed.
   request.SetFetchRequestMode(network::mojom::FetchRequestMode::kNoCORS);
   DocumentThreadableLoader::LoadResourceSynchronously(
-      *frame->GetDocument(), request, client, options, resource_loader_options);
+      *ThreadableLoadingContext::Create(*frame->GetDocument()), request, client,
+      options, resource_loader_options);
   EXPECT_FALSE(client.Failed());
 }
 

diff --git a/third_party/WebKit/Source/core/exported/WebViewImpl.cpp b/third_party/WebKit/Source/core/exported/WebViewImpl.cpp
index 23d1cd49..6c146e7 100644
--- a/third_party/WebKit/Source/core/exported/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/core/exported/WebViewImpl.cpp

@@ -321,13 +321,6 @@
   Page::AllVisitedStateChanged(invalidate_visited_link_hashes);
 }
 
-void WebViewImpl::SetCredentialManagerClient(
-    WebCredentialManagerClient* web_credential_manager_client) {
-  DCHECK(page_);
-  CoreInitializer::GetInstance().ProvideCredentialManagerClient(
-      *page_, web_credential_manager_client);
-}
-
 void WebViewImpl::SetPrerendererClient(
     WebPrerendererClient* prerenderer_client) {
   DCHECK(page_);

diff --git a/third_party/WebKit/Source/core/exported/WebViewImpl.h b/third_party/WebKit/Source/core/exported/WebViewImpl.h
index 806b30b..ceec360 100644
--- a/third_party/WebKit/Source/core/exported/WebViewImpl.h
+++ b/third_party/WebKit/Source/core/exported/WebViewImpl.h

@@ -152,7 +152,6 @@
 
   // WebView methods:
   virtual bool IsWebView() const { return true; }
-  void SetCredentialManagerClient(WebCredentialManagerClient*) override;
   void SetPrerendererClient(WebPrerendererClient*) override;
   WebSettings* GetSettings() override;
   WebString PageEncoding() const override;

diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
index 15282a9..642f55fb 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

@@ -32,6 +32,7 @@
 
 #include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ScriptController.h"
+#include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/SourceLocation.h"
 #include "bindings/core/v8/WindowProxy.h"
 #include "core/css/CSSComputedStyleDeclaration.h"
@@ -41,6 +42,7 @@
 #include "core/css/MediaQueryMatcher.h"
 #include "core/css/StyleMedia.h"
 #include "core/css/resolver/StyleResolver.h"
+#include "core/dom/ComputedAccessibleNode.h"
 #include "core/dom/DOMImplementation.h"
 #include "core/dom/FrameRequestCallbackCollection.h"
 #include "core/dom/SandboxFlags.h"
@@ -1103,6 +1105,15 @@
   return CSSComputedStyleDeclaration::Create(elt, false, pseudo_elt);
 }
 
+ScriptPromise LocalDOMWindow::getComputedAccessibleNode(
+    ScriptState* script_state,
+    Element* element) {
+  DCHECK(element);
+  ComputedAccessibleNode* computed_accessible_node =
+      element->ComputedAccessibleNode();
+  return computed_accessible_node->ComputePromiseProperty(script_state);
+}
+
 CSSRuleList* LocalDOMWindow::getMatchedCSSRules(
     Element* element,
     const String& pseudo_element) const {

diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.h b/third_party/WebKit/Source/core/frame/LocalDOMWindow.h
index cc01d53..a2009327 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.h
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.h

@@ -65,6 +65,7 @@
 class Navigator;
 class PostMessageTimer;
 class Screen;
+class ScriptPromise;
 class ScriptState;
 class ScrollToOptions;
 class SecurityOrigin;
@@ -217,6 +218,9 @@
       Element*,
       const String& pseudo_elt = String()) const;
 
+  // Acessibility Object Model
+  ScriptPromise getComputedAccessibleNode(ScriptState*, Element*);
+
   // WebKit extension
   CSSRuleList* getMatchedCSSRules(Element*, const String& pseudo_elt) const;
 

diff --git a/third_party/WebKit/Source/core/frame/Window.idl b/third_party/WebKit/Source/core/frame/Window.idl
index da1669f..3e9c77b7 100644
--- a/third_party/WebKit/Source/core/frame/Window.idl
+++ b/third_party/WebKit/Source/core/frame/Window.idl

@@ -173,6 +173,10 @@
     //  90 is when rotated counter clockwise.
     [MeasureAs=WindowOrientation, RuntimeEnabled=OrientationEvent] readonly attribute long orientation;
 
+    // Accessibility Object Model
+    // https://github.com/WICG/aom/blob/master/explainer.md
+    [RuntimeEnabled=AccessibilityObjectModel, CallWith=ScriptState] Promise<ComputedAccessibleNode> getComputedAccessibleNode(Element element);
+
     // Non-standard APIs
     [MeasureAs=WindowClientInformation, Replaceable] readonly attribute Navigator clientInformation;
     [MeasureAs=WindowEvent, Custom, NotEnumerable] attribute Event event;

diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 1d39bed..4c7a8319 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

@@ -120,16 +120,6 @@
 // misinterpreted as a user-input value
 const int kUndefinedQualityValue = -1.0;
 
-scoped_refptr<StaticBitmapImage> CreateTransparentImage(const IntSize& size) {
-  if (!IsValidImageSize(size))
-    return nullptr;
-  sk_sp<SkSurface> surface =
-      SkSurface::MakeRasterN32Premul(size.Width(), size.Height());
-  if (!surface)
-    return nullptr;
-  return StaticBitmapImage::Create(surface->makeImageSnapshot());
-}
-
 }  // namespace
 
 inline HTMLCanvasElement::HTMLCanvasElement(Document& document)
@@ -338,10 +328,6 @@
          (!!surface_layer_bridge_);
 }
 
-bool HTMLCanvasElement::IsPaintable() const {
-  return (context_ && context_->IsPaintable()) || IsValidImageSize(Size());
-}
-
 bool HTMLCanvasElement::IsAccelerated() const {
   return context_ && context_->IsAccelerated();
 }
@@ -887,13 +873,12 @@
       mime_type, ImageEncoderUtils::kEncodeReasonToBlobCallback);
 
   CanvasAsyncBlobCreator* async_creator = nullptr;
-    scoped_refptr<StaticBitmapImage> image_bitmap = ToStaticBitmapImage(
-        kBackBuffer, kPreferNoAcceleration, kSnapshotReasonToBlob);
-    if (image_bitmap) {
-      async_creator =
-          CanvasAsyncBlobCreator::Create(image_bitmap, encoding_mime_type,
-                                         callback, start_time, &GetDocument());
-    }
+  scoped_refptr<StaticBitmapImage> image_bitmap = ToStaticBitmapImage(
+      kBackBuffer, kPreferNoAcceleration, kSnapshotReasonToBlob);
+  if (image_bitmap) {
+    async_creator = CanvasAsyncBlobCreator::Create(
+        image_bitmap, encoding_mime_type, callback, start_time, &GetDocument());
+  }
 
   if (async_creator) {
     async_creator->ScheduleAsyncBlobCreation(quality);

diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
index 6507104..9f4faa1c 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.h

@@ -111,8 +111,6 @@
       const String&,
       const CanvasContextCreationAttributes&);
 
-  bool IsPaintable() const;
-
   String toDataURL(const String& mime_type,
                    const ScriptValue& quality_argument,
                    ExceptionState&) const;
@@ -145,7 +143,9 @@
   void DisableDeferral(DisableDeferralReason);
   PaintCanvas* ExistingDrawingCanvas() const;
 
-  CanvasRenderingContext* RenderingContext() const { return context_.Get(); }
+  CanvasRenderingContext* RenderingContext() const override {
+    return context_.Get();
+  }
 
   scoped_refptr<Image> CopiedImage(SourceDrawingBuffer,
                                    AccelerationHint,

diff --git a/third_party/WebKit/Source/core/html/HTMLImageElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLImageElementTest.cpp
index 7747d29..c2f658a 100644
--- a/third_party/WebKit/Source/core/html/HTMLImageElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLImageElementTest.cpp

@@ -7,26 +7,23 @@
 #include <memory>
 #include "core/dom/Document.h"
 #include "core/frame/LocalFrameView.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
 const int kViewportWidth = 500;
 const int kViewportHeight = 600;
-class HTMLImageElementTest : public ::testing::Test {
+class HTMLImageElementTest : public PageTestBase {
  protected:
-  HTMLImageElementTest()
-      : dummy_page_holder_(
-            DummyPageHolder::Create(IntSize(kViewportWidth, kViewportHeight))) {
+  void SetUp() override {
+    PageTestBase::SetUp(IntSize(kViewportWidth, kViewportHeight));
   }
-
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
 };
 
 TEST_F(HTMLImageElementTest, width) {
-  HTMLImageElement* image = HTMLImageElement::Create(
-      dummy_page_holder_->GetDocument(), /* createdByParser */ false);
+  HTMLImageElement* image =
+      HTMLImageElement::Create(GetDocument(), /* createdByParser */ false);
   image->setAttribute(HTMLNames::widthAttr, "400");
   // TODO(yoav): `width` does not impact resourceWidth until we resolve
   // https://github.com/ResponsiveImagesCG/picture-element/issues/268
@@ -36,8 +33,8 @@
 }
 
 TEST_F(HTMLImageElementTest, sourceSize) {
-  HTMLImageElement* image = HTMLImageElement::Create(
-      dummy_page_holder_->GetDocument(), /* createdByParser */ false);
+  HTMLImageElement* image =
+      HTMLImageElement::Create(GetDocument(), /* createdByParser */ false);
   image->setAttribute(HTMLNames::widthAttr, "400");
   EXPECT_EQ(kViewportWidth, image->SourceSize(*image));
   image->setAttribute(HTMLNames::sizesAttr, "50vw");

diff --git a/third_party/WebKit/Source/core/html/HTMLLinkElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLLinkElementTest.cpp
index cc116ba..f335b090 100644
--- a/third_party/WebKit/Source/core/html/HTMLLinkElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLLinkElementTest.cpp

@@ -7,24 +7,13 @@
 #include "core/dom/Document.h"
 #include "core/frame/LocalFrameView.h"
 #include "core/html/HTMLHeadElement.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
-class HTMLLinkElementTest : public ::testing::Test {
- protected:
-  void SetUp() override;
-  Document& GetDocument() const { return dummy_page_holder_->GetDocument(); }
-
- private:
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
-};
-
-void HTMLLinkElementTest::SetUp() {
-  dummy_page_holder_ = DummyPageHolder::Create(IntSize(800, 600));
-}
+class HTMLLinkElementTest : public PageTestBase {};
 
 // This tests that we should ignore empty string value
 // in href attribute value of the link element.

diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.cpp
index ce18a4e..10677ab 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasAsyncBlobCreator.cpp

@@ -6,7 +6,6 @@
 
 #include "base/location.h"
 #include "build/build_config.h"
-#include "core/dom/DOMException.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/fileapi/Blob.h"
@@ -429,8 +428,8 @@
                    WTF::Bind(&V8BlobCallback::InvokeAndReportException,
                              callback_, nullptr, nullptr));
   } else {
-    script_promise_resolver_->Reject(DOMException::Create(
-        kEncodingError, "Encoding of the source image has failed."));
+    Blob* result_blob = nullptr;
+    script_promise_resolver_->Resolve(result_blob);
   }
   // Avoid unwanted retention, see dispose().
   Dispose();

diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.cpp
index 6384215..2a987fd 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.cpp

@@ -4,7 +4,10 @@
 
 #include "core/html/canvas/CanvasRenderingContextHost.h"
 
+#include "core/html/canvas/CanvasRenderingContext.h"
 #include "platform/graphics/StaticBitmapImage.h"
+#include "platform/graphics/skia/SkiaUtils.h"
+#include "third_party/skia/include/core/SkSurface.h"
 
 namespace blink {
 
@@ -22,4 +25,20 @@
   return exception_state.Reject(script_state);
 }
 
+scoped_refptr<StaticBitmapImage>
+CanvasRenderingContextHost::CreateTransparentImage(const IntSize& size) const {
+  if (!IsValidImageSize(size))
+    return nullptr;
+  sk_sp<SkSurface> surface =
+      SkSurface::MakeRasterN32Premul(size.Width(), size.Height());
+  if (!surface)
+    return nullptr;
+  return StaticBitmapImage::Create(surface->makeImageSnapshot());
+}
+
+bool CanvasRenderingContextHost::IsPaintable() const {
+  return (RenderingContext() && RenderingContext()->IsPaintable()) ||
+         IsValidImageSize(Size());
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.h b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.h
index bbf2254..c3c3737 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.h
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContextHost.h

@@ -17,6 +17,7 @@
 
 namespace blink {
 
+class CanvasRenderingContext;
 class FontSelector;
 class StaticBitmapImage;
 class KURL;
@@ -35,6 +36,7 @@
   virtual bool OriginClean() const = 0;
   virtual void SetOriginTainted() = 0;
   virtual const IntSize& Size() const = 0;
+  virtual CanvasRenderingContext* RenderingContext() const = 0;
 
   virtual ExecutionContext* GetTopExecutionContext() const = 0;
   virtual DispatchEventResult HostDispatchEvent(Event*) = 0;
@@ -60,8 +62,12 @@
   // TODO(fserb): remove this.
   virtual bool IsOffscreenCanvas() const { return false; }
 
+  bool IsPaintable() const;
+
  protected:
   virtual ~CanvasRenderingContextHost() {}
+
+  scoped_refptr<StaticBitmapImage> CreateTransparentImage(const IntSize&) const;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/html/forms/HTMLFormControlElementTest.cpp b/third_party/WebKit/Source/core/html/forms/HTMLFormControlElementTest.cpp
index 4c0f8b92..fcd7693 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLFormControlElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HTMLFormControlElementTest.cpp

@@ -12,7 +12,7 @@
 #include "core/loader/EmptyClients.h"
 #include "core/page/ScopedPagePauser.h"
 #include "core/page/ValidationMessageClient.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ -59,36 +59,22 @@
 };
 }  // namespace
 
-class HTMLFormControlElementTest : public ::testing::Test {
+class HTMLFormControlElementTest : public PageTestBase {
  protected:
   void SetUp() override;
-
-  Page& GetPage() const { return dummy_page_holder_->GetPage(); }
-  Document& GetDocument() const { return *document_; }
-
- private:
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
-  Persistent<Document> document_;
 };
 
 void HTMLFormControlElementTest::SetUp() {
   Page::PageClients page_clients;
   FillWithEmptyClients(page_clients);
-  dummy_page_holder_ =
-      DummyPageHolder::Create(IntSize(800, 600), &page_clients);
-
-  document_ = &dummy_page_holder_->GetDocument();
-  document_->SetMimeType("text/html");
+  SetupPageWithClients(&page_clients);
+  GetDocument().SetMimeType("text/html");
 }
 
 TEST_F(HTMLFormControlElementTest, customValidationMessageTextDirection) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
-      "<body><input pattern='abc' value='def' id=input></body>",
-      ASSERT_NO_EXCEPTION);
-  GetDocument().View()->UpdateAllLifecyclePhases();
+  SetHtmlInnerHTML("<body><input pattern='abc' value='def' id=input></body>");
 
-  HTMLInputElement* input =
-      ToHTMLInputElement(GetDocument().getElementById("input"));
+  HTMLInputElement* input = ToHTMLInputElement(GetElementById("input"));
   input->setCustomValidity(
       String::FromUTF8("\xD8\xB9\xD8\xB1\xD8\xA8\xD9\x89"));
   input->setAttribute(
@@ -129,16 +115,13 @@
 }
 
 TEST_F(HTMLFormControlElementTest, UpdateValidationMessageSkippedIfPrinting) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
-      "<body><input required id=input></body>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
+  SetHtmlInnerHTML("<body><input required id=input></body>");
   ValidationMessageClient* validation_message_client =
       new MockFormValidationMessageClient();
   GetPage().SetValidationMessageClient(validation_message_client);
   Page::OrdinaryPages().insert(&GetPage());
 
-  HTMLInputElement* input =
-      ToHTMLInputElement(GetDocument().getElementById("input"));
+  HTMLInputElement* input = ToHTMLInputElement(GetElementById("input"));
   ScopedPagePauser pauser;  // print() pauses the page.
   input->reportValidity();
   EXPECT_FALSE(validation_message_client->IsValidationMessageVisible(*input));

diff --git a/third_party/WebKit/Source/core/html/forms/HTMLInputElementTest.cpp b/third_party/WebKit/Source/core/html/forms/HTMLInputElementTest.cpp
index 3281767..07f9bda 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLInputElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HTMLInputElementTest.cpp

@@ -15,26 +15,18 @@
 #include "core/html/forms/DateTimeChooser.h"
 #include "core/html/forms/HTMLFormElement.h"
 #include "core/html/forms/HTMLOptionElement.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
-class HTMLInputElementTest : public ::testing::Test {
+class HTMLInputElementTest : public PageTestBase {
  protected:
-  Document& GetDocument() { return page_holder_->GetDocument(); }
   HTMLInputElement& TestElement() {
     Element* element = GetDocument().getElementById("test");
     DCHECK(element);
     return ToHTMLInputElement(*element);
   }
-
- private:
-  void SetUp() override {
-    page_holder_ = DummyPageHolder::Create(IntSize(800, 600));
-  }
-
-  std::unique_ptr<DummyPageHolder> page_holder_;
 };
 
 TEST_F(HTMLInputElementTest, FilteredDataListOptionsNoList) {

diff --git a/third_party/WebKit/Source/core/html/forms/HTMLSelectElementTest.cpp b/third_party/WebKit/Source/core/html/forms/HTMLSelectElementTest.cpp
index cb0af77..092eb93b 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLSelectElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HTMLSelectElementTest.cpp

@@ -10,45 +10,34 @@
 #include "core/html/forms/FormController.h"
 #include "core/html/forms/HTMLFormElement.h"
 #include "core/loader/EmptyClients.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
-class HTMLSelectElementTest : public ::testing::Test {
+class HTMLSelectElementTest : public PageTestBase {
  protected:
   void SetUp() override;
-  Document& GetDocument() const { return *document_; }
-
- private:
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
-  Persistent<Document> document_;
 };
 
 void HTMLSelectElementTest::SetUp() {
   Page::PageClients page_clients;
   FillWithEmptyClients(page_clients);
-  dummy_page_holder_ =
-      DummyPageHolder::Create(IntSize(800, 600), &page_clients);
-
-  document_ = &dummy_page_holder_->GetDocument();
-  document_->SetMimeType("text/html");
+  PageTestBase::SetupPageWithClients(&page_clients);
+  GetDocument().SetMimeType("text/html");
 }
 
 TEST_F(HTMLSelectElementTest, SaveRestoreSelectSingleFormControlState) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
-      String("<!DOCTYPE HTML><select id='sel'>"
-             "<option value='111' id='0'>111</option>"
-             "<option value='222'>222</option>"
-             "<option value='111' selected id='2'>!666</option>"
-             "<option value='999'>999</option></select>"));
-  GetDocument().View()->UpdateAllLifecyclePhases();
-  Element* element = GetDocument().getElementById("sel");
+  SetHtmlInnerHTML(
+      "<!DOCTYPE HTML><select id='sel'>"
+      "<option value='111' id='0'>111</option>"
+      "<option value='222'>222</option>"
+      "<option value='111' selected id='2'>!666</option>"
+      "<option value='999'>999</option></select>");
+  Element* element = GetElementById("sel");
   HTMLFormControlElementWithState* select = ToHTMLSelectElement(element);
-  HTMLOptionElement* opt0 =
-      ToHTMLOptionElement(GetDocument().getElementById("0"));
-  HTMLOptionElement* opt2 =
-      ToHTMLOptionElement(GetDocument().getElementById("2"));
+  HTMLOptionElement* opt0 = ToHTMLOptionElement(GetElementById("0"));
+  HTMLOptionElement* opt2 = ToHTMLOptionElement(GetElementById("2"));
 
   // Save the select element state, and then restore again.
   // Test passes if the restored state is not changed.
@@ -70,22 +59,18 @@
 }
 
 TEST_F(HTMLSelectElementTest, SaveRestoreSelectMultipleFormControlState) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
-      String("<!DOCTYPE HTML><select id='sel' multiple>"
-             "<option value='111' id='0'>111</option>"
-             "<option value='222'>222</option>"
-             "<option value='111' selected id='2'>!666</option>"
-             "<option value='999' selected id='3'>999</option></select>"));
-  GetDocument().View()->UpdateAllLifecyclePhases();
+  SetHtmlInnerHTML(
+      "<!DOCTYPE HTML><select id='sel' multiple>"
+      "<option value='111' id='0'>111</option>"
+      "<option value='222'>222</option>"
+      "<option value='111' selected id='2'>!666</option>"
+      "<option value='999' selected id='3'>999</option></select>");
   HTMLFormControlElementWithState* select =
-      ToHTMLSelectElement(GetDocument().getElementById("sel"));
+      ToHTMLSelectElement(GetElementById("sel"));
 
-  HTMLOptionElement* opt0 =
-      ToHTMLOptionElement(GetDocument().getElementById("0"));
-  HTMLOptionElement* opt2 =
-      ToHTMLOptionElement(GetDocument().getElementById("2"));
-  HTMLOptionElement* opt3 =
-      ToHTMLOptionElement(GetDocument().getElementById("3"));
+  HTMLOptionElement* opt0 = ToHTMLOptionElement(GetElementById("0"));
+  HTMLOptionElement* opt2 = ToHTMLOptionElement(GetElementById("2"));
+  HTMLOptionElement* opt3 = ToHTMLOptionElement(GetElementById("3"));
 
   // Save the select element state, and then restore again.
   // Test passes if the selected options are not changed.
@@ -114,17 +99,15 @@
   // restoreFormControlState() couldn't find matched OPTIONs.
   // crbug.com/627833.
 
-  GetDocument().documentElement()->SetInnerHTMLFromString(R"HTML(
+  SetHtmlInnerHTML(R"HTML(
     <select id='sel'>
     <option selected>Default</option>
     <option id='2'>222</option>
     </select>
   )HTML");
-  GetDocument().View()->UpdateAllLifecyclePhases();
-  Element* element = GetDocument().getElementById("sel");
+  Element* element = GetElementById("sel");
   HTMLFormControlElementWithState* select = ToHTMLSelectElement(element);
-  HTMLOptionElement* opt2 =
-      ToHTMLOptionElement(GetDocument().getElementById("2"));
+  HTMLOptionElement* opt2 = ToHTMLOptionElement(GetElementById("2"));
 
   ToHTMLSelectElement(element)->setSelectedIndex(1);
   // Save the current state.
@@ -143,10 +126,9 @@
 }
 
 TEST_F(HTMLSelectElementTest, VisibleBoundsInVisualViewport) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
+  SetHtmlInnerHTML(
       "<select style='position:fixed; top:12.3px; height:24px; "
       "-webkit-appearance:none;'><option>o1</select>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
   HTMLSelectElement* select =
       ToHTMLSelectElement(GetDocument().body()->firstChild());
   ASSERT_NE(select, nullptr);
@@ -155,9 +137,7 @@
 }
 
 TEST_F(HTMLSelectElementTest, PopupIsVisible) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
-      "<select><option>o1</option></select>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
+  SetHtmlInnerHTML("<select><option>o1</option></select>");
   HTMLSelectElement* select =
       ToHTMLSelectElement(GetDocument().body()->firstChild());
   ASSERT_NE(select, nullptr);
@@ -170,47 +150,41 @@
 
 TEST_F(HTMLSelectElementTest, FirstSelectableOption) {
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
-        "<select></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
+    SetHtmlInnerHTML("<select></select>");
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ(nullptr, select->FirstSelectableOption());
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->FirstSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1 disabled></option><option "
         "id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->FirstSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1 style='display:none'></option><option "
         "id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->FirstSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><optgroup><option id=o1></option><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->FirstSelectableOption()->FastGetAttribute(
@@ -220,47 +194,41 @@
 
 TEST_F(HTMLSelectElementTest, LastSelectableOption) {
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
-        "<select></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
+    SetHtmlInnerHTML("<select></select>");
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ(nullptr, select->LastSelectableOption());
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->LastSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2 "
         "disabled></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->LastSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2 "
         "style='display:none'></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->LastSelectableOption()->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><optgroup><option id=o1></option><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->LastSelectableOption()->FastGetAttribute(
@@ -270,75 +238,65 @@
 
 TEST_F(HTMLSelectElementTest, NextSelectableOption) {
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
-        "<select></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
+    SetHtmlInnerHTML("<select></select>");
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ(nullptr, select->NextSelectableOption(nullptr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->NextSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1 disabled></option><option "
         "id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->NextSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1 style='display:none'></option><option "
         "id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->NextSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><optgroup><option id=o1></option><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->NextSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
-    HTMLOptionElement* option =
-        ToHTMLOptionElement(GetDocument().getElementById("o1"));
+    HTMLOptionElement* option = ToHTMLOptionElement(GetElementById("o1"));
     EXPECT_EQ("o2", select->NextSelectableOption(option)->FastGetAttribute(
                         HTMLNames::idAttr));
 
-    EXPECT_EQ(nullptr, select->NextSelectableOption(ToHTMLOptionElement(
-                           GetDocument().getElementById("o2"))));
+    EXPECT_EQ(nullptr, select->NextSelectableOption(
+                           ToHTMLOptionElement(GetElementById("o2"))));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><optgroup><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
-    HTMLOptionElement* option =
-        ToHTMLOptionElement(GetDocument().getElementById("o1"));
+    HTMLOptionElement* option = ToHTMLOptionElement(GetElementById("o1"));
     EXPECT_EQ("o2", select->NextSelectableOption(option)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
@@ -346,84 +304,73 @@
 
 TEST_F(HTMLSelectElementTest, PreviousSelectableOption) {
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
-        "<select></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
+    SetHtmlInnerHTML("<select></select>");
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ(nullptr, select->PreviousSelectableOption(nullptr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->PreviousSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2 "
         "disabled></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->PreviousSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2 "
         "style='display:none'></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o1", select->PreviousSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><optgroup><option id=o1></option><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
     EXPECT_EQ("o2", select->PreviousSelectableOption(nullptr)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><option id=o2></option></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
-    HTMLOptionElement* option =
-        ToHTMLOptionElement(GetDocument().getElementById("o2"));
+    HTMLOptionElement* option = ToHTMLOptionElement(GetElementById("o2"));
     EXPECT_EQ("o1", select->PreviousSelectableOption(option)->FastGetAttribute(
                         HTMLNames::idAttr));
 
-    EXPECT_EQ(nullptr, select->PreviousSelectableOption(ToHTMLOptionElement(
-                           GetDocument().getElementById("o1"))));
+    EXPECT_EQ(nullptr, select->PreviousSelectableOption(
+                           ToHTMLOptionElement(GetElementById("o1"))));
   }
   {
-    GetDocument().documentElement()->SetInnerHTMLFromString(
+    SetHtmlInnerHTML(
         "<select><option id=o1></option><optgroup><option "
         "id=o2></option></optgroup></select>");
-    GetDocument().View()->UpdateAllLifecyclePhases();
     HTMLSelectElement* select =
         ToHTMLSelectElement(GetDocument().body()->firstChild());
-    HTMLOptionElement* option =
-        ToHTMLOptionElement(GetDocument().getElementById("o2"));
+    HTMLOptionElement* option = ToHTMLOptionElement(GetElementById("o2"));
     EXPECT_EQ("o1", select->PreviousSelectableOption(option)->FastGetAttribute(
                         HTMLNames::idAttr));
   }
 }
 
 TEST_F(HTMLSelectElementTest, ActiveSelectionEndAfterOptionRemoval) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
+  SetHtmlInnerHTML(
       "<select><optgroup><option selected>o1</option></optgroup></select>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
   HTMLSelectElement* select =
       ToHTMLSelectElement(GetDocument().body()->firstChild());
   HTMLOptionElement* option =
@@ -436,10 +383,9 @@
 }
 
 TEST_F(HTMLSelectElementTest, DefaultToolTip) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
+  SetHtmlInnerHTML(
       "<select size=4><option value="
       ">Placeholder</option><optgroup><option>o2</option></optgroup></select>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
   HTMLSelectElement* select =
       ToHTMLSelectElement(GetDocument().body()->firstChild());
   Element* option = ToElement(select->firstChild());
@@ -481,10 +427,9 @@
 }
 
 TEST_F(HTMLSelectElementTest, SetRecalcListItemsByOptgroupRemoval) {
-  GetDocument().documentElement()->SetInnerHTMLFromString(
+  SetHtmlInnerHTML(
       "<select><optgroup><option>sub1</option><option>sub2</option></"
       "optgroup></select>");
-  GetDocument().View()->UpdateAllLifecyclePhases();
   HTMLSelectElement* select =
       ToHTMLSelectElement(GetDocument().body()->firstChild());
   select->SetInnerHTMLFromString("");
@@ -494,12 +439,11 @@
 TEST_F(HTMLSelectElementTest, ScrollToOptionAfterLayoutCrash) {
   // crbug.com/737447
   // This test passes if no crash.
-  GetDocument().documentElement()->SetInnerHTMLFromString(R"HTML(
+  SetHtmlInnerHTML(R"HTML(
     <style>*:checked { position:fixed; }</style>
     <select multiple><<option>o1</option><option
     selected>o2</option></select>
   )HTML");
-  GetDocument().View()->UpdateAllLifecyclePhases();
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/html/media/HTMLMediaElementEventListenersTest.cpp b/third_party/WebKit/Source/core/html/media/HTMLMediaElementEventListenersTest.cpp
index 150caa7..2c7f140 100644
--- a/third_party/WebKit/Source/core/html/media/HTMLMediaElementEventListenersTest.cpp
+++ b/third_party/WebKit/Source/core/html/media/HTMLMediaElementEventListenersTest.cpp

@@ -10,7 +10,7 @@
 #include "core/html/media/MediaControls.h"
 #include "core/html/media/MediaCustomControlsFullscreenDetector.h"
 #include "core/loader/EmptyClients.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "platform/testing/EmptyWebMediaPlayer.h"
 #include "platform/testing/RuntimeEnabledFeaturesTestHelpers.h"
 #include "platform/testing/UnitTestHelpers.h"
@@ -46,15 +46,13 @@
 
 }  // anonymous namespace
 
-class HTMLMediaElementEventListenersTest : public ::testing::Test {
+class HTMLMediaElementEventListenersTest : public PageTestBase {
  protected:
   void SetUp() override {
-    page_holder_ = DummyPageHolder::Create(IntSize(800, 600), nullptr,
-                                           MediaStubLocalFrameClient::Create());
+    SetupPageWithClients(nullptr, MediaStubLocalFrameClient::Create());
   }
 
-  Document& GetDocument() { return page_holder_->GetDocument(); }
-  void DestroyDocument() { page_holder_.reset(); }
+  void DestroyDocument() { PageTestBase::TearDown(); }
   HTMLVideoElement* Video() {
     return ToHTMLVideoElement(GetDocument().QuerySelector("video"));
   }
@@ -72,9 +70,6 @@
       MediaCustomControlsFullscreenDetector* detector) {
     return detector->check_viewport_intersection_timer_.IsActive();
   }
-
- private:
-  std::unique_ptr<DummyPageHolder> page_holder_;
 };
 
 TEST_F(HTMLMediaElementEventListenersTest, RemovingFromDocumentCollectsAll) {

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp
index f6d1b47..eec73a95 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp

@@ -12,7 +12,7 @@
 #include "core/html/parser/HTMLResourcePreloader.h"
 #include "core/html/parser/PreloadRequest.h"
 #include "core/media_type_names.h"
-#include "core/testing/DummyPageHolder.h"
+#include "core/testing/PageTestBase.h"
 #include "platform/exported/WrappedResourceResponse.h"
 #include "platform/loader/fetch/ClientHintsPreferences.h"
 #include "platform/weborigin/SecurityOrigin.h"
@@ -175,7 +175,7 @@
   std::unique_ptr<PreloadRequest> preload_request_;
 };
 
-class HTMLPreloadScannerTest : public ::testing::Test {
+class HTMLPreloadScannerTest : public PageTestBase {
  protected:
   enum ViewportState {
     kViewportEnabled,
@@ -187,8 +187,6 @@
     kPreloadDisabled,
   };
 
-  HTMLPreloadScannerTest() : dummy_page_holder_(DummyPageHolder::Create()) {}
-
   MediaValuesCached::MediaValuesCachedData CreateMediaValuesData() {
     MediaValuesCached::MediaValuesCachedData data;
     data.viewport_width = 500;
@@ -211,27 +209,27 @@
       ViewportState viewport_state,
       PreloadState preload_state = kPreloadEnabled,
       ReferrerPolicy document_referrer_policy = kReferrerPolicyDefault) {
-    HTMLParserOptions options(&dummy_page_holder_->GetDocument());
+    HTMLParserOptions options(&GetDocument());
     KURL document_url("http://whatever.test/");
-    dummy_page_holder_->GetDocument().SetURL(document_url);
-    dummy_page_holder_->GetDocument().SetSecurityOrigin(
-        SecurityOrigin::Create(document_url));
-    dummy_page_holder_->GetDocument().GetSettings()->SetViewportEnabled(
-        viewport_state == kViewportEnabled);
-    dummy_page_holder_->GetDocument().GetSettings()->SetViewportMetaEnabled(
-        viewport_state == kViewportEnabled);
-    dummy_page_holder_->GetDocument().GetSettings()->SetDoHtmlPreloadScanning(
-        preload_state == kPreloadEnabled);
-    dummy_page_holder_->GetDocument().SetReferrerPolicy(
-        document_referrer_policy);
+    GetDocument().SetURL(document_url);
+    GetDocument().SetSecurityOrigin(SecurityOrigin::Create(document_url));
+    GetDocument().GetSettings()->SetViewportEnabled(viewport_state ==
+                                                    kViewportEnabled);
+    GetDocument().GetSettings()->SetViewportMetaEnabled(viewport_state ==
+                                                        kViewportEnabled);
+    GetDocument().GetSettings()->SetDoHtmlPreloadScanning(preload_state ==
+                                                          kPreloadEnabled);
+    GetDocument().SetReferrerPolicy(document_referrer_policy);
     scanner_ = HTMLPreloadScanner::Create(
-        options, document_url,
-        CachedDocumentParameters::Create(&dummy_page_holder_->GetDocument()),
+        options, document_url, CachedDocumentParameters::Create(&GetDocument()),
         CreateMediaValuesData(),
         TokenPreloadScanner::ScannerType::kMainDocument);
   }
 
-  void SetUp() override { RunSetUp(kViewportEnabled); }
+  void SetUp() override {
+    PageTestBase::SetUp(IntSize());
+    RunSetUp(kViewportEnabled);
+  }
 
   void Test(PreloadScannerTestCase test_case) {
     HTMLMockHTMLResourcePreloader preloader;
@@ -265,8 +263,8 @@
     if (test_case.expected_referrer) {
       preloader.PreloadRequestVerification(
           test_case.type, test_case.preloaded_url, test_case.output_base_url,
-          test_case.resource_width, test_case.referrer_policy,
-          &dummy_page_holder_->GetDocument(), test_case.expected_referrer);
+          test_case.resource_width, test_case.referrer_policy, &GetDocument(),
+          test_case.expected_referrer);
     } else {
       preloader.PreloadRequestVerification(
           test_case.type, test_case.preloaded_url, test_case.output_base_url,
@@ -281,8 +279,7 @@
     PreloadRequestStream requests = scanner_->Scan(base_url, nullptr);
     preloader.TakeAndPreload(requests);
 
-    preloader.CORSRequestVerification(&dummy_page_holder_->GetDocument(),
-                                      test_case.request_mode,
+    preloader.CORSRequestVerification(&GetDocument(), test_case.request_mode,
                                       test_case.credentials_mode);
   }
 
@@ -307,7 +304,6 @@
   }
 
  private:
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
   std::unique_ptr<HTMLPreloadScanner> scanner_;
 };
 

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLResourcePreloaderTest.cpp b/third_party/WebKit/Source/core/html/parser/HTMLResourcePreloaderTest.cpp
index e88dc16..623fd61 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLResourcePreloaderTest.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLResourcePreloaderTest.cpp

@@ -4,10 +4,10 @@
 
 #include "core/html/parser/HTMLResourcePreloader.h"
 
-#include "core/html/parser/PreloadRequest.h"
-#include "core/testing/DummyPageHolder.h"
-#include "testing/gtest/include/gtest/gtest.h"
 #include <memory>
+#include "core/html/parser/PreloadRequest.h"
+#include "core/testing/PageTestBase.h"
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
@@ -41,9 +41,9 @@
   mutable bool is_cross_origin_;
 };
 
-class HTMLResourcePreloaderTest : public ::testing::Test {
+class HTMLResourcePreloaderTest : public PageTestBase {
  protected:
-  HTMLResourcePreloaderTest() : dummy_page_holder_(DummyPageHolder::Create()) {}
+  void SetUp() override { PageTestBase::SetUp(IntSize()); }
 
   void Test(HTMLResourcePreconnectTestCase test_case) {
     // TODO(yoav): Need a mock loader here to verify things are happenning
@@ -58,15 +58,12 @@
     if (test_case.is_cors)
       preload_request->SetCrossOrigin(kCrossOriginAttributeAnonymous);
     HTMLResourcePreloader* preloader =
-        HTMLResourcePreloader::Create(dummy_page_holder_->GetDocument());
+        HTMLResourcePreloader::Create(GetDocument());
     preloader->Preload(std::move(preload_request), network_hints);
     ASSERT_TRUE(network_hints.DidPreconnect());
     ASSERT_EQ(test_case.is_cors, network_hints.IsCrossOrigin());
     ASSERT_EQ(test_case.is_https, network_hints.IsHTTPS());
   }
-
- private:
-  std::unique_ptr<DummyPageHolder> dummy_page_holder_;
 };
 
 TEST_F(HTMLResourcePreloaderTest, testPreconnect) {

diff --git a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.cpp b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.cpp
index 43cae670..0f0f12ae 100644
--- a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.cpp
+++ b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.cpp

@@ -59,15 +59,16 @@
     CSSValueHorizontalTb, CSSValueVerticalRl, CSSValueVerticalLr};
 static_assert(WTF_ARRAY_LENGTH(kDisplayWritingModeMap) ==
                   VTTCue::kNumberOfWritingDirections,
-              "displayWritingModeMap should have the same number of elements "
-              "as VTTCue::NumberOfWritingDirections");
+              "kDisplayWritingModeMap should have the same number of elements "
+              "as VTTCue::kNumberOfWritingDirections");
 
 static const CSSValueID kDisplayAlignmentMap[] = {
     CSSValueStart, CSSValueCenter, CSSValueEnd, CSSValueLeft, CSSValueRight};
-static_assert(WTF_ARRAY_LENGTH(kDisplayAlignmentMap) ==
-                  VTTCue::kNumberOfAlignments,
-              "displayAlignmentMap should have the same number of elements as "
-              "VTTCue::NumberOfAlignments");
+static_assert(
+    WTF_ARRAY_LENGTH(kDisplayAlignmentMap) ==
+        static_cast<size_t>(VTTCue::TextAlignment::kNumberOfAlignments),
+    "kDisplayAlignmentMap should have the same number of elements as "
+    "VTTCue::TextAlignment::kNumberOfAlignments");
 
 static const String& AutoKeyword() {
   DEFINE_STATIC_LOCAL(const String, auto_string, ("auto"));
@@ -99,6 +100,16 @@
   return right;
 }
 
+static const String& LineLeftKeyword() {
+  DEFINE_STATIC_LOCAL(const String, line_left, ("line-left"));
+  return line_left;
+}
+
+static const String& LineRightKeyword() {
+  DEFINE_STATIC_LOCAL(const String, line_right, ("line-right"));
+  return line_right;
+}
+
 static const String& HorizontalKeyword() {
   return g_empty_string;
 }
@@ -141,13 +152,14 @@
 
 VTTCueBox::VTTCueBox(Document& document)
     : HTMLDivElement(document),
-      snap_to_lines_position_(std::numeric_limits<float>::quiet_NaN()) {
+      snap_to_lines_position_(std::numeric_limits<float>::quiet_NaN()),
+      line_align_(0) {
   SetShadowPseudoId(AtomicString("-webkit-media-text-track-display"));
 }
 
 void VTTCueBox::ApplyCSSProperties(
     const VTTDisplayParameters& display_parameters) {
-  // http://dev.w3.org/html5/webvtt/#applying-css-properties-to-webvtt-node-objects
+  // https://w3c.github.io/webvtt/#applying-css-properties
 
   // Initialize the (root) list of WebVTT Node Objects with the following CSS
   // settings:
@@ -193,8 +205,10 @@
   // text alignment:
   SetInlineStyleProperty(CSSPropertyTextAlign, display_parameters.text_align);
 
-  // The snap-to-lines position is propagated to LayoutVTTCue.
+  // The snap-to-lines position and line alignment is propagated to
+  // LayoutVTTCue.
   snap_to_lines_position_ = display_parameters.snap_to_lines_position;
+  line_align_ = display_parameters.line_align;
 }
 
 LayoutObject* VTTCueBox::CreateLayoutObject(const ComputedStyle& style) {
@@ -205,7 +219,7 @@
   if (style.GetPosition() == EPosition::kRelative)
     return HTMLDivElement::CreateLayoutObject(style);
 
-  return new LayoutVTTCue(this, snap_to_lines_position_);
+  return new LayoutVTTCue(this, snap_to_lines_position_, line_align_);
 }
 
 VTTCue::VTTCue(Document& document,
@@ -218,7 +232,9 @@
       text_position_(std::numeric_limits<float>::quiet_NaN()),
       cue_size_(100),
       writing_direction_(kHorizontal),
-      cue_alignment_(kCenter),
+      text_alignment_(TextAlignment::kCenter),
+      position_alignment_(PositionAlignment::kAuto),
+      line_alignment_(LineAlignment::kStart),
       vtt_node_tree_(nullptr),
       cue_background_box_(HTMLDivElement::Create(document)),
       snap_to_lines_(true),
@@ -296,7 +312,7 @@
 }
 
 void VTTCue::setLine(const DoubleOrAutoKeyword& position) {
-  // http://dev.w3.org/html5/webvtt/#dfn-vttcue-line
+  // https://w3c.github.io/webvtt/#webvtt-line-cue-setting
   // On setting, the WebVTT cue line must be set to the new value; if the new
   // value is the string "auto", then it must be interpreted as the special
   // value auto.  ("auto" is translated to NaN.)
@@ -317,6 +333,39 @@
   CueDidChange();
 }
 
+const String& VTTCue::lineAlign() const {
+  switch (line_alignment_) {
+    case LineAlignment::kStart:
+      return StartKeyword();
+    case LineAlignment::kCenter:
+      return CenterKeyword();
+    case LineAlignment::kEnd:
+      return EndKeyword();
+    default:
+      NOTREACHED();
+      return g_empty_string;
+  }
+}
+
+void VTTCue::setLineAlign(const String& value) {
+  LineAlignment alignment = line_alignment_;
+  if (value == StartKeyword())
+    alignment = LineAlignment::kStart;
+  else if (value == CenterKeyword())
+    alignment = LineAlignment::kCenter;
+  else if (value == EndKeyword())
+    alignment = LineAlignment::kEnd;
+  else
+    NOTREACHED();
+
+  if (alignment == line_alignment_)
+    return;
+
+  CueWillChange();
+  line_alignment_ = alignment;
+  CueDidChange();
+}
+
 bool VTTCue::TextPositionIsAuto() const {
   return std::isnan(text_position_);
 }
@@ -330,7 +379,7 @@
 
 void VTTCue::setPosition(const DoubleOrAutoKeyword& position,
                          ExceptionState& exception_state) {
-  // http://dev.w3.org/html5/webvtt/#dfn-vttcue-position
+  // https://w3c.github.io/webvtt/#dom-vttcue-position
   // On setting, if the new value is negative or greater than 100, then an
   // IndexSizeError exception must be thrown. Otherwise, the WebVTT cue
   // position must be set to the new value; if the new value is the string
@@ -354,14 +403,51 @@
   CueDidChange();
 }
 
+const String& VTTCue::positionAlign() const {
+  switch (position_alignment_) {
+    case PositionAlignment::kLineLeft:
+      return LineLeftKeyword();
+    case PositionAlignment::kCenter:
+      return CenterKeyword();
+    case PositionAlignment::kLineRight:
+      return LineRightKeyword();
+    case PositionAlignment::kAuto:
+      return AutoKeyword();
+    default:
+      NOTREACHED();
+      return g_empty_string;
+  }
+}
+
+void VTTCue::setPositionAlign(const String& value) {
+  PositionAlignment alignment = position_alignment_;
+  if (value == LineLeftKeyword())
+    alignment = PositionAlignment::kLineLeft;
+  else if (value == CenterKeyword())
+    alignment = PositionAlignment::kCenter;
+  else if (value == LineRightKeyword())
+    alignment = PositionAlignment::kLineRight;
+  else if (value == AutoKeyword())
+    alignment = PositionAlignment::kAuto;
+  else
+    NOTREACHED();
+
+  if (alignment == position_alignment_)
+    return;
+
+  CueWillChange();
+  position_alignment_ = alignment;
+  CueDidChange();
+}
+
 void VTTCue::setSize(double size, ExceptionState& exception_state) {
-  // http://dev.w3.org/html5/webvtt/#dfn-vttcue-size
-  // On setting, if the new value is negative or greater than 100, then throw
-  // an IndexSizeError exception.
+  // https://w3c.github.io/webvtt/#dom-vttcue-size
+  // On setting, if the new value is negative or greater than 100, then
+  // an IndexSizeError exception must be thrown.
   if (IsInvalidPercentage(size, exception_state))
     return;
 
-  // Otherwise, set the WebVTT cue size to the new value.
+  // Otherwise, WebVTT cue size must be set to the new value.
   float float_size = clampTo<float>(size);
   if (cue_size_ == float_size)
     return;
@@ -372,16 +458,16 @@
 }
 
 const String& VTTCue::align() const {
-  switch (cue_alignment_) {
-    case kStart:
+  switch (text_alignment_) {
+    case TextAlignment::kStart:
       return StartKeyword();
-    case kCenter:
+    case TextAlignment::kCenter:
       return CenterKeyword();
-    case kEnd:
+    case TextAlignment::kEnd:
       return EndKeyword();
-    case kLeft:
+    case TextAlignment::kLeft:
       return LeftKeyword();
-    case kRight:
+    case TextAlignment::kRight:
       return RightKeyword();
     default:
       NOTREACHED();
@@ -390,25 +476,25 @@
 }
 
 void VTTCue::setAlign(const String& value) {
-  CueAlignment alignment = cue_alignment_;
+  TextAlignment alignment = text_alignment_;
   if (value == StartKeyword())
-    alignment = kStart;
+    alignment = TextAlignment::kStart;
   else if (value == CenterKeyword())
-    alignment = kCenter;
+    alignment = TextAlignment::kCenter;
   else if (value == EndKeyword())
-    alignment = kEnd;
+    alignment = TextAlignment::kEnd;
   else if (value == LeftKeyword())
-    alignment = kLeft;
+    alignment = TextAlignment::kLeft;
   else if (value == RightKeyword())
-    alignment = kRight;
+    alignment = TextAlignment::kRight;
   else
     NOTREACHED();
 
-  if (alignment == cue_alignment_)
+  if (alignment == text_alignment_)
     return;
 
   CueWillChange();
-  cue_alignment_ = alignment;
+  text_alignment_ = alignment;
   CueDidChange();
 }
 
@@ -460,27 +546,27 @@
   CueDidChange();
 }
 
-float VTTCue::CalculateComputedLinePosition() const {
-  // http://dev.w3.org/html5/webvtt/#dfn-cue-computed-line
+float VTTCue::CalculateComputedLine() const {
+  // https://w3c.github.io/webvtt/#cue-computed-line
   // A WebVTT cue has a computed line whose value is that returned by the
   // following algorithm, which is defined in terms of the other aspects of
   // the cue:
 
   // 1. If the line is numeric, the WebVTT cue snap-to-lines flag of the
-  //    WebVTT cue is not set, and the line is negative or greater than 100,
+  //    WebVTT cue is false, and the line is negative or greater than 100,
   //    then return 100 and abort these steps.
   if (!LineIsAuto() && !snap_to_lines_ && IsInvalidPercentage(line_position_))
     return 100;
 
   // 2. If the line is numeric, return the value of the WebVTT cue line and
-  //    abort these steps. (Either the WebVTT cue snap-to-lines flag is set,
+  //    abort these steps. (Either the WebVTT cue snap-to-lines flag is true,
   //    so any value, not just those in the range 0..100, is valid, or the
   //    value is in the range 0..100 and is thus valid regardless of the
   //    value of that flag.)
   if (!LineIsAuto())
     return line_position_;
 
-  // 3. If the WebVTT cue snap-to-lines flag of the WebVTT cue is not set,
+  // 3. If the WebVTT cue snap-to-lines flag of the WebVTT cue is false,
   //    return the value 100 and abort these steps. (The WebVTT cue line is
   //    the special value auto.)
   if (!snap_to_lines_)
@@ -560,43 +646,44 @@
   return IsLtr(text_direction) ? CSSValueLtr : CSSValueRtl;
 }
 
-float VTTCue::CalculateComputedTextPosition() const {
-  // http://dev.w3.org/html5/webvtt/#dfn-cue-computed-position
+float VTTCue::CalculateComputedPosition() const {
+  // https://w3c.github.io/webvtt/#cue-computed-position
 
   // 1. If the position is numeric, then return the value of the position and
   // abort these steps. (Otherwise, the position is the special value auto.)
   if (!TextPositionIsAuto())
     return text_position_;
 
-  switch (cue_alignment_) {
-    // 2. If the cue text alignment is start or left, return 0 and abort these
-    // steps.
-    case kStart:
-    case kLeft:
-      return 0;
-    // 3. If the cue text alignment is end or right, return 100 and abort these
-    // steps.
-    case kEnd:
-    case kRight:
-      return 100;
-    // 4. If the cue text alignment is center, return 50 and abort these steps.
-    case kCenter:
-      return 50;
-    default:
-      NOTREACHED();
-      return 0;
-  }
+  // 2. If the cue text alignment is left, return 0 and abort these steps.
+  if (text_alignment_ == TextAlignment::kLeft)
+    return 0;
+  // 3. If the cue text alignment is right, return 100 and abort these steps.
+  if (text_alignment_ == TextAlignment::kRight)
+    return 100;
+  // 4. Otherwise, return 50 and abort these steps.
+  return 50;
 }
 
-VTTCue::CueAlignment VTTCue::CalculateComputedCueAlignment() const {
-  switch (cue_alignment_) {
-    case VTTCue::kLeft:
-      return VTTCue::kStart;
-    case VTTCue::kRight:
-      return VTTCue::kEnd;
-    default:
-      return cue_alignment_;
-  }
+VTTCue::PositionAlignment VTTCue::CalculateComputedPositionAlignment() const {
+  // https://w3c.github.io/webvtt/#cue-computed-position-alignment
+
+  // 1. If the WebVTT cue position alignment is not auto, then return the value
+  //    of the WebVTT cue position alignment and abort these steps.
+  if (position_alignment_ != PositionAlignment::kAuto)
+    return position_alignment_;
+
+  // 2. If the WebVTT cue text alignment is left, return line-left and
+  // abort these steps.
+  if (text_alignment_ == TextAlignment::kLeft)
+    return PositionAlignment::kLineLeft;
+
+  // 3. If the WebVTT cue text alignment is right, return line-right and
+  // abort these steps.
+  if (text_alignment_ == TextAlignment::kRight)
+    return PositionAlignment::kLineRight;
+
+  // 4. Otherwise, return center.
+  return PositionAlignment::kCenter;
 }
 
 VTTDisplayParameters::VTTDisplayParameters()
@@ -604,10 +691,11 @@
       direction(CSSValueNone),
       text_align(CSSValueNone),
       writing_mode(CSSValueNone),
-      snap_to_lines_position(std::numeric_limits<float>::quiet_NaN()) {}
+      snap_to_lines_position(std::numeric_limits<float>::quiet_NaN()),
+      line_align(0) {}
 
 VTTDisplayParameters VTTCue::CalculateDisplayParameters() const {
-  // http://dev.w3.org/html5/webvtt/#dfn-apply-webvtt-cue-settings
+  // https://w3c.github.io/webvtt/#apply-webvtt-cue-settings
 
   VTTDisplayParameters display_parameters;
 
@@ -619,7 +707,8 @@
 
   // Note: The 'text-align' property is also determined here so that
   // VTTCueBox::applyCSSProperties need not have access to a VTTCue.
-  display_parameters.text_align = kDisplayAlignmentMap[GetCueAlignment()];
+  display_parameters.text_align =
+      kDisplayAlignmentMap[static_cast<size_t>(GetTextAlignment())];
 
   // 3. If the cue writing direction is horizontal, then let block-flow be
   // 'tb'. Otherwise, if the cue writing direction is vertical growing left,
@@ -627,21 +716,22 @@
   // vertical growing right; let block-flow be 'rl'.
   display_parameters.writing_mode = kDisplayWritingModeMap[writing_direction_];
 
-  // Resolve the cue alignment to one of the values {start, end, center}.
-  CueAlignment computed_cue_alignment = CalculateComputedCueAlignment();
+  // Resolve the cue alignment to one of the values {line-left, line-right,
+  // center}.
+  PositionAlignment computed_position_alignment =
+      CalculateComputedPositionAlignment();
 
   // 4. Determine the value of maximum size for cue as per the appropriate
   // rules from the following list:
-  float computed_text_position = CalculateComputedTextPosition();
-  float maximum_size = computed_text_position;
-  if (computed_cue_alignment == kStart) {
-    maximum_size = 100 - computed_text_position;
-  } else if (computed_cue_alignment == kEnd) {
-    maximum_size = computed_text_position;
-  } else if (computed_cue_alignment == kCenter) {
-    maximum_size = computed_text_position <= 50
-                       ? computed_text_position
-                       : (100 - computed_text_position);
+  float computed_position = CalculateComputedPosition();
+  float maximum_size = computed_position;
+  if (computed_position_alignment == PositionAlignment::kLineLeft) {
+    maximum_size = 100 - computed_position;
+  } else if (computed_position_alignment == PositionAlignment::kLineRight) {
+    maximum_size = computed_position;
+  } else if (computed_position_alignment == PositionAlignment::kCenter) {
+    maximum_size =
+        computed_position <= 50 ? computed_position : (100 - computed_position);
     maximum_size = maximum_size * 2;
   } else {
     NOTREACHED();
@@ -660,33 +750,33 @@
   // 7. Determine the value of x-position or y-position for cue as per the
   // appropriate rules from the following list:
   if (writing_direction_ == kHorizontal) {
-    switch (computed_cue_alignment) {
-      case kStart:
-        display_parameters.position.SetX(computed_text_position);
+    switch (computed_position_alignment) {
+      case PositionAlignment::kLineLeft:
+        display_parameters.position.SetX(computed_position);
         break;
-      case kEnd:
-        display_parameters.position.SetX(computed_text_position -
+      case PositionAlignment::kLineRight:
+        display_parameters.position.SetX(computed_position -
                                          display_parameters.size);
         break;
-      case kCenter:
-        display_parameters.position.SetX(computed_text_position -
+      case PositionAlignment::kCenter:
+        display_parameters.position.SetX(computed_position -
                                          display_parameters.size / 2);
         break;
       default:
         NOTREACHED();
     }
   } else {
-    // Cases for m_writingDirection being VerticalGrowing{Left|Right}
-    switch (computed_cue_alignment) {
-      case kStart:
-        display_parameters.position.SetY(computed_text_position);
+    // Cases for writing_direction_ being VerticalGrowing{Left|Right}
+    switch (computed_position_alignment) {
+      case PositionAlignment::kLineLeft:
+        display_parameters.position.SetY(computed_position);
         break;
-      case kEnd:
-        display_parameters.position.SetY(computed_text_position -
+      case PositionAlignment::kLineRight:
+        display_parameters.position.SetY(computed_position -
                                          display_parameters.size);
         break;
-      case kCenter:
-        display_parameters.position.SetY(computed_text_position -
+      case PositionAlignment::kCenter:
+        display_parameters.position.SetY(computed_position -
                                          display_parameters.size / 2);
         break;
       default:
@@ -696,29 +786,34 @@
 
   // A cue has a computed line whose value is defined in terms of
   // the other aspects of the cue.
-  float computed_line_position = CalculateComputedLinePosition();
+  float computed_line = CalculateComputedLine();
 
   // 8. Determine the value of whichever of x-position or y-position is not
   // yet calculated for cue as per the appropriate rules from the following
   // list:
   if (!snap_to_lines_) {
     if (writing_direction_ == kHorizontal)
-      display_parameters.position.SetY(computed_line_position);
+      display_parameters.position.SetY(computed_line);
     else
-      display_parameters.position.SetX(computed_line_position);
+      display_parameters.position.SetX(computed_line);
   } else {
     if (writing_direction_ == kHorizontal)
       display_parameters.position.SetY(0);
     else
       display_parameters.position.SetX(0);
   }
-
   // Step 9 not implemented (margin == 0).
 
-  // The snap-to-lines position is propagated to LayoutVTTCue.
-  display_parameters.snap_to_lines_position =
-      snap_to_lines_ ? computed_line_position
-                     : std::numeric_limits<float>::quiet_NaN();
+  // The snap-to-lines position and line alignment are propagated to
+  // LayoutVTTCue.
+  if (snap_to_lines_) {
+    display_parameters.snap_to_lines_position = computed_line;
+  } else {
+    if (line_alignment_ == LineAlignment::kCenter)
+      display_parameters.line_align = 50;
+    else if (line_alignment_ == LineAlignment::kEnd)
+      display_parameters.line_align = 100;
+  }
 
   DCHECK(std::isfinite(display_parameters.size));
   DCHECK_NE(display_parameters.direction, CSSValueNone);
@@ -839,7 +934,7 @@
   if (cue_size_ != 100)
     UseCounter::Count(GetDocument(), WebFeature::kVTTCueRenderSizeNot100);
 
-  if (cue_alignment_ != kCenter)
+  if (text_alignment_ != TextAlignment::kCenter)
     UseCounter::Count(GetDocument(), WebFeature::kVTTCueRenderAlignNotCenter);
 
   VTTCueBox* display_box = GetDisplayTree();
@@ -882,7 +977,7 @@
 }
 
 static bool ScanPercentage(VTTScanner& input, float& number) {
-  // http://dev.w3.org/html5/webvtt/#dfn-parse-a-percentage-string
+  // https://w3c.github.io/webvtt/#parse-a-percentage-string
 
   // 1. Let input be the string being parsed.
   // 2. If input contains any characters other than U+0025 PERCENT SIGN
@@ -955,7 +1050,7 @@
       }
       case kLine: {
         // If name is a case-sensitive match for "line"
-        // Steps 1 - 2 skipped.
+        // Steps 1 - 2 Handled below.
         float number;
         // 3. If linepos does not contain at least one ASCII digit, then
         //    jump to the step labeled next setting.
@@ -998,32 +1093,74 @@
           if (is_negative && number)
             number = -number;
         }
+        LineAlignment line_alignment = LineAlignment::kStart;
+        if (input.Scan(',')) {
+          // 6. If linealign is a case-sensitive match for the string "start",
+          //    then let cue's WebVTT cue line alignment be start alignment.
+          if (input.Scan("start"))
+            line_alignment = LineAlignment::kStart;
+          // 7. If linealign is a case-sensitive match for the string "center",
+          //    then let cue's WebVTT cue line alignment be center alignment.
+          else if (input.Scan("center"))
+            line_alignment = LineAlignment::kCenter;
+          // 8. If linealign is a case-sensitive match for the string
+          //    "end", then let cue's WebVTT cue line alignment be end
+          //    alignment.
+          else if (input.Scan("end"))
+            line_alignment = LineAlignment::kEnd;
+          // 9. Otherwise, if linealign is not null, then jump to the
+          //    step labeled next setting.
+          else
+            break;
+        }
         if (!input.IsAt(value_run.end()))
           break;
-        // 5. Let cue's WebVTT cue line be number.
+        // 9. Let cue's WebVTT cue line be number.
         line_position_ = number;
-        // 6. If the last character in linepos is a U+0025 PERCENT SIGN
-        //    character (%), then let cue's WebVTT cue snap-to-lines
-        //    flag be false. Otherwise, let it be true.
+        line_alignment_ = line_alignment;
+        // 10. If the last character in linepos is a U+0025 PERCENT SIGN
+        //     character (%), then let cue's WebVTT cue snap-to-lines
+        //     flag be false. Otherwise, let it be true.
         snap_to_lines_ = !is_percentage;
-        // Steps 7 - 9 skipped.
         break;
       }
       case kPosition: {
         // If name is a case-sensitive match for "position".
         float number;
-        // Steps 1 - 2 skipped.
+        // Steps 1 - 2 Handled below.
         // 3. If parse a percentage string from colpos doesn't fail, let
         //    number be the returned percentage, otherwise jump to the step
         //    labeled next setting (text track cue text position's value
         //    remains the special value auto).
         if (!ScanPercentage(input, number))
           break;
+        PositionAlignment position_alignment = PositionAlignment::kAuto;
+        if (input.Scan(',')) {
+          // 4. If colalign is a case-sensitive match for the string
+          //    "line-left", then let cue's WebVTT cue position
+          //    alignment be line-left alignment.
+          if (input.Scan("line-left"))
+            position_alignment = PositionAlignment::kLineLeft;
+          // 5. If colalign is a case-sensitive match for the string
+          //    "center", then let cue's WebVTT cue position alignment
+          //    be center alignment.
+          else if (input.Scan("center"))
+            position_alignment = PositionAlignment::kCenter;
+          // 6. If colalign is a case-sensitive match for the string
+          //    "line-right", then let cue's WebVTT cue position alignment be
+          //    line-right alignment.
+          else if (input.Scan("line-right"))
+            position_alignment = PositionAlignment::kLineRight;
+          // 7. Otherwise, if colalign is not null, then jump to the
+          //    step labeled next setting.
+          else
+            break;
+        }
         if (!input.IsAt(value_run.end()))
           break;
-        // 4. Let cue's cue position be number.
+        // 8. Let cue's cue position be number.
         text_position_ = number;
-        // Steps 5 - 7 skipped.
+        position_alignment_ = position_alignment;
         break;
       }
       case kSize: {
@@ -1045,27 +1182,27 @@
         // 1. If value is a case-sensitive match for the string "start",
         //    then let cue's WebVTT cue text alignment be start alignment.
         if (input.ScanRun(value_run, StartKeyword()))
-          cue_alignment_ = kStart;
+          text_alignment_ = TextAlignment::kStart;
 
         // 2. If value is a case-sensitive match for the string "center",
         //    then let cue's WebVTT cue text alignment be center alignment.
         else if (input.ScanRun(value_run, CenterKeyword()))
-          cue_alignment_ = kCenter;
+          text_alignment_ = TextAlignment::kCenter;
 
         // 3. If value is a case-sensitive match for the string "end", then
         //    let cue's WebVTT cue text alignment be end alignment.
         else if (input.ScanRun(value_run, EndKeyword()))
-          cue_alignment_ = kEnd;
+          text_alignment_ = TextAlignment::kEnd;
 
         // 4. If value is a case-sensitive match for the string "left",
         //    then let cue's WebVTT cue text alignment be left alignment.
         else if (input.ScanRun(value_run, LeftKeyword()))
-          cue_alignment_ = kLeft;
+          text_alignment_ = TextAlignment::kLeft;
 
         // 5. If value is a case-sensitive match for the string "right",
         //    then let cue's WebVTT cue text alignment be right alignment.
         else if (input.ScanRun(value_run, RightKeyword()))
-          cue_alignment_ = kRight;
+          text_alignment_ = TextAlignment::kRight;
         break;
       }
       case kRegionId:

diff --git a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.h b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.h
index 8dda765..ce7cf53 100644
--- a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.h
+++ b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.h

@@ -55,6 +55,7 @@
   CSSValueID text_align;
   CSSValueID writing_mode;
   float snap_to_lines_position;
+  int line_align;
 };
 
 class VTTCueBox final : public HTMLDivElement {
@@ -74,6 +75,7 @@
   // non-snap-to-lines layout where no adjustment should take place.
   // This is set in applyCSSProperties and propagated to LayoutVTTCue.
   float snap_to_lines_position_;
+  int line_align_;
 };
 
 class VTTCue final : public TextTrackCue {
@@ -101,9 +103,15 @@
   void line(DoubleOrAutoKeyword&) const;
   void setLine(const DoubleOrAutoKeyword&);
 
+  const String& lineAlign() const;
+  void setLineAlign(const String&);
+
   void position(DoubleOrAutoKeyword&) const;
   void setPosition(const DoubleOrAutoKeyword&, ExceptionState&);
 
+  const String& positionAlign() const;
+  void setPositionAlign(const String&);
+
   double size() const { return cue_size_; }
   void setSize(double, ExceptionState&);
 
@@ -126,7 +134,7 @@
 
   void RemoveDisplayTree(RemovalNotification) override;
 
-  float CalculateComputedLinePosition() const;
+  float CalculateComputedLine() const;
 
   enum WritingDirection {
     kHorizontal = 0,
@@ -136,7 +144,7 @@
   };
   WritingDirection GetWritingDirection() const { return writing_direction_; }
 
-  enum CueAlignment {
+  enum class TextAlignment {
     kStart = 0,
     kCenter,
     kEnd,
@@ -144,7 +152,13 @@
     kRight,
     kNumberOfAlignments
   };
-  CueAlignment GetCueAlignment() const { return cue_alignment_; }
+  TextAlignment GetTextAlignment() const { return text_alignment_; }
+
+  enum class PositionAlignment { kLineLeft, kCenter, kLineRight, kAuto };
+  PositionAlignment GetPositionAlignment() const { return position_alignment_; }
+
+  enum class LineAlignment { kStart, kCenter, kEnd };
+  LineAlignment GetLineAlignment() const { return line_alignment_; }
 
   ExecutionContext* GetExecutionContext() const override;
 
@@ -171,8 +185,9 @@
   bool TextPositionIsAuto() const;
 
   VTTDisplayParameters CalculateDisplayParameters() const;
-  float CalculateComputedTextPosition() const;
-  CueAlignment CalculateComputedCueAlignment() const;
+  float CalculateComputedPosition() const;
+  LineAlignment CalculateComputedLineAlignment() const;
+  PositionAlignment CalculateComputedPositionAlignment() const;
 
   enum CueSetting {
     kNone,
@@ -190,7 +205,9 @@
   float text_position_;
   float cue_size_;
   WritingDirection writing_direction_;
-  CueAlignment cue_alignment_;
+  TextAlignment text_alignment_;
+  PositionAlignment position_alignment_;
+  LineAlignment line_alignment_;
 
   Member<VTTRegion> region_;
   Member<DocumentFragment> vtt_node_tree_;

diff --git a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.idl b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.idl
index 060ab772..48df964c 100644
--- a/third_party/WebKit/Source/core/html/track/vtt/VTTCue.idl
+++ b/third_party/WebKit/Source/core/html/track/vtt/VTTCue.idl

@@ -30,9 +30,10 @@
 // https://w3c.github.io/webvtt/#the-vttcue-interface
 
 enum AutoKeyword { "auto" };
+typedef (double or AutoKeyword) LineAndPositionSetting;
 enum DirectionSetting { "" /* horizontal */, "rl", "lr" };
-// enum LineAlignSetting { "start", "middle", "end" };
-// enum PositionAlignSetting { "start", "middle", "end", "auto" };
+enum LineAlignSetting { "start", "center", "end" };
+enum PositionAlignSetting { "line-left", "center", "line-right", "auto" };
 enum AlignSetting { "start", "center", "end", "left", "right" };
 
 [
@@ -42,10 +43,10 @@
     [RuntimeEnabled=WebVTTRegions] attribute VTTRegion? region;
     attribute DirectionSetting vertical;
     attribute boolean snapToLines;
-    attribute (double or AutoKeyword) line;
-    // attribute LineAlignSetting lineAlign;
-    [RaisesException=Setter] attribute (double or AutoKeyword) position;
-    // attribute PositionAlignSetting positionAlign;
+    attribute LineAndPositionSetting line;
+    attribute LineAlignSetting lineAlign;
+    [RaisesException=Setter] attribute LineAndPositionSetting position;
+    attribute PositionAlignSetting positionAlign;
     [RaisesException=Setter] attribute double size;
     attribute AlignSetting align;
     attribute DOMString text;

diff --git a/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp
index 202a06ed..4f04520 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorOverlayAgent.cpp

@@ -948,7 +948,7 @@
           ->GetScriptController()
           .ExecuteScriptInMainWorldAndReturnValue(
               ScriptSourceCode(script, ScriptSourceLocationType::kInspector),
-              ScriptFetchOptions(),
+              KURL(), ScriptFetchOptions(),
               ScriptController::kExecuteScriptWhenScriptsDisabled);
   return ToCoreStringWithUndefinedOrNullCheck(string);
 }

diff --git a/third_party/WebKit/Source/core/layout/LayoutVTTCue.cpp b/third_party/WebKit/Source/core/layout/LayoutVTTCue.cpp
index a46f033..c0fa4525 100644
--- a/third_party/WebKit/Source/core/layout/LayoutVTTCue.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutVTTCue.cpp

@@ -89,7 +89,7 @@
   if (IsFlippedBlocksWritingMode(writing_mode))
     line_position = -(line_position + 1);
 
-  // 9. Let position be the result of multiplying step and line offset.
+  // 9. Let position be the result of multiplying step and line.
   LayoutUnit position = step * line_position;
 
   // 10. Vertical Growing Left: Decrease position by the width of the
@@ -148,7 +148,7 @@
 bool SnapToLinesLayouter::ShouldSwitchDirection(InlineFlowBox* first_line_box,
                                                 LayoutUnit step,
                                                 LayoutUnit margin) const {
-  // 17. Horizontal: If step is negative and the top of the first line box in
+  // 16. Horizontal: If step is negative and the top of the first line box in
   // boxes is now above the top of the title area, or if step is positive and
   // the bottom of the first line box in boxes is now below the bottom of the
   // title area, jump to the step labeled switch direction.
@@ -167,7 +167,7 @@
 }
 
 void SnapToLinesLayouter::UpdateLayout() {
-  // http://dev.w3.org/html5/webvtt/#dfn-apply-webvtt-cue-settings
+  // https://w3c.github.io/webvtt/#apply-webvtt-cue-settings
   // Step 13, "If cue's text track cue snap-to-lines flag is set".
 
   InlineFlowBox* first_line_box = FindFirstLineBox();
@@ -236,11 +236,8 @@
   // boxes in output, and all of the boxes in output are entirely within the
   // title area box, then jump to the step labeled done positioning below.
   while (IsOutside(title_area) || IsOverlapping()) {
-    // 16. Let current position score be the percentage of the area of the
-    // bounding box of the boxes in boxes that is outside the title area
-    // box.
     if (!ShouldSwitchDirection(first_line_box, step, margin)) {
-      // 18. Horizontal: Move all the boxes in boxes down by the distance
+      // 17. Horizontal: Move all the boxes in boxes down by the distance
       // given by step. (If step is negative, then this will actually
       // result in an upwards movement of the boxes in absolute terms.)
       // Vertical: Move all the boxes in boxes right by the distance
@@ -248,11 +245,11 @@
       // result in a leftwards movement of the boxes in absolute terms.)
       MoveBoxesBy(step);
 
-      // 19. Jump back to the step labeled step loop.
+      // 18. Jump back to the step labeled step loop.
       continue;
     }
 
-    // 20. Switch direction: If switched is true, then remove all the boxes
+    // 19. Switch direction: If switched is true, then remove all the boxes
     // in boxes, and jump to the step labeled done positioning below.
     if (switched) {
       // This does not "remove" the boxes, but rather just pushes them
@@ -262,54 +259,68 @@
       break;
     }
 
-    // 21. Otherwise, move all the boxes in boxes back to their specified
+    // 20. Otherwise, move all the boxes in boxes back to their specified
     // position as determined in the earlier step.
     cue_box_.SetLocation(specified_position_);
 
-    // 22. Negate step.
+    // 21. Negate step.
     step = -step;
 
-    // 23. Set switched to true.
+    // 22. Set switched to true.
     switched = true;
 
-    // 24. Jump back to the step labeled step loop.
+    // 23. Jump back to the step labeled step loop.
   }
 }
 
 }  // unnamed namespace
 
-LayoutVTTCue::LayoutVTTCue(ContainerNode* node, float snap_to_lines_position)
-    : LayoutBlockFlow(node), snap_to_lines_position_(snap_to_lines_position) {}
+LayoutVTTCue::LayoutVTTCue(ContainerNode* node,
+                           float snap_to_lines_position,
+                           int line_align)
+    : LayoutBlockFlow(node),
+      snap_to_lines_position_(snap_to_lines_position),
+      line_align_(line_align) {}
 
 void LayoutVTTCue::RepositionCueSnapToLinesNotSet() {
-  // FIXME: Implement overlapping detection when snap-to-lines is not set.
-  // http://wkb.ug/84296
-
-  // http://dev.w3.org/html5/webvtt/#dfn-apply-webvtt-cue-settings
+  // https://w3c.github.io/webvtt/#apply-webvtt-cue-settings
   // Step 13, "If cue's text track cue snap-to-lines flag is not set".
 
-  // 1. Let bounding box be the bounding box of the boxes in boxes.
+  if (line_align_) {
+    // 1. Let bounding box be the bounding box of the boxes in boxes.
+    LayoutRect bounding_box = ContentBoxRect();
 
-  // 2. Run the appropriate steps from the following list:
-  //    If the text track cue writing direction is horizontal
-  //       If the text track cue line alignment is middle alignment
-  //          Move all the boxes in boxes up by half of the height of
-  //          bounding box.
-  //       If the text track cue line alignment is end alignment
-  //          Move all the boxes in boxes up by the height of bounding box.
-  //
-  //    If the text track cue writing direction is vertical growing left or
-  //    vertical growing right
-  //       If the text track cue line alignment is middle alignment
-  //          Move all the boxes in boxes left by half of the width of
-  //          bounding box.
-  //       If the text track cue line alignment is end alignment
-  //          Move all the boxes in boxes left by the width of bounding box.
+    WritingMode writing_mode = StyleRef().GetWritingMode();
+    LayoutUnit extent = blink::IsHorizontalWritingMode(writing_mode)
+                            ? bounding_box.Height()
+                            : bounding_box.Width();
+    // 2. Run the appropriate steps from the following list:
+    //    If the text track cue writing direction is horizontal
+    //       If the text track cue line alignment is center alignment
+    //          Move all the boxes in boxes up by half of the height of
+    //          bounding box.
+    //       If the text track cue line alignment is end alignment
+    //          Move all the boxes in boxes up by the height of bounding box.
+    //
+    //    If the text track cue writing direction is vertical growing left or
+    //    vertical growing right
+    //       If the text track cue line alignment is center alignment
+    //          Move all the boxes in boxes left by half of the width of
+    //          bounding box.
+    //       If the text track cue line alignment is end alignment
+    //          Move all the boxes in boxes left by the width of bounding box.
+    LayoutUnit fraction(line_align_);
+    fraction /= 100;
+    SetLogicalTop(LogicalTop() - extent * fraction);
+  }
 
   // 3. If none of the boxes in boxes would overlap any of the boxes in
   // output, and all the boxes in output are within the video's rendering
   // area, then jump to the step labeled done positioning below.
 
+  // FIXME: Implement overlapping detection when snap-to-lines is not set.
+  // http://wkb.ug/84296
+
   // 4. If there is a position to which the boxes in boxes can be moved while
   // maintaining the relative positions of the boxes in boxes to each other
   // such that none of the boxes in boxes would overlap any of the boxes in
@@ -365,7 +376,7 @@
 
   LayoutState state(*this);
 
-  // http://dev.w3.org/html5/webvtt/#dfn-apply-webvtt-cue-settings - step 13.
+  // https://w3c.github.io/webvtt/#apply-webvtt-cue-settings - step 13.
   if (!std::isnan(snap_to_lines_position_))
     SnapToLinesLayouter(*this, ComputeControlsRect()).UpdateLayout();
   else

diff --git a/third_party/WebKit/Source/core/layout/LayoutVTTCue.h b/third_party/WebKit/Source/core/layout/LayoutVTTCue.h
index 59b71e39..489da0d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutVTTCue.h
+++ b/third_party/WebKit/Source/core/layout/LayoutVTTCue.h

@@ -34,7 +34,7 @@
 
 class LayoutVTTCue final : public LayoutBlockFlow {
  public:
-  LayoutVTTCue(ContainerNode*, float snap_to_lines_position);
+  LayoutVTTCue(ContainerNode*, float snap_to_lines_position, int line_align);
 
   // The computed line position for snap-to-lines layout, and NaN for
   // non-snap-to-lines layout where no adjustment should take place.
@@ -47,6 +47,7 @@
   void RepositionCueSnapToLinesNotSet();
 
   float snap_to_lines_position_;
+  int line_align_;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index cfe3ffa..7cbd8b9 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

@@ -118,14 +118,13 @@
 static const int kMaxCORSRedirects = 20;
 
 void DocumentThreadableLoader::LoadResourceSynchronously(
-    Document& document,
+    ThreadableLoadingContext& loading_context,
     const ResourceRequest& request,
     ThreadableLoaderClient& client,
     const ThreadableLoaderOptions& options,
     const ResourceLoaderOptions& resource_loader_options) {
-  (new DocumentThreadableLoader(*ThreadableLoadingContext::Create(document),
-                                &client, kLoadSynchronously, options,
-                                resource_loader_options))
+  (new DocumentThreadableLoader(loading_context, &client, kLoadSynchronously,
+                                options, resource_loader_options))
       ->Start(request);
 }
 
@@ -1245,9 +1244,14 @@
     ResourceLoaderOptions resource_loader_options) {
   FetchParameters fetch_params(request, resource_loader_options);
   if (request.GetFetchRequestMode() ==
-      network::mojom::FetchRequestMode::kNoCORS)
+      network::mojom::FetchRequestMode::kNoCORS) {
     fetch_params.SetOriginRestriction(FetchParameters::kNoOriginRestriction);
-  Resource* resource = RawResource::FetchSynchronously(
+  }
+  if (options_.timeout_milliseconds > 0) {
+    fetch_params.MutableResourceRequest().SetTimeoutInterval(
+        options_.timeout_milliseconds / 1000.0);
+  }
+  RawResource* resource = RawResource::FetchSynchronously(
       fetch_params, loading_context_->GetResourceFetcher());
   ResourceResponse response =
       resource ? resource->GetResponse() : ResourceResponse();
@@ -1312,6 +1316,12 @@
   if (!client_)
     return;
 
+  WTF::Optional<int64_t> downloaded_file_length =
+      resource->DownloadedFileLength();
+  if (downloaded_file_length) {
+    client_->DidDownloadData(*downloaded_file_length);
+  }
+
   HandleSuccessfulFinish(identifier, 0.0);
 }
 

diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
index 958c3f5..2903c5d4 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h

@@ -61,7 +61,7 @@
   USING_GARBAGE_COLLECTED_MIXIN(DocumentThreadableLoader);
 
  public:
-  static void LoadResourceSynchronously(Document&,
+  static void LoadResourceSynchronously(ThreadableLoadingContext&,
                                         const ResourceRequest&,
                                         ThreadableLoaderClient&,
                                         const ThreadableLoaderOptions&,

diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp
index 2238f73..b5296c33 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp

@@ -67,14 +67,15 @@
     const ThreadableLoaderOptions& options,
     const ResourceLoaderOptions& resource_loader_options) {
   if (context.IsWorkerGlobalScope()) {
-    WorkerThreadableLoader::LoadResourceSynchronously(
-        ToWorkerGlobalScope(context), request, client, options,
-        resource_loader_options);
+    DocumentThreadableLoader::LoadResourceSynchronously(
+        *ThreadableLoadingContext::Create(*ToWorkerGlobalScope(&context)),
+        request, client, options, resource_loader_options);
     return;
   }
 
   DocumentThreadableLoader::LoadResourceSynchronously(
-      ToDocument(context), request, client, options, resource_loader_options);
+      *ThreadableLoadingContext::Create(*ToDocument(&context)), request, client,
+      options, resource_loader_options);
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp b/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp
index a0685353..4dcd1a8 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp

@@ -234,6 +234,9 @@
  public:
   WebWorkerFetchContextForTest(KURL site_for_cookies)
       : site_for_cookies_(site_for_cookies.Copy()) {}
+
+  base::WaitableEvent* GetTerminateSyncLoadEvent() override { return nullptr; }
+
   void InitializeOnWorkerThread(
       scoped_refptr<base::SingleThreadTaskRunner>) override {}
 

diff --git a/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp b/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp
index 1ae03e8..9999878 100644
--- a/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp
+++ b/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp

@@ -254,6 +254,16 @@
     InstanceCounters::DecrementCounter(InstanceCounters::kUACSSResourceCounter);
 }
 
+void ImageResource::OnMemoryDump(WebMemoryDumpLevelOfDetail level_of_detail,
+                                 WebProcessMemoryDump* memory_dump) const {
+  Resource::OnMemoryDump(level_of_detail, memory_dump);
+  const String name = GetMemoryDumpName() + "/image_content";
+  auto* dump = memory_dump->CreateMemoryAllocatorDump(name);
+  size_t encoded_size =
+      content_->HasImage() ? content_->GetImage()->Data()->size() : 0;
+  dump->AddScalar("size", "bytes", encoded_size);
+}
+
 void ImageResource::Trace(blink::Visitor* visitor) {
   visitor->Trace(multipart_parser_);
   visitor->Trace(content_);

diff --git a/third_party/WebKit/Source/core/loader/resource/ImageResource.h b/third_party/WebKit/Source/core/loader/resource/ImageResource.h
index d0d426a..183deca 100644
--- a/third_party/WebKit/Source/core/loader/resource/ImageResource.h
+++ b/third_party/WebKit/Source/core/loader/resource/ImageResource.h

@@ -102,6 +102,9 @@
   // flag it so that it can persist beyond navigation.
   void FlagAsUserAgentResource();
 
+  void OnMemoryDump(WebMemoryDumpLevelOfDetail,
+                    WebProcessMemoryDump*) const override;
+
   void Trace(blink::Visitor*) override;
 
  private:

diff --git a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp
index 670c7ce..646cb2b 100644
--- a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp
+++ b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.cpp

@@ -133,11 +133,9 @@
     return nullptr;
   }
   scoped_refptr<Image> image = context_->GetImage(hint, reason);
-  if (!image) {
-    *status = kInvalidSourceImageStatus;
-  } else {
-    *status = kNormalSourceImageStatus;
-  }
+  if (!image)
+    image = CreateTransparentImage(Size());
+  *status = image ? kNormalSourceImageStatus : kInvalidSourceImageStatus;
   return image;
 }
 
@@ -218,12 +216,6 @@
   return origin_clean_ && !disable_reading_from_canvas_;
 }
 
-bool OffscreenCanvas::IsPaintable() const {
-  if (!context_)
-    return IsValidImageSize(size_);
-  return context_->IsPaintable() && size_.Width() && size_.Height();
-}
-
 bool OffscreenCanvas::IsAccelerated() const {
   return context_ && context_->IsAccelerated();
 }
@@ -379,31 +371,35 @@
     return exception_state.Reject(script_state);
   }
 
-  if (!this->IsPaintable()) {
-    exception_state.ThrowDOMException(
-        kIndexSizeError, "The size of the OffscreenCanvas is zero.");
-    return exception_state.Reject(script_state);
-  }
+  ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
+  ScriptPromise promise = resolver->Promise();
 
-  if (!this->context_) {
-    exception_state.ThrowDOMException(
-        kInvalidStateError, "OffscreenCanvas object has no rendering contexts");
-    return exception_state.Reject(script_state);
+  if (!IsPaintable() || size_.IsEmpty()) {
+    Blob* blob = nullptr;
+    resolver->Resolve(blob);
+    return promise;
   }
 
   double start_time = WTF::CurrentTimeTicksInSeconds();
-  String encoding_mime_type = ImageEncoderUtils::ToEncodingMimeType(
-      options.type(), ImageEncoderUtils::kEncodeReasonConvertToBlobPromise);
 
-  ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   CanvasAsyncBlobCreator* async_creator = nullptr;
   scoped_refptr<StaticBitmapImage> snapshot =
-      context_->GetImage(kPreferNoAcceleration, kSnapshotReasonUnknown);
-  async_creator = CanvasAsyncBlobCreator::Create(
-      snapshot, encoding_mime_type, start_time,
-      ExecutionContext::From(script_state), resolver);
-  async_creator->ScheduleAsyncBlobCreation(options.quality());
-  return resolver->Promise();
+      context_
+          ? context_->GetImage(kPreferNoAcceleration, kSnapshotReasonUnknown)
+          : CreateTransparentImage(size_);
+  if (snapshot) {
+    String encoding_mime_type = ImageEncoderUtils::ToEncodingMimeType(
+        options.type(), ImageEncoderUtils::kEncodeReasonConvertToBlobPromise);
+    async_creator = CanvasAsyncBlobCreator::Create(
+        snapshot, encoding_mime_type, start_time,
+        ExecutionContext::From(script_state), resolver);
+    async_creator->ScheduleAsyncBlobCreation(options.quality());
+  } else {
+    Blob* blob = nullptr;
+    resolver->Resolve(blob);
+  }
+
+  return promise;
 }
 
 FontSelector* OffscreenCanvas::GetFontSelector() {

diff --git a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h
index c1f653a2..bdfc90c 100644
--- a/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h
+++ b/third_party/WebKit/Source/core/offscreencanvas/OffscreenCanvas.h

@@ -74,7 +74,6 @@
       ExecutionContext*,
       const String&,
       const CanvasContextCreationAttributes&);
-  CanvasRenderingContext* RenderingContext() { return context_; }
 
   static void RegisterRenderingContextFactory(
       std::unique_ptr<CanvasRenderingContextFactory>);
@@ -104,6 +103,7 @@
                        ExceptionState&) override;
   void FinalizeFrame() override;
   void DetachContext() override { context_ = nullptr; }
+  CanvasRenderingContext* RenderingContext() const override { return context_; }
 
   // OffscreenCanvasFrameDispatcherClient implementation
   void BeginFrame() final;
@@ -178,8 +178,6 @@
   bool origin_clean_ = true;
   bool disable_reading_from_canvas_ = false;
 
-  bool IsPaintable() const;
-
   std::unique_ptr<OffscreenCanvasFrameDispatcher> frame_dispatcher_;
 
   Member<ScriptPromiseResolver> commit_promise_resolver_;

diff --git a/third_party/WebKit/Source/core/resize_observer/ResizeObserver.cpp b/third_party/WebKit/Source/core/resize_observer/ResizeObserver.cpp
index b989cb2e..dec3b27 100644
--- a/third_party/WebKit/Source/core/resize_observer/ResizeObserver.cpp
+++ b/third_party/WebKit/Source/core/resize_observer/ResizeObserver.cpp

@@ -109,6 +109,14 @@
   HeapVector<Member<ResizeObserverEntry>> entries;
 
   for (auto& observation : active_observations_) {
+    // In case that the observer and the target belong to different execution
+    // contexts and the target's execution context is already gone, then skip
+    // such a target.
+    ExecutionContext* execution_context =
+        observation->Target()->GetExecutionContext();
+    if (!execution_context || execution_context->IsContextDestroyed())
+      continue;
+
     LayoutPoint location = observation->ComputeTargetLocation();
     LayoutSize size = observation->ComputeTargetSize();
     observation->SetObservationSize(size);
@@ -130,6 +138,16 @@
     auto entry = new ResizeObserverEntry(observation->Target(), content_rect);
     entries.push_back(entry);
   }
+
+  if (entries.size() == 0) {
+    // No entry to report.
+    // Note that, if |active_observations_| is not empty but |entries| is empty,
+    // it means that it's possible that no target element is making |callback_|
+    // alive. In this case, we must not touch |callback_|.
+    ClearObservations();
+    return;
+  }
+
   DCHECK(callback_ || delegate_);
   if (callback_)
     callback_->InvokeAndReportException(this, entries, this);

diff --git a/third_party/WebKit/Source/core/resize_observer/ResizeObserverTest.cpp b/third_party/WebKit/Source/core/resize_observer/ResizeObserverTest.cpp
index 1513485..d72d5e2 100644
--- a/third_party/WebKit/Source/core/resize_observer/ResizeObserverTest.cpp
+++ b/third_party/WebKit/Source/core/resize_observer/ResizeObserverTest.cpp

@@ -116,12 +116,12 @@
   // Test whether ResizeObserver is kept alive by direct JS reference
   //
   script_controller.ExecuteScriptInMainWorldAndReturnValue(
-      ScriptSourceCode("var ro = new ResizeObserver( entries => {});"),
+      ScriptSourceCode("var ro = new ResizeObserver( entries => {});"), KURL(),
       ScriptFetchOptions(),
       ScriptController::kExecuteScriptWhenScriptsDisabled);
   ASSERT_EQ(observers.size(), 1U);
   script_controller.ExecuteScriptInMainWorldAndReturnValue(
-      ScriptSourceCode("ro = undefined;"), ScriptFetchOptions(),
+      ScriptSourceCode("ro = undefined;"), KURL(), ScriptFetchOptions(),
       ScriptController::kExecuteScriptWhenScriptsDisabled);
   V8GCController::CollectAllGarbageForTesting(v8::Isolate::GetCurrent());
   WebHeap::CollectAllGarbageForTesting();
@@ -135,14 +135,14 @@
                        "var el = document.createElement('div');"
                        "ro.observe(el);"
                        "ro = undefined;"),
-      ScriptFetchOptions(),
+      KURL(), ScriptFetchOptions(),
       ScriptController::kExecuteScriptWhenScriptsDisabled);
   ASSERT_EQ(observers.size(), 1U);
   V8GCController::CollectAllGarbageForTesting(v8::Isolate::GetCurrent());
   WebHeap::CollectAllGarbageForTesting();
   ASSERT_EQ(observers.size(), 1U);
   script_controller.ExecuteScriptInMainWorldAndReturnValue(
-      ScriptSourceCode("el = undefined;"), ScriptFetchOptions(),
+      ScriptSourceCode("el = undefined;"), KURL(), ScriptFetchOptions(),
       ScriptController::kExecuteScriptWhenScriptsDisabled);
   V8GCController::CollectAllGarbageForTesting(v8::Isolate::GetCurrent());
   WebHeap::CollectAllGarbageForTesting();

diff --git a/third_party/WebKit/Source/core/script/ClassicPendingScript.cpp b/third_party/WebKit/Source/core/script/ClassicPendingScript.cpp
index 6a477c4e..847569ea 100644
--- a/third_party/WebKit/Source/core/script/ClassicPendingScript.cpp
+++ b/third_party/WebKit/Source/core/script/ClassicPendingScript.cpp

@@ -74,6 +74,7 @@
     bool is_external)
     : PendingScript(element, starting_position),
       options_(options),
+      base_url_(element->GetDocument().BaseURL()),
       source_location_type_(source_location_type),
       is_external_(is_external),
       ready_state_(is_external ? kWaitingForResource : kReady),
@@ -235,7 +236,8 @@
     ScriptSourceCode source_code(
         GetElement()->TextFromChildren(), source_location_type_,
         nullptr /* cache_handler */, document_url, StartingPosition());
-    return ClassicScript::Create(source_code, options_, kSharableCrossOrigin);
+    return ClassicScript::Create(source_code, base_url_, options_,
+                                 kSharableCrossOrigin);
   }
 
   DCHECK(GetResource()->IsLoaded());
@@ -243,7 +245,7 @@
   bool streamer_ready = (ready_state_ == kReady) && streamer_ &&
                         !streamer_->StreamingSuppressed();
   ScriptSourceCode source_code(streamer_ready ? streamer_ : nullptr, resource);
-  return ClassicScript::Create(source_code, options_,
+  return ClassicScript::Create(source_code, base_url_, options_,
                                resource->CalculateAccessControlStatus());
 }
 

diff --git a/third_party/WebKit/Source/core/script/ClassicPendingScript.h b/third_party/WebKit/Source/core/script/ClassicPendingScript.h
index 3ab5258..1f25af50 100644
--- a/third_party/WebKit/Source/core/script/ClassicPendingScript.h
+++ b/third_party/WebKit/Source/core/script/ClassicPendingScript.h

@@ -114,6 +114,12 @@
 
   const ScriptFetchOptions options_;
 
+  // "base url" snapshot taken at #prepare-a-script timing.
+  // https://html.spec.whatwg.org/#prepare-a-script
+  // which will eventually be used as #concept-script-base-url.
+  // https://html.spec.whatwg.org/multipage/webappapis.html#concept-script-base-url
+  const KURL base_url_;
+
   const ScriptSourceLocationType source_location_type_;
   const bool is_external_;
   ReadyState ready_state_;

diff --git a/third_party/WebKit/Source/core/script/ClassicScript.cpp b/third_party/WebKit/Source/core/script/ClassicScript.cpp
index adecbb7e..1ebb5c3 100644
--- a/third_party/WebKit/Source/core/script/ClassicScript.cpp
+++ b/third_party/WebKit/Source/core/script/ClassicScript.cpp

@@ -17,7 +17,7 @@
 void ClassicScript::RunScript(LocalFrame* frame,
                               const SecurityOrigin* security_origin) const {
   frame->GetScriptController().ExecuteScriptInMainWorld(
-      GetScriptSourceCode(), FetchOptions(), access_control_status_);
+      GetScriptSourceCode(), BaseURL(), FetchOptions(), access_control_status_);
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/script/ClassicScript.h b/third_party/WebKit/Source/core/script/ClassicScript.h
index a499443..3a54b39 100644
--- a/third_party/WebKit/Source/core/script/ClassicScript.h
+++ b/third_party/WebKit/Source/core/script/ClassicScript.h

@@ -17,9 +17,10 @@
 class CORE_EXPORT ClassicScript final : public Script {
  public:
   static ClassicScript* Create(const ScriptSourceCode& script_source_code,
+                               const KURL& base_url,
                                const ScriptFetchOptions& fetch_options,
                                AccessControlStatus access_control_status) {
-    return new ClassicScript(script_source_code, fetch_options,
+    return new ClassicScript(script_source_code, base_url, fetch_options,
                              access_control_status);
   }
 
@@ -31,10 +32,10 @@
 
  private:
   ClassicScript(const ScriptSourceCode& script_source_code,
+                const KURL& base_url,
                 const ScriptFetchOptions& fetch_options,
                 AccessControlStatus access_control_status)
-      // TODO(kouhei): This should be document.BaseURL() instead.
-      : Script(fetch_options, script_source_code.Url()),
+      : Script(fetch_options, base_url),
         script_source_code_(script_source_code),
         access_control_status_(access_control_status) {}
 

diff --git a/third_party/WebKit/Source/core/script/DynamicModuleResolverTest.cpp b/third_party/WebKit/Source/core/script/DynamicModuleResolverTest.cpp
index 247bb15b..bc0f451 100644
--- a/third_party/WebKit/Source/core/script/DynamicModuleResolverTest.cpp
+++ b/third_party/WebKit/Source/core/script/DynamicModuleResolverTest.cpp

@@ -155,15 +155,15 @@
   String message_;
 };
 
-class NotReached final : public ScriptFunction {
+class DynamicModuleResolverTestNotReached final : public ScriptFunction {
  public:
   static v8::Local<v8::Function> CreateFunction(ScriptState* script_state) {
-    auto not_reached = new NotReached(script_state);
+    auto not_reached = new DynamicModuleResolverTestNotReached(script_state);
     return not_reached->BindToV8Function();
   }
 
  private:
-  explicit NotReached(ScriptState* script_state)
+  explicit DynamicModuleResolverTestNotReached(ScriptState* script_state)
       : ScriptFunction(script_state) {}
 
   ScriptValue Call(ScriptValue) override {
@@ -185,7 +185,8 @@
   auto capture =
       new CaptureExportedStringFunction(scope.GetScriptState(), "foo");
   promise.Then(capture->Bind(),
-               NotReached::CreateFunction(scope.GetScriptState()));
+               DynamicModuleResolverTestNotReached::CreateFunction(
+                   scope.GetScriptState()));
 
   auto resolver = DynamicModuleResolver::Create(modulator);
   resolver->ResolveDynamically("./dependency.js", TestReferrerURL(),
@@ -217,7 +218,8 @@
   ScriptPromise promise = promise_resolver->Promise();
 
   auto capture = new CaptureErrorFunction(scope.GetScriptState());
-  promise.Then(NotReached::CreateFunction(scope.GetScriptState()),
+  promise.Then(DynamicModuleResolverTestNotReached::CreateFunction(
+                   scope.GetScriptState()),
                capture->Bind());
 
   auto resolver = DynamicModuleResolver::Create(modulator);
@@ -239,7 +241,8 @@
   ScriptPromise promise = promise_resolver->Promise();
 
   auto capture = new CaptureErrorFunction(scope.GetScriptState());
-  promise.Then(NotReached::CreateFunction(scope.GetScriptState()),
+  promise.Then(DynamicModuleResolverTestNotReached::CreateFunction(
+                   scope.GetScriptState()),
                capture->Bind());
 
   auto resolver = DynamicModuleResolver::Create(modulator);
@@ -265,7 +268,8 @@
   ScriptPromise promise = promise_resolver->Promise();
 
   auto capture = new CaptureErrorFunction(scope.GetScriptState());
-  promise.Then(NotReached::CreateFunction(scope.GetScriptState()),
+  promise.Then(DynamicModuleResolverTestNotReached::CreateFunction(
+                   scope.GetScriptState()),
                capture->Bind());
 
   auto resolver = DynamicModuleResolver::Create(modulator);
@@ -302,7 +306,8 @@
   auto capture =
       new CaptureExportedStringFunction(scope.GetScriptState(), "foo");
   promise.Then(capture->Bind(),
-               NotReached::CreateFunction(scope.GetScriptState()));
+               DynamicModuleResolverTestNotReached::CreateFunction(
+                   scope.GetScriptState()));
 
   auto resolver = DynamicModuleResolver::Create(modulator);
   resolver->ResolveDynamically("./dependency.js", /* null referrer */ KURL(),

diff --git a/third_party/WebKit/Source/core/streams/ReadableStreamOperationsTest.cpp b/third_party/WebKit/Source/core/streams/ReadableStreamOperationsTest.cpp
index 8258716..2dbb64b 100644
--- a/third_party/WebKit/Source/core/streams/ReadableStreamOperationsTest.cpp
+++ b/third_party/WebKit/Source/core/streams/ReadableStreamOperationsTest.cpp

@@ -24,21 +24,22 @@
 
 namespace {
 
-class NotReached : public ScriptFunction {
+class ReadableStreamOperationsTestNotReached : public ScriptFunction {
  public:
   static v8::Local<v8::Function> CreateFunction(ScriptState* script_state) {
-    NotReached* self = new NotReached(script_state);
+    ReadableStreamOperationsTestNotReached* self =
+        new ReadableStreamOperationsTestNotReached(script_state);
     return self->BindToV8Function();
   }
 
  private:
-  explicit NotReached(ScriptState* script_state)
+  explicit ReadableStreamOperationsTestNotReached(ScriptState* script_state)
       : ScriptFunction(script_state) {}
 
   ScriptValue Call(ScriptValue) override;
 };
 
-ScriptValue NotReached::Call(ScriptValue) {
+ScriptValue ReadableStreamOperationsTestNotReached::Call(ScriptValue) {
   EXPECT_TRUE(false) << "'Unreachable' code was reached";
   return ScriptValue();
 }
@@ -263,10 +264,12 @@
   Iteration* it2 = new Iteration();
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it1),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it2),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
 
   v8::MicrotasksScope::PerformCheckpoint(scope.GetIsolate());
   EXPECT_FALSE(it1->IsSet());
@@ -328,13 +331,16 @@
   Iteration* it3 = new Iteration();
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it1),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it2),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it3),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
 
   v8::MicrotasksScope::PerformCheckpoint(scope.GetIsolate());
 
@@ -475,10 +481,12 @@
   Iteration* it2 = new Iteration();
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader1)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it1),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
   ReadableStreamOperations::DefaultReaderRead(scope.GetScriptState(), reader2)
       .Then(ReaderFunction::CreateFunction(scope.GetScriptState(), it2),
-            NotReached::CreateFunction(scope.GetScriptState()));
+            ReadableStreamOperationsTestNotReached::CreateFunction(
+                scope.GetScriptState()));
 
   v8::MicrotasksScope::PerformCheckpoint(scope.GetIsolate());
   EXPECT_FALSE(it1->IsSet());

diff --git a/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.cpp b/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.cpp
index a6ed380..072059a 100644
--- a/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.cpp
+++ b/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.cpp

@@ -4,6 +4,7 @@
 
 #include "core/workers/ThreadedMessagingProxyBase.h"
 
+#include "base/synchronization/waitable_event.h"
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/frame/Deprecation.h"
@@ -48,6 +49,8 @@
     std::unique_ptr<WebWorkerFetchContext> web_worker_fetch_context =
         web_frame->Client()->CreateWorkerFetchContext();
     DCHECK(web_worker_fetch_context);
+    terminate_sync_load_event_ =
+        web_worker_fetch_context->GetTerminateSyncLoadEvent();
     web_worker_fetch_context->SetApplicationCacheHostID(
         document->Fetcher()->Context().ApplicationCacheHostID());
     web_worker_fetch_context->SetIsOnSubframe(
@@ -146,6 +149,11 @@
     return;
   asked_to_terminate_ = true;
 
+  if (terminate_sync_load_event_) {
+    terminate_sync_load_event_->Signal();
+    terminate_sync_load_event_ = nullptr;
+  }
+
   if (worker_thread_)
     worker_thread_->Terminate();
 

diff --git a/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.h b/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.h
index 68526c2..5870f670 100644
--- a/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.h
+++ b/third_party/WebKit/Source/core/workers/ThreadedMessagingProxyBase.h

@@ -16,6 +16,12 @@
 #include "platform/wtf/Forward.h"
 #include "platform/wtf/Optional.h"
 
+namespace base {
+
+class WaitableEvent;
+
+}  // namespace base
+
 namespace blink {
 
 class ExecutionContext;
@@ -103,6 +109,8 @@
 
   bool asked_to_terminate_;
 
+  base::WaitableEvent* terminate_sync_load_event_ = nullptr;
+
   // Used to keep this alive until the worker thread gets terminated. This is
   // necessary because the co-owner (i.e., Worker or Worklet object) can be
   // destroyed before thread termination.

diff --git a/third_party/WebKit/Source/modules/ModulesInitializer.cpp b/third_party/WebKit/Source/modules/ModulesInitializer.cpp
index 46b412b..826f6ad 100644
--- a/third_party/WebKit/Source/modules/ModulesInitializer.cpp
+++ b/third_party/WebKit/Source/modules/ModulesInitializer.cpp

@@ -38,7 +38,6 @@
 #include "modules/canvas/canvas2d/CanvasRenderingContext2D.h"
 #include "modules/canvas/imagebitmap/ImageBitmapRenderingContext.h"
 #include "modules/canvas/offscreencanvas2d/OffscreenCanvasRenderingContext2D.h"
-#include "modules/credentialmanager/CredentialManagerClient.h"
 #include "modules/csspaint/CSSPaintImageGeneratorImpl.h"
 #include "modules/device_orientation/DeviceMotionController.h"
 #include "modules/device_orientation/DeviceOrientationAbsoluteController.h"
@@ -252,13 +251,6 @@
   return HTMLMediaElementRemotePlayback::remote(html_media_element);
 }
 
-void ModulesInitializer::ProvideCredentialManagerClient(
-    Page& page,
-    WebCredentialManagerClient* web_credential_manager_client) const {
-  ::blink::ProvideCredentialManagerClientTo(
-      page, new CredentialManagerClient(web_credential_manager_client));
-}
-
 void ModulesInitializer::ProvideModulesToPage(Page& page,
                                               WebViewClient* client) const {
   MediaKeysController::ProvideMediaKeysTo(page);

diff --git a/third_party/WebKit/Source/modules/ModulesInitializer.h b/third_party/WebKit/Source/modules/ModulesInitializer.h
index 0af77ad..4718f72c 100644
--- a/third_party/WebKit/Source/modules/ModulesInitializer.h
+++ b/third_party/WebKit/Source/modules/ModulesInitializer.h

@@ -40,8 +40,6 @@
   WebRemotePlaybackClient* CreateWebRemotePlaybackClient(
       HTMLMediaElement&) const override;
 
-  void ProvideCredentialManagerClient(Page&, WebCredentialManagerClient*)
-      const override;
   void ProvideModulesToPage(Page&, WebViewClient*) const override;
   void ForceNextWebGLContextCreationToFail() const override;
 

diff --git a/third_party/WebKit/Source/modules/canvas/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
index e8a81c76..e95fb89 100644
--- a/third_party/WebKit/Source/modules/canvas/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas/offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp

@@ -138,7 +138,7 @@
 scoped_refptr<StaticBitmapImage> OffscreenCanvasRenderingContext2D::GetImage(
     AccelerationHint hint,
     SnapshotReason reason) const {
-  if (!CanCreateCanvas2DBuffer())
+  if (!HasCanvas2DBuffer())
     return nullptr;
   scoped_refptr<StaticBitmapImage> image =
       GetImageBuffer()->NewImageSnapshot(hint, reason);
@@ -197,7 +197,7 @@
 }
 
 bool OffscreenCanvasRenderingContext2D::IsPaintable() const {
-  return CanCreateCanvas2DBuffer();
+  return HasCanvas2DBuffer();
 }
 
 String OffscreenCanvasRenderingContext2D::ColorSpaceAsString() const {

diff --git a/third_party/WebKit/Source/modules/credentialmanager/BUILD.gn b/third_party/WebKit/Source/modules/credentialmanager/BUILD.gn
index 6b2fcab..7bc7d695 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/BUILD.gn
+++ b/third_party/WebKit/Source/modules/credentialmanager/BUILD.gn

@@ -14,8 +14,8 @@
     "AuthenticatorResponse.h",
     "Credential.cpp",
     "Credential.h",
-    "CredentialManagerClient.cpp",
-    "CredentialManagerClient.h",
+    "CredentialManagerProxy.cpp",
+    "CredentialManagerProxy.h",
     "CredentialManagerTypeConverters.cpp",
     "CredentialManagerTypeConverters.h",
     "CredentialsContainer.cpp",
@@ -28,7 +28,5 @@
     "PasswordCredential.h",
     "PublicKeyCredential.cpp",
     "PublicKeyCredential.h",
-    "WebAuthenticationClient.cpp",
-    "WebAuthenticationClient.h",
   ]
 }

diff --git a/third_party/WebKit/Source/modules/credentialmanager/Credential.cpp b/third_party/WebKit/Source/modules/credentialmanager/Credential.cpp
index 61df171..85ac1e9 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/Credential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/Credential.cpp

@@ -11,25 +11,25 @@
 
 Credential::~Credential() {}
 
-Credential::Credential(PlatformCredential* credential)
-    : platform_credential_(credential) {}
+Credential::Credential(const String& id, const String& type)
+    : id_(id), type_(type) {
+  DCHECK(!id_.IsEmpty());
+  DCHECK(!type_.IsEmpty());
+}
 
-Credential::Credential(const String& id)
-    : platform_credential_(PlatformCredential::Create(id)) {}
-
-KURL Credential::ParseStringAsURL(const String& url,
-                                  ExceptionState& exception_state) {
+KURL Credential::ParseStringAsURLOrThrow(const String& url,
+                                         ExceptionState& exception_state) {
   if (url.IsEmpty())
     return KURL();
   KURL parsed_url = KURL(NullURL(), url);
-  if (!parsed_url.IsValid())
+  if (!parsed_url.IsValid()) {
     exception_state.ThrowDOMException(kSyntaxError,
                                       "'" + url + "' is not a valid URL.");
+  }
   return parsed_url;
 }
 
 void Credential::Trace(blink::Visitor* visitor) {
-  visitor->Trace(platform_credential_);
   ScriptWrappable::Trace(visitor);
 }
 

diff --git a/third_party/WebKit/Source/modules/credentialmanager/Credential.h b/third_party/WebKit/Source/modules/credentialmanager/Credential.h
index b413143a..effa513 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/Credential.h
+++ b/third_party/WebKit/Source/modules/credentialmanager/Credential.h

@@ -7,9 +7,9 @@
 
 #include "modules/ModulesExport.h"
 #include "platform/bindings/ScriptWrappable.h"
-#include "platform/credentialmanager/PlatformCredential.h"
 #include "platform/heap/Handle.h"
 #include "platform/weborigin/KURL.h"
+#include "platform/wtf/text/WTFString.h"
 
 namespace blink {
 
@@ -20,26 +20,26 @@
 
  public:
   virtual ~Credential();
-
-  // Credential.idl
-  const String& id() const { return platform_credential_->Id(); }
-  const String& type() const { return platform_credential_->GetType(); }
-
   virtual void Trace(blink::Visitor*);
 
-  PlatformCredential* GetPlatformCredential() const {
-    return platform_credential_;
-  }
+  virtual bool IsPasswordCredential() const { return false; }
+  virtual bool IsFederatedCredential() const { return false; }
+  virtual bool IsPublicKeyCredential() const { return false; }
+
+  // Credential.idl
+  const String& id() const { return id_; }
+  const String& type() const { return type_; }
 
  protected:
-  Credential(PlatformCredential*);
-  Credential(const String& id);
+  Credential(const String& id, const String& type);
 
-  // Parses a string as a KURL. Throws an exception via |exceptionState| if an
-  // invalid URL is produced.
-  static KURL ParseStringAsURL(const String&, ExceptionState&);
+  // Parses a String into a KURL that is potentially empty or null. Throws an
+  // exception via |exceptionState| if an invalid URL is produced.
+  static KURL ParseStringAsURLOrThrow(const String&, ExceptionState&);
 
-  Member<PlatformCredential> platform_credential_;
+ private:
+  String id_;
+  String type_;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.cpp
deleted file mode 100644
index 1eacbaa..0000000
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.cpp
+++ /dev/null

@@ -1,93 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "modules/credentialmanager/CredentialManagerClient.h"
-
-#include <utility>
-#include "core/dom/Document.h"
-#include "core/dom/ExecutionContext.h"
-#include "core/page/Page.h"
-#include "platform/bindings/ScriptState.h"
-
-namespace blink {
-
-CredentialManagerClient::CredentialManagerClient(
-    WebCredentialManagerClient* client)
-    : client_(client) {}
-
-CredentialManagerClient::~CredentialManagerClient() {}
-
-void CredentialManagerClient::Trace(blink::Visitor* visitor) {
-  visitor->Trace(authentication_client_);
-  Supplement<Page>::Trace(visitor);
-}
-
-// static
-const char* CredentialManagerClient::SupplementName() {
-  return "CredentialManagerClient";
-}
-
-// static
-CredentialManagerClient* CredentialManagerClient::From(
-    ExecutionContext* execution_context) {
-  if (!execution_context->IsDocument() ||
-      !ToDocument(execution_context)->GetPage())
-    return nullptr;
-  return From(ToDocument(execution_context)->GetPage());
-}
-
-// static
-CredentialManagerClient* CredentialManagerClient::From(Page* page) {
-  return static_cast<CredentialManagerClient*>(
-      Supplement<Page>::From(page, SupplementName()));
-}
-
-void ProvideCredentialManagerClientTo(Page& page,
-                                      CredentialManagerClient* client) {
-  CredentialManagerClient::ProvideTo(
-      page, CredentialManagerClient::SupplementName(), client);
-}
-
-void CredentialManagerClient::DispatchFailedSignIn(
-    const WebCredential& credential,
-    WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  if (!client_)
-    return;
-  client_->DispatchFailedSignIn(credential, callbacks);
-}
-
-void CredentialManagerClient::DispatchStore(
-    const WebCredential& credential,
-    WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  if (!client_)
-    return;
-  client_->DispatchStore(credential, callbacks);
-}
-
-void CredentialManagerClient::DispatchPreventSilentAccess(
-    WebCredentialManagerClient::NotificationCallbacks* callbacks) {
-  if (!client_)
-    return;
-  client_->DispatchPreventSilentAccess(callbacks);
-}
-
-void CredentialManagerClient::DispatchGet(
-    WebCredentialMediationRequirement mediation,
-    bool include_passwords,
-    const WebVector<WebURL>& federations,
-    WebCredentialManagerClient::RequestCallbacks* callbacks) {
-  if (!client_)
-    return;
-  client_->DispatchGet(mediation, include_passwords, federations, callbacks);
-}
-
-void CredentialManagerClient::DispatchMakeCredential(
-    LocalFrame& frame,
-    const MakePublicKeyCredentialOptions& options,
-    std::unique_ptr<WebAuthenticationClient::PublicKeyCallbacks> callbacks) {
-  if (!authentication_client_)
-    authentication_client_ = new WebAuthenticationClient(frame);
-  authentication_client_->DispatchMakeCredential(options, std::move(callbacks));
-}
-}  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.h b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.h
deleted file mode 100644
index 9e7a0da..0000000
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerClient.h
+++ /dev/null

@@ -1,72 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CredentialManagerClient_h
-#define CredentialManagerClient_h
-
-#include <memory>
-#include "core/page/Page.h"
-#include "modules/ModulesExport.h"
-#include "modules/credentialmanager/MakePublicKeyCredentialOptions.h"
-#include "modules/credentialmanager/WebAuthenticationClient.h"
-#include "platform/Supplementable.h"
-#include "public/platform/WebCredentialManagerClient.h"
-#include "public/platform/WebCredentialMediationRequirement.h"
-#include "public/platform/WebVector.h"
-
-namespace blink {
-
-class ExecutionContext;
-class Page;
-class WebCredential;
-class WebURL;
-
-// CredentialManagerClient lives as a supplement to Page, and wraps the
-// embedder-provided WebCredentialManagerClient's methods to make them visible
-// to the bindings code.
-class MODULES_EXPORT CredentialManagerClient final
-    : public GarbageCollectedFinalized<CredentialManagerClient>,
-      public Supplement<Page> {
-  USING_GARBAGE_COLLECTED_MIXIN(CredentialManagerClient);
-
- public:
-  explicit CredentialManagerClient(WebCredentialManagerClient*);
-  virtual ~CredentialManagerClient();
-  virtual void Trace(blink::Visitor*);
-
-  static const char* SupplementName();
-  static CredentialManagerClient* From(Page*);
-  static CredentialManagerClient* From(ExecutionContext*);
-
-  // Ownership of the callback is transferred to the callee for each of
-  // the following methods.
-  virtual void DispatchFailedSignIn(
-      const WebCredential&,
-      WebCredentialManagerClient::NotificationCallbacks*);
-  virtual void DispatchStore(
-      const WebCredential&,
-      WebCredentialManagerClient::NotificationCallbacks*);
-  virtual void DispatchPreventSilentAccess(
-      WebCredentialManagerClient::NotificationCallbacks*);
-  virtual void DispatchGet(WebCredentialMediationRequirement,
-                           bool include_passwords,
-                           const WebVector<WebURL>& federations,
-                           WebCredentialManagerClient::RequestCallbacks*);
-  virtual void DispatchMakeCredential(
-      LocalFrame&,
-      const MakePublicKeyCredentialOptions&,
-      std::unique_ptr<WebAuthenticationClient::PublicKeyCallbacks>);
-
- private:
-  WebCredentialManagerClient* client_;
-  // TODO(crbug.com/740081): Merge authentication_client_ into this class.
-  Member<WebAuthenticationClient> authentication_client_;
-};
-
-MODULES_EXPORT void ProvideCredentialManagerClientTo(Page&,
-                                                     CredentialManagerClient*);
-
-}  // namespace blink
-
-#endif  // CredentialManagerClient_h

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.cpp
new file mode 100644
index 0000000..77d49d1
--- /dev/null
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.cpp

@@ -0,0 +1,48 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "modules/credentialmanager/CredentialManagerProxy.h"
+
+#include "core/dom/Document.h"
+#include "core/dom/ExecutionContext.h"
+#include "core/frame/LocalFrame.h"
+#include "platform/bindings/ScriptState.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
+
+namespace blink {
+
+CredentialManagerProxy::CredentialManagerProxy(Document* document) {
+  LocalFrame* frame = document->GetFrame();
+  DCHECK(frame);
+  frame->GetInterfaceProvider().GetInterface(&credential_manager_);
+  frame->GetInterfaceProvider().GetInterface(
+      mojo::MakeRequest(&authenticator_));
+}
+
+CredentialManagerProxy::~CredentialManagerProxy() {}
+
+// static
+CredentialManagerProxy* CredentialManagerProxy::From(Document* document) {
+  DCHECK(document);
+  if (!Supplement<Document>::From(document, SupplementName())) {
+    ProvideTo(*document, CredentialManagerProxy::SupplementName(),
+              new CredentialManagerProxy(document));
+  }
+  return static_cast<CredentialManagerProxy*>(
+      Supplement<Document>::From(document, SupplementName()));
+}
+
+// static
+CredentialManagerProxy* CredentialManagerProxy::From(
+    ScriptState* script_state) {
+  DCHECK(script_state->ContextIsValid());
+  return From(ToDocumentOrNull(ExecutionContext::From(script_state)));
+}
+
+// static
+const char* CredentialManagerProxy::SupplementName() {
+  return "CredentialManagerProxy";
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.h b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.h
new file mode 100644
index 0000000..576c9f64
--- /dev/null
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerProxy.h

@@ -0,0 +1,67 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CredentialManagerProxy_h
+#define CredentialManagerProxy_h
+
+#include "core/dom/Document.h"
+#include "modules/ModulesExport.h"
+#include "platform/Supplementable.h"
+#include "platform/heap/Handle.h"
+#include "public/platform/modules/credentialmanager/credential_manager.mojom-blink.h"
+#include "public/platform/modules/webauth/authenticator.mojom-blink.h"
+
+namespace blink {
+
+class ScriptState;
+
+// Owns the client end of the mojo::CredentialManager interface connection to an
+// implementation that services requests in the security context of the document
+// supplemented by this CredentialManagerProxy instance.
+//
+// This facilitates routing API calls to be serviced in the correct security
+// context, even if the `window.navigator.credentials` instance from one
+// browsing context was passed to another; in which case the Credential
+// Management API call must still be serviced in the browsing context
+// responsible for actually calling the API method, as opposed to the context
+// whose global object owns the CredentialsContainer instance on which the
+// method was called.
+class MODULES_EXPORT CredentialManagerProxy
+    : public GarbageCollectedFinalized<CredentialManagerProxy>,
+      public Supplement<Document> {
+  USING_GARBAGE_COLLECTED_MIXIN(CredentialManagerProxy);
+
+ public:
+  explicit CredentialManagerProxy(Document*);
+  virtual ~CredentialManagerProxy();
+
+  ::password_manager::mojom::blink::CredentialManager* CredentialManager() {
+    return credential_manager_.get();
+  }
+
+  ::webauth::mojom::blink::Authenticator* Authenticator() {
+    return authenticator_.get();
+  }
+
+  void FlushCredentialManagerConnectionForTesting() {
+    credential_manager_.FlushForTesting();
+  }
+
+  // Both flavors must be called only with arguments representing a valid
+  // context corresponding to an attached Document.
+  static CredentialManagerProxy* From(ScriptState*);
+  static CredentialManagerProxy* From(Document*);
+
+ private:
+  static const char* SupplementName();
+
+  // TODO(crbug.com/740081): Merge |credential_manager_| and |authenticator_|
+  // into a single Mojo interface.
+  ::password_manager::mojom::blink::CredentialManagerPtr credential_manager_;
+  ::webauth::mojom::blink::AuthenticatorPtr authenticator_;
+};
+
+}  // namespace blink
+
+#endif  // CredentialManagerProxy_h

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.cpp
index 0e81ba2..ba5c85a 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.cpp

@@ -5,7 +5,10 @@
 #include "modules/credentialmanager/CredentialManagerTypeConverters.h"
 
 #include "bindings/core/v8/array_buffer_or_array_buffer_view.h"
+#include "modules/credentialmanager/Credential.h"
+#include "modules/credentialmanager/FederatedCredential.h"
 #include "modules/credentialmanager/MakePublicKeyCredentialOptions.h"
+#include "modules/credentialmanager/PasswordCredential.h"
 #include "modules/credentialmanager/PublicKeyCredential.h"
 #include "modules/credentialmanager/PublicKeyCredentialParameters.h"
 #include "modules/credentialmanager/PublicKeyCredentialRpEntity.h"
@@ -20,6 +23,10 @@
 
 namespace mojo {
 
+using password_manager::mojom::blink::CredentialInfo;
+using password_manager::mojom::blink::CredentialInfoPtr;
+using password_manager::mojom::blink::CredentialType;
+using password_manager::mojom::blink::CredentialManagerError;
 using webauth::mojom::blink::AuthenticatorStatus;
 using webauth::mojom::blink::MakePublicKeyCredentialOptionsPtr;
 using webauth::mojom::blink::PublicKeyCredentialRpEntity;
@@ -32,37 +39,69 @@
 using webauth::mojom::blink::AuthenticatorTransport;
 
 // static
-blink::WebCredentialManagerError
-TypeConverter<blink::WebCredentialManagerError, AuthenticatorStatus>::Convert(
+CredentialInfoPtr TypeConverter<CredentialInfoPtr, blink::Credential*>::Convert(
+    blink::Credential* credential) {
+  auto info = CredentialInfo::New();
+  info->id = credential->id();
+  if (credential->IsPasswordCredential()) {
+    ::blink::PasswordCredential* password_credential =
+        static_cast<::blink::PasswordCredential*>(credential);
+    info->type = CredentialType::PASSWORD;
+    info->password = password_credential->password();
+    info->name = password_credential->name();
+    info->icon = password_credential->iconURL();
+    info->federation = blink::SecurityOrigin::CreateUnique();
+  } else {
+    DCHECK(credential->IsFederatedCredential());
+    ::blink::FederatedCredential* federated_credential =
+        static_cast<::blink::FederatedCredential*>(credential);
+    info->type = CredentialType::FEDERATED;
+    info->password = g_empty_string;
+    info->federation = federated_credential->GetProviderAsOrigin();
+    info->name = federated_credential->name();
+    info->icon = federated_credential->iconURL();
+  }
+  return info;
+}
+
+// static
+blink::Credential*
+TypeConverter<blink::Credential*, CredentialInfoPtr>::Convert(
+    const CredentialInfoPtr& info) {
+  switch (info->type) {
+    case CredentialType::FEDERATED:
+      return blink::FederatedCredential::Create(info->id, info->federation,
+                                                info->name, info->icon);
+    case CredentialType::PASSWORD:
+      return blink::PasswordCredential::Create(info->id, info->password,
+                                               info->name, info->icon);
+    case CredentialType::EMPTY:
+      return nullptr;
+  }
+  NOTREACHED();
+  return nullptr;
+}
+
+// static
+CredentialManagerError
+TypeConverter<CredentialManagerError, AuthenticatorStatus>::Convert(
     const AuthenticatorStatus& status) {
   switch (status) {
-    case webauth::mojom::blink::AuthenticatorStatus::NOT_ALLOWED_ERROR:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerNotAllowedError;
-    case webauth::mojom::blink::AuthenticatorStatus::PENDING_REQUEST:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerPendingRequestError;
     case webauth::mojom::blink::AuthenticatorStatus::NOT_SUPPORTED_ERROR:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerNotSupportedError;
-    case webauth::mojom::blink::AuthenticatorStatus::SECURITY_ERROR:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerSecurityError;
+      return CredentialManagerError::NOT_SUPPORTED;
+    case webauth::mojom::blink::AuthenticatorStatus::NOT_ALLOWED_ERROR:
+      return CredentialManagerError::NOT_ALLOWED;
     case webauth::mojom::blink::AuthenticatorStatus::UNKNOWN_ERROR:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerUnknownError;
-    case webauth::mojom::blink::AuthenticatorStatus::CANCELLED:
-      return blink::WebCredentialManagerError::
-          kWebCredentialManagerCancelledError;
-    case webauth::mojom::blink::AuthenticatorStatus::NOT_IMPLEMENTED:
-      return blink::kWebCredentialManagerNotImplementedError;
+      return CredentialManagerError::UNKNOWN;
+    case webauth::mojom::blink::AuthenticatorStatus::PENDING_REQUEST:
+      return CredentialManagerError::PENDING_REQUEST;
     case webauth::mojom::blink::AuthenticatorStatus::SUCCESS:
       NOTREACHED();
       break;
   };
 
   NOTREACHED();
-  return blink::WebCredentialManagerError::kWebCredentialManagerUnknownError;
+  return CredentialManagerError::UNKNOWN;
 }
 
 // static

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.h b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.h
index 7c0ba27..eaab935 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.h
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialManagerTypeConverters.h

@@ -7,11 +7,12 @@
 
 #include "platform/wtf/Vector.h"
 #include "platform/wtf/text/WTFString.h"
-#include "public/platform/WebCredentialManagerError.h"
+#include "public/platform/modules/credentialmanager/credential_manager.mojom-blink.h"
 #include "public/platform/modules/webauth/authenticator.mojom-blink.h"
 
 namespace blink {
 class ArrayBufferOrArrayBufferView;
+class Credential;
 class MakePublicKeyCredentialOptions;
 class PublicKeyCredentialParameters;
 class PublicKeyCredentialRpEntity;
@@ -20,11 +21,27 @@
 
 namespace mojo {
 
+// password_manager::mojom::blink::CredentialManager --------------------------
+
+template <>
+struct TypeConverter<password_manager::mojom::blink::CredentialInfoPtr,
+                     blink::Credential*> {
+  static password_manager::mojom::blink::CredentialInfoPtr Convert(
+      blink::Credential*);
+};
+
+template <>
+struct TypeConverter<blink::Credential*,
+                     password_manager::mojom::blink::CredentialInfoPtr> {
+  static blink::Credential* Convert(
+      const password_manager::mojom::blink::CredentialInfoPtr&);
+};
+
 // webauth::mojom::blink::Authenticator ---------------------------------------
 template <>
-struct TypeConverter<blink::WebCredentialManagerError,
+struct TypeConverter<password_manager::mojom::blink::CredentialManagerError,
                      webauth::mojom::blink::AuthenticatorStatus> {
-  static blink::WebCredentialManagerError Convert(
+  static password_manager::mojom::blink::CredentialManagerError Convert(
       const webauth::mojom::blink::AuthenticatorStatus&);
 };
 

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
index 78c9117..bc52ec9 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainer.cpp

@@ -6,7 +6,7 @@
 
 #include <memory>
 #include <utility>
-#include "bindings/core/v8/Dictionary.h"
+
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
@@ -18,165 +18,75 @@
 #include "core/frame/UseCounter.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/page/FrameTree.h"
+#include "core/typed_arrays/DOMArrayBuffer.h"
 #include "modules/credentialmanager/AuthenticatorAttestationResponse.h"
 #include "modules/credentialmanager/AuthenticatorResponse.h"
 #include "modules/credentialmanager/Credential.h"
 #include "modules/credentialmanager/CredentialCreationOptions.h"
-#include "modules/credentialmanager/CredentialManagerClient.h"
+#include "modules/credentialmanager/CredentialManagerProxy.h"
+#include "modules/credentialmanager/CredentialManagerTypeConverters.h"
 #include "modules/credentialmanager/CredentialRequestOptions.h"
 #include "modules/credentialmanager/FederatedCredential.h"
 #include "modules/credentialmanager/FederatedCredentialRequestOptions.h"
 #include "modules/credentialmanager/MakePublicKeyCredentialOptions.h"
 #include "modules/credentialmanager/PasswordCredential.h"
 #include "modules/credentialmanager/PublicKeyCredential.h"
-#include "platform/credentialmanager/PlatformFederatedCredential.h"
-#include "platform/credentialmanager/PlatformPasswordCredential.h"
 #include "platform/weborigin/SecurityOrigin.h"
-#include "public/platform/Platform.h"
-#include "public/platform/WebCredential.h"
-#include "public/platform/WebCredentialManagerClient.h"
-#include "public/platform/WebCredentialMediationRequirement.h"
-#include "public/platform/WebFederatedCredential.h"
-#include "public/platform/WebPasswordCredential.h"
+#include "platform/wtf/Functional.h"
+#include "third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom-blink.h"
 
 namespace blink {
+
 namespace {
 
-bool IsSameOriginWithAncestors(Frame*);
-void RejectDueToCredentialManagerError(ScriptPromiseResolver*,
-                                       WebCredentialManagerError);
+using ::password_manager::mojom::blink::CredentialManagerError;
+using ::password_manager::mojom::blink::CredentialInfo;
+using ::password_manager::mojom::blink::CredentialInfoPtr;
+using ::password_manager::mojom::blink::CredentialMediationRequirement;
+using ::webauth::mojom::blink::AuthenticatorStatus;
+using MojoMakePublicKeyCredentialOptions =
+    ::webauth::mojom::blink::MakePublicKeyCredentialOptions;
+using ::webauth::mojom::blink::PublicKeyCredentialInfoPtr;
 
-class NotificationCallbacks
-    : public WebCredentialManagerClient::NotificationCallbacks {
-  WTF_MAKE_NONCOPYABLE(NotificationCallbacks);
+enum class RequiredOriginType { kSecure, kSecureAndSameWithAncestors };
+
+// Off-heap wrapper that holds a strong reference to a ScriptPromiseResolver.
+class ScopedPromiseResolver {
+  WTF_MAKE_NONCOPYABLE(ScopedPromiseResolver);
 
  public:
-  enum class SameOriginRequirement { kMustBeSameOrigin, kCanBeCrossOrigin };
-
-  explicit NotificationCallbacks(ScriptPromiseResolver* resolver,
-                                 SameOriginRequirement same_origin_requirement)
-      : resolver_(resolver),
-        same_origin_requirement_(same_origin_requirement) {}
-  ~NotificationCallbacks() override {}
-
-  void OnSuccess() override {
-    Frame* frame = resolver_->GetFrame();
-    SECURITY_CHECK(!frame ||
-                   same_origin_requirement_ ==
-                       SameOriginRequirement::kCanBeCrossOrigin ||
-                   IsSameOriginWithAncestors(frame));
-
-    resolver_->Resolve();
-  }
-
-  void OnError(WebCredentialManagerError reason) override {
-    RejectDueToCredentialManagerError(resolver_, reason);
-  }
-
- private:
-  const Persistent<ScriptPromiseResolver> resolver_;
-  const SameOriginRequirement same_origin_requirement_;
-};
-
-class RequestCallbacks : public WebCredentialManagerClient::RequestCallbacks {
-  WTF_MAKE_NONCOPYABLE(RequestCallbacks);
-
- public:
-  explicit RequestCallbacks(ScriptPromiseResolver* resolver)
+  explicit ScopedPromiseResolver(ScriptPromiseResolver* resolver)
       : resolver_(resolver) {}
-  ~RequestCallbacks() override {}
 
-  void OnSuccess(std::unique_ptr<WebCredential> credential) override {
-    Frame* frame = resolver_->GetFrame();
-    SECURITY_CHECK(!frame || IsSameOriginWithAncestors(frame));
-
-    if (!frame) {
-      resolver_->Resolve();
-      return;
-    }
-
-    if (!credential) {
-      resolver_->Resolve(v8::Null(resolver_->GetScriptState()->GetIsolate()));
-      return;
-    }
-
-    DCHECK(credential->IsPasswordCredential() ||
-           credential->IsFederatedCredential());
-    UseCounter::Count(ExecutionContext::From(resolver_->GetScriptState()),
-                      WebFeature::kCredentialManagerGetReturnedCredential);
-    if (credential->IsPasswordCredential())
-      resolver_->Resolve(PasswordCredential::Create(
-          static_cast<WebPasswordCredential*>(credential.get())));
-    else
-      resolver_->Resolve(FederatedCredential::Create(
-          static_cast<WebFederatedCredential*>(credential.get())));
+  ~ScopedPromiseResolver() {
+    if (resolver_)
+      OnConnectionError();
   }
 
-  void OnError(WebCredentialManagerError reason) override {
-    RejectDueToCredentialManagerError(resolver_, reason);
-  }
+  // Releases the owned |resolver_|. This is to be called by the Mojo response
+  // callback responsible for resolving the corresponding ScriptPromise.
+  //
+  // If this method is not called before |this| goes of scope, it is assumed
+  // that a Mojo connection error has occurred, and the response callback was
+  // never invoked. The Promise will be rejected with an appropriate exception.
+  ScriptPromiseResolver* Release() { return resolver_.Release(); }
 
  private:
-  const Persistent<ScriptPromiseResolver> resolver_;
+  void OnConnectionError() {
+    // The only anticapted reason for a connection error is that the embedder
+    // does not implement mojom::CredentialManager, so go out on a limb and try
+    // to provide an actionable error message.
+    resolver_->Reject(DOMException::Create(
+        kNotSupportedError,
+        "The user agent does not implement a password store."));
+  }
+
+  Persistent<ScriptPromiseResolver> resolver_;
 };
 
-class PublicKeyCallbacks : public WebAuthenticationClient::PublicKeyCallbacks {
-  WTF_MAKE_NONCOPYABLE(PublicKeyCallbacks);
-
- public:
-  explicit PublicKeyCallbacks(ScriptPromiseResolver* resolver)
-      : resolver_(resolver) {}
-  ~PublicKeyCallbacks() override {
-    OnError(blink::kWebCredentialManagerUnknownError);
-  }
-
-  void OnSuccess(
-      webauth::mojom::blink::PublicKeyCredentialInfoPtr credential) override {
-    Frame* frame = resolver_->GetFrame();
-    SECURITY_CHECK(!frame || frame == frame->Tree().Top());
-
-    if (!frame) {
-      resolver_->Resolve();
-      return;
-    }
-
-    if (!credential || credential->client_data_json.IsEmpty() ||
-        credential->response->attestation_object.IsEmpty()) {
-      resolver_->Resolve(v8::Null(resolver_->GetScriptState()->GetIsolate()));
-      return;
-    }
-
-    DOMArrayBuffer* client_data_buffer =
-        VectorToDOMArrayBuffer(std::move(credential->client_data_json));
-    DOMArrayBuffer* attestation_buffer = VectorToDOMArrayBuffer(
-        std::move(credential->response->attestation_object));
-    DOMArrayBuffer* raw_id =
-        VectorToDOMArrayBuffer(std::move(credential->raw_id));
-    AuthenticatorAttestationResponse* authenticator_response =
-        AuthenticatorAttestationResponse::Create(client_data_buffer,
-                                                 attestation_buffer);
-    resolver_->Resolve(PublicKeyCredential::Create(credential->id, raw_id,
-                                                   authenticator_response));
-  }
-
-  void OnError(WebCredentialManagerError reason) override {
-    RejectDueToCredentialManagerError(resolver_, reason);
-  }
-
- private:
-  DOMArrayBuffer* VectorToDOMArrayBuffer(const Vector<uint8_t> buffer) {
-    return DOMArrayBuffer::Create(static_cast<const void*>(buffer.data()),
-                                  buffer.size());
-  }
-
-  const Persistent<ScriptPromiseResolver> resolver_;
-};
-
-bool IsSameOriginWithAncestors(Frame* frame) {
-  if (!frame)
-    return true;
-
-  Frame* current = frame;
+bool IsSameOriginWithAncestors(const Frame* frame) {
+  DCHECK(frame);
+  const Frame* current = frame;
   const SecurityOrigin* origin =
       frame->GetSecurityContext()->GetSecurityOrigin();
   while (current->Tree().Parent()) {
@@ -187,40 +97,62 @@
   return true;
 }
 
-bool CheckBoilerplate(ScriptPromiseResolver* resolver) {
+bool CheckSecurityRequirementsBeforeRequest(
+    ScriptPromiseResolver* resolver,
+    RequiredOriginType required_origin_type) {
+  // Credential Management is not exposed to Workers or Worklets, so the current
+  // realm execution context must have a responsible browsing context.
+  SECURITY_CHECK(resolver->GetFrame());
+
   String error_message;
-  if (!ExecutionContext::From(resolver->GetScriptState())
-           ->IsSecureContext(error_message)) {
+  if (!resolver->GetExecutionContext()->IsSecureContext(error_message)) {
     resolver->Reject(DOMException::Create(kSecurityError, error_message));
     return false;
   }
 
-  CredentialManagerClient* client = CredentialManagerClient::From(
-      ExecutionContext::From(resolver->GetScriptState()));
-  if (!client) {
+  if (required_origin_type == RequiredOriginType::kSecureAndSameWithAncestors &&
+      !IsSameOriginWithAncestors(resolver->GetFrame())) {
     resolver->Reject(DOMException::Create(
-        kInvalidStateError,
-        "Could not establish connection to the credential manager."));
+        kNotAllowedError,
+        "`PasswordCredential` and `FederatedCredential` objects may only be "
+        "stored/retrieved in a document which is same-origin with all of its "
+        "ancestors."));
     return false;
   }
 
   return true;
 }
 
+void AssertSecurityRequirementsBeforeResponse(
+    ScriptPromiseResolver* resolver,
+    RequiredOriginType require_origin) {
+  // The |resolver| will blanket ignore Reject/Resolve calls if the context is
+  // gone -- nevertheless, call Reject() to be on the safe side.
+  if (!resolver->GetExecutionContext()) {
+    resolver->Reject();
+    return;
+  }
+
+  SECURITY_CHECK(resolver->GetFrame());
+  SECURITY_CHECK(resolver->GetExecutionContext()->IsSecureContext());
+  SECURITY_CHECK(require_origin !=
+                     RequiredOriginType::kSecureAndSameWithAncestors ||
+                 IsSameOriginWithAncestors(resolver->GetFrame()));
+}
+
+// Checks if the icon URL of |credential| is an a-priori authenticated URL.
+// https://w3c.github.io/webappsec-credential-management/#dom-credentialuserdata-iconurl
 bool IsIconURLEmptyOrSecure(const Credential* credential) {
-  PlatformCredential* platform_credential = credential->GetPlatformCredential();
-  if (!platform_credential->IsPassword() &&
-      !platform_credential->IsFederated()) {
+  if (!credential->IsPasswordCredential() &&
+      !credential->IsFederatedCredential()) {
+    DCHECK(credential->IsPublicKeyCredential());
     return true;
   }
 
   const KURL& url =
-      platform_credential->IsFederated()
-          ? static_cast<const PlatformFederatedCredential*>(platform_credential)
-                ->IconURL()
-          : static_cast<const PlatformPasswordCredential*>(platform_credential)
-                ->IconURL();
-
+      credential->IsFederatedCredential()
+          ? static_cast<const FederatedCredential*>(credential)->iconURL()
+          : static_cast<const PasswordCredential*>(credential)->iconURL();
   if (url.IsEmpty())
     return true;
 
@@ -230,46 +162,99 @@
          SecurityOrigin::Create(url)->IsPotentiallyTrustworthy();
 }
 
-void RejectDueToCredentialManagerError(ScriptPromiseResolver* resolver,
-                                       WebCredentialManagerError reason) {
+DOMException* CredentialManagerErrorToDOMException(
+    CredentialManagerError reason) {
   switch (reason) {
-    case kWebCredentialManagerDisabledError:
-      resolver->Reject(DOMException::Create(
-          kInvalidStateError, "The credential manager is disabled."));
-      break;
-    case kWebCredentialManagerPendingRequestError:
-      resolver->Reject(DOMException::Create(kInvalidStateError,
-                                            "A request is already pending."));
-      break;
-    case kWebCredentialManagerNotAllowedError:
-      resolver->Reject(DOMException::Create(kNotAllowedError,
-                                            "The operation is not allowed."));
-      break;
-    case kWebCredentialManagerNotSupportedError:
-      resolver->Reject(DOMException::Create(
+    case CredentialManagerError::PENDING_REQUEST:
+      return DOMException::Create(kInvalidStateError,
+                                  "A request is already pending.");
+    case CredentialManagerError::PASSWORD_STORE_UNAVAILABLE:
+      return DOMException::Create(kNotSupportedError,
+                                  "The password store is unavailable.");
+    case CredentialManagerError::NOT_ALLOWED:
+      return DOMException::Create(kNotAllowedError,
+                                  "The operation is not allowed.");
+    case CredentialManagerError::NOT_SUPPORTED:
+      return DOMException::Create(
           kNotSupportedError,
-          "Parameters for this operation are not supported."));
+          "Parameters for this operation are not supported.");
+    case CredentialManagerError::UNKNOWN:
+      return DOMException::Create(kNotReadableError,
+                                  "An unknown error occurred while talking "
+                                  "to the credential manager.");
+    case CredentialManagerError::SUCCESS:
+      NOTREACHED();
       break;
-    case kWebCredentialManagerSecurityError:
-      resolver->Reject(DOMException::Create(kSecurityError,
-                                            "The operation is insecure and "
-                                            "is not allowed."));
-      break;
-    case kWebCredentialManagerCancelledError:
-      resolver->Reject(DOMException::Create(
-          kNotAllowedError, "The user cancelled the operation."));
-      break;
-    case kWebCredentialManagerNotImplementedError:
-      resolver->Reject(DOMException::Create(
-          kNotAllowedError, "The operation is not implemented."));
-      break;
-    case kWebCredentialManagerUnknownError:
-    default:
-      resolver->Reject(DOMException::Create(kNotReadableError,
-                                            "An unknown error occurred while "
-                                            "talking to the credential "
-                                            "manager."));
-      break;
+  }
+  return nullptr;
+}
+
+void OnStoreComplete(std::unique_ptr<ScopedPromiseResolver> scoped_resolver,
+                     RequiredOriginType required_origin_type) {
+  auto* resolver = scoped_resolver->Release();
+  AssertSecurityRequirementsBeforeResponse(resolver, required_origin_type);
+  resolver->Resolve();
+}
+
+void OnPreventSilentAccessComplete(
+    std::unique_ptr<ScopedPromiseResolver> scoped_resolver) {
+  auto* resolver = scoped_resolver->Release();
+  const auto required_origin_type = RequiredOriginType::kSecure;
+  AssertSecurityRequirementsBeforeResponse(resolver, required_origin_type);
+
+  resolver->Resolve();
+}
+
+void OnGetComplete(std::unique_ptr<ScopedPromiseResolver> scoped_resolver,
+                   RequiredOriginType required_origin_type,
+                   CredentialManagerError error,
+                   CredentialInfoPtr credential_info) {
+  auto* resolver = scoped_resolver->Release();
+
+  AssertSecurityRequirementsBeforeResponse(resolver, required_origin_type);
+  if (error == CredentialManagerError::SUCCESS) {
+    DCHECK(credential_info);
+    UseCounter::Count(resolver->GetExecutionContext(),
+                      WebFeature::kCredentialManagerGetReturnedCredential);
+    resolver->Resolve(mojo::ConvertTo<Credential*>(std::move(credential_info)));
+  } else {
+    DCHECK(!credential_info);
+    resolver->Reject(CredentialManagerErrorToDOMException(error));
+  }
+}
+
+DOMArrayBuffer* VectorToDOMArrayBuffer(const Vector<uint8_t> buffer) {
+  return DOMArrayBuffer::Create(static_cast<const void*>(buffer.data()),
+                                buffer.size());
+}
+
+void OnMakePublicKeyCredentialComplete(
+    std::unique_ptr<ScopedPromiseResolver> scoped_resolver,
+    AuthenticatorStatus status,
+    PublicKeyCredentialInfoPtr credential) {
+  auto* resolver = scoped_resolver->Release();
+  const auto required_origin_type = RequiredOriginType::kSecure;
+
+  AssertSecurityRequirementsBeforeResponse(resolver, required_origin_type);
+  if (status == AuthenticatorStatus::SUCCESS) {
+    DCHECK(credential);
+    DCHECK(!credential->client_data_json.IsEmpty());
+    DCHECK(!credential->response->attestation_object.IsEmpty());
+    DOMArrayBuffer* client_data_buffer =
+        VectorToDOMArrayBuffer(std::move(credential->client_data_json));
+    DOMArrayBuffer* attestation_buffer = VectorToDOMArrayBuffer(
+        std::move(credential->response->attestation_object));
+    DOMArrayBuffer* raw_id =
+        VectorToDOMArrayBuffer(std::move(credential->raw_id));
+    AuthenticatorAttestationResponse* authenticator_response =
+        AuthenticatorAttestationResponse::Create(client_data_buffer,
+                                                 attestation_buffer);
+    resolver->Resolve(PublicKeyCredential::Create(credential->id, raw_id,
+                                                  authenticator_response));
+  } else {
+    DCHECK(!credential);
+    resolver->Reject(CredentialManagerErrorToDOMException(
+        mojo::ConvertTo<CredentialManagerError>(status)));
   }
 }
 
@@ -286,20 +271,12 @@
     const CredentialRequestOptions& options) {
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   ScriptPromise promise = resolver->Promise();
-  ExecutionContext* context = ExecutionContext::From(script_state);
 
-  Frame* frame = ToDocument(context)->GetFrame();
-  if ((options.hasPassword() || options.hasFederated()) &&
-      !IsSameOriginWithAncestors(frame)) {
-    resolver->Reject(DOMException::Create(
-        kNotAllowedError,
-        "`PasswordCredential` and `FederatedCredential` objects may only be "
-        "retrieved in a document which is same-origin with all of its "
-        "ancestors."));
-    return promise;
-  }
-
-  if (!CheckBoilerplate(resolver))
+  auto required_origin_type =
+      options.hasFederated() || options.hasPassword()
+          ? RequiredOriginType::kSecureAndSameWithAncestors
+          : RequiredOriginType::kSecure;
+  if (!CheckSecurityRequirementsBeforeRequest(resolver, required_origin_type))
     return promise;
 
   Vector<KURL> providers;
@@ -311,26 +288,30 @@
     }
   }
 
-  WebCredentialMediationRequirement requirement;
-
+  CredentialMediationRequirement requirement;
   if (options.mediation() == "silent") {
-    UseCounter::Count(context,
+    UseCounter::Count(ExecutionContext::From(script_state),
                       WebFeature::kCredentialManagerGetMediationSilent);
-    requirement = WebCredentialMediationRequirement::kSilent;
+    requirement = CredentialMediationRequirement::kSilent;
   } else if (options.mediation() == "optional") {
-    UseCounter::Count(context,
+    UseCounter::Count(ExecutionContext::From(script_state),
                       WebFeature::kCredentialManagerGetMediationOptional);
-    requirement = WebCredentialMediationRequirement::kOptional;
+    requirement = CredentialMediationRequirement::kOptional;
   } else {
     DCHECK_EQ("required", options.mediation());
-    UseCounter::Count(context,
+    UseCounter::Count(ExecutionContext::From(script_state),
                       WebFeature::kCredentialManagerGetMediationRequired);
-    requirement = WebCredentialMediationRequirement::kRequired;
+    requirement = CredentialMediationRequirement::kRequired;
   }
 
-  CredentialManagerClient::From(context)->DispatchGet(
-      requirement, options.password(), providers,
-      new RequestCallbacks(resolver));
+  auto* credential_manager =
+      CredentialManagerProxy::From(script_state)->CredentialManager();
+  credential_manager->Get(
+      requirement, options.password(), std::move(providers),
+      WTF::Bind(&OnGetComplete,
+                WTF::Passed(std::make_unique<ScopedPromiseResolver>(resolver)),
+                required_origin_type));
+
   return promise;
 }
 
@@ -339,22 +320,15 @@
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   ScriptPromise promise = resolver->Promise();
 
-  Frame* frame = ToDocument(ExecutionContext::From(script_state))->GetFrame();
-  if ((credential->type() == "password" || credential->type() == "federated") &&
-      !IsSameOriginWithAncestors(frame)) {
-    resolver->Reject(
-        DOMException::Create(kNotAllowedError,
-                             "`PasswordCredential` and `FederatedCredential` "
-                             "objects may only be stored in a document which "
-                             "is same-origin with all of its ancestors."));
-    return promise;
-  }
-
-  if (!CheckBoilerplate(resolver))
+  auto required_origin_type =
+      credential->IsFederatedCredential() || credential->IsPasswordCredential()
+          ? RequiredOriginType::kSecureAndSameWithAncestors
+          : RequiredOriginType::kSecure;
+  if (!CheckSecurityRequirementsBeforeRequest(resolver, required_origin_type))
     return promise;
 
-  if (!(credential->GetPlatformCredential()->IsFederated() ||
-        credential->GetPlatformCredential()->IsPassword())) {
+  if (!(credential->IsFederatedCredential() ||
+        credential->IsPasswordCredential())) {
     resolver->Reject(DOMException::Create(
         kNotSupportedError,
         "Store operation not permitted for PublicKey credentials."));
@@ -366,14 +340,14 @@
     return promise;
   }
 
-  auto web_credential =
-      WebCredential::Create(credential->GetPlatformCredential());
-  CredentialManagerClient::From(ExecutionContext::From(script_state))
-      ->DispatchStore(
-          *web_credential,
-          new NotificationCallbacks(
-              resolver,
-              NotificationCallbacks::SameOriginRequirement::kMustBeSameOrigin));
+  auto* credential_manager =
+      CredentialManagerProxy::From(script_state)->CredentialManager();
+  credential_manager->Store(
+      CredentialInfo::From(credential),
+      WTF::Bind(&OnStoreComplete,
+                WTF::Passed(std::make_unique<ScopedPromiseResolver>(resolver)),
+                required_origin_type));
+
   return promise;
 }
 
@@ -383,42 +357,50 @@
     ExceptionState& exception_state) {
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   ScriptPromise promise = resolver->Promise();
-  if (!CheckBoilerplate(resolver))
+
+  const auto required_origin_type = RequiredOriginType::kSecure;
+  if (!CheckSecurityRequirementsBeforeRequest(resolver, required_origin_type))
     return promise;
 
   if ((options.hasPassword() + options.hasFederated() +
        options.hasPublicKey()) != 1) {
-    resolver->Reject(DOMException::Create(kNotSupportedError,
-                                          "Only exactly one of 'password', "
-                                          "'federated', and 'publicKey' "
-                                          "credential types are currently "
-                                          "supported."));
+    resolver->Reject(DOMException::Create(
+        kNotSupportedError,
+        "Only exactly one of 'password', 'federated', and 'publicKey' "
+        "credential types are currently supported."));
     return promise;
   }
 
   if (options.hasPassword()) {
-    if (options.password().IsPasswordCredentialData()) {
-      resolver->Resolve(PasswordCredential::Create(
-          options.password().GetAsPasswordCredentialData(), exception_state));
-    } else {
-      resolver->Resolve(PasswordCredential::Create(
-          options.password().GetAsHTMLFormElement(), exception_state));
-    }
+    resolver->Resolve(
+        options.password().IsPasswordCredentialData()
+            ? PasswordCredential::Create(
+                  options.password().GetAsPasswordCredentialData(),
+                  exception_state)
+            : PasswordCredential::Create(
+                  options.password().GetAsHTMLFormElement(), exception_state));
   } else if (options.hasFederated()) {
     resolver->Resolve(
         FederatedCredential::Create(options.federated(), exception_state));
   } else {
     DCHECK(options.hasPublicKey());
-    // Dispatch the publicKey credential operation.
-    // TODO(https://crbug.com/740081): Eventually unify with CredMan's mojo.
-    // TODO(engedy): Make frame checks more efficient in the refactor.
-    LocalFrame* frame =
-        ToDocument(ExecutionContext::From(script_state))->GetFrame();
-    CredentialManagerClient::From(ExecutionContext::From(script_state))
-        ->DispatchMakeCredential(
-            *frame, options.publicKey(),
-            std::make_unique<PublicKeyCallbacks>(resolver));
+    auto mojo_options =
+        MojoMakePublicKeyCredentialOptions::From(options.publicKey());
+    if (mojo_options) {
+      auto* authenticator =
+          CredentialManagerProxy::From(script_state)->Authenticator();
+      authenticator->MakeCredential(
+          std::move(mojo_options),
+          WTF::Bind(
+              &OnMakePublicKeyCredentialComplete,
+              WTF::Passed(std::make_unique<ScopedPromiseResolver>(resolver))));
+    } else {
+      resolver->Reject(DOMException::Create(
+          kNotSupportedError,
+          "Required parameters missing in `options.publicKey`."));
+    }
   }
+
   return promise;
 }
 
@@ -426,13 +408,16 @@
     ScriptState* script_state) {
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
   ScriptPromise promise = resolver->Promise();
-  if (!CheckBoilerplate(resolver))
+  const auto required_origin_type = RequiredOriginType::kSecure;
+  if (!CheckSecurityRequirementsBeforeRequest(resolver, required_origin_type))
     return promise;
 
-  CredentialManagerClient::From(ExecutionContext::From(script_state))
-      ->DispatchPreventSilentAccess(new NotificationCallbacks(
-          resolver,
-          NotificationCallbacks::SameOriginRequirement::kCanBeCrossOrigin));
+  auto* credential_manager =
+      CredentialManagerProxy::From(script_state)->CredentialManager();
+  credential_manager->PreventSilentAccess(WTF::Bind(
+      &OnPreventSilentAccessComplete,
+      WTF::Passed(std::make_unique<ScopedPromiseResolver>(resolver))));
+
   return promise;
 }
 

diff --git a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainerTest.cpp b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainerTest.cpp
index 0baae06f..4d66019 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainerTest.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/CredentialsContainerTest.cpp

@@ -5,74 +5,163 @@
 #include "modules/credentialmanager/CredentialsContainer.h"
 
 #include <memory>
+#include <utility>
 
 #include "bindings/core/v8/V8BindingForTesting.h"
 #include "bindings/core/v8/V8GCController.h"
 #include "core/dom/Document.h"
-#include "modules/credentialmanager/CredentialManagerClient.h"
+#include "core/frame/FrameTestHelpers.h"
+#include "core/frame/LocalFrame.h"
+#include "modules/credentialmanager/CredentialManagerProxy.h"
 #include "modules/credentialmanager/CredentialRequestOptions.h"
-#include "public/platform/WebCredential.h"
-#include "public/platform/WebCredentialMediationRequirement.h"
-#include "testing/gmock/include/gmock/gmock.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "platform/testing/UnitTestHelpers.h"
+#include "platform/weborigin/SecurityOrigin.h"
+#include "platform/wtf/Functional.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom-blink.h"
 
 namespace blink {
 
-using ::testing::_;
-using ::testing::SaveArg;
-
 namespace {
 
-class MockCredentialManagerClient : public WebCredentialManagerClient {
+class MockCredentialManager
+    : public ::password_manager::mojom::blink::CredentialManager {
+  WTF_MAKE_NONCOPYABLE(MockCredentialManager);
+
  public:
-  MOCK_METHOD2(DispatchFailedSignIn,
-               void(const WebCredential&, NotificationCallbacks*));
-  MOCK_METHOD2(DispatchStore,
-               void(const WebCredential&, NotificationCallbacks*));
-  MOCK_METHOD1(DispatchPreventSilentAccess, void(NotificationCallbacks*));
-  MOCK_METHOD4(DispatchGet,
-               void(WebCredentialMediationRequirement,
-                    bool,
-                    const WebVector<WebURL>& federations,
-                    RequestCallbacks*));
+  MockCredentialManager() : binding_(this) {}
+  ~MockCredentialManager() {}
+
+  void Bind(
+      ::password_manager::mojom::blink::CredentialManagerRequest request) {
+    binding_.Bind(std::move(request));
+  }
+
+  void WaitForConnectionError() {
+    if (!binding_.is_bound())
+      return;
+
+    binding_.set_connection_error_handler(WTF::Bind(&testing::ExitRunLoop));
+    testing::EnterRunLoop();
+  }
+
+  void WaitForCallToGet() {
+    if (get_callback_)
+      return;
+
+    testing::EnterRunLoop();
+  }
+
+  void InvokeGetCallback() {
+    EXPECT_TRUE(binding_.is_bound());
+
+    auto info = password_manager::mojom::blink::CredentialInfo::New();
+    info->type = password_manager::mojom::blink::CredentialType::EMPTY;
+    info->federation = SecurityOrigin::CreateUnique();
+    std::move(get_callback_)
+        .Run(password_manager::mojom::blink::CredentialManagerError::SUCCESS,
+             std::move(info));
+  }
+
+ protected:
+  virtual void Store(
+      password_manager::mojom::blink::CredentialInfoPtr credential,
+      StoreCallback callback) {}
+  virtual void PreventSilentAccess(PreventSilentAccessCallback callback) {}
+  virtual void Get(
+      password_manager::mojom::blink::CredentialMediationRequirement mediation,
+      bool include_passwords,
+      const WTF::Vector<::blink::KURL>& federations,
+      GetCallback callback) {
+    get_callback_ = std::move(callback);
+    testing::ExitRunLoop();
+  }
+
+ private:
+  mojo::Binding<::password_manager::mojom::blink::CredentialManager> binding_;
+
+  GetCallback get_callback_;
+};
+
+class CredentialManagerTestingContext {
+  STACK_ALLOCATED();
+
+ public:
+  CredentialManagerTestingContext(
+      MockCredentialManager* mock_credential_manager) {
+    dummy_context_.GetDocument().SetSecurityOrigin(
+        SecurityOrigin::CreateFromString("https://example.test"));
+    dummy_context_.GetDocument().SetSecureContextStateForTesting(
+        SecureContextState::kSecure);
+    service_manager::InterfaceProvider::TestApi test_api(
+        &dummy_context_.GetFrame().GetInterfaceProvider());
+    test_api.SetBinderForName(
+        ::password_manager::mojom::blink::CredentialManager::Name_,
+        WTF::BindRepeating(
+            [](MockCredentialManager* mock_credential_manager,
+               mojo::ScopedMessagePipeHandle handle) {
+              mock_credential_manager->Bind(
+                  ::password_manager::mojom::blink::CredentialManagerRequest(
+                      std::move(handle)));
+            },
+            WTF::Unretained(mock_credential_manager)));
+  }
+
+  Document* Document() { return &dummy_context_.GetDocument(); }
+  LocalFrame* Frame() { return &dummy_context_.GetFrame(); }
+  ScriptState* ScriptState() { return dummy_context_.GetScriptState(); }
+
+ private:
+  V8TestingScope dummy_context_;
 };
 
 }  // namespace
 
-// Make a call to CredentialsContainer::get(). Destroy v8::Context.
-// Make sure that the renderer doesn't crash if got a credential.
-TEST(CredentialsContainerTest, TestGetWithDocumentDestroyed) {
-  CredentialsContainer* credential_container = CredentialsContainer::Create();
-  std::unique_ptr<WebCredentialManagerClient::RequestCallbacks> get_callback;
+// The completion callbacks for pending mojom::CredentialManager calls each own
+// a persistent handle to a ScriptPromiseResolver instance. Ensure that if the
+// document is destored while a call is pending, it can still be freed up.
+TEST(CredentialsContainerTest, PendingGetRequest_NoGCCycles) {
+  MockCredentialManager mock_credential_manager;
+  WeakPersistent<Document> weak_document;
 
   {
-    V8TestingScope scope;
-
-    // Set up.
-    scope.GetDocument().SetSecurityOrigin(
-        SecurityOrigin::CreateFromString("https://example.test"));
-    scope.GetDocument().SetSecureContextStateForTesting(
-        SecureContextState::kSecure);
-    ::testing::StrictMock<MockCredentialManagerClient> mock_client;
-    ProvideCredentialManagerClientTo(scope.GetPage(),
-                                     new CredentialManagerClient(&mock_client));
-
-    // Request a credential.
-    WebCredentialManagerClient::RequestCallbacks* callback = nullptr;
-    EXPECT_CALL(mock_client, DispatchGet(_, _, _, _))
-        .WillOnce(SaveArg<3>(&callback));
-    credential_container->get(scope.GetScriptState(),
-                              CredentialRequestOptions());
-
-    ASSERT_TRUE(callback);
-    get_callback.reset(callback);
+    CredentialManagerTestingContext context(&mock_credential_manager);
+    weak_document = context.Document();
+    CredentialsContainer::Create()->get(context.ScriptState(),
+                                        CredentialRequestOptions());
+    mock_credential_manager.WaitForCallToGet();
   }
 
-  // Garbage collect v8::Context.
   V8GCController::CollectAllGarbageForTesting(v8::Isolate::GetCurrent());
+  ThreadState::Current()->CollectAllGarbage();
 
-  // Invoking the callback shouldn't crash.
-  get_callback->OnSuccess(std::unique_ptr<WebCredential>());
+  ASSERT_EQ(nullptr, weak_document.Get());
+
+  mock_credential_manager.InvokeGetCallback();
+  mock_credential_manager.WaitForConnectionError();
+}
+
+// If the document is detached before the request is resolved, the promise
+// should be left unresolved, and there should be no crashes.
+TEST(CredentialsContainerTest,
+     PendingGetRequest_NoCrashOnResponseAfterDocumentShutdown) {
+  MockCredentialManager mock_credential_manager;
+  CredentialManagerTestingContext context(&mock_credential_manager);
+
+  auto* proxy = CredentialManagerProxy::From(context.Document());
+  auto promise = CredentialsContainer::Create()->get(
+      context.ScriptState(), CredentialRequestOptions());
+  mock_credential_manager.WaitForCallToGet();
+
+  context.Document()->Shutdown();
+
+  mock_credential_manager.InvokeGetCallback();
+  proxy->FlushCredentialManagerConnectionForTesting();
+
+  EXPECT_EQ(v8::Promise::kPending,
+            promise.V8Value().As<v8::Promise>()->State());
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/DEPS b/third_party/WebKit/Source/modules/credentialmanager/DEPS
index f9dba43..0a024eb 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/DEPS
+++ b/third_party/WebKit/Source/modules/credentialmanager/DEPS

@@ -1,5 +1,6 @@
 include_rules = [
-    "-modules",
-    "+modules/ModulesExport.h",
-    "+modules/credentialmanager",
+  "-modules",
+  "+modules/ModulesExport.h",
+  "+modules/credentialmanager",
+  "+mojo/public",
 ]

diff --git a/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.cpp b/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.cpp
index c17139fb..ead2078 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.cpp

@@ -6,64 +6,53 @@
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "modules/credentialmanager/FederatedCredentialInit.h"
-#include "platform/credentialmanager/PlatformFederatedCredential.h"
-#include "platform/weborigin/SecurityOrigin.h"
-#include "public/platform/WebFederatedCredential.h"
 
 namespace blink {
 
-FederatedCredential* FederatedCredential::Create(
-    WebFederatedCredential* web_federated_credential) {
-  return new FederatedCredential(web_federated_credential);
+namespace {
+constexpr char kFederatedCredentialType[] = "federated";
 }
 
 FederatedCredential* FederatedCredential::Create(
     const FederatedCredentialInit& data,
     ExceptionState& exception_state) {
-  if (data.id().IsEmpty()) {
+  if (data.id().IsEmpty())
     exception_state.ThrowTypeError("'id' must not be empty.");
-    return nullptr;
-  }
-  if (data.provider().IsEmpty()) {
+  if (data.provider().IsEmpty())
     exception_state.ThrowTypeError("'provider' must not be empty.");
-    return nullptr;
-  }
 
-  KURL icon_url = ParseStringAsURL(data.iconURL(), exception_state);
-  KURL provider_url = ParseStringAsURL(data.provider(), exception_state);
+  KURL icon_url = ParseStringAsURLOrThrow(data.iconURL(), exception_state);
+  KURL provider_url = ParseStringAsURLOrThrow(data.provider(), exception_state);
+
   if (exception_state.HadException())
     return nullptr;
-  return new FederatedCredential(data.id(), provider_url, data.name(),
-                                 icon_url);
+
+  return new FederatedCredential(
+      data.id(), SecurityOrigin::Create(provider_url), data.name(), icon_url);
+}
+
+FederatedCredential* FederatedCredential::Create(
+    const String& id,
+    scoped_refptr<const SecurityOrigin> provider,
+    const String& name,
+    const KURL& icon_url) {
+  return new FederatedCredential(id, provider, name, icon_url);
 }
 
 FederatedCredential::FederatedCredential(
-    WebFederatedCredential* web_federated_credential)
-    : Credential(web_federated_credential->GetPlatformCredential()) {}
-
-FederatedCredential::FederatedCredential(const String& id,
-                                         const KURL& provider,
-                                         const String& name,
-                                         const KURL& icon)
-    : Credential(
-          PlatformFederatedCredential::Create(id,
-                                              SecurityOrigin::Create(provider),
-                                              name,
-                                              icon)) {}
-
-const String FederatedCredential::provider() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->Provider()
-      ->ToString();
+    const String& id,
+    scoped_refptr<const SecurityOrigin> provider,
+    const String& name,
+    const KURL& icon_url)
+    : Credential(id, kFederatedCredentialType),
+      provider_(provider),
+      name_(name),
+      icon_url_(icon_url) {
+  DCHECK(provider);
 }
 
-const String& FederatedCredential::name() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->Name();
+bool FederatedCredential::IsFederatedCredential() const {
+  return true;
 }
 
-const KURL& FederatedCredential::iconURL() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->IconURL();
-}
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.h b/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.h
index 0d595aa..e31af08 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.h
+++ b/third_party/WebKit/Source/modules/credentialmanager/FederatedCredential.h

@@ -5,17 +5,16 @@
 #ifndef FederatedCredential_h
 #define FederatedCredential_h
 
-#include "bindings/core/v8/serialization/SerializedScriptValue.h"
 #include "modules/ModulesExport.h"
 #include "modules/credentialmanager/Credential.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/weborigin/KURL.h"
+#include "platform/weborigin/SecurityOrigin.h"
 
 namespace blink {
 
 class FederatedCredentialInit;
-class WebFederatedCredential;
 
 class MODULES_EXPORT FederatedCredential final : public Credential {
   DEFINE_WRAPPERTYPEINFO();
@@ -23,23 +22,41 @@
  public:
   static FederatedCredential* Create(const FederatedCredentialInit&,
                                      ExceptionState&);
-  static FederatedCredential* Create(WebFederatedCredential*);
+  static FederatedCredential* Create(
+      const String& id,
+      scoped_refptr<const SecurityOrigin> provider,
+      const String& name,
+      const KURL& icon_url);
+
+  scoped_refptr<const SecurityOrigin> GetProviderAsOrigin() const {
+    return provider_;
+  }
+
+  // Credential:
+  bool IsFederatedCredential() const override;
 
   // FederatedCredential.idl
-  const String provider() const;
-  const String& name() const;
-  const KURL& iconURL() const;
-
-  // TODO(mkwst): This is a stub, as we don't yet have any support on the
-  // Chromium-side.
-  const String& protocol() const { return g_empty_string; }
+  String provider() const {
+    CHECK(provider_);
+    return provider_->ToString();
+  }
+  const String& name() const { return name_; }
+  const KURL& iconURL() const { return icon_url_; }
+  const String& protocol() const {
+    // TODO(mkwst): This is a stub, as we don't yet have any support on the
+    // Chromium-side.
+    return g_empty_string;
+  }
 
  private:
-  FederatedCredential(WebFederatedCredential*);
   FederatedCredential(const String& id,
-                      const KURL& provider,
+                      scoped_refptr<const SecurityOrigin> provider,
                       const String& name,
-                      const KURL& icon);
+                      const KURL& icon_url);
+
+  const scoped_refptr<const SecurityOrigin> provider_;
+  const String name_;
+  const KURL icon_url_;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/OWNERS b/third_party/WebKit/Source/modules/credentialmanager/OWNERS
index 22246892..16269f1 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/OWNERS
+++ b/third_party/WebKit/Source/modules/credentialmanager/OWNERS

@@ -1,6 +1,9 @@
+engedy@chromium.org
 mkwst@chromium.org
+vasilii@chromium.org
 
 per-file *TypeConverter*.*=set noparent
 per-file *TypeConverter*.*=file://ipc/SECURITY_OWNERS
 
-# COMPONENT: UI>Browser>Passwords
+# COMPONENT: Blink>SecurityFeature>CredentialManagement
+# TEAM: identity-dev@chromium.org

diff --git a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
index 66fa1a14..de26108 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.cpp

@@ -11,31 +11,24 @@
 #include "core/html/forms/ListedElement.h"
 #include "core/html_names.h"
 #include "modules/credentialmanager/PasswordCredentialData.h"
-#include "platform/credentialmanager/PlatformPasswordCredential.h"
-#include "public/platform/WebCredential.h"
-#include "public/platform/WebPasswordCredential.h"
 
 namespace blink {
 
-PasswordCredential* PasswordCredential::Create(
-    WebPasswordCredential* web_password_credential) {
-  return new PasswordCredential(web_password_credential);
+namespace {
+constexpr char kPasswordCredentialType[] = "password";
 }
 
 // https://w3c.github.io/webappsec-credential-management/#construct-passwordcredential-data
 PasswordCredential* PasswordCredential::Create(
     const PasswordCredentialData& data,
     ExceptionState& exception_state) {
-  if (data.id().IsEmpty()) {
+  if (data.id().IsEmpty())
     exception_state.ThrowTypeError("'id' must not be empty.");
-    return nullptr;
-  }
-  if (data.password().IsEmpty()) {
+  if (data.password().IsEmpty())
     exception_state.ThrowTypeError("'password' must not be empty.");
-    return nullptr;
-  }
 
-  KURL icon_url = ParseStringAsURL(data.iconURL(), exception_state);
+  KURL icon_url = ParseStringAsURLOrThrow(data.iconURL(), exception_state);
+
   if (exception_state.HadException())
     return nullptr;
 
@@ -85,30 +78,26 @@
   return PasswordCredential::Create(data, exception_state);
 }
 
-PasswordCredential::PasswordCredential(
-    WebPasswordCredential* web_password_credential)
-    : Credential(web_password_credential->GetPlatformCredential()) {}
+PasswordCredential* PasswordCredential::Create(const String& id,
+                                               const String& password,
+                                               const String& name,
+                                               const KURL& icon_url) {
+  return new PasswordCredential(id, password, name, icon_url);
+}
 
 PasswordCredential::PasswordCredential(const String& id,
                                        const String& password,
                                        const String& name,
-                                       const KURL& icon)
-    : Credential(PlatformPasswordCredential::Create(id, password, name, icon)) {
+                                       const KURL& icon_url)
+    : Credential(id, kPasswordCredentialType),
+      password_(password),
+      name_(name),
+      icon_url_(icon_url) {
+  DCHECK(!password.IsEmpty());
 }
 
-const String& PasswordCredential::password() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->Password();
-}
-
-const String& PasswordCredential::name() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->Name();
-}
-
-const KURL& PasswordCredential::iconURL() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->IconURL();
+bool PasswordCredential::IsPasswordCredential() const {
+  return true;
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.h b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.h
index f878cbd..1124089 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.h
+++ b/third_party/WebKit/Source/modules/credentialmanager/PasswordCredential.h

@@ -15,7 +15,6 @@
 
 class HTMLFormElement;
 class PasswordCredentialData;
-class WebPasswordCredential;
 
 class MODULES_EXPORT PasswordCredential final : public Credential {
   DEFINE_WRAPPERTYPEINFO();
@@ -24,19 +23,28 @@
   static PasswordCredential* Create(const PasswordCredentialData&,
                                     ExceptionState&);
   static PasswordCredential* Create(HTMLFormElement*, ExceptionState&);
-  static PasswordCredential* Create(WebPasswordCredential*);
+  static PasswordCredential* Create(const String& id,
+                                    const String& password,
+                                    const String& name,
+                                    const KURL& icon_url);
+
+  // Credential:
+  bool IsPasswordCredential() const override;
 
   // PasswordCredential.idl
-  const String& password() const;
-  const String& name() const;
-  const KURL& iconURL() const;
+  const String& password() const { return password_; }
+  const String& name() const { return name_; }
+  const KURL& iconURL() const { return icon_url_; }
 
  private:
-  PasswordCredential(WebPasswordCredential*);
   PasswordCredential(const String& id,
                      const String& password,
                      const String& name,
                      const KURL& icon);
+
+  const String password_;
+  const String name_;
+  const KURL icon_url_;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.cpp b/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.cpp
index c41e799..79a174b 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.cpp
+++ b/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.cpp

@@ -6,6 +6,11 @@
 
 namespace blink {
 
+namespace {
+// https://www.w3.org/TR/webauthn/#dom-publickeycredential-type-slot:
+constexpr char kPublicKeyCredentialType[] = "public-key";
+}  // namespace
+
 PublicKeyCredential* PublicKeyCredential::Create(
     const String& id,
     DOMArrayBuffer* raw_id,
@@ -16,7 +21,9 @@
 PublicKeyCredential::PublicKeyCredential(const String& id,
                                          DOMArrayBuffer* raw_id,
                                          AuthenticatorResponse* response)
-    : Credential(id), raw_id_(raw_id), response_(response) {}
+    : Credential(id, kPublicKeyCredentialType),
+      raw_id_(raw_id),
+      response_(response) {}
 
 void PublicKeyCredential::Trace(blink::Visitor* visitor) {
   visitor->Trace(raw_id_);
@@ -24,4 +31,8 @@
   Credential::Trace(visitor);
 }
 
+bool PublicKeyCredential::IsPublicKeyCredential() const {
+  return true;
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.h b/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.h
index cfddd7a..cd451aa 100644
--- a/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.h
+++ b/third_party/WebKit/Source/modules/credentialmanager/PublicKeyCredential.h

@@ -26,7 +26,9 @@
   DOMArrayBuffer* rawId() const { return raw_id_.Get(); }
   AuthenticatorResponse* response() const { return response_.Get(); }
 
-  virtual void Trace(blink::Visitor*);
+  // Credential:
+  void Trace(blink::Visitor*) override;
+  bool IsPublicKeyCredential() const override;
 
  private:
   explicit PublicKeyCredential(const String& id,

diff --git a/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.cpp b/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.cpp
deleted file mode 100644
index ecbe84a..0000000
--- a/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.cpp
+++ /dev/null

@@ -1,95 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "modules/credentialmanager/WebAuthenticationClient.h"
-
-#include <utility>
-#include "bindings/core/v8/ScriptPromise.h"
-#include "bindings/core/v8/ScriptPromiseResolver.h"
-#include "core/dom/DOMException.h"
-#include "core/dom/Document.h"
-#include "core/dom/ExceptionCode.h"
-#include "core/frame/LocalFrame.h"
-#include "modules/credentialmanager/CredentialManagerTypeConverters.h"
-#include "modules/credentialmanager/MakePublicKeyCredentialOptions.h"
-#include "public/platform/InterfaceProvider.h"
-#include "services/service_manager/public/cpp/interface_provider.h"
-
-namespace blink {
-
-namespace {
-
-void RespondToPublicKeyCallback(
-    std::unique_ptr<WebAuthenticationClient::PublicKeyCallbacks> callbacks,
-    webauth::mojom::blink::AuthenticatorStatus status,
-    webauth::mojom::blink::PublicKeyCredentialInfoPtr credential) {
-  if (status != webauth::mojom::AuthenticatorStatus::SUCCESS) {
-    DCHECK(!credential);
-    callbacks->OnError(mojo::ConvertTo<WebCredentialManagerError>(status));
-    return;
-  }
-
-  // Ensure we have an AuthenticatorAttestationResponse
-  DCHECK(credential);
-  DCHECK(!credential->client_data_json.IsEmpty());
-  DCHECK(!credential->response->attestation_object.IsEmpty());
-  callbacks->OnSuccess(std::move(credential));
-}
-}  // namespace
-
-}  // namespace blink
-
-namespace blink {
-
-WebAuthenticationClient::WebAuthenticationClient(LocalFrame& frame) {
-  frame.GetInterfaceProvider().GetInterface(mojo::MakeRequest(&authenticator_));
-  authenticator_.set_connection_error_handler(
-      WTF::Bind(&WebAuthenticationClient::OnAuthenticatorConnectionError,
-                WrapWeakPersistent(this)));
-}
-
-WebAuthenticationClient::~WebAuthenticationClient() {}
-
-void WebAuthenticationClient::DispatchMakeCredential(
-    const MakePublicKeyCredentialOptions& publicKey,
-    std::unique_ptr<WebAuthenticationClient::PublicKeyCallbacks> callbacks) {
-  if (!authenticator_) {
-    callbacks->OnError(
-        WebCredentialManagerError::kWebCredentialManagerNotImplementedError);
-    return;
-  }
-
-  auto options =
-      webauth::mojom::blink::MakePublicKeyCredentialOptions::From(publicKey);
-  if (!options) {
-    callbacks->OnError(
-        WebCredentialManagerError::kWebCredentialManagerNotSupportedError);
-    return;
-  }
-
-  authenticator_->MakeCredential(std::move(options),
-                                 WTF::Bind(&RespondToPublicKeyCallback,
-                                           WTF::Passed(std::move(callbacks))));
-}
-
-void WebAuthenticationClient::GetAssertion(
-    const PublicKeyCredentialRequestOptions& publicKey,
-    WebAuthenticationClient::PublicKeyCallbacks* callbacks) {
-  // TODO (kpaulhamus): implement GetAssertion and removed NOTREACHED().
-  NOTREACHED();
-  return;
-}
-
-void WebAuthenticationClient::OnAuthenticatorConnectionError() {
-  Cleanup();
-}
-
-void WebAuthenticationClient::Trace(blink::Visitor* visitor) {}
-
-// Closes the Mojo connection.
-void WebAuthenticationClient::Cleanup() {
-  authenticator_.reset();
-}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.h b/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.h
deleted file mode 100644
index bda4960c..0000000
--- a/third_party/WebKit/Source/modules/credentialmanager/WebAuthenticationClient.h
+++ /dev/null

@@ -1,49 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebAuthenticationClient_h
-#define WebAuthenticationClient_h
-
-#include <memory>
-#include "platform/heap/Handle.h"
-#include "public/platform/WebCallbacks.h"
-#include "public/platform/WebCredentialManagerError.h"
-#include "public/platform/modules/webauth/authenticator.mojom-blink.h"
-
-namespace blink {
-
-class LocalFrame;
-class MakePublicKeyCredentialOptions;
-class PublicKeyCredentialRequestOptions;
-
-class WebAuthenticationClient final
-    : public GarbageCollectedFinalized<WebAuthenticationClient> {
- public:
-  // Used by calls to authenticator.mojom.
-  typedef WebCallbacks<webauth::mojom::blink::PublicKeyCredentialInfoPtr,
-                       WebCredentialManagerError>
-      PublicKeyCallbacks;
-
-  explicit WebAuthenticationClient(LocalFrame&);
-
-  virtual ~WebAuthenticationClient();
-
-  // WebAuthentication.idl
-  void DispatchMakeCredential(const MakePublicKeyCredentialOptions&,
-                              std::unique_ptr<PublicKeyCallbacks>);
-
-  void GetAssertion(const PublicKeyCredentialRequestOptions&,
-                    PublicKeyCallbacks*);
-
-  virtual void Trace(blink::Visitor*);
-
- private:
-  void OnAuthenticatorConnectionError();
-  void Cleanup();
-
-  webauth::mojom::blink::AuthenticatorPtr authenticator_;
-};
-}  // namespace blink
-
-#endif  // WebAuthenticationClient_h

diff --git a/third_party/WebKit/Source/modules/fetch/Request.cpp b/third_party/WebKit/Source/modules/fetch/Request.cpp
index 43ddd793..594c908 100644
--- a/third_party/WebKit/Source/modules/fetch/Request.cpp
+++ b/third_party/WebKit/Source/modules/fetch/Request.cpp

@@ -47,6 +47,7 @@
   request->SetCacheMode(original->CacheMode());
   request->SetRedirect(original->Redirect());
   request->SetIntegrity(original->Integrity());
+  request->SetKeepalive(original->Keepalive());
   return request;
 }
 

diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp
index 8012d00..70da76bce 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp

@@ -4,6 +4,7 @@
 
 #include "modules/media_controls/MediaControlsRotateToFullscreenDelegate.h"
 
+#include "bindings/core/v8/V8BindingForCore.h"
 #include "core/dom/ElementVisibilityObserver.h"
 #include "core/dom/UserGestureIndicator.h"
 #include "core/dom/events/Event.h"
@@ -54,6 +55,11 @@
   // TODO(johnme): Check this is battery efficient (note that this doesn't need
   // to receive events for 180 deg rotations).
   dom_window->addEventListener(EventTypeNames::orientationchange, this, false);
+
+  // TODO(795286): device orientation now requires a v8::Context in the stack so
+  // we are creating one so the event pump starts running.
+  ScriptState::Scope scope(
+      ToScriptStateForMainWorld(video_element_->GetDocument().GetFrame()));
   dom_window->addEventListener(EventTypeNames::deviceorientation, this, false);
 }
 

diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp
index eaf4026..8ac7f2b 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp

@@ -249,8 +249,7 @@
       event->SetDefaultHandled();
     }
   }
-
-  // TODO(mlamouri): should call MediaControlInputElement::DefaultEventHandler.
+  MediaControlInputElement::DefaultEventHandler(event);
 }
 
 bool MediaControlOverlayPlayButtonElement::KeepEventInNode(Event* event) {

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
index dca61cf7..a34a9593 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp

@@ -83,6 +83,7 @@
 #include "modules/peerconnection/RTCVoidRequestImpl.h"
 #include "modules/peerconnection/RTCVoidRequestPromiseImpl.h"
 #include "modules/peerconnection/testing/InternalsRTCPeerConnection.h"
+#include "platform/InstanceCounters.h"
 #include "platform/bindings/Microtask.h"
 #include "platform/bindings/ScriptState.h"
 #include "platform/bindings/V8ThrowException.h"
@@ -116,8 +117,8 @@
 const char kSignalingStateClosedMessage[] =
     "The RTCPeerConnection's signalingState is 'closed'.";
 
-// For testing: Keep track of number of existing PeerConnections.
-int g_peer_connection_counter = 0;
+// The maximum number of PeerConnections that can exist simultaneously.
+const long kMaxPeerConnections = 500;
 
 bool ThrowExceptionIfSignalingStateClosed(
     RTCPeerConnection::SignalingState state,
@@ -508,7 +509,14 @@
   // If we fail, set |m_closed| and |m_stopped| to true, to avoid hitting the
   // assert in the destructor.
 
-  g_peer_connection_counter++;
+  if (InstanceCounters::CounterValue(
+          InstanceCounters::kRTCPeerConnectionCounter) >= kMaxPeerConnections) {
+    exception_state.ThrowDOMException(kUnknownError,
+                                      "Cannot create so many PeerConnections");
+    return;
+  }
+  InstanceCounters::IncrementCounter(
+      InstanceCounters::kRTCPeerConnectionCounter);
   if (!document->GetFrame()) {
     closed_ = true;
     stopped_ = true;
@@ -549,7 +557,8 @@
   // We are assuming that a wrapper is always created when RTCPeerConnection is
   // created.
   DCHECK(closed_ || stopped_);
-  g_peer_connection_counter--;
+  InstanceCounters::DecrementCounter(
+      InstanceCounters::kRTCPeerConnectionCounter);
 }
 
 void RTCPeerConnection::Dispose() {
@@ -1786,7 +1795,12 @@
 }
 
 int RTCPeerConnection::PeerConnectionCount() {
-  return g_peer_connection_counter;
+  return InstanceCounters::CounterValue(
+      InstanceCounters::kRTCPeerConnectionCounter);
+}
+
+int RTCPeerConnection::PeerConnectionCountLimit() {
+  return kMaxPeerConnections;
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h
index fc08d635..7b89fbb 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h

@@ -216,6 +216,7 @@
 
   // For testing; exported to testing/InternalWebRTCPeerConnection
   static int PeerConnectionCount();
+  static int PeerConnectionCountLimit();
 
   virtual void Trace(blink::Visitor*);
 

diff --git a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.cpp b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.cpp
index 05ff3de..cb24dee 100644
--- a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.cpp

@@ -10,4 +10,8 @@
   return RTCPeerConnection::PeerConnectionCount();
 }
 
+int InternalsRTCPeerConnection::peerConnectionCountLimit(Internals& internals) {
+  return RTCPeerConnection::PeerConnectionCountLimit();
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.h b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.h
index 11f4d26..82876d6 100644
--- a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.h
+++ b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.h

@@ -17,6 +17,7 @@
 
  public:
   static int peerConnectionCount(Internals&);
+  static int peerConnectionCountLimit(Internals&);
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.idl b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.idl
index 37fe749..5c572c40 100644
--- a/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.idl
+++ b/third_party/WebKit/Source/modules/peerconnection/testing/InternalsRTCPeerConnection.idl

@@ -6,4 +6,5 @@
     ImplementedAs=InternalsRTCPeerConnection
 ] partial interface Internals {
     long peerConnectionCount();
+    readonly attribute long peerConnectionCountLimit;
 };

diff --git a/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp b/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp
index f3d7e62..c07c4af 100644
--- a/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp
+++ b/third_party/WebKit/Source/modules/sensor/SensorProxy.cpp

@@ -116,8 +116,13 @@
     return;
   }
 
-  if (reading_.timestamp() != reading_data.timestamp()) {
-    DCHECK_GT(reading_data.timestamp(), reading_.timestamp())
+  double latest_timestamp = reading_data.timestamp();
+  if (reading_.timestamp() != latest_timestamp &&
+      latest_timestamp != 0.0)  // The shared buffer is zeroed when
+                                // sensor is stopped, we skip this
+                                // reading.
+  {
+    DCHECK_GT(latest_timestamp, reading_.timestamp())
         << "Timestamps must increase monotonically";
     reading_ = reading_data;
     for (Observer* observer : observers_)

diff --git a/third_party/WebKit/Source/modules/webdatabase/Database.cpp b/third_party/WebKit/Source/modules/webdatabase/Database.cpp
index 39e6d20e..35537f0 100644
--- a/third_party/WebKit/Source/modules/webdatabase/Database.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/Database.cpp

@@ -226,8 +226,7 @@
                    const String& name,
                    const String& expected_version,
                    const String& display_name,
-                   unsigned estimated_size,
-                   V8DatabaseCallback* creation_callback)
+                   unsigned estimated_size)
     : database_context_(database_context),
       name_(name.IsolatedCopy()),
       expected_version_(expected_version.IsolatedCopy()),
@@ -236,7 +235,6 @@
       guid_(0),
       opened_(0),
       new_(false),
-      creation_callback_(creation_callback),
       transaction_in_progress_(false),
       is_transaction_queue_enabled_(true) {
   DCHECK(IsMainThread());
@@ -283,17 +281,13 @@
   visitor->Trace(database_context_);
   visitor->Trace(sqlite_database_);
   visitor->Trace(database_authorizer_);
-  visitor->Trace(creation_callback_);
   ScriptWrappable::Trace(visitor);
 }
 
-void Database::TraceWrappers(const ScriptWrappableVisitor* visitor) const {
-  visitor->TraceWrappers(creation_callback_);
-}
-
 bool Database::OpenAndVerifyVersion(bool set_version_in_new_database,
                                     DatabaseError& error,
-                                    String& error_message) {
+                                    String& error_message,
+                                    V8DatabaseCallback* creation_callback) {
   WaitableEvent event;
   if (!GetDatabaseContext()->DatabaseThreadAvailable())
     return false;
@@ -304,28 +298,27 @@
       this, set_version_in_new_database, &event, error, error_message, success);
   GetDatabaseContext()->GetDatabaseThread()->ScheduleTask(std::move(task));
   event.Wait();
-  if (creation_callback_) {
+  if (creation_callback) {
     if (success && IsNew()) {
       STORAGE_DVLOG(1)
           << "Scheduling DatabaseCreationCallbackTask for database " << this;
       probe::AsyncTaskScheduled(GetExecutionContext(), "openDatabase",
-                                creation_callback_);
+                                creation_callback);
       GetExecutionContext()
           ->GetTaskRunner(TaskType::kDatabaseAccess)
-          ->PostTask(FROM_HERE, WTF::Bind(&Database::RunCreationCallback,
-                                          WrapPersistent(this)));
-    } else {
-      creation_callback_ = nullptr;
+          ->PostTask(
+              FROM_HERE,
+              WTF::Bind(&Database::RunCreationCallback, WrapPersistent(this),
+                        WrapPersistentCallbackFunction(creation_callback)));
     }
   }
 
   return success;
 }
 
-void Database::RunCreationCallback() {
-  probe::AsyncTask async_task(GetExecutionContext(), creation_callback_);
-  creation_callback_->InvokeAndReportException(nullptr, this);
-  creation_callback_ = nullptr;
+void Database::RunCreationCallback(V8DatabaseCallback* creation_callback) {
+  probe::AsyncTask async_task(GetExecutionContext(), creation_callback);
+  creation_callback->InvokeAndReportException(nullptr, this);
 }
 
 void Database::Close() {

diff --git a/third_party/WebKit/Source/modules/webdatabase/Database.h b/third_party/WebKit/Source/modules/webdatabase/Database.h
index e005f51..6f6beca6 100644
--- a/third_party/WebKit/Source/modules/webdatabase/Database.h
+++ b/third_party/WebKit/Source/modules/webdatabase/Database.h

@@ -55,12 +55,12 @@
 
  public:
   virtual ~Database();
-  void Trace(blink::Visitor*);
-  void TraceWrappers(const ScriptWrappableVisitor*) const;
+  void Trace(blink::Visitor*) override;
 
   bool OpenAndVerifyVersion(bool set_version_in_new_database,
                             DatabaseError&,
-                            String& error_message);
+                            String& error_message,
+                            V8DatabaseCallback* creation_callback);
   void Close();
 
   SQLTransactionBackend* RunTransaction(SQLTransaction*,
@@ -129,12 +129,11 @@
            const String& name,
            const String& expected_version,
            const String& display_name,
-           unsigned estimated_size,
-           V8DatabaseCallback* creation_callback);
+           unsigned estimated_size);
   bool PerformOpenAndVerify(bool set_version_in_new_database,
                             DatabaseError&,
                             String& error_message);
-  void RunCreationCallback();
+  void RunCreationCallback(V8DatabaseCallback* creation_callback);
 
   void ScheduleTransaction();
 
@@ -200,7 +199,6 @@
   SQLiteDatabase sqlite_database_;
 
   Member<DatabaseAuthorizer> database_authorizer_;
-  TraceWrapperMember<V8DatabaseCallback> creation_callback_;
   Deque<CrossThreadPersistent<SQLTransactionBackend>> transaction_queue_;
   Mutex transaction_in_progress_mutex_;
   bool transaction_in_progress_;

diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp b/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp
index 7bf1d5a..dbe1c9c 100644
--- a/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp

@@ -146,11 +146,10 @@
   DatabaseContext* backend_context = DatabaseContextFor(context)->Backend();
   if (DatabaseTracker::Tracker().CanEstablishDatabase(
           backend_context, name, display_name, estimated_size, error)) {
-    Database* backend =
-        new Database(backend_context, name, expected_version, display_name,
-                     estimated_size, creation_callback);
+    Database* backend = new Database(backend_context, name, expected_version,
+                                     display_name, estimated_size);
     if (backend->OpenAndVerifyVersion(set_version_in_new_database, error,
-                                      error_message))
+                                      error_message, creation_callback))
       return backend;
   }
 

diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index 27b61fb5..8f42a446 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn

@@ -590,12 +590,6 @@
     "clipboard/ClipboardUtilities.cpp",
     "clipboard/ClipboardUtilities.h",
     "cpu/mips/CommonMacrosMSA.h",
-    "credentialmanager/PlatformCredential.cpp",
-    "credentialmanager/PlatformCredential.h",
-    "credentialmanager/PlatformFederatedCredential.cpp",
-    "credentialmanager/PlatformFederatedCredential.h",
-    "credentialmanager/PlatformPasswordCredential.cpp",
-    "credentialmanager/PlatformPasswordCredential.h",
     "exported/FilePathConversion.cpp",
     "exported/InterfaceRegistry.cpp",
     "exported/Platform.cpp",
@@ -619,7 +613,6 @@
     "exported/WebContentDecryptionModuleResult.cpp",
     "exported/WebContentDecryptionModuleSession.cpp",
     "exported/WebContentSettingCallbacks.cpp",
-    "exported/WebCredential.cpp",
     "exported/WebCryptoAlgorithm.cpp",
     "exported/WebCryptoKey.cpp",
     "exported/WebCryptoKeyAlgorithm.cpp",
@@ -631,7 +624,6 @@
     "exported/WebEncryptedMediaClient.cpp",
     "exported/WebEncryptedMediaKeyInformation.cpp",
     "exported/WebEncryptedMediaRequest.cpp",
-    "exported/WebFederatedCredential.cpp",
     "exported/WebFileSystemCallbacks.cpp",
     "exported/WebFont.cpp",
     "exported/WebFontDescription.cpp",
@@ -653,7 +645,6 @@
     "exported/WebMixedContent.cpp",
     "exported/WebMockClipboard.cpp",
     "exported/WebNetworkStateNotifier.cpp",
-    "exported/WebPasswordCredential.cpp",
     "exported/WebPrerender.cpp",
     "exported/WebPrerenderingSupport.cpp",
     "exported/WebPresentationConnection.cpp",

diff --git a/third_party/WebKit/Source/platform/InstanceCounters.h b/third_party/WebKit/Source/platform/InstanceCounters.h
index f7bdd90..8cc6fed1 100644
--- a/third_party/WebKit/Source/platform/InstanceCounters.h
+++ b/third_party/WebKit/Source/platform/InstanceCounters.h

@@ -51,7 +51,8 @@
   V(PausableObject)               \
   V(V8PerContextData)             \
   V(WorkerGlobalScope)            \
-  V(UACSSResource)
+  V(UACSSResource)                \
+  V(RTCPeerConnection)
 
 class InstanceCounters {
   STATIC_ONLY(InstanceCounters);

diff --git a/third_party/WebKit/Source/platform/WaitableEvent.h b/third_party/WebKit/Source/platform/WaitableEvent.h
index 6fe0550..24d94f23 100644
--- a/third_party/WebKit/Source/platform/WaitableEvent.h
+++ b/third_party/WebKit/Source/platform/WaitableEvent.h

@@ -41,6 +41,9 @@
 
 namespace blink {
 
+// TODO(crbug.com/796799): Deprecate blink::WaitableEvent and use
+// base::WaitableEvent instead.
+//
 // Provides a thread synchronization that can be used to allow one thread to
 // wait until another thread to finish some work.
 class PLATFORM_EXPORT WaitableEvent {

diff --git a/third_party/WebKit/Source/platform/WebTaskRunner.cpp b/third_party/WebKit/Source/platform/WebTaskRunner.cpp
index ec52d749..35b7114 100644
--- a/third_party/WebKit/Source/platform/WebTaskRunner.cpp
+++ b/third_party/WebKit/Source/platform/WebTaskRunner.cpp

@@ -112,22 +112,15 @@
   DCHECK(runner_);
 }
 
-// Use a custom function for base::Bind instead of convertToBaseCallback to
-// avoid copying the closure later in the call chain. Copying the bound state
-// can lead to data races with ref counted objects like StringImpl. See
-// crbug.com/679915 for more details.
 void WebTaskRunner::PostTask(const base::Location& location,
                              CrossThreadClosure task) {
-  PostDelayedTask(location,
-                  base::BindOnce(&RunCrossThreadClosure, std::move(task)),
-                  base::TimeDelta());
+  PostCrossThreadTask(*this, location, std::move(task));
 }
 
 void WebTaskRunner::PostDelayedTask(const base::Location& location,
                                     CrossThreadClosure task,
                                     TimeDelta delay) {
-  PostDelayedTask(
-      location, base::BindOnce(&RunCrossThreadClosure, std::move(task)), delay);
+  PostDelayedCrossThreadTask(*this, location, std::move(task), delay);
 }
 
 void WebTaskRunner::PostTask(const base::Location& location,
@@ -161,4 +154,24 @@
 
 WebTaskRunner::~WebTaskRunner() = default;
 
+// Use a custom function for base::Bind instead of WTF::Bind to
+// avoid copying the closure later in the call chain. Copying the bound state
+// can lead to data races with ref counted objects like StringImpl. See
+// crbug.com/679915 for more details.
+void PostCrossThreadTask(WebTaskRunner& task_runner,
+                         const base::Location& location,
+                         CrossThreadClosure task) {
+  task_runner.PostDelayedTask(
+      location, base::BindOnce(&RunCrossThreadClosure, std::move(task)),
+      base::TimeDelta());
+}
+
+void PostDelayedCrossThreadTask(WebTaskRunner& task_runner,
+                                const base::Location& location,
+                                CrossThreadClosure task,
+                                TimeDelta delay) {
+  task_runner.PostDelayedTask(
+      location, base::BindOnce(&RunCrossThreadClosure, std::move(task)), delay);
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/WebTaskRunner.h b/third_party/WebKit/Source/platform/WebTaskRunner.h
index 1108104..beabea3d 100644
--- a/third_party/WebKit/Source/platform/WebTaskRunner.h
+++ b/third_party/WebKit/Source/platform/WebTaskRunner.h

@@ -70,7 +70,8 @@
 
   // Helpers for posting bound functions as tasks.
 
-  // For cross-thread posting. Can be called from any thread.
+  // Deprecated. Use namespace-level Post(Delayed)CrossThreadTask() defined
+  // below.
   void PostTask(const base::Location&, CrossThreadClosure);
   void PostDelayedTask(const base::Location&,
                        CrossThreadClosure,
@@ -97,6 +98,15 @@
   DISALLOW_COPY_AND_ASSIGN(WebTaskRunner);
 };
 
+// For cross-thread posting. Can be called from any thread.
+BLINK_PLATFORM_EXPORT void PostCrossThreadTask(WebTaskRunner&,
+                                               const base::Location&,
+                                               CrossThreadClosure);
+BLINK_PLATFORM_EXPORT void PostDelayedCrossThreadTask(WebTaskRunner&,
+                                                      const base::Location&,
+                                                      CrossThreadClosure,
+                                                      TimeDelta delay);
+
 }  // namespace blink
 
 #endif  // WebTaskRunner_h

diff --git a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
index 174f9a8c..4bc8be6 100644
--- a/third_party/WebKit/Source/platform/audio/AudioDestination.cpp
+++ b/third_party/WebKit/Source/platform/audio/AudioDestination.cpp

@@ -50,13 +50,7 @@
 // that we would ever need. The current UMA stats indicates that this is, in
 // fact, probably too small. There are Android devices out there with a size of
 // 8000 or so.  We might need to make this larger. See: crbug.com/670747
-// TODO(andrew.macpherson): This either needs to be bigger since some OSes allow
-// buffer sizes of 8192 via latencyHint now or else we need to do some
-// validation of the latencyHint 'exact' size before passing it to
-// CreateAudioDevice. Clamping may be tricky though as the buffer size is
-// dependent on the sample rate for some platforms and we're passing in a time
-// value and not a buffer size in the latencyHint. See: crbug.com/737047
-const size_t kFIFOSize = 8192;
+const size_t kFIFOSize = 96 * 128;
 
 scoped_refptr<AudioDestination> AudioDestination::Create(
     AudioIOCallback& callback,
@@ -272,7 +266,8 @@
   // Check if the requested buffer size is too large.
   bool is_buffer_size_valid =
       callback_buffer_size_ + AudioUtilities::kRenderQuantumFrames <= kFIFOSize;
-  DCHECK(is_buffer_size_valid);
+  DCHECK_LE(callback_buffer_size_ + AudioUtilities::kRenderQuantumFrames,
+            kFIFOSize);
   return is_buffer_size_valid;
 }
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.cpp b/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.cpp
deleted file mode 100644
index 496a88c..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.cpp
+++ /dev/null

@@ -1,18 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "platform/credentialmanager/PlatformCredential.h"
-
-namespace blink {
-
-PlatformCredential* PlatformCredential::Create(const String& id) {
-  return new PlatformCredential(id);
-}
-
-PlatformCredential::PlatformCredential(const String& id)
-    : id_(id), type_("credential") {}
-
-PlatformCredential::~PlatformCredential() {}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.h b/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.h
deleted file mode 100644
index b293b8a..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformCredential.h
+++ /dev/null

@@ -1,41 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PlatformCredential_h
-#define PlatformCredential_h
-#include "base/macros.h"
-#include "platform/heap/Handle.h"
-#include "platform/wtf/text/WTFString.h"
-
-namespace blink {
-
-class PLATFORM_EXPORT PlatformCredential
-    : public GarbageCollectedFinalized<PlatformCredential> {
- public:
-  static PlatformCredential* Create(const String& id);
-  virtual ~PlatformCredential();
-
-  const String& Id() const { return id_; }
-  const String& GetType() const { return type_; }
-
-  virtual bool IsPassword() { return false; }
-  virtual bool IsFederated() { return false; }
-
-  virtual void Trace(blink::Visitor* visitor) {}
-
- protected:
-  PlatformCredential(const String& id);
-
-  void SetType(const String& type) { type_ = type; }
-
- private:
-  String id_;
-  String type_;
-
-  DISALLOW_COPY_AND_ASSIGN(PlatformCredential);
-};
-
-}  // namespace blink
-
-#endif  // PlatformCredential_h

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.cpp b/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.cpp
deleted file mode 100644
index 3ef5f2c..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.cpp
+++ /dev/null

@@ -1,32 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "platform/credentialmanager/PlatformFederatedCredential.h"
-
-namespace blink {
-
-PlatformFederatedCredential* PlatformFederatedCredential::Create(
-    const String& id,
-    scoped_refptr<const SecurityOrigin> provider,
-    const String& name,
-    const KURL& icon_url) {
-  return new PlatformFederatedCredential(id, std::move(provider), name,
-                                         icon_url);
-}
-
-PlatformFederatedCredential::PlatformFederatedCredential(
-    const String& id,
-    scoped_refptr<const SecurityOrigin> provider,
-    const String& name,
-    const KURL& icon_url)
-    : PlatformCredential(id),
-      name_(name),
-      icon_url_(icon_url),
-      provider_(std::move(provider)) {
-  SetType("federated");
-}
-
-PlatformFederatedCredential::~PlatformFederatedCredential() {}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.h b/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.h
deleted file mode 100644
index a20e2fe..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformFederatedCredential.h
+++ /dev/null

@@ -1,46 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PlatformFederatedCredential_h
-#define PlatformFederatedCredential_h
-
-#include "platform/credentialmanager/PlatformCredential.h"
-#include "platform/heap/Handle.h"
-#include "platform/weborigin/KURL.h"
-#include "platform/weborigin/SecurityOrigin.h"
-#include "platform/wtf/text/WTFString.h"
-
-namespace blink {
-
-class PLATFORM_EXPORT PlatformFederatedCredential final
-    : public PlatformCredential {
-  WTF_MAKE_NONCOPYABLE(PlatformFederatedCredential);
-
- public:
-  static PlatformFederatedCredential* Create(
-      const String& id,
-      scoped_refptr<const SecurityOrigin> provider,
-      const String& name,
-      const KURL& icon_url);
-  ~PlatformFederatedCredential() override;
-
-  scoped_refptr<const SecurityOrigin> Provider() const { return provider_; }
-
-  bool IsFederated() override { return true; }
-  const String& Name() const { return name_; }
-  const KURL& IconURL() const { return icon_url_; }
-
- private:
-  PlatformFederatedCredential(const String& id,
-                              scoped_refptr<const SecurityOrigin> provider,
-                              const String& name,
-                              const KURL& icon_url);
-  String name_;
-  KURL icon_url_;
-  scoped_refptr<const SecurityOrigin> provider_;
-};
-
-}  // namespace blink
-
-#endif  // PlatformFederatedCredential_h

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.cpp b/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.cpp
deleted file mode 100644
index 13b1c01..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.cpp
+++ /dev/null

@@ -1,30 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "platform/credentialmanager/PlatformPasswordCredential.h"
-
-namespace blink {
-
-PlatformPasswordCredential* PlatformPasswordCredential::Create(
-    const String& id,
-    const String& password,
-    const String& name,
-    const KURL& icon_url) {
-  return new PlatformPasswordCredential(id, password, name, icon_url);
-}
-
-PlatformPasswordCredential::PlatformPasswordCredential(const String& id,
-                                                       const String& password,
-                                                       const String& name,
-                                                       const KURL& icon_url)
-    : PlatformCredential(id),
-      name_(name),
-      icon_url_(icon_url),
-      password_(password) {
-  SetType("password");
-}
-
-PlatformPasswordCredential::~PlatformPasswordCredential() {}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.h b/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.h
deleted file mode 100644
index 676e556..0000000
--- a/third_party/WebKit/Source/platform/credentialmanager/PlatformPasswordCredential.h
+++ /dev/null

@@ -1,45 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PlatformPasswordCredential_h
-#define PlatformPasswordCredential_h
-
-#include "base/macros.h"
-#include "platform/credentialmanager/PlatformCredential.h"
-#include "platform/heap/Handle.h"
-#include "platform/weborigin/KURL.h"
-#include "platform/wtf/text/WTFString.h"
-
-namespace blink {
-
-class PLATFORM_EXPORT PlatformPasswordCredential final
-    : public PlatformCredential {
- public:
-  static PlatformPasswordCredential* Create(const String& id,
-                                            const String& password,
-                                            const String& name,
-                                            const KURL& icon_url);
-  ~PlatformPasswordCredential() override;
-
-  const String& Password() const { return password_; }
-
-  bool IsPassword() override { return true; }
-  const String& Name() const { return name_; }
-  const KURL& IconURL() const { return icon_url_; }
-
- private:
-  PlatformPasswordCredential(const String& id,
-                             const String& password,
-                             const String& name,
-                             const KURL& icon_url);
-  String name_;
-  KURL icon_url_;
-  String password_;
-
-  DISALLOW_COPY_AND_ASSIGN(PlatformPasswordCredential);
-};
-
-}  // namespace blink
-
-#endif  // PlatformPasswordCredential_h

diff --git a/third_party/WebKit/Source/platform/exported/WebCredential.cpp b/third_party/WebKit/Source/platform/exported/WebCredential.cpp
deleted file mode 100644
index f01c886..0000000
--- a/third_party/WebKit/Source/platform/exported/WebCredential.cpp
+++ /dev/null

@@ -1,67 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "public/platform/WebCredential.h"
-
-#include <memory>
-#include "platform/credentialmanager/PlatformCredential.h"
-#include "public/platform/WebFederatedCredential.h"
-#include "public/platform/WebPasswordCredential.h"
-
-namespace blink {
-
-std::unique_ptr<WebCredential> WebCredential::Create(
-    PlatformCredential* credential) {
-  if (credential->IsPassword()) {
-    return std::make_unique<WebPasswordCredential>(credential);
-  }
-
-  if (credential->IsFederated()) {
-    return std::make_unique<WebFederatedCredential>(credential);
-  }
-
-  NOTREACHED();
-  return nullptr;
-}
-
-WebCredential::WebCredential(const WebString& id)
-    : platform_credential_(PlatformCredential::Create(id)) {}
-
-WebCredential::WebCredential(const WebCredential& other) {
-  Assign(other);
-}
-
-void WebCredential::Assign(const WebCredential& other) {
-  platform_credential_ = other.platform_credential_;
-}
-
-WebCredential::WebCredential(PlatformCredential* credential)
-    : platform_credential_(credential) {}
-
-WebCredential& WebCredential::operator=(PlatformCredential* credential) {
-  platform_credential_ = credential;
-  return *this;
-}
-
-void WebCredential::Reset() {
-  platform_credential_.Reset();
-}
-
-WebString WebCredential::Id() const {
-  return platform_credential_->Id();
-}
-
-WebString WebCredential::GetType() const {
-  return platform_credential_->GetType();
-}
-
-bool WebCredential::IsPasswordCredential() const {
-  return platform_credential_->IsPassword();
-}
-
-bool WebCredential::IsFederatedCredential() const {
-  return platform_credential_->IsFederated();
-}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/exported/WebFederatedCredential.cpp b/third_party/WebKit/Source/platform/exported/WebFederatedCredential.cpp
deleted file mode 100644
index 5241840c..0000000
--- a/third_party/WebKit/Source/platform/exported/WebFederatedCredential.cpp
+++ /dev/null

@@ -1,46 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "public/platform/WebFederatedCredential.h"
-
-#include "platform/credentialmanager/PlatformFederatedCredential.h"
-
-namespace blink {
-WebFederatedCredential::WebFederatedCredential(
-    const WebString& id,
-    const WebSecurityOrigin& provider,
-    const WebString& name,
-    const WebURL& icon_url)
-    : WebCredential(
-          PlatformFederatedCredential::Create(id, provider, name, icon_url)) {}
-
-void WebFederatedCredential::Assign(const WebFederatedCredential& other) {
-  platform_credential_ = other.platform_credential_;
-}
-
-WebSecurityOrigin WebFederatedCredential::Provider() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->Provider();
-}
-
-WebString WebFederatedCredential::Name() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->Name();
-}
-
-WebURL WebFederatedCredential::IconURL() const {
-  return static_cast<PlatformFederatedCredential*>(platform_credential_.Get())
-      ->IconURL();
-}
-
-WebFederatedCredential::WebFederatedCredential(PlatformCredential* credential)
-    : WebCredential(credential) {}
-
-WebFederatedCredential& WebFederatedCredential::operator=(
-    PlatformCredential* credential) {
-  platform_credential_ = credential;
-  return *this;
-}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/exported/WebPasswordCredential.cpp b/third_party/WebKit/Source/platform/exported/WebPasswordCredential.cpp
deleted file mode 100644
index f23ec11..0000000
--- a/third_party/WebKit/Source/platform/exported/WebPasswordCredential.cpp
+++ /dev/null

@@ -1,45 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "public/platform/WebPasswordCredential.h"
-
-#include "platform/credentialmanager/PlatformPasswordCredential.h"
-
-namespace blink {
-WebPasswordCredential::WebPasswordCredential(const WebString& id,
-                                             const WebString& password,
-                                             const WebString& name,
-                                             const WebURL& icon_url)
-    : WebCredential(
-          PlatformPasswordCredential::Create(id, password, name, icon_url)) {}
-
-void WebPasswordCredential::Assign(const WebPasswordCredential& other) {
-  platform_credential_ = other.platform_credential_;
-}
-
-WebString WebPasswordCredential::Password() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->Password();
-}
-
-WebString WebPasswordCredential::Name() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->Name();
-}
-
-WebURL WebPasswordCredential::IconURL() const {
-  return static_cast<PlatformPasswordCredential*>(platform_credential_.Get())
-      ->IconURL();
-}
-
-WebPasswordCredential::WebPasswordCredential(PlatformCredential* credential)
-    : WebCredential(credential) {}
-
-WebPasswordCredential& WebPasswordCredential::operator=(
-    PlatformCredential* credential) {
-  platform_credential_ = credential;
-  return *this;
-}
-
-}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/exported/WebRuntimeFeatures.cpp b/third_party/WebKit/Source/platform/exported/WebRuntimeFeatures.cpp
index c8cdb55..e346d50e 100644
--- a/third_party/WebKit/Source/platform/exported/WebRuntimeFeatures.cpp
+++ b/third_party/WebKit/Source/platform/exported/WebRuntimeFeatures.cpp

@@ -490,4 +490,8 @@
   RuntimeEnabledFeatures::SetPWAFullCodeCacheEnabled(enable);
 }
 
+void WebRuntimeFeatures::EnableDoubleTapToJumpOnVideo(bool enable) {
+  RuntimeEnabledFeatures::SetDoubleTapToJumpOnVideoEnabled(enable);
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp b/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp
index 0e2d50a..5861585f 100644
--- a/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp
+++ b/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp

@@ -145,6 +145,10 @@
   resource_request_->SetCacheMode(cache_mode);
 }
 
+double WebURLRequest::TimeoutInterval() const {
+  return resource_request_->TimeoutInterval();
+}
+
 WebString WebURLRequest::HttpMethod() const {
   return resource_request_->HttpMethod();
 }

diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.cpp b/third_party/WebKit/Source/platform/fonts/FontCache.cpp
index 20376c8..a1a47c03 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.cpp

@@ -275,6 +275,17 @@
   return font.get();
 }
 
+scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+    const FontDescription& description,
+    UChar32 lookup_char,
+    const SimpleFontData* font_data_to_substitute,
+    FontFallbackPriority fallback_priority) {
+  if (Character::IsUnassignedOrPrivateUse(lookup_char))
+    return nullptr;
+  return PlatformFallbackFontForCharacter(
+      description, lookup_char, font_data_to_substitute, fallback_priority);
+}
+
 void FontCache::ReleaseFontData(const SimpleFontData* font_data) {
   font_data_cache_.Release(font_data);
 }

diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.h b/third_party/WebKit/Source/platform/fonts/FontCache.h
index 225c761..c75a78a 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.h
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.h

@@ -107,8 +107,6 @@
 
   void ReleaseFontData(const SimpleFontData*);
 
-  // This method is implemented by the plaform and used by
-  // FontFastPath to lookup the font for a given character.
   scoped_refptr<SimpleFontData> FallbackFontForCharacter(
       const FontDescription&,
       UChar32,
@@ -239,6 +237,12 @@
   ~FontCache() {}
 
  private:
+  scoped_refptr<SimpleFontData> PlatformFallbackFontForCharacter(
+      const FontDescription&,
+      UChar32,
+      const SimpleFontData* font_data_to_substitute,
+      FontFallbackPriority = FontFallbackPriority::kText);
+
   friend class FontGlobalContext;
   FontCache();
 

diff --git a/third_party/WebKit/Source/platform/fonts/FontCacheTest.cpp b/third_party/WebKit/Source/platform/fonts/FontCacheTest.cpp
index 5da0633..2b824fd 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCacheTest.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontCacheTest.cpp

@@ -28,6 +28,21 @@
   EXPECT_TRUE(font_data);
 }
 
+TEST(FontCache, NoFallbackForPrivateUseArea) {
+  FontCache* font_cache = FontCache::GetFontCache();
+  ASSERT_TRUE(font_cache);
+
+  FontDescription font_description;
+  font_description.SetGenericFamily(FontDescription::kStandardFamily);
+  for (UChar32 character : {0xE000, 0xE401, 0xE402, 0xE403, 0xF8FF, 0xF0000,
+                            0xFAAAA, 0xFFFFF, 0x100000, 0x10AAAA, 0x10FFFF}) {
+    scoped_refptr<SimpleFontData> font_data =
+        font_cache->FallbackFontForCharacter(font_description, character,
+                                             nullptr);
+    EXPECT_EQ(font_data.get(), nullptr);
+  }
+}
+
 TEST(FontCache, firstAvailableOrFirst) {
   EXPECT_TRUE(FontCache::FirstAvailableOrFirst("").IsEmpty());
   EXPECT_TRUE(FontCache::FirstAvailableOrFirst(String()).IsEmpty());

diff --git a/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp b/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp
index 28ab743..672b3c6 100644
--- a/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp
+++ b/third_party/WebKit/Source/platform/fonts/android/FontCacheAndroid.cpp

@@ -76,7 +76,7 @@
 // static
 void FontCache::SetSystemFontFamily(const AtomicString&) {}
 
-scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+scoped_refptr<SimpleFontData> FontCache::PlatformFallbackFontForCharacter(
     const FontDescription& font_description,
     UChar32 c,
     const SimpleFontData*,

diff --git a/third_party/WebKit/Source/platform/fonts/fuchsia/FontCacheFuchsia.cpp b/third_party/WebKit/Source/platform/fonts/fuchsia/FontCacheFuchsia.cpp
index 70a4b6cd..106feb6 100644
--- a/third_party/WebKit/Source/platform/fonts/fuchsia/FontCacheFuchsia.cpp
+++ b/third_party/WebKit/Source/platform/fonts/fuchsia/FontCacheFuchsia.cpp

@@ -45,7 +45,7 @@
   NOTIMPLEMENTED();
 }
 
-scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+scoped_refptr<SimpleFontData> FontCache::PlatformFallbackFontForCharacter(
     const FontDescription&,
     UChar32,
     const SimpleFontData* font_data_to_substitute,

diff --git a/third_party/WebKit/Source/platform/fonts/linux/FontCacheLinux.cpp b/third_party/WebKit/Source/platform/fonts/linux/FontCacheLinux.cpp
index 63e652b..b740375 100644
--- a/third_party/WebKit/Source/platform/fonts/linux/FontCacheLinux.cpp
+++ b/third_party/WebKit/Source/platform/fonts/linux/FontCacheLinux.cpp

@@ -86,7 +86,7 @@
 }
 
 #if !defined(OS_ANDROID)
-scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+scoped_refptr<SimpleFontData> FontCache::PlatformFallbackFontForCharacter(
     const FontDescription& font_description,
     UChar32 c,
     const SimpleFontData*,

diff --git a/third_party/WebKit/Source/platform/fonts/mac/FontCacheMac.mm b/third_party/WebKit/Source/platform/fonts/mac/FontCacheMac.mm
index 2e119a30..7908f124 100644
--- a/third_party/WebKit/Source/platform/fonts/mac/FontCacheMac.mm
+++ b/third_party/WebKit/Source/platform/fonts/mac/FontCacheMac.mm

@@ -105,7 +105,7 @@
   return app_kit_font_weight >= 7;
 }
 
-scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+scoped_refptr<SimpleFontData> FontCache::PlatformFallbackFontForCharacter(
     const FontDescription& font_description,
     UChar32 character,
     const SimpleFontData* font_data_to_substitute,

diff --git a/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp b/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp
index 24e59a93..ff6cf75b 100644
--- a/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp
+++ b/third_party/WebKit/Source/platform/fonts/win/FontCacheSkiaWin.cpp

@@ -110,7 +110,7 @@
 
 // Given the desired base font, this will create a SimpleFontData for a specific
 // font that can be used to render the given range of characters.
-scoped_refptr<SimpleFontData> FontCache::FallbackFontForCharacter(
+scoped_refptr<SimpleFontData> FontCache::PlatformFallbackFontForCharacter(
     const FontDescription& font_description,
     UChar32 character,
     const SimpleFontData* original_font_data,

diff --git a/third_party/WebKit/Source/platform/loader/fetch/FetchParameters.cpp b/third_party/WebKit/Source/platform/loader/fetch/FetchParameters.cpp
index 5ec729e4..c9e3ef21 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/FetchParameters.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/FetchParameters.cpp

@@ -122,7 +122,9 @@
   // Synchronous requests should always be max priority, lest they hang the
   // renderer.
   resource_request_.SetPriority(ResourceLoadPriority::kHighest);
-  resource_request_.SetTimeoutInterval(10);
+  if (resource_request_.TimeoutInterval() == INT_MAX) {
+    resource_request_.SetTimeoutInterval(10);
+  }
   options_.synchronous_policy = kRequestSynchronously;
 }
 

diff --git a/third_party/WebKit/Source/platform/loader/fetch/RawResource.cpp b/third_party/WebKit/Source/platform/loader/fetch/RawResource.cpp
index 3d636fc..62bf707 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/RawResource.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/RawResource.cpp

@@ -231,6 +231,8 @@
 }
 
 void RawResource::DidDownloadData(int data_length) {
+  downloaded_file_length_ =
+      (downloaded_file_length_ ? *downloaded_file_length_ : 0) + data_length;
   ResourceClientWalker<RawResourceClient> w(Clients());
   while (RawResourceClient* c = w.Next())
     c->DataDownloaded(this, data_length);

diff --git a/third_party/WebKit/Source/platform/loader/fetch/RawResource.h b/third_party/WebKit/Source/platform/loader/fetch/RawResource.h
index 31646e0..9b361f01 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/RawResource.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/RawResource.h

@@ -30,6 +30,7 @@
 #include "platform/loader/fetch/Resource.h"
 #include "platform/loader/fetch/ResourceClient.h"
 #include "platform/loader/fetch/ResourceLoaderOptions.h"
+#include "platform/wtf/Optional.h"
 #include "public/platform/WebDataConsumerHandle.h"
 
 namespace blink {
@@ -80,6 +81,10 @@
   bool WillFollowRedirect(const ResourceRequest&,
                           const ResourceResponse&) override;
 
+  WTF::Optional<int64_t> DownloadedFileLength() const {
+    return downloaded_file_length_;
+  }
+
  private:
   class RawResourceFactory : public NonTextResourceFactory {
    public:
@@ -111,6 +116,8 @@
   bool MatchPreload(const FetchParameters&, WebTaskRunner*) override;
   void NotifyFinished() override;
 
+  WTF::Optional<int64_t> downloaded_file_length_;
+
   // Used for preload matching.
   std::unique_ptr<BufferingDataPipeWriter> data_pipe_writer_;
   std::unique_ptr<WebDataConsumerHandle> data_consumer_handle_;

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
index 1402764..540c43a 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp

@@ -63,6 +63,8 @@
 
 namespace blink {
 
+constexpr uint32_t ResourceFetcher::kKeepaliveInflightBytesQuota;
+
 namespace {
 
 constexpr base::TimeDelta kKeepaliveLoadersTimeout =
@@ -1357,9 +1359,13 @@
 
 void ResourceFetcher::HandleLoaderFinish(Resource* resource,
                                          double finish_time,
-                                         LoaderFinishType type) {
+                                         LoaderFinishType type,
+                                         uint32_t inflight_keepalive_bytes) {
   DCHECK(resource);
 
+  DCHECK_LE(inflight_keepalive_bytes, inflight_keepalive_bytes_);
+  inflight_keepalive_bytes_ -= inflight_keepalive_bytes;
+
   ResourceLoader* loader = resource->Loader();
   if (type == kDidFinishFirstPartInMultipart) {
     // When loading a multipart resource, make the loader non-block when
@@ -1418,9 +1424,13 @@
 }
 
 void ResourceFetcher::HandleLoaderError(Resource* resource,
-                                        const ResourceError& error) {
+                                        const ResourceError& error,
+                                        uint32_t inflight_keepalive_bytes) {
   DCHECK(resource);
 
+  DCHECK_LE(inflight_keepalive_bytes_, inflight_keepalive_bytes);
+  inflight_keepalive_bytes_ -= inflight_keepalive_bytes;
+
   RemoveResourceLoader(resource->Loader());
 
   resource_timing_info_map_.Take(resource);
@@ -1497,7 +1507,21 @@
     // crbug.com/632580
     resource->SetResourceRequest(request);
 
-    loader = ResourceLoader::Create(this, scheduler_, resource);
+    using QuotaType = decltype(inflight_keepalive_bytes_);
+    QuotaType size = 0;
+    if (request.GetKeepalive() && request.HttpBody()) {
+      auto original_size = request.HttpBody()->SizeInBytes();
+      DCHECK_LE(inflight_keepalive_bytes_, kKeepaliveInflightBytesQuota);
+      if (original_size > std::numeric_limits<QuotaType>::max())
+        return false;
+      size = static_cast<QuotaType>(original_size);
+      if (kKeepaliveInflightBytesQuota - inflight_keepalive_bytes_ < size)
+        return false;
+
+      inflight_keepalive_bytes_ += size;
+    }
+
+    loader = ResourceLoader::Create(this, scheduler_, resource, size);
     if (resource->ShouldBlockLoadEvent())
       loaders_.insert(loader);
     else

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h
index 557aa78..8d09171 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h

@@ -129,8 +129,13 @@
   void RecordResourceTimingOnRedirect(Resource*, const ResourceResponse&, bool);
 
   enum LoaderFinishType { kDidFinishLoading, kDidFinishFirstPartInMultipart };
-  void HandleLoaderFinish(Resource*, double finish_time, LoaderFinishType);
-  void HandleLoaderError(Resource*, const ResourceError&);
+  void HandleLoaderFinish(Resource*,
+                          double finish_time,
+                          LoaderFinishType,
+                          uint32_t inflight_keepalive_bytes);
+  void HandleLoaderError(Resource*,
+                         const ResourceError&,
+                         uint32_t inflight_keepalive_bytes);
   bool IsControlledByServiceWorker() const;
 
   String GetCacheIdentifier() const;
@@ -291,11 +296,15 @@
   // Timeout timer for keepalive requests.
   TaskHandle keepalive_loaders_task_handle_;
 
+  uint32_t inflight_keepalive_bytes_ = 0;
+
   // 28 bits left
   bool auto_load_images_ : 1;
   bool images_enabled_ : 1;
   bool allow_stale_resources_ : 1;
   bool image_fetched_ : 1;
+
+  static constexpr uint32_t kKeepaliveInflightBytesQuota = 64 * 1024;
 };
 
 class ResourceCacheValidationSuppressor {

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp
index 5bcd2301..d707d35 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.cpp

@@ -66,17 +66,21 @@
 
 ResourceLoader* ResourceLoader::Create(ResourceFetcher* fetcher,
                                        ResourceLoadScheduler* scheduler,
-                                       Resource* resource) {
-  return new ResourceLoader(fetcher, scheduler, resource);
+                                       Resource* resource,
+                                       uint32_t inflight_keepalive_bytes) {
+  return new ResourceLoader(fetcher, scheduler, resource,
+                            inflight_keepalive_bytes);
 }
 
 ResourceLoader::ResourceLoader(ResourceFetcher* fetcher,
                                ResourceLoadScheduler* scheduler,
-                               Resource* resource)
+                               Resource* resource,
+                               uint32_t inflight_keepalive_bytes)
     : scheduler_client_id_(ResourceLoadScheduler::kInvalidClientId),
       fetcher_(fetcher),
       scheduler_(scheduler),
       resource_(resource),
+      inflight_keepalive_bytes_(inflight_keepalive_bytes),
       is_cache_aware_loading_activated_(false),
       cancel_timer_(
           GetTaskRunnerFor(resource_->GetResourceRequest(), Context()),
@@ -625,8 +629,8 @@
       resource_->Identifier(),
       network_instrumentation::RequestOutcome::kSuccess);
 
-  fetcher_->HandleLoaderFinish(resource_.Get(), 0,
-                               ResourceFetcher::kDidFinishFirstPartInMultipart);
+  fetcher_->HandleLoaderFinish(
+      resource_.Get(), 0, ResourceFetcher::kDidFinishFirstPartInMultipart, 0);
 }
 
 void ResourceLoader::DidFinishLoading(double finish_time,
@@ -647,7 +651,8 @@
       network_instrumentation::RequestOutcome::kSuccess);
 
   fetcher_->HandleLoaderFinish(resource_.Get(), finish_time,
-                               ResourceFetcher::kDidFinishLoading);
+                               ResourceFetcher::kDidFinishLoading,
+                               inflight_keepalive_bytes_);
 }
 
 void ResourceLoader::DidFail(const WebURLError& error,
@@ -676,12 +681,11 @@
   network_instrumentation::EndResourceLoad(
       resource_->Identifier(), network_instrumentation::RequestOutcome::kFail);
 
-  fetcher_->HandleLoaderError(resource_.Get(), error);
+  fetcher_->HandleLoaderError(resource_.Get(), error,
+                              inflight_keepalive_bytes_);
 }
 
 void ResourceLoader::RequestSynchronously(const ResourceRequest& request) {
-  // downloadToFile is not supported for synchronous requests.
-  DCHECK(!request.DownloadToFile());
   DCHECK(loader_);
   DCHECK_EQ(request.Priority(), ResourceLoadPriority::kHighest);
 
@@ -691,8 +695,10 @@
   WebData data_out;
   int64_t encoded_data_length = WebURLLoaderClient::kUnknownEncodedDataLength;
   int64_t encoded_body_length = 0;
+  base::Optional<int64_t> downloaded_file_length;
   loader_->LoadSynchronously(request_in, response_out, error_out, data_out,
-                             encoded_data_length, encoded_body_length);
+                             encoded_data_length, encoded_body_length,
+                             downloaded_file_length);
 
   // A message dispatched while synchronously fetching the resource
   // can bring about the cancellation of this load.
@@ -722,6 +728,11 @@
     });
     resource_->SetResourceBuffer(data_out);
   }
+
+  if (downloaded_file_length) {
+    DCHECK(request.DownloadToFile());
+    DidDownloadData(*downloaded_file_length, encoded_body_length);
+  }
   DidFinishLoading(CurrentTimeTicksInSeconds(), encoded_data_length,
                    encoded_body_length, decoded_body_length);
 }

diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.h b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.h
index 2d6c5c38..5385610 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceLoader.h

@@ -61,7 +61,8 @@
  public:
   static ResourceLoader* Create(ResourceFetcher*,
                                 ResourceLoadScheduler*,
-                                Resource*);
+                                Resource*,
+                                uint32_t inflight_keepalive_bytes = 0);
   ~ResourceLoader() override;
   void Trace(blink::Visitor*) override;
 
@@ -135,7 +136,10 @@
   friend class SubresourceIntegrityTest;
 
   // Assumes ResourceFetcher and Resource are non-null.
-  ResourceLoader(ResourceFetcher*, ResourceLoadScheduler*, Resource*);
+  ResourceLoader(ResourceFetcher*,
+                 ResourceLoadScheduler*,
+                 Resource*,
+                 uint32_t inflight_keepalive_bytes);
 
   void StartWith(const ResourceRequest&);
 
@@ -164,6 +168,7 @@
   Member<ResourceLoadScheduler> scheduler_;
   Member<Resource> resource_;
 
+  uint32_t inflight_keepalive_bytes_;
   bool is_cache_aware_loading_activated_;
 
   TaskRunnerTimer<ResourceLoader> cancel_timer_;

diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc
index 85b0feb..e20f2f8d 100644
--- a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc

@@ -101,12 +101,14 @@
   return redirect_url;
 }
 
-void WebURLLoaderMock::LoadSynchronously(const WebURLRequest& request,
-                                         WebURLResponse& response,
-                                         base::Optional<WebURLError>& error,
-                                         WebData& data,
-                                         int64_t& encoded_data_length,
-                                         int64_t& encoded_body_length) {
+void WebURLLoaderMock::LoadSynchronously(
+    const WebURLRequest& request,
+    WebURLResponse& response,
+    base::Optional<WebURLError>& error,
+    WebData& data,
+    int64_t& encoded_data_length,
+    int64_t& encoded_body_length,
+    base::Optional<int64_t>& downloaded_file_length) {
   if (factory_->IsMockedURL(request.Url())) {
     factory_->LoadSynchronously(request, &response, &error, &data,
                                 &encoded_data_length);
@@ -115,7 +117,8 @@
   AssertFallbackLoaderAvailability(request.Url(), default_loader_.get());
   using_default_loader_ = true;
   default_loader_->LoadSynchronously(request, response, error, data,
-                                     encoded_data_length, encoded_body_length);
+                                     encoded_data_length, encoded_body_length,
+                                     downloaded_file_length);
 }
 
 void WebURLLoaderMock::LoadAsynchronously(const WebURLRequest& request,

diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h
index 1d049ea..9572e57d 100644
--- a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h

@@ -45,12 +45,14 @@
                        const WebURLResponse& redirect_response);
 
   // WebURLLoader methods:
-  void LoadSynchronously(const WebURLRequest& request,
-                         WebURLResponse& response,
-                         Optional<WebURLError>& error,
-                         WebData& data,
-                         int64_t& encoded_data_length,
-                         int64_t& encoded_body_length) override;
+  void LoadSynchronously(
+      const WebURLRequest& request,
+      WebURLResponse& response,
+      Optional<WebURLError>& error,
+      WebData& data,
+      int64_t& encoded_data_length,
+      int64_t& encoded_body_length,
+      base::Optional<int64_t>& downloaded_file_length) override;
   void LoadAsynchronously(const WebURLRequest& request,
                           WebURLLoaderClient* client) override;
   void Cancel() override;

diff --git a/third_party/WebKit/Source/platform/text/Character.cpp b/third_party/WebKit/Source/platform/text/Character.cpp
index b37b8c7..ec7766a1 100644
--- a/third_party/WebKit/Source/platform/text/Character.cpp
+++ b/third_party/WebKit/Source/platform/text/Character.cpp

@@ -283,4 +283,9 @@
          (script == USCRIPT_COMMON || script == USCRIPT_INHERITED);
 }
 
+bool Character::IsUnassignedOrPrivateUse(UChar32 character) {
+  return WTF::Unicode::Category(character) &
+         (WTF::Unicode::kOther_NotAssigned | WTF::Unicode::kOther_PrivateUse);
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/text/Character.h b/third_party/WebKit/Source/platform/text/Character.h
index d617f2a2..71aa562 100644
--- a/third_party/WebKit/Source/platform/text/Character.h
+++ b/third_party/WebKit/Source/platform/text/Character.h

@@ -175,6 +175,7 @@
   static String NormalizeSpaces(const UChar*, unsigned length);
 
   static bool IsCommonOrInheritedScript(UChar32);
+  static bool IsUnassignedOrPrivateUse(UChar32);
 
  private:
   static bool IsCJKIdeographOrSymbolSlow(UChar32);

diff --git a/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py b/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py
index 0797088..6f97d640 100755
--- a/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py
+++ b/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py

@@ -56,6 +56,9 @@
             # //base/memory/ptr_util.h.
             'base::WrapUnique',
 
+            # //base/synchronization/waitable_event.h.
+            'base::WaitableEvent',
+
             # Debugging helpers from //base/debug are allowed everywhere.
             'base::debug::.+',
 

diff --git a/third_party/WebKit/common/feature_policy/feature_policy.cc b/third_party/WebKit/common/feature_policy/feature_policy.cc
index 18a35ee..1179368 100644
--- a/third_party/WebKit/common/feature_policy/feature_policy.cc
+++ b/third_party/WebKit/common/feature_policy/feature_policy.cc

@@ -40,7 +40,7 @@
 ParsedFeaturePolicyDeclaration::ParsedFeaturePolicyDeclaration(
     const ParsedFeaturePolicyDeclaration& rhs) = default;
 
-ParsedFeaturePolicyDeclaration::~ParsedFeaturePolicyDeclaration() {}
+ParsedFeaturePolicyDeclaration::~ParsedFeaturePolicyDeclaration() = default;
 
 bool operator==(const ParsedFeaturePolicyDeclaration& lhs,
                 const ParsedFeaturePolicyDeclaration& rhs) {
@@ -183,7 +183,7 @@
 FeaturePolicy::FeaturePolicy(url::Origin origin)
     : origin_(origin), feature_list_(GetDefaultFeatureList()) {}
 
-FeaturePolicy::~FeaturePolicy() {}
+FeaturePolicy::~FeaturePolicy() = default;
 
 // static
 std::unique_ptr<FeaturePolicy> FeaturePolicy::CreateFromParentPolicy(

diff --git a/third_party/WebKit/common/feature_policy/feature_policy_unittest.cc b/third_party/WebKit/common/feature_policy/feature_policy_unittest.cc
index 784578d..dbfca2370 100644
--- a/third_party/WebKit/common/feature_policy/feature_policy_unittest.cc
+++ b/third_party/WebKit/common/feature_policy/feature_policy_unittest.cc

@@ -32,7 +32,7 @@
              {kDefaultOffFeature,
               FeaturePolicy::FeatureDefault::DisableForAll}}) {}
 
-  ~FeaturePolicyTest() override {}
+  ~FeaturePolicyTest() override = default;
 
   std::unique_ptr<FeaturePolicy> CreateFromParentPolicy(
       const FeaturePolicy* parent,

diff --git a/third_party/WebKit/common/frame_policy.cc b/third_party/WebKit/common/frame_policy.cc
index 78eaab5..8b01b71 100644
--- a/third_party/WebKit/common/frame_policy.cc
+++ b/third_party/WebKit/common/frame_policy.cc

@@ -13,10 +13,8 @@
                          const ParsedFeaturePolicy& container_policy)
     : sandbox_flags(sandbox_flags), container_policy(container_policy) {}
 
-FramePolicy::FramePolicy(const FramePolicy& lhs)
-    : sandbox_flags(lhs.sandbox_flags),
-      container_policy(lhs.container_policy) {}
+FramePolicy::FramePolicy(const FramePolicy& lhs) = default;
 
-FramePolicy::~FramePolicy() {}
+FramePolicy::~FramePolicy() = default;
 
 }  // namespace blink

diff --git a/third_party/WebKit/common/message_port/message_port_channel.cc b/third_party/WebKit/common/message_port/message_port_channel.cc
index a972c36..dca6a76 100644
--- a/third_party/WebKit/common/message_port/message_port_channel.cc
+++ b/third_party/WebKit/common/message_port/message_port_channel.cc

@@ -14,12 +14,12 @@
 
 namespace blink {
 
-MessagePortChannel::~MessagePortChannel() {}
+MessagePortChannel::~MessagePortChannel() = default;
 
 MessagePortChannel::MessagePortChannel() : state_(new State()) {}
 
-MessagePortChannel::MessagePortChannel(const MessagePortChannel& other)
-    : state_(other.state_) {}
+MessagePortChannel::MessagePortChannel(const MessagePortChannel& other) =
+    default;
 
 MessagePortChannel& MessagePortChannel::operator=(
     const MessagePortChannel& other) {
@@ -117,7 +117,7 @@
   state_->StopWatching();
 }
 
-MessagePortChannel::State::State() {}
+MessagePortChannel::State::State() = default;
 
 MessagePortChannel::State::State(mojo::ScopedMessagePipeHandle handle)
     : handle_(std::move(handle)) {}

diff --git a/third_party/WebKit/common/origin_trials/trial_token.cc b/third_party/WebKit/common/origin_trials/trial_token.cc
index 2d4678f..ec715ff3 100644
--- a/third_party/WebKit/common/origin_trials/trial_token.cc
+++ b/third_party/WebKit/common/origin_trials/trial_token.cc

@@ -40,7 +40,7 @@
 
 }  // namespace
 
-TrialToken::~TrialToken() {}
+TrialToken::~TrialToken() = default;
 
 // static
 std::unique_ptr<TrialToken> TrialToken::From(

diff --git a/third_party/WebKit/common/origin_trials/trial_token_validator.cc b/third_party/WebKit/common/origin_trials/trial_token_validator.cc
index ced5b84..f1646fdc 100644
--- a/third_party/WebKit/common/origin_trials/trial_token_validator.cc
+++ b/third_party/WebKit/common/origin_trials/trial_token_validator.cc

@@ -18,7 +18,7 @@
     : policy_(std::move(policy)) {
   DCHECK(policy_.get());
 }
-TrialTokenValidator::~TrialTokenValidator() {}
+TrialTokenValidator::~TrialTokenValidator() = default;
 
 OriginTrialTokenStatus TrialTokenValidator::ValidateToken(
     const std::string& token,

diff --git a/third_party/WebKit/common/origin_trials/trial_token_validator_unittest.cc b/third_party/WebKit/common/origin_trials/trial_token_validator_unittest.cc
index 346026e..d2b0b3ab 100644
--- a/third_party/WebKit/common/origin_trials/trial_token_validator_unittest.cc
+++ b/third_party/WebKit/common/origin_trials/trial_token_validator_unittest.cc

@@ -168,7 +168,7 @@
     SetPublicKey(kTestPublicKey);
   }
 
-  ~TrialTokenValidatorTest() override {}
+  ~TrialTokenValidatorTest() override = default;
 
   void SetPublicKey(const uint8_t* key) { policy_->SetPublicKey(key); }
 

diff --git a/third_party/WebKit/public/BUILD.gn b/third_party/WebKit/public/BUILD.gn
index a4ba948..6c56d379 100644
--- a/third_party/WebKit/public/BUILD.gn
+++ b/third_party/WebKit/public/BUILD.gn

@@ -166,10 +166,6 @@
     "platform/WebContentSettingCallbacks.h",
     "platform/WebContentSettingsClient.h",
     "platform/WebCookieJar.h",
-    "platform/WebCredential.h",
-    "platform/WebCredentialManagerClient.h",
-    "platform/WebCredentialManagerError.h",
-    "platform/WebCredentialMediationRequirement.h",
     "platform/WebCrypto.h",
     "platform/WebCryptoAlgorithm.h",
     "platform/WebCryptoAlgorithmParams.h",
@@ -197,7 +193,6 @@
     "platform/WebEventListenerProperties.h",
     "platform/WebExternalTextureLayer.h",
     "platform/WebFallbackThemeEngine.h",
-    "platform/WebFederatedCredential.h",
     "platform/WebFileError.h",
     "platform/WebFileInfo.h",
     "platform/WebFileSystem.h",
@@ -271,7 +266,6 @@
     "platform/WebNativeScrollBehavior.h",
     "platform/WebNetworkStateNotifier.h",
     "platform/WebOverscrollBehavior.h",
-    "platform/WebPasswordCredential.h",
     "platform/WebPlatformEventListener.h",
     "platform/WebPlatformEventType.h",
     "platform/WebPluginListBuilder.h",
@@ -354,7 +348,6 @@
     "platform/WebTouchAction.h",
     "platform/WebTouchEvent.h",
     "platform/WebTouchPoint.h",
-    "platform/WebTraceLocation.h",
     "platform/WebTrialTokenValidator.h",
     "platform/WebURL.h",
     "platform/WebURLError.h",

diff --git a/third_party/WebKit/public/platform/WebCredential.h b/third_party/WebKit/public/platform/WebCredential.h
deleted file mode 100644
index a4d4cfc..0000000
--- a/third_party/WebKit/public/platform/WebCredential.h
+++ /dev/null

@@ -1,58 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebCredential_h
-#define WebCredential_h
-
-#include "public/platform/WebCommon.h"
-#include "public/platform/WebPrivatePtr.h"
-#include "public/platform/WebString.h"
-#include "public/platform/WebURL.h"
-
-#include <memory>
-
-namespace blink {
-
-class PlatformCredential;
-
-class WebCredential {
- public:
-  BLINK_PLATFORM_EXPORT WebCredential(const WebString& id);
-  BLINK_PLATFORM_EXPORT WebCredential(const WebCredential&);
-  virtual ~WebCredential() { Reset(); }
-
-  BLINK_PLATFORM_EXPORT void Assign(const WebCredential&);
-  BLINK_PLATFORM_EXPORT void Reset();
-
-  BLINK_PLATFORM_EXPORT WebString Id() const;
-  BLINK_PLATFORM_EXPORT WebString GetType() const;
-
-  BLINK_PLATFORM_EXPORT bool IsPasswordCredential() const;
-  BLINK_PLATFORM_EXPORT bool IsFederatedCredential() const;
-
-  // TODO(mkwst): Drop this once Chromium is updated. https://crbug.com/494880
-  BLINK_PLATFORM_EXPORT bool IsLocalCredential() const {
-    return IsPasswordCredential();
-  }
-
-#if INSIDE_BLINK
-  BLINK_PLATFORM_EXPORT static std::unique_ptr<WebCredential> Create(
-      PlatformCredential*);
-  BLINK_PLATFORM_EXPORT WebCredential& operator=(PlatformCredential*);
-  BLINK_PLATFORM_EXPORT PlatformCredential* GetPlatformCredential() const {
-    return platform_credential_.Get();
-  }
-#endif
-
- protected:
-#if INSIDE_BLINK
-  BLINK_PLATFORM_EXPORT WebCredential(PlatformCredential*);
-#endif
-
-  WebPrivatePtr<PlatformCredential> platform_credential_;
-};
-
-}  // namespace blink
-
-#endif  // WebCredential_h

diff --git a/third_party/WebKit/public/platform/WebCredentialManagerClient.h b/third_party/WebKit/public/platform/WebCredentialManagerClient.h
deleted file mode 100644
index 79edb4a..0000000
--- a/third_party/WebKit/public/platform/WebCredentialManagerClient.h
+++ /dev/null

@@ -1,47 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebCredentialManagerClient_h
-#define WebCredentialManagerClient_h
-
-#include "public/platform/WebCallbacks.h"
-#include "public/platform/WebCredentialManagerError.h"
-#include "public/platform/WebCredentialMediationRequirement.h"
-#include "public/platform/WebVector.h"
-
-#include <memory>
-
-namespace blink {
-
-class WebCredential;
-class WebURL;
-
-// WebCredentialManagerClient is an interface which allows an embedder to
-// implement 'navigator.credential.*' calls which are defined in the
-// 'credentialmanager' module.
-class WebCredentialManagerClient {
- public:
-  typedef WebCallbacks<std::unique_ptr<WebCredential>,
-                       WebCredentialManagerError>
-      RequestCallbacks;
-  typedef WebCallbacks<void, WebCredentialManagerError> NotificationCallbacks;
-
-  // Ownership of the callback is transferred to the callee for each of
-  // the following methods.
-  virtual void DispatchFailedSignIn(const WebCredential&,
-                                    NotificationCallbacks*) {}
-  virtual void DispatchStore(const WebCredential&, NotificationCallbacks*) {}
-  virtual void DispatchPreventSilentAccess(NotificationCallbacks*) {}
-  virtual void DispatchGet(WebCredentialMediationRequirement mediation,
-                           bool include_passwords,
-                           const WebVector<WebURL>& federations,
-                           RequestCallbacks*) {}
-
- protected:
-  virtual ~WebCredentialManagerClient() = default;
-};
-
-}  // namespace blink
-
-#endif  // WebCredentialManager_h

diff --git a/third_party/WebKit/public/platform/WebCredentialManagerError.h b/third_party/WebKit/public/platform/WebCredentialManagerError.h
deleted file mode 100644
index 99f0dea..0000000
--- a/third_party/WebKit/public/platform/WebCredentialManagerError.h
+++ /dev/null

@@ -1,28 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebCredentialManagerError_h
-#define WebCredentialManagerError_h
-
-namespace blink {
-
-// FIXME: This is a placeholder list of error conditions. We'll likely expand
-// the list as the API evolves.
-enum WebCredentialManagerError {
-  kWebCredentialManagerNoError = 0,
-  kWebCredentialManagerDisabledError,
-  kWebCredentialManagerPendingRequestError,
-  kWebCredentialManagerPasswordStoreUnavailableError,
-  kWebCredentialManagerNotAllowedError,
-  kWebCredentialManagerNotSupportedError,
-  kWebCredentialManagerSecurityError,
-  kWebCredentialManagerCancelledError,
-  kWebCredentialManagerUnknownError,
-  kWebCredentialManagerNotImplementedError,
-  kWebCredentialManagerErrorLastType = kWebCredentialManagerUnknownError,
-};
-
-}  // namespace blink
-
-#endif

diff --git a/third_party/WebKit/public/platform/WebCredentialMediationRequirement.h b/third_party/WebKit/public/platform/WebCredentialMediationRequirement.h
deleted file mode 100644
index 63639f7..0000000
--- a/third_party/WebKit/public/platform/WebCredentialMediationRequirement.h
+++ /dev/null

@@ -1,14 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebCredentialMediationRequirement_h
-#define WebCredentialMediationRequirement_h
-
-namespace blink {
-
-enum class WebCredentialMediationRequirement { kSilent, kOptional, kRequired };
-
-}  // namespace blink
-
-#endif

diff --git a/third_party/WebKit/public/platform/WebFederatedCredential.h b/third_party/WebKit/public/platform/WebFederatedCredential.h
deleted file mode 100644
index 55278b6..0000000
--- a/third_party/WebKit/public/platform/WebFederatedCredential.h
+++ /dev/null

@@ -1,36 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebFederatedCredential_h
-#define WebFederatedCredential_h
-
-#include "public/platform/WebCommon.h"
-#include "public/platform/WebCredential.h"
-#include "public/platform/WebSecurityOrigin.h"
-#include "public/platform/WebString.h"
-
-namespace blink {
-
-class WebFederatedCredential : public WebCredential {
- public:
-  BLINK_PLATFORM_EXPORT WebFederatedCredential(
-      const WebString& id,
-      const WebSecurityOrigin& federation,
-      const WebString& name,
-      const WebURL& icon_url);
-
-  BLINK_PLATFORM_EXPORT void Assign(const WebFederatedCredential&);
-  BLINK_PLATFORM_EXPORT WebSecurityOrigin Provider() const;
-  BLINK_PLATFORM_EXPORT WebString Name() const;
-  BLINK_PLATFORM_EXPORT WebURL IconURL() const;
-
-#if INSIDE_BLINK
-  BLINK_PLATFORM_EXPORT WebFederatedCredential(PlatformCredential*);
-  BLINK_PLATFORM_EXPORT WebFederatedCredential& operator=(PlatformCredential*);
-#endif
-};
-
-}  // namespace blink
-
-#endif  // WebFederatedCredential_h

diff --git a/third_party/WebKit/public/platform/WebPasswordCredential.h b/third_party/WebKit/public/platform/WebPasswordCredential.h
deleted file mode 100644
index f93e8bb..0000000
--- a/third_party/WebKit/public/platform/WebPasswordCredential.h
+++ /dev/null

@@ -1,36 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebPasswordCredential_h
-#define WebPasswordCredential_h
-
-#include "public/platform/WebCommon.h"
-#include "public/platform/WebCredential.h"
-#include "public/platform/WebString.h"
-#include "public/platform/WebURL.h"
-
-namespace blink {
-
-class WebPasswordCredential : public WebCredential {
- public:
-  BLINK_PLATFORM_EXPORT WebPasswordCredential(const WebString& id,
-                                              const WebString& password,
-                                              const WebString& name,
-                                              const WebURL& icon_url);
-
-  BLINK_PLATFORM_EXPORT void Assign(const WebPasswordCredential&);
-
-  BLINK_PLATFORM_EXPORT WebString Password() const;
-  BLINK_PLATFORM_EXPORT WebString Name() const;
-  BLINK_PLATFORM_EXPORT WebURL IconURL() const;
-
-#if INSIDE_BLINK
-  BLINK_PLATFORM_EXPORT WebPasswordCredential(PlatformCredential*);
-  BLINK_PLATFORM_EXPORT WebPasswordCredential& operator=(PlatformCredential*);
-#endif
-};
-
-}  // namespace blink
-
-#endif  // WebPasswordCredential_h

diff --git a/third_party/WebKit/public/platform/WebRuntimeFeatures.h b/third_party/WebKit/public/platform/WebRuntimeFeatures.h
index 06e9ec2..f698f15 100644
--- a/third_party/WebKit/public/platform/WebRuntimeFeatures.h
+++ b/third_party/WebKit/public/platform/WebRuntimeFeatures.h

@@ -184,6 +184,7 @@
   BLINK_PLATFORM_EXPORT static void EnableWorkStealingInScriptRunner(bool);
   BLINK_PLATFORM_EXPORT static void EnableStopLoadingInBackgroundAndroid(bool);
   BLINK_PLATFORM_EXPORT static void EnablePWAFullCodeCache(bool);
+  BLINK_PLATFORM_EXPORT static void EnableDoubleTapToJumpOnVideo(bool);
 
  private:
   WebRuntimeFeatures();

diff --git a/third_party/WebKit/public/platform/WebTraceLocation.h b/third_party/WebKit/public/platform/WebTraceLocation.h
deleted file mode 100644
index 23ec5513..0000000
--- a/third_party/WebKit/public/platform/WebTraceLocation.h
+++ /dev/null

@@ -1,16 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebTraceLocation_h
-#define WebTraceLocation_h
-
-#include "base/location.h"
-
-namespace blink {
-
-using WebTraceLocation = base::Location;
-#define BLINK_FROM_HERE FROM_HERE
-}
-
-#endif  // WebTraceLocation_h

diff --git a/third_party/WebKit/public/platform/WebURLLoader.h b/third_party/WebKit/public/platform/WebURLLoader.h
index fbc751e..dc4b205 100644
--- a/third_party/WebKit/public/platform/WebURLLoader.h
+++ b/third_party/WebKit/public/platform/WebURLLoader.h

@@ -51,12 +51,14 @@
   // Load the request synchronously, returning results directly to the
   // caller upon completion.  There is no mechanism to interrupt a
   // synchronous load!!
-  virtual void LoadSynchronously(const WebURLRequest&,
-                                 WebURLResponse&,
-                                 base::Optional<WebURLError>&,
-                                 WebData&,
-                                 int64_t& encoded_data_length,
-                                 int64_t& encoded_body_length) = 0;
+  virtual void LoadSynchronously(
+      const WebURLRequest&,
+      WebURLResponse&,
+      base::Optional<WebURLError>&,
+      WebData&,
+      int64_t& encoded_data_length,
+      int64_t& encoded_body_length,
+      base::Optional<int64_t>& downloaded_file_length) = 0;
 
   // Load the request asynchronously, sending notifications to the given
   // client.  The client will receive no further notifications if the

diff --git a/third_party/WebKit/public/platform/WebURLRequest.h b/third_party/WebKit/public/platform/WebURLRequest.h
index a298dcd..2b4515f 100644
--- a/third_party/WebKit/public/platform/WebURLRequest.h
+++ b/third_party/WebKit/public/platform/WebURLRequest.h

@@ -193,6 +193,8 @@
   BLINK_PLATFORM_EXPORT mojom::FetchCacheMode GetCacheMode() const;
   BLINK_PLATFORM_EXPORT void SetCacheMode(mojom::FetchCacheMode);
 
+  BLINK_PLATFORM_EXPORT double TimeoutInterval() const;
+
   BLINK_PLATFORM_EXPORT WebString HttpMethod() const;
   BLINK_PLATFORM_EXPORT void SetHTTPMethod(const WebString&);
 

diff --git a/third_party/WebKit/public/platform/WebWorkerFetchContext.h b/third_party/WebKit/public/platform/WebWorkerFetchContext.h
index 30cd20a0..2df3d6b2 100644
--- a/third_party/WebKit/public/platform/WebWorkerFetchContext.h
+++ b/third_party/WebKit/public/platform/WebWorkerFetchContext.h

@@ -14,7 +14,8 @@
 
 namespace base {
 class SingleThreadTaskRunner;
-}
+class WaitableEvent;
+}  // namespace base
 
 namespace blink {
 
@@ -31,6 +32,13 @@
  public:
   virtual ~WebWorkerFetchContext() = default;
 
+  // Returns a raw pointer of a WaitableEvent which will be signaled from the
+  // main thread when the worker's GlobalScope is terminated, which will
+  // terminate sync loading requests on the worker thread.
+  // The raw pointer is valid only while the WebWorkerFetchContext is alive
+  // which is supposed to have the same lifetime as the worker's GlobalScope.
+  virtual base::WaitableEvent* GetTerminateSyncLoadEvent() = 0;
+
   virtual void InitializeOnWorkerThread(
       scoped_refptr<base::SingleThreadTaskRunner>) = 0;
 

diff --git a/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom b/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom
index ea7cf47..f58f6d5 100644
--- a/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom
+++ b/third_party/WebKit/public/platform/modules/credentialmanager/credential_manager.mojom

@@ -21,18 +21,19 @@
 
 enum CredentialManagerError {
   SUCCESS,
-  DISABLED,
-  PENDINGREQUEST,
-  PASSWORDSTOREUNAVAILABLE,
+  PENDING_REQUEST,
+  PASSWORD_STORE_UNAVAILABLE,
+  NOT_ALLOWED,
+  NOT_SUPPORTED,
   UNKNOWN
 };
 
 struct CredentialInfo {
   CredentialType type;
-  string id;
-  string name;
+  string? id;
+  string? name;
   url.mojom.Url icon;
-  string password;
+  string? password;
   url.mojom.Origin federation;
 };
 

diff --git a/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom b/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom
index f7ab3b1..13c14e2 100644
--- a/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom
+++ b/third_party/WebKit/public/platform/modules/webauth/authenticator.mojom

@@ -14,13 +14,10 @@
 
 enum AuthenticatorStatus {
   SUCCESS,
-  CANCELLED,
   PENDING_REQUEST,
   NOT_ALLOWED_ERROR,
   NOT_SUPPORTED_ERROR,
-  SECURITY_ERROR,
   UNKNOWN_ERROR,
-  NOT_IMPLEMENTED,
 };
 
 // The public key and attestation that is returned by an authenticator's

diff --git a/third_party/WebKit/public/platform/scheduler/child/webthread_base.h b/third_party/WebKit/public/platform/scheduler/child/webthread_base.h
index 1253b746..4fcb76c2 100644
--- a/third_party/WebKit/public/platform/scheduler/child/webthread_base.h
+++ b/third_party/WebKit/public/platform/scheduler/child/webthread_base.h

@@ -8,12 +8,12 @@
 #include <map>
 #include <memory>
 
+#include "base/location.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/threading/thread.h"
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebThread.h"
-#include "public/platform/WebTraceLocation.h"
 
 namespace blink {
 namespace scheduler {
@@ -37,8 +37,7 @@
   bool IsCurrentThread() const override;
   PlatformThreadId ThreadId() const override = 0;
 
-  virtual void PostIdleTask(const WebTraceLocation& location,
-                            IdleTask idle_task);
+  virtual void PostIdleTask(const base::Location& location, IdleTask idle_task);
 
   void AddTaskObserver(TaskObserver* observer) override;
   void RemoveTaskObserver(TaskObserver* observer) override;

diff --git a/third_party/WebKit/public/platform/web_feature.mojom b/third_party/WebKit/public/platform/web_feature.mojom
index 38dd4dd..4a63a089 100644
--- a/third_party/WebKit/public/platform/web_feature.mojom
+++ b/third_party/WebKit/public/platform/web_feature.mojom

@@ -1784,6 +1784,48 @@
   kFileAccessedSharedWorker = 2275,
   kV8MediaKeys_GetStatusForPolicy_Method = 2276,
   kV8DeoptimizerDisableSpeculation = 2277,
+  kCSSSelectorCue = 2278,
+  kCSSSelectorWebkitCalendarPickerIndicator = 2279,
+  kCSSSelectorWebkitClearButton = 2280,
+  kCSSSelectorWebkitColorSwatch = 2281,
+  kCSSSelectorWebkitColorSwatchWrapper = 2282,
+  kCSSSelectorWebkitDateAndTimeValue = 2283,
+  kCSSSelectorWebkitDatetimeEdit = 2284,
+  kCSSSelectorWebkitDatetimeEditAmpmField = 2285,
+  kCSSSelectorWebkitDatetimeEditDayField = 2286,
+  kCSSSelectorWebkitDatetimeEditFieldsWrapper = 2287,
+  kCSSSelectorWebkitDatetimeEditHourField = 2288,
+  kCSSSelectorWebkitDatetimeEditMillisecondField = 2289,
+  kCSSSelectorWebkitDatetimeEditMinuteField = 2290,
+  kCSSSelectorWebkitDatetimeEditMonthField = 2291,
+  kCSSSelectorWebkitDatetimeEditSecondField = 2292,
+  kCSSSelectorWebkitDatetimeEditText = 2293,
+  kCSSSelectorWebkitDatetimeEditWeekField = 2294,
+  kCSSSelectorWebkitDatetimeEditYearField = 2295,
+  kCSSSelectorWebkitDetailsMarker = 2296,
+  kCSSSelectorWebkitFileUploadButton = 2297,
+  kCSSSelectorWebkitInnerSpinButton = 2298,
+  kCSSSelectorWebkitInputPlaceholder = 2299,
+  kCSSSelectorWebkitMediaSliderContainer = 2300,
+  kCSSSelectorWebkitMediaSliderThumb = 2301,
+  kCSSSelectorWebkitMediaTextTrackContainer = 2302,
+  kCSSSelectorWebkitMediaTextTrackDisplay = 2303,
+  kCSSSelectorWebkitMediaTextTrackRegion = 2304,
+  kCSSSelectorWebkitMediaTextTrackRegionContainer = 2305,
+  kCSSSelectorWebkitMeterBar = 2306,
+  kCSSSelectorWebkitMeterEvenLessGoodValue = 2307,
+  kCSSSelectorWebkitMeterInnerElement = 2308,
+  kCSSSelectorWebkitMeterOptimumValue = 2309,
+  kCSSSelectorWebkitMeterSuboptimumValue = 2310,
+  kCSSSelectorWebkitProgressBar = 2311,
+  kCSSSelectorWebkitProgressInnerElement = 2312,
+  kCSSSelectorWebkitProgressValue = 2313,
+  kCSSSelectorWebkitSearchCancelButton = 2314,
+  kCSSSelectorWebkitSliderContainer = 2315,
+  kCSSSelectorWebkitSliderRunnableTrack = 2316,
+  kCSSSelectorWebkitSliderThumb = 2317,
+  kCSSSelectorWebkitTextfieldDecorationContainer = 2318,
+  kCSSSelectorWebkitUnknownPseudo = 2319,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.

diff --git a/third_party/WebKit/public/web/WebView.h b/third_party/WebKit/public/web/WebView.h
index ccaade78..d4350872 100644
--- a/third_party/WebKit/public/web/WebView.h
+++ b/third_party/WebKit/public/web/WebView.h

@@ -41,7 +41,6 @@
 
 namespace blink {
 
-class WebCredentialManagerClient;
 class WebFrame;
 class WebHitTestResult;
 class WebLocalFrame;
@@ -114,7 +113,6 @@
                                       mojom::PageVisibilityState);
 
   // Initializes the various client interfaces.
-  virtual void SetCredentialManagerClient(WebCredentialManagerClient*) = 0;
   virtual void SetPrerendererClient(WebPrerendererClient*) = 0;
 
   // Options -------------------------------------------------------------

diff --git a/third_party/ots/src/ots.cc b/third_party/ots/src/ots.cc
index f7e67a5b..f6020143 100644
--- a/third_party/ots/src/ots.cc
+++ b/third_party/ots/src/ots.cc

@@ -14,7 +14,7 @@
 #include <map>
 #include <vector>
 
-#include "third_party/woff2/src/woff2_dec.h"
+#include <woff2/decode.h>
 
 // The OpenType Font File
 // http://www.microsoft.com/typography/otspec/otff.htm

diff --git a/third_party/woff2/BUILD.gn b/third_party/woff2/BUILD.gn
index 2e359ee7..953a5f87 100644
--- a/third_party/woff2/BUILD.gn
+++ b/third_party/woff2/BUILD.gn

@@ -2,9 +2,14 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+config("woff2_includes") {
+  include_dirs = [ "include" ]
+}
+
 static_library("woff2_dec") {
   sources = [
     "src/buffer.h",
+    "src/file.h",
     "src/round.h",
     "src/store_bytes.h",
     "src/table_tags.cc",
@@ -14,9 +19,10 @@
     "src/woff2_common.cc",
     "src/woff2_common.h",
     "src/woff2_dec.cc",
-    "src/woff2_dec.h",
     "src/woff2_out.cc",
-    "src/woff2_out.h",
+    "woff2/include/decode.h",
+    "woff2/include/encode.h",
+    "woff2/include/output.h",
   ]
 
   configs -= [ "//build/config/compiler:chromium_code" ]
@@ -26,7 +32,7 @@
     "//third_party/brotli:dec",
   ]
 
-  include_dirs = [ "src" ]
+  public_configs = [ ":woff2_includes" ]
 
   # TODO(ksakamoto): http://crbug.com/167187
   if (is_win) {

diff --git a/third_party/woff2/README.chromium b/third_party/woff2/README.chromium
index 959f05f..c97a8e40 100644
--- a/third_party/woff2/README.chromium
+++ b/third_party/woff2/README.chromium

@@ -1,6 +1,6 @@
 Name: woff2
 URL: https://github.com/google/woff2
-Version: cbea7b962ea73b6d3ec7e7c1ad2c2a90604b9b9d
+Version: 1bccf208bca986e53a647dfe4811322adb06ecf8
 License: Apache 2.0
 License File: LICENSE
 Security Critical: yes

diff --git a/third_party/woff2/include/woff2/decode.h b/third_party/woff2/include/woff2/decode.h
new file mode 100644
index 0000000..6ef3b8e
--- /dev/null
+++ b/third_party/woff2/include/woff2/decode.h

@@ -0,0 +1,36 @@
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for converting WOFF2 format font files to their TTF versions. */
+
+#ifndef WOFF2_WOFF2_DEC_H_
+#define WOFF2_WOFF2_DEC_H_
+
+#include <stddef.h>
+#include <inttypes.h>
+#include <woff2/output.h>
+
+namespace woff2 {
+
+// Compute the size of the final uncompressed font, or 0 on error.
+size_t ComputeWOFF2FinalSize(const uint8_t *data, size_t length);
+
+// Decompresses the font into the target buffer. The result_length should
+// be the same as determined by ComputeFinalSize(). Returns true on successful
+// decompression.
+// DEPRECATED; please prefer the version that takes a WOFF2Out*
+bool ConvertWOFF2ToTTF(uint8_t *result, size_t result_length,
+                       const uint8_t *data, size_t length);
+
+// Decompresses the font into out. Returns true on success.
+// Works even if WOFF2Header totalSfntSize is wrong.
+// Please prefer this API.
+bool ConvertWOFF2ToTTF(const uint8_t *data, size_t length,
+                       WOFF2Out* out);
+
+} // namespace woff2
+
+#endif  // WOFF2_WOFF2_DEC_H_

diff --git a/third_party/woff2/include/woff2/encode.h b/third_party/woff2/include/woff2/encode.h
new file mode 100644
index 0000000..34b7722
--- /dev/null
+++ b/third_party/woff2/include/woff2/encode.h

@@ -0,0 +1,43 @@
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for converting WOFF2 format font files to their TTF versions. */
+
+#ifndef WOFF2_WOFF2_ENC_H_
+#define WOFF2_WOFF2_ENC_H_
+
+#include <stddef.h>
+#include <inttypes.h>
+#include <string>
+
+namespace woff2 {
+
+struct WOFF2Params {
+  WOFF2Params() : extended_metadata(""), brotli_quality(11),
+                  allow_transforms(true) {}
+
+  std::string extended_metadata;
+  int brotli_quality;
+  bool allow_transforms;
+};
+
+// Returns an upper bound on the size of the compressed file.
+size_t MaxWOFF2CompressedSize(const uint8_t* data, size_t length);
+size_t MaxWOFF2CompressedSize(const uint8_t* data, size_t length,
+                              const std::string& extended_metadata);
+
+// Compresses the font into the target buffer. *result_length should be at least
+// the value returned by MaxWOFF2CompressedSize(), upon return, it is set to the
+// actual compressed size. Returns true on successful compression.
+bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
+                       uint8_t *result, size_t *result_length);
+bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
+                       uint8_t *result, size_t *result_length,
+                       const WOFF2Params& params);
+
+} // namespace woff2
+
+#endif  // WOFF2_WOFF2_ENC_H_

diff --git a/third_party/woff2/include/woff2/output.h b/third_party/woff2/include/woff2/output.h
new file mode 100644
index 0000000..c325f67
--- /dev/null
+++ b/third_party/woff2/include/woff2/output.h

@@ -0,0 +1,86 @@
+/* Copyright 2016 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Output buffer for WOFF2 decompression. */
+
+#ifndef WOFF2_WOFF2_OUT_H_
+#define WOFF2_WOFF2_OUT_H_
+
+#include <algorithm>
+#include <cstring>
+#include <memory>
+#include <string>
+
+namespace woff2 {
+
+// Suggested max size for output.
+const size_t kDefaultMaxSize = 30 * 1024 * 1024;
+
+/**
+ * Output interface for the woff2 decoding.
+ *
+ * Writes to arbitrary offsets are supported to facilitate updating offset
+ * table and checksums after tables are ready. Reading the current size is
+ * supported so a 'loca' table can be built up while writing glyphs.
+ *
+ * By default limits size to kDefaultMaxSize.
+ */
+class WOFF2Out {
+ public:
+  virtual ~WOFF2Out(void) {}
+
+  // Append n bytes of data from buf.
+  // Return true if all written, false otherwise.
+  virtual bool Write(const void *buf, size_t n) = 0;
+
+  // Write n bytes of data from buf at offset.
+  // Return true if all written, false otherwise.
+  virtual bool Write(const void *buf, size_t offset, size_t n) = 0;
+
+  virtual size_t Size() = 0;
+};
+
+/**
+ * Expanding memory block for woff2 out. By default limited to kDefaultMaxSize.
+ */
+class WOFF2StringOut : public WOFF2Out {
+ public:
+  // Create a writer that writes its data to buf.
+  // buf->size() will grow to at most max_size
+  // buf may be sized (e.g. using EstimateWOFF2FinalSize) or empty.
+  explicit WOFF2StringOut(std::string* buf);
+
+  bool Write(const void *buf, size_t n) override;
+  bool Write(const void *buf, size_t offset, size_t n) override;
+  size_t Size() override { return offset_; }
+  size_t MaxSize() { return max_size_; }
+  void SetMaxSize(size_t max_size);
+ private:
+  std::string* buf_;
+  size_t max_size_;
+  size_t offset_;
+};
+
+/**
+ * Fixed memory block for woff2 out.
+ */
+class WOFF2MemoryOut : public WOFF2Out {
+ public:
+  // Create a writer that writes its data to buf.
+  WOFF2MemoryOut(uint8_t* buf, size_t buf_size);
+
+  bool Write(const void *buf, size_t n) override;
+  bool Write(const void *buf, size_t offset, size_t n) override;
+  size_t Size() override { return offset_; }
+ private:
+  uint8_t* buf_;
+  size_t buf_size_;
+  size_t offset_;
+};
+
+} // namespace woff2
+
+#endif  // WOFF2_WOFF2_OUT_H_

diff --git a/third_party/woff2/src/buffer.h b/third_party/woff2/src/buffer.h
index 08681a6f..7240e51 100644
--- a/third_party/woff2/src/buffer.h
+++ b/third_party/woff2/src/buffer.h

@@ -1,19 +1,11 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// The parts of ots.h & opentype-sanitiser.h that we need, taken from the
-// https://code.google.com/p/ots/ project.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* The parts of ots.h & opentype-sanitiser.h that we need, taken from the
+   https://code.google.com/p/ots/ project. */
 
 #ifndef WOFF2_BUFFER_H_
 #define WOFF2_BUFFER_H_

diff --git a/third_party/woff2/src/convert_woff2ttf_fuzzer.cc b/third_party/woff2/src/convert_woff2ttf_fuzzer.cc
index 3fdd15b..2d977a3 100644
--- a/third_party/woff2/src/convert_woff2ttf_fuzzer.cc
+++ b/third_party/woff2/src/convert_woff2ttf_fuzzer.cc

@@ -1,7 +1,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "woff2_dec.h"
+#include <woff2/decode.h>
 
 // Entry point for LibFuzzer.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {

diff --git a/third_party/woff2/src/convert_woff2ttf_fuzzer_new_entry.cc b/third_party/woff2/src/convert_woff2ttf_fuzzer_new_entry.cc
index 75114a91..5ad9336 100644
--- a/third_party/woff2/src/convert_woff2ttf_fuzzer_new_entry.cc
+++ b/third_party/woff2/src/convert_woff2ttf_fuzzer_new_entry.cc

@@ -1,5 +1,5 @@
 #include <string>
-#include "woff2_dec.h"
+#include <woff2/decode.h>
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t data_size) {
   // Decode using newer entry pattern.

diff --git a/third_party/woff2/src/file.h b/third_party/woff2/src/file.h
index 7afcb31..6131877 100644
--- a/third_party/woff2/src/file.h
+++ b/third_party/woff2/src/file.h

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// File IO helpers.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* File IO helpers. */
 
 #ifndef WOFF2_FILE_H_
 #define WOFF2_FILE_H_

diff --git a/third_party/woff2/src/font.cc b/third_party/woff2/src/font.cc
index fc496e0..a45153e 100644
--- a/third_party/woff2/src/font.cc
+++ b/third_party/woff2/src/font.cc

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Font management utilities
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Font management utilities */
 
 #include "./font.h"
 
@@ -131,6 +123,9 @@
       (*all_tables)[table.offset] = font->FindTable(table.tag);
     } else {
       table.reuse_of = (*all_tables)[table.offset];
+      if (table.tag != table.reuse_of->tag) {
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
 
   }
@@ -331,8 +326,11 @@
     return 0;
   }
   int index_fmt = IndexFormat(font);
-  int num_glyphs = (loca_table->length / (index_fmt == 0 ? 2 : 4)) - 1;
-  return num_glyphs;
+  int loca_record_size = (index_fmt == 0 ? 2 : 4);
+  if (loca_table->length < loca_record_size) {
+    return 0;
+  }
+  return (loca_table->length / loca_record_size) - 1;
 }
 
 int IndexFormat(const Font& font) {

diff --git a/third_party/woff2/src/font.h b/third_party/woff2/src/font.h
index 93806e6..7b8dddd 100644
--- a/third_party/woff2/src/font.h
+++ b/third_party/woff2/src/font.h

@@ -1,19 +1,11 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Data model for a font file in sfnt format, reading and writing functions and
-// accessors for the glyph data.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Data model for a font file in sfnt format, reading and writing functions and
+   accessors for the glyph data. */
 
 #ifndef WOFF2_FONT_H_
 #define WOFF2_FONT_H_

diff --git a/third_party/woff2/src/glyph.cc b/third_party/woff2/src/glyph.cc
index 4c6b60a..057174d 100644
--- a/third_party/woff2/src/glyph.cc
+++ b/third_party/woff2/src/glyph.cc

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Glyph manipulation
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Glyph manipulation */
 
 #include "./glyph.h"
 

diff --git a/third_party/woff2/src/glyph.h b/third_party/woff2/src/glyph.h
index 0ee755c..f24056f 100644
--- a/third_party/woff2/src/glyph.h
+++ b/third_party/woff2/src/glyph.h

@@ -1,19 +1,11 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Data model and I/O for glyph data within sfnt format files for the purpose of
-// performing the preprocessing step of the WOFF 2.0 conversion.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Data model and I/O for glyph data within sfnt format files for the purpose of
+   performing the preprocessing step of the WOFF 2.0 conversion. */
 
 #ifndef WOFF2_GLYPH_H_
 #define WOFF2_GLYPH_H_

diff --git a/third_party/woff2/src/normalize.cc b/third_party/woff2/src/normalize.cc
index b538b91..6685e08 100644
--- a/third_party/woff2/src/normalize.cc
+++ b/third_party/woff2/src/normalize.cc

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Glyph normalization
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Glyph normalization */
 
 #include "./normalize.h"
 
@@ -52,7 +44,7 @@
   loca_table->buffer.resize(Round4(num_glyphs + 1) * glyph_sz);
   loca_table->length = (num_glyphs + 1) * glyph_sz;
 
-  uint8_t* glyf_dst = &glyf_table->buffer[0];
+  uint8_t* glyf_dst = num_glyphs ? &glyf_table->buffer[0] : NULL;
   uint8_t* loca_dst = &loca_table->buffer[0];
   uint32_t glyf_offset = 0;
   size_t loca_offset = 0;
@@ -78,16 +70,13 @@
     }
     glyf_offset += glyf_dst_size;
   }
-  if (glyf_offset == 0) {
-    return false;
-  }
 
   StoreLoca(index_fmt, glyf_offset, &loca_offset, loca_dst);
 
   glyf_table->buffer.resize(glyf_offset);
-  glyf_table->data = &glyf_table->buffer[0];
+  glyf_table->data = glyf_offset ? &glyf_table->buffer[0] : NULL;
   glyf_table->length = glyf_offset;
-  loca_table->data = &loca_table->buffer[0];
+  loca_table->data = loca_offset ? &loca_table->buffer[0] : NULL;
 
   return true;
 }
@@ -107,7 +96,10 @@
   int sz = Round4(table->length);
   table->buffer.resize(sz);
   uint8_t* buf = &table->buffer[0];
-  memcpy(buf, table->data, sz);
+  memcpy(buf, table->data, table->length);
+  if (PREDICT_FALSE(sz > table->length)) {
+    memset(buf + table->length, 0, sz - table->length);
+  }
   table->data = buf;
   return true;
 }

diff --git a/third_party/woff2/src/normalize.h b/third_party/woff2/src/normalize.h
index e015348..c6fee74 100644
--- a/third_party/woff2/src/normalize.h
+++ b/third_party/woff2/src/normalize.h

@@ -1,20 +1,12 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Functions for normalizing fonts. Since the WOFF 2.0 decoder creates font
-// files in normalized form, the WOFF 2.0 conversion is guaranteed to be
-// lossless (in a bitwise sense) only for normalized font files.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Functions for normalizing fonts. Since the WOFF 2.0 decoder creates font
+   files in normalized form, the WOFF 2.0 conversion is guaranteed to be
+   lossless (in a bitwise sense) only for normalized font files. */
 
 #ifndef WOFF2_NORMALIZE_H_
 #define WOFF2_NORMALIZE_H_

diff --git a/third_party/woff2/src/port.h b/third_party/woff2/src/port.h
index bac47a93..8b60fee 100644
--- a/third_party/woff2/src/port.h
+++ b/third_party/woff2/src/port.h

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helper function for bit twiddling and macros for branch prediction.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helper function for bit twiddling and macros for branch prediction. */
 
 #ifndef WOFF2_PORT_H_
 #define WOFF2_PORT_H_
@@ -60,4 +52,15 @@
 #define PREDICT_TRUE(x) (x)
 #endif
 
+#if (defined(__ARM_ARCH) && (__ARM_ARCH == 7)) || \
+    (defined(M_ARM) && (M_ARM == 7)) || \
+    defined(__aarch64__) || defined(__ARM64_ARCH_8__) || defined(__i386) || \
+    defined(_M_IX86) || defined(__x86_64__) || defined(_M_X64)
+#if defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+#define WOFF_LITTLE_ENDIAN
+#elif defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+#define WOFF_BIG_ENDIAN
+#endif  /* endianness */
+#endif  /* CPU whitelist */
+
 #endif  // WOFF2_PORT_H_

diff --git a/third_party/woff2/src/round.h b/third_party/woff2/src/round.h
index abb81f82..e5b2cb1 100644
--- a/third_party/woff2/src/round.h
+++ b/third_party/woff2/src/round.h

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helper for rounding
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helper for rounding */
 
 #ifndef WOFF2_ROUND_H_
 #define WOFF2_ROUND_H_

diff --git a/third_party/woff2/src/store_bytes.h b/third_party/woff2/src/store_bytes.h
index 74b279c4..fff3c62 100644
--- a/third_party/woff2/src/store_bytes.h
+++ b/third_party/woff2/src/store_bytes.h

@@ -1,19 +1,11 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helper functions for storing integer values into byte streams.
-// No bounds checking is performed, that is the responsibility of the caller.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helper functions for storing integer values into byte streams.
+   No bounds checking is performed, that is the responsibility of the caller. */
 
 #ifndef WOFF2_STORE_BYTES_H_
 #define WOFF2_STORE_BYTES_H_
@@ -22,6 +14,8 @@
 #include <stddef.h>
 #include <string.h>
 
+#include "./port.h"
+
 namespace woff2 {
 
 inline size_t StoreU32(uint8_t* dst, size_t offset, uint32_t x) {
@@ -33,10 +27,10 @@
 }
 
 inline size_t Store16(uint8_t* dst, size_t offset, int x) {
-#if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+#if defined(WOFF_LITTLE_ENDIAN)
   *reinterpret_cast<uint16_t*>(dst + offset) =
       ((x & 0xFF) << 8) | ((x & 0xFF00) >> 8);
-#elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+#elif defined(WOFF_BIG_ENDIAN)
   *reinterpret_cast<uint16_t*>(dst + offset) = static_cast<uint16_t>(x);
 #else
   dst[offset] = x >> 8;
@@ -53,11 +47,11 @@
 }
 
 inline void Store16(int val, size_t* offset, uint8_t* dst) {
-#if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+#if defined(WOFF_LITTLE_ENDIAN)
   *reinterpret_cast<uint16_t*>(dst + *offset) =
       ((val & 0xFF) << 8) | ((val & 0xFF00) >> 8);
   *offset += 2;
-#elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+#elif defined(WOFF_BIG_ENDIAN)
   *reinterpret_cast<uint16_t*>(dst + *offset) = static_cast<uint16_t>(val);
   *offset += 2;
 #else

diff --git a/third_party/woff2/src/table_tags.cc b/third_party/woff2/src/table_tags.cc
index 0071e00..dca3ec8 100644
--- a/third_party/woff2/src/table_tags.cc
+++ b/third_party/woff2/src/table_tags.cc

@@ -1,18 +1,10 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Font table tags
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Font table tags */
 
 #include "./table_tags.h"
 

diff --git a/third_party/woff2/src/table_tags.h b/third_party/woff2/src/table_tags.h
index daa5d92..42dc0ae1 100644
--- a/third_party/woff2/src/table_tags.h
+++ b/third_party/woff2/src/table_tags.h

@@ -1,18 +1,10 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Font table tags
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Font table tags */
 
 #ifndef WOFF2_TABLE_TAGS_H_
 #define WOFF2_TABLE_TAGS_H_

diff --git a/third_party/woff2/src/transform.cc b/third_party/woff2/src/transform.cc
index 2ad8b16..999bef37 100644
--- a/third_party/woff2/src/transform.cc
+++ b/third_party/woff2/src/transform.cc

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for preprocessing fonts as part of the WOFF 2.0 conversion.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for preprocessing fonts as part of the WOFF 2.0 conversion. */
 
 #include "./transform.h"
 

diff --git a/third_party/woff2/src/transform.h b/third_party/woff2/src/transform.h
index e9d1b0d..a4583d1 100644
--- a/third_party/woff2/src/transform.h
+++ b/third_party/woff2/src/transform.h

@@ -1,18 +1,10 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for preprocessing fonts as part of the WOFF 2.0 conversion.
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for preprocessing fonts as part of the WOFF 2.0 conversion. */
 
 #ifndef WOFF2_TRANSFORM_H_
 #define WOFF2_TRANSFORM_H_

diff --git a/third_party/woff2/src/variable_length.cc b/third_party/woff2/src/variable_length.cc
index 264eb0a1..4f348d5 100644
--- a/third_party/woff2/src/variable_length.cc
+++ b/third_party/woff2/src/variable_length.cc

@@ -1,18 +1,10 @@
-// Copyright 2015 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helper functions for woff2 variable length types: 255UInt16 and UIntBase128
+/* Copyright 2015 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helper functions for woff2 variable length types: 255UInt16 and UIntBase128 */
 
 #include "./variable_length.h"
 

diff --git a/third_party/woff2/src/variable_length.h b/third_party/woff2/src/variable_length.h
index 2816ae2..208010653 100644
--- a/third_party/woff2/src/variable_length.h
+++ b/third_party/woff2/src/variable_length.h

@@ -1,18 +1,10 @@
-// Copyright 2015 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helper functions for woff2 variable length types: 255UInt16 and UIntBase128
+/* Copyright 2015 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helper functions for woff2 variable length types: 255UInt16 and UIntBase128 */
 
 #ifndef WOFF2_VARIABLE_LENGTH_H_
 #define WOFF2_VARIABLE_LENGTH_H_

diff --git a/third_party/woff2/src/woff2_common.cc b/third_party/woff2/src/woff2_common.cc
index eba6a46e..fe0a3be 100644
--- a/third_party/woff2/src/woff2_common.cc
+++ b/third_party/woff2/src/woff2_common.cc

@@ -1,23 +1,17 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Helpers common across multiple parts of woff2
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Helpers common across multiple parts of woff2 */
 
 #include <algorithm>
 
 #include "./woff2_common.h"
 
+#include "./port.h"
+
 namespace woff2 {
 
 
@@ -25,11 +19,11 @@
   uint32_t checksum = 0;
   size_t aligned_size = size & ~3;
   for (size_t i = 0; i < aligned_size; i += 4) {
-#if (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__))
+#if defined(WOFF_LITTLE_ENDIAN)
     uint32_t v = *reinterpret_cast<const uint32_t*>(buf + i);
     checksum += (((v & 0xFF) << 24) | ((v & 0xFF00) << 8) |
       ((v & 0xFF0000) >> 8) | ((v & 0xFF000000) >> 24));
-#elif (defined(__BYTE_ORDER__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__))
+#elif defined(WOFF_BIG_ENDIAN)
     checksum += *reinterpret_cast<const uint32_t*>(buf + i);
 #else
     checksum += (buf[i] << 24) | (buf[i + 1] << 16) |

diff --git a/third_party/woff2/src/woff2_common.h b/third_party/woff2/src/woff2_common.h
index a8c45af..51fd4a7 100644
--- a/third_party/woff2/src/woff2_common.h
+++ b/third_party/woff2/src/woff2_common.h

@@ -1,18 +1,10 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Common definition for WOFF2 encoding/decoding
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Common definition for WOFF2 encoding/decoding */
 
 #ifndef WOFF2_WOFF2_COMMON_H_
 #define WOFF2_WOFF2_COMMON_H_

diff --git a/third_party/woff2/src/woff2_compress.cc b/third_party/woff2/src/woff2_compress.cc
index e5cf710..80e3108 100644
--- a/third_party/woff2/src/woff2_compress.cc
+++ b/third_party/woff2/src/woff2_compress.cc

@@ -1,23 +1,15 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// A commandline tool for compressing ttf format files to woff2.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* A commandline tool for compressing ttf format files to woff2. */
 
 #include <string>
 
 #include "file.h"
-#include "./woff2_enc.h"
+#include <woff2/encode.h>
 
 
 int main(int argc, char **argv) {

diff --git a/third_party/woff2/src/woff2_dec.cc b/third_party/woff2/src/woff2_dec.cc
index ee85fad..8186c8e 100644
--- a/third_party/woff2/src/woff2_dec.cc
+++ b/third_party/woff2/src/woff2_dec.cc

@@ -1,20 +1,12 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for converting WOFF2 format font files to their TTF versions.
+/* Copyright 2014 Google Inc. All Rights Reserved.
 
-#include "./woff2_dec.h"
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for converting WOFF2 format font files to their TTF versions. */
+
+#include <woff2/decode.h>
 
 #include <stdlib.h>
 #include <algorithm>
@@ -27,7 +19,7 @@
 #include <memory>
 #include <utility>
 
-#include "./brotli/decode.h"
+#include <brotli/decode.h>
 #include "./buffer.h"
 #include "./port.h"
 #include "./round.h"
@@ -411,6 +403,14 @@
     return FONT_COMPRESSION_FAILURE();
   }
 
+  // https://dev.w3.org/webfonts/WOFF2/spec/#conform-mustRejectLoca
+  // dst_length here is origLength in the spec
+  uint32_t expected_loca_dst_length = (info->index_format ? 4 : 2)
+    * (static_cast<uint32_t>(info->num_glyphs) + 1);
+  if (PREDICT_FALSE(loca_table->dst_length != expected_loca_dst_length)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
+
   unsigned int offset = (2 + kNumSubStreams) * 4;
   if (PREDICT_FALSE(offset > glyf_table->transform_length)) {
     return FONT_COMPRESSION_FAILURE();
@@ -592,6 +592,14 @@
             instruction_size, glyph_buf.get(), glyph_buf_size, &glyph_size))) {
         return FONT_COMPRESSION_FAILURE();
       }
+    } else {
+      // n_contours == 0; empty glyph. Must NOT have a bbox.
+      if (PREDICT_FALSE(have_bbox)) {
+#ifdef FONT_COMPRESSION_BIN
+        fprintf(stderr, "Empty glyph has a bbox\n");
+#endif
+        return FONT_COMPRESSION_FAILURE();
+      }
     }
 
     loca_values[i] = out->Size() - glyf_start;
@@ -669,6 +677,14 @@
   bool has_proportional_lsbs = (hmtx_flags & 1) == 0;
   bool has_monospace_lsbs = (hmtx_flags & 2) == 0;
 
+  // Bits 2-7 are reserved and MUST be zero.
+  if ((hmtx_flags & 0xFC) != 0) {
+#ifdef FONT_COMPRESSION_BIN
+    fprintf(stderr, "Illegal hmtx flags; bits 2-7 must be 0\n");
+#endif
+    return FONT_COMPRESSION_FAILURE();
+  }
+
   // you say you transformed but there is little evidence of it
   if (has_proportional_lsbs && has_monospace_lsbs) {
     return FONT_COMPRESSION_FAILURE();
@@ -876,11 +892,26 @@
   std::vector<Table*> tables = Tables(hdr, font_index);
 
   // 'glyf' without 'loca' doesn't make sense
-  if (PREDICT_FALSE(static_cast<bool>(FindTable(&tables, kGlyfTableTag)) !=
-                    static_cast<bool>(FindTable(&tables, kLocaTableTag)))) {
+  const Table* glyf_table = FindTable(&tables, kGlyfTableTag);
+  const Table* loca_table = FindTable(&tables, kLocaTableTag);
+  if (PREDICT_FALSE(static_cast<bool>(glyf_table) !=
+                    static_cast<bool>(loca_table))) {
+#ifdef FONT_COMPRESSION_BIN
+      fprintf(stderr, "Cannot have just one of glyf/loca\n");
+#endif
     return FONT_COMPRESSION_FAILURE();
   }
 
+  if (glyf_table != NULL) {
+    if (PREDICT_FALSE((glyf_table->flags & kWoff2FlagsTransform)
+                      != (loca_table->flags & kWoff2FlagsTransform))) {
+#ifdef FONT_COMPRESSION_BIN
+      fprintf(stderr, "Cannot transform just one of glyf/loca\n");
+#endif
+      return FONT_COMPRESSION_FAILURE();
+    }
+  }
+
   uint32_t font_checksum = metadata->header_checksum;
   if (hdr->header_version) {
     font_checksum = hdr->ttc_fonts[font_index].header_checksum;
@@ -899,7 +930,7 @@
 
     // TODO(user) a collection with optimized hmtx that reused glyf/loca
     // would fail. We don't optimize hmtx for collections yet.
-    if (PREDICT_FALSE(static_cast<uint64_t>(table.src_offset + table.src_length)
+    if (PREDICT_FALSE(static_cast<uint64_t>(table.src_offset) + table.src_length
         > transformed_buf_size)) {
       return FONT_COMPRESSION_FAILURE();
     }
@@ -1100,8 +1131,9 @@
 
       ttc_font.table_indices.resize(num_tables);
 
-      const Table* glyf_table = NULL;
-      const Table* loca_table = NULL;
+
+      unsigned int glyf_idx = 0;
+      unsigned int loca_idx = 0;
 
       for (uint32_t j = 0; j < num_tables; j++) {
         unsigned int table_idx;
@@ -1113,19 +1145,23 @@
 
         const Table& table = hdr->tables[table_idx];
         if (table.tag == kLocaTableTag) {
-          loca_table = &table;
+          loca_idx = table_idx;
         }
         if (table.tag == kGlyfTableTag) {
-          glyf_table = &table;
+          glyf_idx = table_idx;
         }
 
       }
 
-      if (PREDICT_FALSE((glyf_table == NULL) != (loca_table == NULL))) {
+      // if we have both glyf and loca make sure they are consecutive
+      // if we have just one we'll reject the font elsewhere
+      if (glyf_idx > 0 || loca_idx > 0) {
+        if (PREDICT_FALSE(glyf_idx > loca_idx || loca_idx - glyf_idx != 1)) {
 #ifdef FONT_COMPRESSION_BIN
-        fprintf(stderr, "Cannot have just one of glyf/loca\n");
+        fprintf(stderr, "TTC font %d has non-consecutive glyf/loca\n", i);
 #endif
-        return FONT_COMPRESSION_FAILURE();
+          return FONT_COMPRESSION_FAILURE();
+        }
       }
     }
   }
@@ -1299,6 +1335,9 @@
 
   const uint8_t* src_buf = data + hdr.compressed_offset;
   std::vector<uint8_t> uncompressed_buf(hdr.uncompressed_size);
+  if (PREDICT_FALSE(hdr.uncompressed_size < 1)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
   if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0],
                                      hdr.uncompressed_size, src_buf,
                                      hdr.compressed_length))) {

diff --git a/third_party/woff2/src/woff2_dec.h b/third_party/woff2/src/woff2_dec.h
deleted file mode 100644
index b889812..0000000
--- a/third_party/woff2/src/woff2_dec.h
+++ /dev/null

@@ -1,44 +0,0 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for converting WOFF2 format font files to their TTF versions.
-
-#ifndef WOFF2_WOFF2_DEC_H_
-#define WOFF2_WOFF2_DEC_H_
-
-#include <stddef.h>
-#include <inttypes.h>
-#include "./woff2_out.h"
-
-namespace woff2 {
-
-// Compute the size of the final uncompressed font, or 0 on error.
-size_t ComputeWOFF2FinalSize(const uint8_t *data, size_t length);
-
-// Decompresses the font into the target buffer. The result_length should
-// be the same as determined by ComputeFinalSize(). Returns true on successful
-// decompression.
-// DEPRECATED; please prefer the version that takes a WOFF2Out*
-bool ConvertWOFF2ToTTF(uint8_t *result, size_t result_length,
-                       const uint8_t *data, size_t length);
-
-// Decompresses the font into out. Returns true on success.
-// Works even if WOFF2Header totalSfntSize is wrong.
-// Please prefer this API.
-bool ConvertWOFF2ToTTF(const uint8_t *data, size_t length,
-                       WOFF2Out* out);
-
-} // namespace woff2
-
-#endif  // WOFF2_WOFF2_DEC_H_

diff --git a/third_party/woff2/src/woff2_decompress.cc b/third_party/woff2/src/woff2_decompress.cc
index f29c797..de088b9 100644
--- a/third_party/woff2/src/woff2_decompress.cc
+++ b/third_party/woff2/src/woff2_decompress.cc

@@ -1,24 +1,16 @@
-// Copyright 2013 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// A very simple commandline tool for decompressing woff2 format files to true
-// type font files.
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* A very simple commandline tool for decompressing woff2 format files to true
+   type font files. */
 
 #include <string>
 
 #include "./file.h"
-#include "./woff2_dec.h"
+#include <woff2/decode.h>
 
 
 int main(int argc, char **argv) {
@@ -32,6 +24,7 @@
   string filename(argv[1]);
   string outfilename = filename.substr(0, filename.find_last_of(".")) + ".ttf";
 
+  // Note: update woff2_dec_fuzzer_new_entry.cc if this pattern changes.
   string input = woff2::GetFileContent(filename);
   const uint8_t* raw_input = reinterpret_cast<const uint8_t*>(input.data());
   string output(std::min(woff2::ComputeWOFF2FinalSize(raw_input, input.size()),

diff --git a/third_party/woff2/src/woff2_enc.cc b/third_party/woff2/src/woff2_enc.cc
index bc5238f..ec00878b 100644
--- a/third_party/woff2/src/woff2_enc.cc
+++ b/third_party/woff2/src/woff2_enc.cc

@@ -1,20 +1,12 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for converting TTF format font files to their WOFF2 versions.
+/* Copyright 2014 Google Inc. All Rights Reserved.
 
-#include "./woff2_enc.h"
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Library for converting TTF format font files to their WOFF2 versions. */
+
+#include <woff2/encode.h>
 
 #include <stdlib.h>
 #include <complex>
@@ -23,7 +15,7 @@
 #include <string>
 #include <vector>
 
-#include "./brotli/encode.h"
+#include <brotli/encode.h>
 #include "./buffer.h"
 #include "./font.h"
 #include "./normalize.h"
@@ -34,7 +26,6 @@
 #include "./variable_length.h"
 #include "./woff2_common.h"
 
-
 namespace woff2 {
 
 namespace {
@@ -106,7 +97,8 @@
 
 size_t ComputeWoff2Length(const FontCollection& font_collection,
                           const std::vector<Table>& tables,
-                          std::map<uint32_t, uint16_t> index_by_offset,
+                          std::map<std::pair<uint32_t, uint32_t>, uint16_t>
+                            index_by_tag_offset,
                           size_t compressed_data_length,
                           size_t extended_metadata_length) {
   size_t size = kWoff2HeaderSize;
@@ -129,7 +121,8 @@
         // no collection entry for xform table
         if (table.tag & 0x80808080) continue;
 
-        uint16_t table_index = index_by_offset[table.offset];
+        std::pair<uint32_t, uint32_t> tag_offset(table.tag, table.offset);
+        uint16_t table_index = index_by_tag_offset[tag_offset];
         size += Size255UShort(table_index);  // 255UInt16 index entry
       }
     }
@@ -321,7 +314,7 @@
   }
 
   std::vector<Table> tables;
-  std::map<uint32_t, uint16_t> index_by_offset;
+  std::map<std::pair<uint32_t, uint32_t>, uint16_t> index_by_tag_offset;
 
   for (const auto& font : font_collection.fonts) {
 
@@ -331,8 +324,9 @@
         continue;
       }
 
-      if (index_by_offset.find(src_table.offset) == index_by_offset.end()) {
-        index_by_offset[src_table.offset] = tables.size();
+      std::pair<uint32_t, uint32_t> tag_offset(src_table.tag, src_table.offset);
+      if (index_by_tag_offset.find(tag_offset) == index_by_tag_offset.end()) {
+        index_by_tag_offset[tag_offset] = tables.size();
       } else {
         return false;
       }
@@ -357,7 +351,8 @@
   }
 
   size_t woff2_length = ComputeWoff2Length(font_collection, tables,
-      index_by_offset, total_compressed_length, compressed_metadata_buf_length);
+      index_by_tag_offset, total_compressed_length,
+      compressed_metadata_buf_length);
   if (woff2_length > *result_length) {
 #ifdef FONT_COMPRESSION_BIN
     fprintf(stderr, "Result allocation was too small (%zd vs %zd bytes).\n",
@@ -430,14 +425,15 @@
           table.IsReused() ? table.reuse_of->offset : table.offset;
         uint32_t table_length =
           table.IsReused() ? table.reuse_of->length : table.length;
-        if (index_by_offset.find(table_offset) == index_by_offset.end()) {
+        std::pair<uint32_t, uint32_t> tag_offset(table.tag, table_offset);
+        if (index_by_tag_offset.find(tag_offset) == index_by_tag_offset.end()) {
 #ifdef FONT_COMPRESSION_BIN
-          fprintf(stderr, "Missing table index for offset 0x%08x\n",
+fprintf(stderr, "Missing table index for offset 0x%08x\n",
                   table_offset);
 #endif
           return FONT_COMPRESSION_FAILURE();
         }
-        uint16_t index = index_by_offset[table_offset];
+        uint16_t index = index_by_tag_offset[tag_offset];
         Store255UShort(index, &offset, result);
 
       }

diff --git a/third_party/woff2/src/woff2_enc.h b/third_party/woff2/src/woff2_enc.h
deleted file mode 100644
index 3ac8c3ab..0000000
--- a/third_party/woff2/src/woff2_enc.h
+++ /dev/null

@@ -1,54 +0,0 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Library for converting WOFF2 format font files to their TTF versions.
-
-#ifndef WOFF2_WOFF2_ENC_H_
-#define WOFF2_WOFF2_ENC_H_
-
-#include <stddef.h>
-#include <inttypes.h>
-#include <string>
-
-using std::string;
-
-
-namespace woff2 {
-
-struct WOFF2Params {
-  WOFF2Params() : extended_metadata(""), brotli_quality(11),
-                  allow_transforms(true) {}
-
-  string extended_metadata;
-  int brotli_quality;
-  bool allow_transforms;
-};
-
-// Returns an upper bound on the size of the compressed file.
-size_t MaxWOFF2CompressedSize(const uint8_t* data, size_t length);
-size_t MaxWOFF2CompressedSize(const uint8_t* data, size_t length,
-                              const string& extended_metadata);
-
-// Compresses the font into the target buffer. *result_length should be at least
-// the value returned by MaxWOFF2CompressedSize(), upon return, it is set to the
-// actual compressed size. Returns true on successful compression.
-bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
-                       uint8_t *result, size_t *result_length);
-bool ConvertTTFToWOFF2(const uint8_t *data, size_t length,
-                       uint8_t *result, size_t *result_length,
-                       const WOFF2Params& params);
-
-} // namespace woff2
-
-#endif  // WOFF2_WOFF2_ENC_H_

diff --git a/third_party/woff2/src/woff2_info.cc b/third_party/woff2/src/woff2_info.cc
new file mode 100644
index 0000000..2b51adc
--- /dev/null
+++ b/third_party/woff2/src/woff2_info.cc

@@ -0,0 +1,144 @@
+/* Copyright 2014 Google Inc. All Rights Reserved.
+
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* A commandline tool for dumping info about a woff2 file. */
+
+#include <string>
+
+#include "file.h"
+#include "./woff2_common.h"
+#include "./buffer.h"
+#include "./font.h"
+#include "./table_tags.h"
+#include "./variable_length.h"
+
+std::string PrintTag(int tag) {
+  if (tag & 0x80808080) {
+    return std::string("_xfm");  // print _xfm for xform tables (else garbage)
+  }
+  char printable[] = {
+    static_cast<char>((tag >> 24) & 0xFF),
+    static_cast<char>((tag >> 16) & 0xFF),
+    static_cast<char>((tag >> 8) & 0xFF),
+    static_cast<char>(tag & 0xFF)
+  };
+  return std::string(printable, 4);
+}
+
+int main(int argc, char **argv) {
+  using std::string;
+
+  if (argc != 2) {
+    fprintf(stderr, "One argument, the input filename, must be provided.\n");
+    return 1;
+  }
+
+  string filename(argv[1]);
+  string outfilename = filename.substr(0, filename.find_last_of(".")) + ".woff2";
+  fprintf(stdout, "Processing %s => %s\n",
+    filename.c_str(), outfilename.c_str());
+  string input = woff2::GetFileContent(filename);
+
+  woff2::Buffer file(reinterpret_cast<const uint8_t*>(input.data()),
+    input.size());
+
+  printf("WOFF2Header\n");
+  uint32_t signature, flavor, length, totalSfntSize, totalCompressedSize;
+  uint32_t metaOffset, metaLength, metaOrigLength, privOffset, privLength;
+  uint16_t num_tables, reserved, major, minor;
+  if (!file.ReadU32(&signature)) return 1;
+  if (!file.ReadU32(&flavor)) return 1;
+  if (!file.ReadU32(&length)) return 1;
+  if (!file.ReadU16(&num_tables)) return 1;
+  if (!file.ReadU16(&reserved)) return 1;
+  if (!file.ReadU32(&totalSfntSize)) return 1;
+  if (!file.ReadU32(&totalCompressedSize)) return 1;
+  if (!file.ReadU16(&major)) return 1;
+  if (!file.ReadU16(&minor)) return 1;
+  if (!file.ReadU32(&metaOffset)) return 1;
+  if (!file.ReadU32(&metaLength)) return 1;
+  if (!file.ReadU32(&metaOrigLength)) return 1;
+  if (!file.ReadU32(&privOffset)) return 1;
+  if (!file.ReadU32(&privLength)) return 1;
+
+  if (signature != 0x774F4632) {
+    printf("Invalid signature: %08x\n", signature);
+    return 1;
+  }
+  printf("signature           0x%08x\n", signature);
+  printf("flavor              0x%08x\n", flavor);
+  printf("length              %d\n", length);
+  printf("numTables           %d\n", num_tables);
+  printf("reserved            %d\n", reserved);
+  printf("totalSfntSize       %d\n", totalSfntSize);
+  printf("totalCompressedSize %d\n", totalCompressedSize);
+  printf("majorVersion        %d\n", major);
+  printf("minorVersion        %d\n", minor);
+  printf("metaOffset          %d\n", metaOffset);
+  printf("metaLength          %d\n", metaLength);
+  printf("metaOrigLength      %d\n", metaOrigLength);
+  printf("privOffset          %d\n", privOffset);
+  printf("privLength          %d\n", privLength);
+
+  std::vector<uint32_t> table_tags;
+  printf("TableDirectory starts at +%zu\n", file.offset());
+  printf("Entry offset flags tag  origLength txLength\n");
+  for (auto i = 0; i < num_tables; i++) {
+    size_t offset = file.offset();
+    uint8_t flags;
+    uint32_t tag, origLength, transformLength;
+    if (!file.ReadU8(&flags)) return 1;
+    if ((flags & 0x3f) == 0x3f) {
+      if (!file.ReadU32(&tag)) return 1;
+    } else {
+      tag = woff2::kKnownTags[flags & 0x3f];
+    }
+    table_tags.push_back(tag);
+    if (!ReadBase128(&file, &origLength)) return 1;
+
+    printf("%5d %6zu  0x%02x %s %10d", i, offset, flags,
+        PrintTag(tag).c_str(), origLength);
+
+    uint8_t xform_version = (flags >> 6) & 0x3;
+    if (tag == woff2::kGlyfTableTag || tag == woff2::kLocaTableTag) {
+      if (xform_version == 0) {
+        if (!ReadBase128(&file, &transformLength)) return 1;
+        printf(" %8d", transformLength);
+      }
+    } else if (xform_version > 0) {
+      if (!ReadBase128(&file, &transformLength)) return 1;
+      printf(" %8d", transformLength);
+    }
+    printf("\n");
+  }
+
+  // Collection header
+  if (flavor == woff2::kTtcFontFlavor) {
+    uint32_t version, numFonts;
+    if (!file.ReadU32(&version)) return 1;
+    if (!woff2::Read255UShort(&file, &numFonts)) return 1;
+    printf("CollectionHeader 0x%08x %d fonts\n", version, numFonts);
+
+    for (auto i = 0; i < numFonts; i++) {
+      uint32_t numTables, flavor;
+      if (!woff2::Read255UShort(&file, &numTables)) return 1;
+      if (!file.ReadU32(&flavor)) return 1;
+      printf("CollectionFontEntry %d flavor 0x%08x %d tables\n", i, flavor,
+          numTables);
+      for (auto j = 0; j < numTables; j++) {
+        uint32_t table_idx;
+        if (!woff2::Read255UShort(&file, &table_idx)) return 1;
+        if (table_idx >= table_tags.size()) return 1;
+        printf("  %d %s (idx %d)\n", j,
+            PrintTag(table_tags[table_idx]).c_str(), table_idx);
+      }
+    }
+  }
+
+  printf("TableDirectory ends at +%zu\n", file.offset());
+
+  return 0;
+}

diff --git a/third_party/woff2/src/woff2_out.cc b/third_party/woff2/src/woff2_out.cc
index 8882306..8ab3268 100644
--- a/third_party/woff2/src/woff2_out.cc
+++ b/third_party/woff2/src/woff2_out.cc

@@ -1,20 +1,14 @@
-// Copyright 2014 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Output buffer for WOFF2 decompression.
+/* Copyright 2014 Google Inc. All Rights Reserved.
 
-#include "./woff2_out.h"
+   Distributed under MIT license.
+   See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+*/
+
+/* Output buffer for WOFF2 decompression. */
+
+#include <woff2/output.h>
+
+using std::string;
 
 namespace woff2 {
 

diff --git a/third_party/woff2/src/woff2_out.h b/third_party/woff2/src/woff2_out.h
deleted file mode 100644
index c956afa..0000000
--- a/third_party/woff2/src/woff2_out.h
+++ /dev/null

@@ -1,114 +0,0 @@
-// Copyright 2016 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Output buffer for WOFF2 decompression.
-
-// Copyright 2016 Google Inc. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-// Output buffer for WOFF2 decompression.
-
-#ifndef WOFF2_WOFF2_OUT_H_
-#define WOFF2_WOFF2_OUT_H_
-
-#include <algorithm>
-#include <cstring>
-#include <memory>
-#include <string>
-#include "./port.h"
-
-namespace woff2 {
-
-// Suggested max size for output.
-const size_t kDefaultMaxSize = 30 * 1024 * 1024;
-
-using std::string;
-
-
-/**
- * Output interface for the woff2 decoding.
- *
- * Writes to arbitrary offsets are supported to facilitate updating offset
- * table and checksums after tables are ready. Reading the current size is
- * supported so a 'loca' table can be built up while writing glyphs.
- *
- * By default limits size to kDefaultMaxSize.
- */
-class WOFF2Out {
- public:
-  virtual ~WOFF2Out(void) {}
-
-  // Append n bytes of data from buf.
-  // Return true if all written, false otherwise.
-  virtual bool Write(const void *buf, size_t n) = 0;
-
-  // Write n bytes of data from buf at offset.
-  // Return true if all written, false otherwise.
-  virtual bool Write(const void *buf, size_t offset, size_t n) = 0;
-
-  virtual size_t Size() = 0;
-};
-
-/**
- * Expanding memory block for woff2 out. By default limited to kDefaultMaxSize.
- */
-class WOFF2StringOut : public WOFF2Out {
- public:
-  // Create a writer that writes its data to buf.
-  // buf->size() will grow to at most max_size
-  // buf may be sized (e.g. using EstimateWOFF2FinalSize) or empty.
-  explicit WOFF2StringOut(string* buf);
-
-  bool Write(const void *buf, size_t n) override;
-  bool Write(const void *buf, size_t offset, size_t n) override;
-  size_t Size() override { return offset_; }
-  size_t MaxSize() { return max_size_; }
-  void SetMaxSize(size_t max_size);
- private:
-  string* buf_;
-  size_t max_size_;
-  size_t offset_;
-};
-
-/**
- * Fixed memory block for woff2 out.
- */
-class WOFF2MemoryOut : public WOFF2Out {
- public:
-  // Create a writer that writes its data to buf.
-  WOFF2MemoryOut(uint8_t* buf, size_t buf_size);
-
-  bool Write(const void *buf, size_t n) override;
-  bool Write(const void *buf, size_t offset, size_t n) override;
-  size_t Size() override { return offset_; }
- private:
-  uint8_t* buf_;
-  size_t buf_size_;
-  size_t offset_;
-};
-
-} // namespace woff2
-
-#endif  // WOFF2_WOFF2_OUT_H_

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 98bd04a0..96560952 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -17282,6 +17282,48 @@
   <int value="2275" label="FileAccessedSharedWorker"/>
   <int value="2276" label="V8MediaKeys_GetStatusForPolicy_Method"/>
   <int value="2277" label="V8DeoptimizerDisableSpeculation"/>
+  <int value="2278" label="CSSSelectorCue"/>
+  <int value="2279" label="CSSSelectorWebkitCalendarPickerIndicator"/>
+  <int value="2280" label="CSSSelectorWebkitClearButton"/>
+  <int value="2281" label="CSSSelectorWebkitColorSwatch"/>
+  <int value="2282" label="CSSSelectorWebkitColorSwatchWrapper"/>
+  <int value="2283" label="CSSSelectorWebkitDateAndTimeValue"/>
+  <int value="2284" label="CSSSelectorWebkitDatetimeEdit"/>
+  <int value="2285" label="CSSSelectorWebkitDatetimeEditAmpmField"/>
+  <int value="2286" label="CSSSelectorWebkitDatetimeEditDayField"/>
+  <int value="2287" label="CSSSelectorWebkitDatetimeEditFieldsWrapper"/>
+  <int value="2288" label="CSSSelectorWebkitDatetimeEditHourField"/>
+  <int value="2289" label="CSSSelectorWebkitDatetimeEditMillisecondField"/>
+  <int value="2290" label="CSSSelectorWebkitDatetimeEditMinuteField"/>
+  <int value="2291" label="CSSSelectorWebkitDatetimeEditMonthField"/>
+  <int value="2292" label="CSSSelectorWebkitDatetimeEditSecondField"/>
+  <int value="2293" label="CSSSelectorWebkitDatetimeEditText"/>
+  <int value="2294" label="CSSSelectorWebkitDatetimeEditWeekField"/>
+  <int value="2295" label="CSSSelectorWebkitDatetimeEditYearField"/>
+  <int value="2296" label="CSSSelectorWebkitDetailsMarker"/>
+  <int value="2297" label="CSSSelectorWebkitFileUploadButton"/>
+  <int value="2298" label="CSSSelectorWebkitInnerSpinButton"/>
+  <int value="2299" label="CSSSelectorWebkitInputPlaceholder"/>
+  <int value="2300" label="CSSSelectorWebkitMediaSliderContainer"/>
+  <int value="2301" label="CSSSelectorWebkitMediaSliderThumb"/>
+  <int value="2302" label="CSSSelectorWebkitMediaTextTrackContainer"/>
+  <int value="2303" label="CSSSelectorWebkitMediaTextTrackDisplay"/>
+  <int value="2304" label="CSSSelectorWebkitMediaTextTrackRegion"/>
+  <int value="2305" label="CSSSelectorWebkitMediaTextTrackRegionContainer"/>
+  <int value="2306" label="CSSSelectorWebkitMeterBar"/>
+  <int value="2307" label="CSSSelectorWebkitMeterEvenLessGoodValue"/>
+  <int value="2308" label="CSSSelectorWebkitMeterInnerElement"/>
+  <int value="2309" label="CSSSelectorWebkitMeterOptimumValue"/>
+  <int value="2310" label="CSSSelectorWebkitMeterSuboptimumValue"/>
+  <int value="2311" label="CSSSelectorWebkitProgressBar"/>
+  <int value="2312" label="CSSSelectorWebkitProgressInnerElement"/>
+  <int value="2313" label="CSSSelectorWebkitProgressValue"/>
+  <int value="2314" label="CSSSelectorWebkitSearchCancelButton"/>
+  <int value="2315" label="CSSSelectorWebkitSliderContainer"/>
+  <int value="2316" label="CSSSelectorWebkitSliderRunnableTrack"/>
+  <int value="2317" label="CSSSelectorWebkitSliderThumb"/>
+  <int value="2318" label="CSSSelectorWebkitTextfieldDecorationContainer"/>
+  <int value="2319" label="CSSSelectorWebkitUnknownPseudo"/>
 </enum>
 
 <enum name="FeedbackSource">

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index c64a9f0..abee1719 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -67784,6 +67784,14 @@
   </summary>
 </histogram>
 
+<histogram name="Profile.DiceUI.GaiaAccountsStale" enum="BooleanStale">
+  <owner>tangltom@chromium.org</owner>
+  <summary>
+    This histogram tracks whether the accounts cached in the GAIA cookie service
+    manager are stale when presenting the user menu when DICE is enabled.
+  </summary>
+</histogram>
+
 <histogram name="Profile.ExtensionSize" units="MB">
   <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
   <summary>Size of the extension cookies database.</summary>

diff --git a/tools/perf/benchmarks/smoothness.py b/tools/perf/benchmarks/smoothness.py
index 57731120..5eb9381 100644
--- a/tools/perf/benchmarks/smoothness.py
+++ b/tools/perf/benchmarks/smoothness.py

@@ -42,12 +42,21 @@
 
   http://www.chromium.org/developers/design-documents/rendering-benchmarks
   """
-  page_set = page_sets.Top25SmoothPageSet
 
   @classmethod
   def Name(cls):
     return 'smoothness.top_25_smooth'
 
+  @classmethod
+  def AddBenchmarkCommandLineArgs(cls, parser):
+    parser.add_option('--scroll-forever', action='store_true',
+                      help='If set, continuously scroll up and down forever. '
+                           'This is useful for analysing scrolling behaviour '
+                           'with tools such as perf.')
+
+  def CreateStorySet(self, options):
+    return page_sets.Top25SmoothPageSet(scroll_forever=options.scroll_forever)
+
 
 @benchmark.Owner(emails=['senorblanco@chromium.org'])
 class SmoothnessToughFiltersCases(_Smoothness):

diff --git a/tools/perf/page_sets/top_25_smooth.py b/tools/perf/page_sets/top_25_smooth.py
index 8d5ee5c..2a02a9b5 100644
--- a/tools/perf/page_sets/top_25_smooth.py
+++ b/tools/perf/page_sets/top_25_smooth.py

@@ -8,9 +8,13 @@
 from page_sets import top_pages
 
 
-def _IssueMarkerAndScroll(action_runner):
+def _IssueMarkerAndScroll(action_runner, scroll_forever):
   with action_runner.CreateGestureInteraction('ScrollAction'):
     action_runner.ScrollPage()
+    if scroll_forever:
+      while True:
+        action_runner.ScrollPage(direction='up')
+        action_runner.ScrollPage(direction='down')
 
 
 def _CreatePageClassWithSmoothInteractions(page_cls):
@@ -18,7 +22,7 @@
 
     def RunPageInteractions(self, action_runner):
       action_runner.Wait(1)
-      _IssueMarkerAndScroll(action_runner)
+      _IssueMarkerAndScroll(action_runner, self.story_set.scroll_forever)
   return DerivedSmoothPage
 
 
@@ -33,7 +37,7 @@
 
   def RunPageInteractions(self, action_runner):
     action_runner.Wait(1)
-    _IssueMarkerAndScroll(action_runner)
+    _IssueMarkerAndScroll(action_runner, self.story_set.scroll_forever)
 
 
 class GmailSmoothPage(top_pages.GmailPage):
@@ -57,6 +61,12 @@
     with action_runner.CreateGestureInteraction('ScrollAction'):
       action_runner.ScrollElement(
           element_function='window.__scrollableElementForTelemetry')
+      if self.story_set.scroll_forever:
+        while True:
+          action_runner.ScrollElement(direction='up',
+              element_function='window.__scrollableElementForTelemetry')
+          action_runner.ScrollElement(direction='down',
+              element_function='window.__scrollableElementForTelemetry')
 
 
 class GoogleCalendarSmoothPage(top_pages.GoogleCalendarPage):
@@ -67,6 +77,12 @@
     action_runner.Wait(1)
     with action_runner.CreateGestureInteraction('ScrollAction'):
       action_runner.ScrollElement(selector='#scrolltimedeventswk')
+      if self.story_set.scroll_forever:
+        while True:
+          action_runner.ScrollElement(direction='up',
+                                      selector='#scrolltimedeventswk')
+          action_runner.ScrollElement(direction='down',
+                                      selector='#scrolltimedeventswk')
 
 
 class GoogleDocSmoothPage(top_pages.GoogleDocPage):
@@ -77,6 +93,12 @@
     action_runner.Wait(1)
     with action_runner.CreateGestureInteraction('ScrollAction'):
       action_runner.ScrollElement(selector='.kix-appview-editor')
+      if self.story_set.scroll_forever:
+        while True:
+          action_runner.ScrollElement(direction='up',
+                                      selector='.kix-appview-editor')
+          action_runner.ScrollElement(direction='down',
+                                      selector='.kix-appview-editor')
 
 
 class ESPNSmoothPage(top_pages.ESPNPage):
@@ -87,17 +109,22 @@
     action_runner.Wait(1)
     with action_runner.CreateGestureInteraction('ScrollAction'):
       action_runner.ScrollPage(left_start_ratio=0.1)
+      if self.story_set.scroll_forever:
+        while True:
+          action_runner.ScrollPage(direction='up', left_start_ratio=0.1)
+          action_runner.ScrollPage(direction='down', left_start_ratio=0.1)
 
 
 class Top25SmoothPageSet(story.StorySet):
 
   """ Pages hand-picked for 2012 CrOS scrolling tuning efforts. """
 
-  def __init__(self, techcrunch=True):
+  def __init__(self, techcrunch=True, scroll_forever=False):
     super(Top25SmoothPageSet, self).__init__(
         archive_data_file='data/top_25_smooth.json',
         cloud_storage_bucket=story.PARTNER_BUCKET)
 
+    self.scroll_forever = scroll_forever
     desktop_state_class = shared_page_state.SharedDesktopPageState
 
     self.AddStory(_CreatePageClassWithSmoothInteractions(

diff --git a/ui/display/win/color_profile_reader.cc b/ui/display/win/color_profile_reader.cc
index 0958f005..c53c10e 100644
--- a/ui/display/win/color_profile_reader.cc
+++ b/ui/display/win/color_profile_reader.cc

@@ -17,10 +17,10 @@
 namespace win {
 namespace {
 
-BOOL CALLBACK EnumMonitorCallback(HMONITOR monitor,
-                                  HDC input_hdc,
-                                  LPRECT rect,
-                                  LPARAM data) {
+BOOL CALLBACK EnumMonitorForProfilePathCallback(HMONITOR monitor,
+                                                HDC input_hdc,
+                                                LPRECT rect,
+                                                LPARAM data) {
   base::string16 device_name;
   MONITORINFOEX monitor_info;
   ::ZeroMemory(&monitor_info, sizeof(monitor_info));
@@ -75,7 +75,7 @@
 // static
 ColorProfileReader::DeviceToPathMap ColorProfileReader::BuildDeviceToPathMap() {
   DeviceToPathMap device_to_path_map;
-  EnumDisplayMonitors(nullptr, nullptr, EnumMonitorCallback,
+  EnumDisplayMonitors(nullptr, nullptr, EnumMonitorForProfilePathCallback,
                       reinterpret_cast<LPARAM>(&device_to_path_map));
   return device_to_path_map;
 }

diff --git a/ui/display/win/screen_win.cc b/ui/display/win/screen_win.cc
index 96eb358..0063450b 100644
--- a/ui/display/win/screen_win.cc
+++ b/ui/display/win/screen_win.cc

@@ -183,10 +183,10 @@
   return monitor_info;
 }
 
-BOOL CALLBACK EnumMonitorCallback(HMONITOR monitor,
-                                  HDC hdc,
-                                  LPRECT rect,
-                                  LPARAM data) {
+BOOL CALLBACK EnumMonitorForDisplayInfoCallback(HMONITOR monitor,
+                                                HDC hdc,
+                                                LPRECT rect,
+                                                LPARAM data) {
   std::vector<DisplayInfo>* display_infos =
       reinterpret_cast<std::vector<DisplayInfo>*>(data);
   DCHECK(display_infos);
@@ -197,7 +197,7 @@
 
 std::vector<DisplayInfo> GetDisplayInfosFromSystem() {
   std::vector<DisplayInfo> display_infos;
-  EnumDisplayMonitors(nullptr, nullptr, EnumMonitorCallback,
+  EnumDisplayMonitors(nullptr, nullptr, EnumMonitorForDisplayInfoCallback,
                       reinterpret_cast<LPARAM>(&display_infos));
   DCHECK_EQ(static_cast<size_t>(::GetSystemMetrics(SM_CMONITORS)),
             display_infos.size());

diff --git a/ui/gfx/BUILD.gn b/ui/gfx/BUILD.gn
index 062733a..fbdd3add 100644
--- a/ui/gfx/BUILD.gn
+++ b/ui/gfx/BUILD.gn

@@ -558,6 +558,8 @@
       "linux/client_native_pixmap_dmabuf.h",
       "linux/client_native_pixmap_factory_dmabuf.cc",
       "linux/client_native_pixmap_factory_dmabuf.h",
+      "linux/native_pixmap_dmabuf.cc",
+      "linux/native_pixmap_dmabuf.h",
     ]
 
     deps += [ "//third_party/libdrm" ]
@@ -803,6 +805,10 @@
       "//ui/gfx/range/mojo:unit_test",
     ]
   }
+
+  if (is_linux) {
+    sources += [ "linux/native_pixmap_dmabuf_unittest.cc" ]
+  }
 }
 
 if (is_android) {

diff --git a/ui/gfx/linux/native_pixmap_dmabuf.cc b/ui/gfx/linux/native_pixmap_dmabuf.cc
new file mode 100644
index 0000000..8502ccb2
--- /dev/null
+++ b/ui/gfx/linux/native_pixmap_dmabuf.cc

@@ -0,0 +1,86 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/gfx/linux/native_pixmap_dmabuf.h"
+
+#include "base/posix/eintr_wrapper.h"
+
+namespace gfx {
+
+NativePixmapDmaBuf::NativePixmapDmaBuf(const gfx::Size& size,
+                                       gfx::BufferFormat format,
+                                       const gfx::NativePixmapHandle& handle)
+    : size_(size), format_(format), planes_(handle.planes) {
+  for (auto& fd : handle.fds) {
+    fds_.emplace_back(fd.fd);
+  }
+}
+
+NativePixmapDmaBuf::~NativePixmapDmaBuf() {}
+
+void* NativePixmapDmaBuf::GetEGLClientBuffer() const {
+  return nullptr;
+}
+
+bool NativePixmapDmaBuf::AreDmaBufFdsValid() const {
+  if (fds_.empty())
+    return false;
+
+  for (const auto& fd : fds_) {
+    if (!fd.is_valid())
+      return false;
+  }
+  return true;
+}
+
+size_t NativePixmapDmaBuf::GetDmaBufFdCount() const {
+  return fds_.size();
+}
+
+int NativePixmapDmaBuf::GetDmaBufFd(size_t plane) const {
+  DCHECK_LT(plane, fds_.size());
+  return fds_[plane].get();
+}
+
+int NativePixmapDmaBuf::GetDmaBufPitch(size_t plane) const {
+  DCHECK_LT(plane, planes_.size());
+  return planes_[plane].stride;
+}
+
+int NativePixmapDmaBuf::GetDmaBufOffset(size_t plane) const {
+  DCHECK_LT(plane, planes_.size());
+  return planes_[plane].offset;
+}
+
+uint64_t NativePixmapDmaBuf::GetDmaBufModifier(size_t plane) const {
+  DCHECK_LT(plane, planes_.size());
+  return planes_[plane].modifier;
+}
+
+gfx::BufferFormat NativePixmapDmaBuf::GetBufferFormat() const {
+  return format_;
+}
+
+gfx::Size NativePixmapDmaBuf::GetBufferSize() const {
+  return size_;
+}
+
+uint32_t NativePixmapDmaBuf::GetUniqueId() const {
+  return 0;
+}
+
+bool NativePixmapDmaBuf::ScheduleOverlayPlane(
+    gfx::AcceleratedWidget widget,
+    int plane_z_order,
+    gfx::OverlayTransform plane_transform,
+    const gfx::Rect& display_bounds,
+    const gfx::RectF& crop_rect) {
+  return false;
+}
+
+gfx::NativePixmapHandle NativePixmapDmaBuf::ExportHandle() {
+  return gfx::NativePixmapHandle();
+}
+
+}  // namespace gfx

diff --git a/ui/gfx/linux/native_pixmap_dmabuf.h b/ui/gfx/linux/native_pixmap_dmabuf.h
new file mode 100644
index 0000000..d01868ad
--- /dev/null
+++ b/ui/gfx/linux/native_pixmap_dmabuf.h

@@ -0,0 +1,62 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_GFX_LINUX_NATIVE_PIXMAP_DMABUF_H_
+#define UI_GFX_LINUX_NATIVE_PIXMAP_DMABUF_H_
+
+#include <stdint.h>
+
+#include <memory>
+
+#include "base/files/scoped_file.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "ui/gfx/client_native_pixmap.h"
+#include "ui/gfx/geometry/size.h"
+#include "ui/gfx/native_pixmap.h"
+
+namespace gfx {
+
+// This class converts a gfx::NativePixmapHandle to a gfx::NativePixmap.
+// It is useful because gl::GLImageNativePixmap::Initialize only takes
+// a gfx::NativePixmap as input.
+class GFX_EXPORT NativePixmapDmaBuf : public gfx::NativePixmap {
+ public:
+  NativePixmapDmaBuf(const gfx::Size& size,
+                     gfx::BufferFormat format,
+                     const gfx::NativePixmapHandle& handle);
+
+  // NativePixmap:
+  void* GetEGLClientBuffer() const override;
+  bool AreDmaBufFdsValid() const override;
+  size_t GetDmaBufFdCount() const override;
+  int GetDmaBufFd(size_t plane) const override;
+  int GetDmaBufPitch(size_t plane) const override;
+  int GetDmaBufOffset(size_t plane) const override;
+  uint64_t GetDmaBufModifier(size_t plane) const override;
+  gfx::BufferFormat GetBufferFormat() const override;
+  gfx::Size GetBufferSize() const override;
+  uint32_t GetUniqueId() const override;
+  bool ScheduleOverlayPlane(gfx::AcceleratedWidget widget,
+                            int plane_z_order,
+                            gfx::OverlayTransform plane_transform,
+                            const gfx::Rect& display_bounds,
+                            const gfx::RectF& crop_rect) override;
+  gfx::NativePixmapHandle ExportHandle() override;
+
+ protected:
+  ~NativePixmapDmaBuf() override;
+
+ private:
+  gfx::Size size_;
+  gfx::BufferFormat format_;
+  std::vector<base::ScopedFD> fds_;
+  std::vector<gfx::NativePixmapPlane> planes_;
+
+  DISALLOW_COPY_AND_ASSIGN(NativePixmapDmaBuf);
+};
+
+}  // namespace gfx
+
+#endif  // UI_GFX_LINUX_NATIVE_PIXMAP_DMABUF_H_

diff --git a/ui/gfx/linux/native_pixmap_dmabuf_unittest.cc b/ui/gfx/linux/native_pixmap_dmabuf_unittest.cc
new file mode 100644
index 0000000..c6759702
--- /dev/null
+++ b/ui/gfx/linux/native_pixmap_dmabuf_unittest.cc

@@ -0,0 +1,71 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/gfx/linux/native_pixmap_dmabuf.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace gfx {
+
+class NativePixmapDmabufTest : public testing::Test {
+ protected:
+  gfx::NativePixmapHandle CreateMockNativePixmapHandle(gfx::Size image_size) {
+    gfx::NativePixmapHandle handle;
+
+    for (int i = 0; i < 4; ++i) {
+      // These values are arbitrarily chosen to be different from each other.
+      const int stride = (i + 1) * image_size.width();
+      const int offset = i * image_size.width() * image_size.height();
+      const uint64_t size = stride * image_size.height();
+      const uint64_t modifiers = 1 << i;
+
+      handle.fds.emplace_back(
+          base::FileDescriptor(i + 1, true /* auto_close */));
+
+      handle.planes.emplace_back(stride, offset, size, modifiers);
+    }
+
+    return handle;
+  }
+};
+
+// Verifies NativePixmapDmaBuf conversion from and to NativePixmapHandle.
+TEST_F(NativePixmapDmabufTest, Convert) {
+  const gfx::Size image_size(128, 64);
+  const gfx::BufferFormat format = gfx::BufferFormat::RGBX_8888;
+
+  gfx::NativePixmapHandle origin_handle =
+      CreateMockNativePixmapHandle(image_size);
+
+  // NativePixmapHandle to NativePixmapDmabuf
+  scoped_refptr<gfx::NativePixmap> native_pixmap_dmabuf(
+      new gfx::NativePixmapDmaBuf(image_size, format, origin_handle));
+  EXPECT_TRUE(native_pixmap_dmabuf->AreDmaBufFdsValid());
+
+  // NativePixmap to NativePixmapHandle.
+  gfx::NativePixmapHandle handle;
+  for (size_t i = 0; i < native_pixmap_dmabuf->GetDmaBufFdCount(); ++i) {
+    handle.fds.emplace_back(base::FileDescriptor(
+        native_pixmap_dmabuf->GetDmaBufFd(i), true /* auto_close */));
+
+    handle.planes.emplace_back(
+        native_pixmap_dmabuf->GetDmaBufPitch(i),
+        native_pixmap_dmabuf->GetDmaBufOffset(i),
+        native_pixmap_dmabuf->GetDmaBufPitch(i) * image_size.height(),
+        native_pixmap_dmabuf->GetDmaBufModifier(i));
+  }
+
+  // NativePixmapHandle is unchanged during convertion to NativePixmapDmabuf.
+  EXPECT_EQ(origin_handle.fds, handle.fds);
+  EXPECT_EQ(origin_handle.fds.size(), handle.planes.size());
+  EXPECT_EQ(origin_handle.planes.size(), handle.planes.size());
+  for (size_t i = 0; i < origin_handle.planes.size(); ++i) {
+    EXPECT_EQ(origin_handle.planes[i].stride, handle.planes[i].stride);
+    EXPECT_EQ(origin_handle.planes[i].offset, handle.planes[i].offset);
+    EXPECT_EQ(origin_handle.planes[i].size, handle.planes[i].size);
+    EXPECT_EQ(origin_handle.planes[i].modifier, handle.planes[i].modifier);
+  }
+}
+
+}  // namespace gfx